Cisco VPN :: ASA 5505 - Got Error When Trying To Connect VPN Client
Oct 19, 2009
I get the following error when trying to connect a vpn client through an ASA5505 with an already configured ipsec AES/256 site to site connection:
regular translation creation failed for protocol 50 src:inside:192.168.1.167 dst:outside:xx.xxx.x.64
The site to site addressing is not relevant, I'm not trying to pass traffic over the site-to-site, but rather create a new vpn from inside client to outside external vpn box that's not under my control. The client is able to create a connection, but no traffic is passed, when I try to ping / rdp, the above message is returned to me. If I add the rule static(inside, outside) interface 192.168.1.167 netmask 255.255.255.255 then it works, everything works, but ONLY from this computer.
Been Google for hours, but with no result as of yet.
I am unable to connect to the vpn I set up on my ASA 5505 using the Cisco VPN Client on a Windows machine. The log of the vpn client and the config of the ASA 5505 are below.
LOG CISCO VPN CLIENT Cisco Systems VPN Client Version 5.0.06.0160 Copyright (C) 1998-2009 Cisco Systems, Inc. All Rights Reserved.
I'm trying to set up a 5505 (running 8.3) so that i can use the client vpn through RADIUS authentication.I have set up a new local RAIDUS windows box and used the ASDM asistant and a few other guides to setup the 5505.
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem.
The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
i have a question about tunneling a software EasyVPN client to a client ASA Network. It looks like this:
EasyVPN Server 192.168.202.0/24 Network extension mode to Client EasyVPN ASA 192.168.1.0/24 This works fine in both directions. But now i want to connect the client ASA network via EasyVPN software client from outside. The user are already able to connect to the ASA Server on its static outside IP obtaining an IP from a 192.168.21.0/24 pool. This works fine. But how am i able to connect to the 192.168.1.0/24 network from this client?
We have a cisco asa 5505 on which we have setup a group VPN. The VPN connections from all cisco vpn clients works fine except one. The keep getting the below error
"Secure VPN Connection terminated locally by the client. Reason 412: The remote peer is no longer responding. Connection Terminated".
Not sure why only one client won't be able to connect. The version we are using is 5.0.02 for VPN client.
Got some issues when setting up IPSEC/VPN on the asa 5505. I want to connect from the ipad with the built in IPSec client..Get these errors when i run the debug crypto isakmp.
tying to connect CSM client to CSM server (ver 4.0) and getting attached error message. The server is running, no errors reported while installation, all services are up and fine. I tried to install client locally on the server and connect it that way with no luck. CSM server runs on Win 2008, firewall disabled.
Some of my VPN users are getting the following error on Windows 7 64 bit computer. I have uploaded the client to a website. The VPN users are supposed to download and install the client from the web-site. Then they enter the URL to connect to our VPN. This worked fine during the test and only some users are having issues. This seems like Windows issue.
Error “There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personal or package vendor”
I used mixed mesh 1510 and 1520. WLC version is 4.1.192.35M (Mesh).During 2year WLC is no problem. But, recently WLC's current client error.Normally user is 20. But, these day, user is 2500 and normal client is not assoiate.2500 user's status is probing and WLAN profile is unknown. probing client is not automatically disappear.We are locate isolated area. So, wireless user is a few. But, wired user is very many.after WLC reboot, status is OK.
We have an ASA 5540 successfully using SSL VPN Client Tunnels with no issues, and have been attempting to build the ability for IPSec Clients to connect as well. I have the authentication working, yet cannot complete the establishment of the tunnel for the client. The client receives an error of "Secure VPn Connection terminated by Peer, Reason 433: (Reason not specified by Peer)". In the log on the client, I see the following when the connection drops:
(this is after successful connection, split tunnel setups, then this set of items appears in the log) 377 09:29:08.071 02/28/13 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from <outside IP of ASA> 378 09:29:08.071 02/28/13 Sev=Info/5 IKE/0x63000045 RESPONDER-LIFETIME notify has value of 86400 seconds
[code]...
I see the message where it terminates and where is says 'Account Start Failure' but I can't figure out what that is indicating..
running cisco VPN client over Windows XP SP 2 64 bits.
I get the error 442 Failed to enable the virtual adapter. I have seen a number of solutions, but can not find solutions or workarounds for Windows XP 64 bits.
I've deployed AnyConnect on Windows 7 clients, and they are throwing this message after few days of usage: "The VPN client driver has encountered an error."
-Version: anyconnect-win-2.4.0202-web-deploy-k9 -OS: Windows 7 Pro 64-bit -FW: ASA 5505
What seems to fix it:
1. Uninstall Any Connect Client then, 2. Remove C:UsersUserAppDataLocalCisco folder
I try to connect to RV220W with windows 7 client but I fail : error 789. I compare again and again pre shared key, but it doesn't change anything. How to connect to RV220W with IPsec client ?
When I attempt to export the certificate for the quickvpn client via the router web interface, it looks as if the export works, and it asks me to save the zip file. However, upon opening the zip file I receive the error: The compressed folder is invalid or corrupted.
This happens in multiple browsers, from multiple machines.
