[VPN] Cisco VPN Client

Livio Zanol Puppim livio.zanol.puppim at gmail.com
Mon Jul 3 20:41:53 EDT 2006


Hey you all!

I'm new in VPN world, but I'm having problems to connect a PC(behind a NAT),
to my VPN server(valid IP adress) using Cisco VPN Client. I've already
forwarded the following ports to my PC:

500 UDP
4500 UDP (The server negotiate this port with me)
5000 and 5001 TCP/UDP

What else must I do? The VPN works normally for directed connected PCs.

I'll post the VPN client log here so you can see the problem, sorry for
ANOTHER cisco VPN problem behind NAT:

------------------------------------------------------------------------------------------------------------------------------------------------


Cisco Systems VPN Client Version 4.7.00.0533

Copyright (C) 1998-2005 Cisco Systems, Inc. All Rights Reserved.

Client Type(s): Windows, WinNT

Running on: 5.1.2600 Service Pack 2

Config file directory: C:\Arquivos de programas\Cisco Systems\VPN Client\

1 21:27:26.703 07/03/06 Sev=Info/4 CM/0x63100002

Begin connection process

2 21:27:26.718 07/03/06 Sev=Info/4 CM/0x63100004

Establish secure connection using Ethernet

3 21:27:26.718 07/03/06 Sev=Info/4 CM/0x63100024

Attempt connection with server "*X.X.X.X*"

4 21:27:26.718 07/03/06 Sev=Info/6 IKE/0x6300003B

Attempting to establish a connection with* X.X.X.X*.

5 21:27:26.734 07/03/06 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd),
VID(Nat-T), VID(Frag), VID(Unity)) to *X.X.X.X

*

6 21:27:26.921 07/03/06 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = *X.X.X.X

*

7 21:27:26.921 07/03/06 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID(Unity), VID(dpd), VID(?), VID(Xauth),
VID(Nat-T), KE, ID, NON, HASH, NAT-D, NAT-D) from *X.X.X.X

*

8 21:27:26.921 07/03/06 Sev=Info/5 IKE/0x63000001

Peer is a Cisco-Unity compliant peer

9 21:27:26.921 07/03/06 Sev=Info/5 IKE/0x63000001

Peer supports DPD

10 21:27:26.921 07/03/06 Sev=Info/5 IKE/0x63000001

Peer supports DWR Code and DWR Text

11 21:27:26.921 07/03/06 Sev=Info/5 IKE/0x63000001

Peer supports XAUTH

12 21:27:26.921 07/03/06 Sev=Info/5 IKE/0x63000001

Peer supports NAT-T

13 21:27:26.937 07/03/06 Sev=Info/6 IKE/0x63000001

IOS Vendor ID Contruction successful

14 21:27:26.937 07/03/06 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D,
NAT-D, VID(?), VID(Unity)) to *X.X.X.X

*

15 21:27:26.937 07/03/06 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

16 21:27:26.937 07/03/06 Sev=Info/4 IKE/0x63000083

IKE Port in use - Local Port = 0x1194, Remote Port = 0x1194

17 21:27:26.937 07/03/06 Sev=Info/5 IKE/0x63000072

Automatic NAT Detection Status:

Remote end is NOT behind a NAT device

This end IS behind a NAT device

18 21:27:26.937 07/03/06 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA
in the system

19 21:27:26.937 07/03/06 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA
in the system

20 21:27:26.968 07/03/06 Sev=Info/5 IKE/0x6300005E

Client sending a firewall request to concentrator

21 21:27:26.968 07/03/06 Sev=Info/5 IKE/0x6300005D

Firewall Policy: Product=Cisco Systems Integrated Client Firewall,
Capability= (Centralized Protection Policy).

22 21:27:26.968 07/03/06 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to *X.X.X.X

*

23 21:27:26.968 07/03/06 Sev=Info/4 IPSEC/0x63700008

IPSec driver successfully started

24 21:27:26.968 07/03/06 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

25 21:27:27.046 07/03/06 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = *X.X.X.X

*

26 21:27:27.046 07/03/06 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from *
X.X.X.X

*

27 21:27:27.046 07/03/06 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 86400 seconds

28 21:27:27.046 07/03/06 Sev=Info/5 IKE/0x63000047

This SA has already been alive for 1 seconds, setting expiry to 86399
seconds from now

29 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = *X.X.X.X

*

30 21:27:27.109 07/03/06 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from *X.X.X.X

