Re: Cisco VPN Client
Aida Lumbreras <[email protected]> Tue, 4 Jul 2006 19:52:27 -0500
| Newsgroups | gmane.comp.security.vpn |
|---|---|
| Organization | HOME |
| Message-ID | <[email protected]> |
--===============0199417258== Content-Type: multipart/alternative; boundary="====_389028280803163_====_" --====_389028280803163_====_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Hi Livio, It seems you are connecting to a cisco router, the routers by default already have NAT-T enabled (after 12.3(13)T version). So I do not think this migth be the problem unless you have this command on your configuration: no crypto ipsec nat-t udp encapsulation which migth disable nat-t Have your tried rebooting the router you are connecting to? =A0I have seen those errors many times, and if all the proper ports are opened and the config is fine, a simple reboot may take care of the problem. If the problem persist, can I get a copy of your configuration? Thanks! Aida Lumbreras --------------------------------------- >Hey you all! >=A0 >I'm new in VPN world, but I'm having problems to connect a PC(behind >a NAT), to my VPN server(valid IP adress) using Cisco VPN Client. >I've already forwarded the following ports to my PC: >=A0 >500 UDP >4500 UDP (The server negotiate this port with me) >5000 and 5001 TCP/UDP >=A0 >What else must I do? The VPN works normally for directed connected >PCs. >=A0 >I'll post the VPN client log here so you can see the problem, sorry >for ANOTHER cisco VPN problem behind NAT: >=A0 >--------------------------------------------------------------------- >--------------------------------------------------------------------- >------ >=A0 >Cisco Systems VPN Client Version 4.7.00.0533 >Copyright (C) 1998-2005 Cisco Systems, Inc. All Rights Reserved. >Client Type(s): Windows, WinNT >Running on: 5.1.2600 Service Pack 2 >Config file directory: C:\Arquivos de programas\Cisco Systems\VPN >Client\ >1 21:27:26.703 07/03/06 Sev=3DInfo/4 CM/0x63100002 >Begin connection process >2 21:27:26.718 07/03/06 Sev=3DInfo/4 CM/0x63100004 >Establish secure connection using Ethernet >3 21:27:26.718 07/03/06 Sev=3DInfo/4 CM/0x63100024 >Attempt connection with server "X.X.X.X" >4 21:27:26.718 07/03/06 Sev=3DInfo/6 IKE/0x6300003B >Attempting to establish a connection with X.X.X.X. >5 21:27:26.734 07/03/06 Sev=3DInfo/4 IKE/0x63000013 >SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), >VID(Nat-T), VID(Frag), VID(Unity)) to X.X.X.X >6 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x6300002F >Received ISAKMP packet: peer =3D X.X.X.X >7 21:27:26.921 07/03/06 Sev=3DInfo/4 IKE/0x63000014 >RECEIVING <<< ISAKMP OAK AG (SA, VID(Unity), VID(dpd), VID(?), >VID(Xauth), VID(Nat-T), KE, ID, NON, HASH, NAT-D, NAT-D) from X.X.X.X >8 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001 >Peer is a Cisco-Unity compliant peer >9 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001 >Peer supports DPD >10 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001 >Peer supports DWR Code and DWR Text >11 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001 >Peer supports XAUTH >12 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001 >Peer supports NAT-T >13 21:27:26.937 07/03/06 Sev=3DInfo/6 IKE/0x63000001 >IOS Vendor ID Contruction successful >14 21:27:26.937 07/03/06 Sev=3DInfo/4 IKE/0x63000013 >SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, >NAT-D, NAT-D, VID(?), VID(Unity)) to X.X.X.X >15 21:27:26.937 07/03/06 Sev=3DInfo/6 IKE/0x63000055 >Sent a keepalive on the IPSec SA >16 21:27:26.937 07/03/06 Sev=3DInfo/4 IKE/0x63000083 >IKE Port in use - Local Port =3D 0x1194, Remote Port =3D 0x1194 >17 21:27:26.937 07/03/06 Sev=3DInfo/5 IKE/0x63000072 >Automatic NAT Detection Status: >Remote end is NOT behind a NAT device >This end IS behind a NAT device >18 21:27:26.937 07/03/06 Sev=3DInfo/4 CM/0x6310000E >Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated >IKE SA in the system >19 21:27:26.937 07/03/06 Sev=3DInfo/4 CM/0x6310000E >Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated >IKE SA in the system >20 21:27:26.968 07/03/06 Sev=3DInfo/5 IKE/0x6300005E >Client sending a firewall request to concentrator >21 21:27:26.968 07/03/06 Sev=3DInfo/5 IKE/0x6300005D >Firewall Policy: Product=3DCisco Systems Integrated Client Firewall, >Capability=3D (Centralized Protection Policy). >22 21:27:26.968 07/03/06 Sev=3DInfo/4 IKE/0x63000013 >SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to X.X.X.X >23 21:27:26.968 07/03/06 Sev=3DInfo/4 IPSEC/0x63700008 >IPSec driver successfully started >24 21:27:26.968 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014 >Deleted all keys >25 21:27:27.046 07/03/06 Sev=3DInfo/5 IKE/0x6300002F >Received ISAKMP packet: peer =3D X.X.X.X >26 21:27:27.046 07/03/06 Sev=3DInfo/4 IKE/0x63000014 >RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) >from X.X.X.X >27 21:27:27.046 07/03/06 Sev=3DInfo/5 IKE/0x63000045 >RESPONDER-LIFETIME notify has value of 86400 seconds >28 21:27:27.046 07/03/06 Sev=3DInfo/5 IKE/0x63000047 >This SA has already been alive for 1 seconds, setting expiry to >86399 seconds from now >29 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300002F >Received ISAKMP packet: peer =3D X.X.X.X >30 21:27:27.109 07/03/06 Sev=3DInfo/4 IKE/0x63000014 >RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from X.X.X.X >31 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x63000010 >MODE_CFG_REPLY: Attribute =3D INTERNAL_IPV4_ADDRESS: , value =3D X.X.X.X >32 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x63000010 >MODE_CFG_REPLY: Attribute =3D INTERNAL_IPV4_NETMASK: , value =3D >255.255.255.0 >33 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0xA3000017 >MODE_CFG_REPLY: The received (INTERNAL_ADDRESS_EXPIRY) attribute and >value (-256) is not supported >34 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000D >MODE_CFG_REPLY: Attribute =3D MODECFG_UNITY_SAVEPWD: , value =3D >0x00000000 >35 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000D >MODE_CFG_REPLY: Attribute =3D MODECFG_UNITY_SPLIT_INCLUDE (# of >split_nets), value =3D 0x00000007 >36 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #1 >subnet =3D X.X.X.X >mask =3D 255.255.255.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >37 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #2 >subnet =3D X.X.X.X >mask =3D 255.255.0.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >38 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #3 >subnet =3D X.X.X.X >mask =3D 255.255.0.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >39 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #4 >subnet =3D X.X.X.X >mask =3D 255.255.0.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >40 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #5 >subnet =3D X.X.X.X >mask =3D 255.255.0.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >41 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #6 >subnet =3D X.X.X.X >mask =3D 255.255.0.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >42 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F >SPLIT_NET #7 >subnet =3D X.X.X.X >mask =3D 255.255.0.0 >protocol =3D 0 >src port =3D 0 >dest port=3D0 >43 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0xA3000015 >MODE_CFG_REPLY: Received MODECFG_UNITY_SPLITDNS_NAME attribute with >no data >44 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000E >MODE_CFG_REPLY: Attribute =3D APPLICATION_VERSION, value =3D Cisco IOS >Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version 12.4(7a), >RELEASE SOFTWARE (fc3) >Technical Support: http://www.cisco.com/techsupport >Copyright (c) 1986-2006 by Cisco Systems, Inc. >Compiled Tue 25-Apr-06 02:54 by ssearch >45 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000D >MODE_CFG_REPLY: Attribute =3D Received and using NAT-T port number , >value =3D 0x00001194 >46 21:27:27.109 07/03/06 Sev=3DInfo/4 CM/0x63100019 >Mode Config data received >47 21:27:27.109 07/03/06 Sev=3DInfo/4 IKE/0x63000056 >Received a key request from Driver: Local IP =3D Y.Y.Y.Y, GW IP =3D >X.X.X.X, Remote IP =3D 0.0.0.0 >48 21:27:27.109 07/03/06 Sev=3DInfo/4 IKE/0x63000013 >SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to X.X.X.X >49 21:27:27.312 07/03/06 Sev=3DInfo/5 IKE/0x6300002F >Received ISAKMP packet: peer =3D X.X.X.X >50 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000014 >RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN) >from X.X.X.X >51 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000013 >SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to X.X.X.X >52 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000049 >Discarding IPsec SA negotiation, MsgID=3D9C889DF0 >53 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000017 >Marking IKE SA for deletion (I_Cookie=3D4A3797BB0E9DACC7 >R_Cookie=3D67C4C5E4CD6CD6AD) reason =3D DEL_REASON_IKE_NEG_FAILED >54 21:27:27.484 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014 >Deleted all keys >55 21:27:30.453 07/03/06 Sev=3DInfo/4 IKE/0x6300004B >Discarding IKE SA negotiation (I_Cookie=3D4A3797BB0E9DACC7 >R_Cookie=3D67C4C5E4CD6CD6AD) reason =3D DEL_REASON_IKE_NEG_FAILED >56 21:27:30.453 07/03/06 Sev=3DInfo/4 CM/0x63100012 >Phase 1 SA deleted before first Phase 2 SA is up cause by >"DEL_REASON_IKE_NEG_FAILED". 0 Crypto Active IKE SA, 0 User >Authenticated IKE SA in the system >57 21:27:30.453 07/03/06 Sev=3DInfo/5 CM/0x63100025 >Initializing CVPNDrv >58 21:27:30.453 07/03/06 Sev=3DInfo/4 IKE/0x63000001 >IKE received signal to terminate VPN connection >59 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014 >Deleted all keys >60 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014 >Deleted all keys >61 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014 >Deleted all keys >62 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x6370000A >IPSec driver successfully stopped >=A0 > =A0 >--------------------------------------------------------------------- >----------------------------------------------------------------- >Resumed log: >=A0 >2=A0=A0=A0=A0=A0 21:20:47.953=A0 07/03/06=A0 = Sev=3DWarning/3=A0IKE/0xA3000029 No keys >are available to decrypt the received ISAKMP payload >=A0 >=A0 >=A0 >Thank you all! :) >[]'s --====_389028280803163_====_ Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable <HTML> <HEAD> </HEAD> <BODY> <P>Hi Livio,</P> <P>It seems you are connecting to a cisco router, the routers by = default already have NAT-T enabled (after 12.3(13)T version). So I do = not think this migth be the problem unless you have this command on = your configuration:</P> <P><BR></P> <P>no crypto ipsec nat-t udp encapsulation</P> <P><BR></P> <P>which migth disable nat-t</P> <P><BR></P> <P>Have your tried rebooting the router you are connecting to? = I have seen those errors many times, and if all the proper = ports are opened and the config is fine, a simple reboot may take = care of the problem.</P> <P><BR></P> <P>If the problem persist, can I get a copy of your configuration?</P> <P><BR></P> <P>Thanks!</P> <P><BR></P> <P>Aida Lumbreras</P> <P><BR></P> <P>---------------------------------------</P> <BLOCKQUOTE> <P>>Hey you all!</P> <P>> </P> <P>>I'm new in VPN world, but I'm having problems to connect a = PC(behind</P> <P>>a NAT), to my VPN server(valid IP adress) using Cisco VPN = Client. </P> <P>>I've already forwarded the following ports to my PC:</P> <P>> </P> <P>>500 UDP</P> <P>>4500 UDP (The server negotiate this port with me)</P> <P>>5000 and 5001 TCP/UDP</P> <P>> </P> <P>>What else must I do? The VPN works normally for directed = connected</P> <P>>PCs.