I have a single user with the 2.4.1012 any connect VPN who can not establish his tunnel.We have many other users who can connect to the same tunnel group who do not have this problem so I think it is related to his pc and not to the ASA firewall.
He receives an error indicating there is a problem with the client driver.So far, we have allowed the AnyConnect VPN agent to interact with the desktop via My Computer>Manager>Services and Applications>services menu.
We checked and the Routing and Remote Access service is not enabled on the PC.I even tried having him connect using the program and the command line program and he always receives the same error that the client driver encountered an errors.I got him to run the DART tool.
I have a Cisco 1841 router connected to two different lines (same ISP) and I would like to load balance between them. I think I have achieved this point, but the problem is that remote VPNs do not work (only from Dialer1).This is my diagram:
I have a Pix 515E with a VPN setup. I recently tried to connect Cisco VPN Client and get the following error: "Secure VPN Connection terminated locally by the client. Reason 412: The remote peer is no longer responding" I have previously been able to connect to this VPN using Cisco VPN Client without issue. Below is a copy of my config and VPN Client log & debug logs from Pix. We have Newwave Communications Cable internet, which i just found out the the ISP has recently implemented DOCSIS 3.0. (i'm not sure if that matters).
******************************************************************************************************************************************* pix1(config)# sh run : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0
We have a Cisco 5505 firewall and working to setup VPN through the firewall, what Cisco vpn client should we download for our users to have the right client on their desktop/latops.
There is a Cisco VPN client (running on Windows 7) and an ASA5505. The goals are client could use remote gateway on ASA for Skype and able to access the devices in ASA inside interface.
The Skype works well but I cannot access devices in the interface inside via VPN connection. Following is the config, how to correct NAT or VPN settings?
I am using ASA 5505 with firmware 8.2(2). My ISP uses PPPoE as a WAN connection protocol. There is a problem with getting PPPoE session started on my ASA 5505. The debug output says that after negotiation of PPP-authentication protocol ASA receives a PADT packet from ISP’s concentrator. To get more information I captured all packets on outside interface with WireShark. Packet-dumps (in .pcap format) are attached in this post. I have tried all possible combinations of PAP/CHAP/MSCHAP values in “vpdn group MYGROUP ppp authentication” command. If you take a look at the packet-dumps you can see, that in case of “PAP” – ISP’s concentrator rejects negotiation (PAP is not supported by my ISP). In case of CHAP/MSCHAP (that ARE supported by my ISP) – ASA acknowledges the using of MSCHAP v.2 PPP-auth protocol, which is actually not supported by it…
Judging by MAC-addresses of ISP’s concentrators it is visible that Cisco’s equipment also is used.
The questions is: Why ASA acknowledges using of unsupported ppp-auth protocol during negotiation and what I need to do to resolve this issue? (ISP’s support says, that they cannot change PPP-auth protocol negotiation order. Also they says that I need to contact with manufacturer of my equipment).
We find ourselves in a difficult situation with the Cisco VPN Client version 5.0.07.0290 where it keeps giving us an
"Error 42: Unable to create certificate enrollment request"
When we attempt to use the Online enrollment method to create and enroll a new certificate. There is no additional information in the VPN client logs where we have set 3-High for all logs. In addition, Wire shark does not show any packets sent from the machine running the client to the Cisco 3825 router which runs the Cisco CA.
To create and enroll a certificate we do the following:
1. Click on the Enroll button to show the Certificate Enrollment dialog 2. Select Online 3. Select <New> for Certificate Authority 4. Enter http://192.168.120.1 as CA URL (note, 192.168.120.1 is the IP of the Cisco 3825) 5. Click Next to display the dialog where we can enter certificate details 6. Enter details in all fields except IP Address and Domain 7. Click Enroll which shows a dialog with the Error 42 ... message in it.
If we attempt to create a request by using the File method, all works fine, that is, the client creates a file with the enrollment request. The fact that the client does not send any messages to the Cisco CA leads us to believe that we have a problem on the client machine. However, the client does not write any information in the logs, so it is a bit hard to fix the problem. I can provide additional configuration information if required for both the client and the Cisco CA. Note that we have not modified any client configuration. Basically, we installed the client on a Windows 7 64bit machine and attempted the steps listed above.
I have a client that has a 5505 installed. They want to VPN in with their Win7 laptop, but they don't want to shell out $1000 for the 10-pack Cisco VPN client.I have successfully setup the clientless VPN, and they can, through a browser, get to their files, but they'd like to map network drives so it's just like they're in the office.I tried setting the IP Sec up on the 5505, and then using the built-in Win7 VPN network connection, but no go.I also do everything through the ASDM, but I realize some things cannot be done. I'd prefer to use the ASDM!Anyone else get this configured? 99% of what I see out here is how to connect the 5505 for site-to-site VPN.