*

31 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = *X.X.X.X

*

32 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.0

33 21:27:27.109 07/03/06 Sev=Info/5 IKE/0xA3000017

MODE_CFG_REPLY: The received (INTERNAL_ADDRESS_EXPIRY) attribute and value
(-256) is not supported

34 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000

35 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets),
value = 0x00000007

36 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #1

subnet = *X.X.X.X*

mask = 255.255.255.0

protocol = 0

src port = 0

dest port=0

37 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #2

subnet = *X.X.X.X

*

mask = 255.255.0.0

protocol = 0

src port = 0

dest port=0

38 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #3

subnet = *X.X.X.X

*

mask = 255.255.0.0

protocol = 0

src port = 0

dest port=0

39 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #4

subnet = *X.X.X.X*

mask = 255.255.0.0

protocol = 0

src port = 0

dest port=0

40 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #5

subnet = *X.X.X.X

*

mask = 255.255.0.0

protocol = 0

src port = 0

dest port=0

41 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #6

subnet = *X.X.X.X*

mask = 255.255.0.0

protocol = 0

src port = 0

dest port=0

42 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #7

subnet = *X.X.X.X*

mask = 255.255.0.0

protocol = 0

src port = 0

dest port=0

43 21:27:27.109 07/03/06 Sev=Info/5 IKE/0xA3000015

MODE_CFG_REPLY: Received MODECFG_UNITY_SPLITDNS_NAME attribute with no data

44 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco IOS Software,
3800 Software (C3845-ADVIPSERVICESK9-M), Version 12.4(7a), RELEASE SOFTWARE
(fc3)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2006 by Cisco Systems, Inc.

Compiled Tue 25-Apr-06 02:54 by ssearch

45 21:27:27.109 07/03/06 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value =
0x00001194

46 21:27:27.109 07/03/06 Sev=Info/4 CM/0x63100019

Mode Config data received

47 21:27:27.109 07/03/06 Sev=Info/4 IKE/0x63000056

Received a key request from Driver: Local IP = *Y.Y.Y.Y*, GW IP = *X.X.X.X*,
Remote IP = *0.0.0.0

*

48 21:27:27.109 07/03/06 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to *X.X.X.X

*

49 21:27:27.312 07/03/06 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = *X.X.X.X

*

50 21:27:27.312 07/03/06 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN) from *
X.X.X.X

*

51 21:27:27.312 07/03/06 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to *X.X.X.X

*

52 21:27:27.312 07/03/06 Sev=Info/4 IKE/0x63000049

Discarding IPsec SA negotiation, MsgID=9C889DF0

53 21:27:27.312 07/03/06 Sev=Info/4 IKE/0x63000017

Marking IKE SA for deletion (I_Cookie=4A3797BB0E9DACC7
R_Cookie=67C4C5E4CD6CD6AD) reason = DEL_REASON_IKE_NEG_FAILED

54 21:27:27.484 07/03/06 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

55 21:27:30.453 07/03/06 Sev=Info/4 IKE/0x6300004B

Discarding IKE SA negotiation (I_Cookie=4A3797BB0E9DACC7
R_Cookie=67C4C5E4CD6CD6AD) reason = DEL_REASON_IKE_NEG_FAILED

56 21:27:30.453 07/03/06 Sev=Info/4 CM/0x63100012

Phase 1 SA deleted before first Phase 2 SA is up cause by
"DEL_REASON_IKE_NEG_FAILED". 0 Crypto Active IKE SA, 0 User Authenticated
IKE SA in the system

57 21:27:30.453 07/03/06 Sev=Info/5 CM/0x63100025

Initializing CVPNDrv

58 21:27:30.453 07/03/06 Sev=Info/4 IKE/0x63000001

IKE received signal to terminate VPN connection

59 21:27:30.468 07/03/06 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

60 21:27:30.468 07/03/06 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

61 21:27:30.468 07/03/06 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

62 21:27:30.468 07/03/06 Sev=Info/4 IPSEC/0x6370000A

IPSec driver successfully stopped



--------------------------------------------------------------------------------------------------------------------------------------
Resumed log:

2      21:20:47.953  07/03/06  Sev=Warning/3 IKE/0xA3000029
No keys are available to decrypt the received ISAKMP payload



Thank you all! :)
[]'s
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/vpn/attachments/20060703/2c4a5810/attachment.htm 


More information about the VPN mailing list