We recently upgraded our 5505s to 8.2(5) 26 and noticed that each will crash after a cerntain amount of time. Some crash every 30 minutes other will crash every 4 to 8 hrs. The only difference would be the user's home ISP and/or home router, if they have one. They are configured with a dynamic dhcp IP address for the outside interface and the crash files starts with the following:When we downgrade back to 8.2(5) 13 the problem goes away. Any known bugs for this version? I haven't been able to find anything yet. We do have one 5505 that does not have this issues. The only thing that may be different is that it was never at 8.2(5) 13. We had downgrade it from a 8.3 version.
We have a RA Vpn split_tunnel setup in one of our locations which is working fine in all areas except for traffic destinged for one specific website using https. This vendor only allows the HTTPS connections to them to come from certain outside IP addresses. ssentially it should work like this:RAVPN_client (10.4.4.0/27) --> https request to vendor_ip (208.x.x.x) ---> ASA55XX --> NAT_to_outside_ip --> https request to vendor_ip (208.x.x.x) need to understand how you would go about NATing ONLY this specific https traffic from the RA VPN while not having to alter the setup otherwise. Internal hosts (aka behind the ASA physically) do not have any issue getting to this site, as its nat'd to the outside ip address as we expect.Here is what we are using for the NAT Exemption list he 10.2.2.x, 192.168.100.x and 172.23.2.x are other remote sites that we have. RA VPN users are using the 10.4.4.0/27 do not have any issues connecting to them, no matter the protocol.
Attached you find both configuration of the EzVPN server and remote. The tunnel is getting up and if I ping from the ASA to the Router, I see the packets getting encrypted:
ezvpn-asa# ping 172.16.100.1 ... ezvpn-asa# show crypto ipsec sa interface: outside Crypto map tag: _vpnc_cm, seq num: 10, local addr: 172.16.100.2
[code]....
If I connect a client with IP address 192.168.1.2 to the interface eth0/1 and do a ping to the cme, I don't see any packets getting encrypted. I don't have any idea about VPN, I just need it for a wireless lab environment. What do I have to configure on the ASA, so the inside traffic is encrypted?
I have a Cisco ASA 5505 which is setup as an EasyVPN client to e remote VPN concentrator.
The Cisco ASA has the 50 internal user license with 10 VPN peers.
We just upgraded the license from the base 10 internal user to 50 user license but it has not resolved the problem and only 10 internal users still work, the 11th fails.
Does each EasyVPN client on the inside network take up 1 of the 10 VPN peer licences?
This seems to be the issue from what I can see, just need confirmation.
I have an ASA 5505 that is on the perimeter of a hub & spoke vpn network, when I connect to this device using the VPN client I can connect to any device across the VPN infrastructure with the exception of the sub net that the client is connected to, for instance:
VPN client internal network connects to 192.168.113.0 /24 and is issued that ip address 192.168.113.200, the VPN client can be pinged from another device in this network however the client cannot access anything on this sub net, all other sites can be accessed ie. main site 192.168.16.0/24, second site 192.168.110/24 and third site 192.168.112/24. The ACL Manager has a single entry of "Source 192.168.113.0/24 Destination 192.168.0.0/16 and the "Standard ACL 192.168.8.8./16 permit.
I'm setting up our ASA 5505 for remote access VPN and now need to insert the VPN client addresses (allocated via RADIUS) into OSPF so that they get redistributed through our network.
The configuration of the ASA is that its hairpinning because it is behind an existing router/firewall (192.168.252.254), therefore it only has an inside interface (plus one for management).
The VPN access works fine as long as I have a static route on our router/firewall pointing the VPN clients network range to the ASA. But once I configure OSPF with a redistribute static (because VPN client addresses get added the the ASA as statics), a host route (which is fine) gets added to our firewall with a next hop of the router/firewall itself and not the ASA.
ieVPN Client route on the ASAS 192.168.242.75 255.255.255.255 [1/0] via 192.168.252.254, inside (not to sure if this is expected behaviour - would have thought it should be a Connected route)
VPN Client route on the Router/Firewall 192.168.242.75 192.168.252.254 UGH 0 1246 em2 (I would have expected that OSPF should have put this in with a gateway of .200) Route in the ASA OSPF database192.168.242.75 192.168.252.200 839 0x80000002 0x9e45 0
This might actually go into Networking Basics because of the nature of the problem, but I tossed it in here because of the Cisco product involved. Long story short, I need to do some detective work to figure an apporpriate IP address for a NIC.I recently started working at a company with the ASA 5505 and I need to upgrade the software image on a bunch of them. There's already a computer set up with a TFTP server and Hyper-Terminal to do it. I'm trying to use the CLI update procedur[URL] but when I get to the beginning of the actual transfer from the TFTP, I get stuck at "Accessing" and then the connection times out with the message "Unknown Error".The only thing I can think of is that somehow the ASA is not making it all the way to the TFTP server, probably because the IP address settings on the NIC for the computer is set wrong. I say this because in the config file provided me, the ASA is given an address X.Y.Z.1, subnet mask /24 (where all the letters are constants) and the TFTP server has an addess in its software config of X.Y.Z.10 mask /24, but the NIC on the computer is set to A.B.C.105, which is an entirely different network.I need to figure out what I can make the NIC IP address so I stop getting the error. I tried a couple of different X.Y.Z.x addresses, but haven't gotten anything yet.