</P> <P>> </P> <P>>I'll post the VPN client log here so you can see the problem, = sorry</P> <P>>for ANOTHER cisco VPN problem behind NAT:</P> <P>> </P> <P>>= ---------------------------------------------------------------------<= /P> <P>>= ---------------------------------------------------------------------<= /P> <P>>------</P> <P>> </P> <P>>Cisco Systems VPN Client Version 4.7.00.0533</P> <P>>Copyright (C) 1998-2005 Cisco Systems, Inc. All Rights = Reserved.</P> <P>>Client Type(s): Windows, WinNT</P> <P>>Running on: 5.1.2600 Service Pack 2</P> <P>>Config file directory: C:\Arquivos de programas\Cisco = Systems\VPN</P> <P>>Client\</P> <P>>1 21:27:26.703 07/03/06 Sev=3DInfo/4 CM/0x63100002</P> <P>>Begin connection process</P> <P>>2 21:27:26.718 07/03/06 Sev=3DInfo/4 CM/0x63100004</P> <P>>Establish secure connection using Ethernet</P> <P>>3 21:27:26.718 07/03/06 Sev=3DInfo/4 CM/0x63100024</P> <P>>Attempt connection with server "X.X.X.X"</P> <P>>4 21:27:26.718 07/03/06 Sev=3DInfo/6 IKE/0x6300003B</P> <P>>Attempting to establish a connection with X.X.X.X.</P> <P>>5 21:27:26.734 07/03/06 Sev=3DInfo/4 IKE/0x63000013 </P> <P>>SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, = VID(Xauth), VID(dpd),</P> <P>>VID(Nat-T), VID(Frag), VID(Unity)) to X.X.X.X</P> <P>>6 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x6300002F</P> <P>>Received ISAKMP packet: peer =3D X.X.X.X </P> <P>>7 21:27:26.921 07/03/06 Sev=3DInfo/4 IKE/0x63000014</P> <P>>RECEIVING <<< ISAKMP OAK AG (SA, VID(Unity), = VID(dpd), VID(?),</P> <P>>VID(Xauth), VID(Nat-T), KE, ID, NON, HASH, NAT-D, NAT-D) from = X.X.X.X</P> <P>>8 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001</P> <P>>Peer is a Cisco-Unity compliant peer</P> <P>>9 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001</P> <P>>Peer supports DPD</P> <P>>10 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001</P> <P>>Peer supports DWR Code and DWR Text</P> <P>>11 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001</P> <P>>Peer supports XAUTH</P> <P>>12 21:27:26.921 07/03/06 Sev=3DInfo/5 IKE/0x63000001</P> <P>>Peer supports NAT-T</P> <P>>13 21:27:26.937 07/03/06 Sev=3DInfo/6 IKE/0x63000001</P> <P>>IOS Vendor ID Contruction successful</P> <P>>14 21:27:26.937 07/03/06 Sev=3DInfo/4 IKE/0x63000013</P> <P>>SENDING >>> ISAKMP OAK AG *(HASH, = NOTIFY:STATUS_INITIAL_CONTACT,</P> <P>>NAT-D, NAT-D, VID(?), VID(Unity)) to X.X.X.X</P> <P>>15 21:27:26.937 07/03/06 Sev=3DInfo/6 IKE/0x63000055</P> <P>>Sent a keepalive on the IPSec SA</P> <P>>16 21:27:26.937 07/03/06 Sev=3DInfo/4 IKE/0x63000083</P> <P>>IKE Port in use - Local Port =3D 0x1194, Remote Port =3D = 0x1194</P> <P>>17 21:27:26.937 07/03/06 Sev=3DInfo/5 IKE/0x63000072</P> <P>>Automatic NAT Detection Status:</P> <P>>Remote end is NOT behind a NAT device</P> <P>>This end IS behind a NAT device</P> <P>>18 21:27:26.937 07/03/06 Sev=3DInfo/4 CM/0x6310000E</P> <P>>Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User = Authenticated</P> <P>>IKE SA in the system</P> <P>>19 21:27:26.937 07/03/06 Sev=3DInfo/4 CM/0x6310000E</P> <P>>Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User = Authenticated</P> <P>>IKE SA in the system</P> <P>>20 21:27:26.968 07/03/06 Sev=3DInfo/5 IKE/0x6300005E</P> <P>>Client sending a firewall request to concentrator</P> <P>>21 21:27:26.968 07/03/06 Sev=3DInfo/5 IKE/0x6300005D</P> <P> >Firewall Policy: Product=3DCisco Systems Integrated Client = Firewall,</P> <P>>Capability=3D (Centralized Protection Policy).</P> <P>>22 21:27:26.968 07/03/06 Sev=3DInfo/4 IKE/0x63000013</P> <P>>SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to = X.X.X.X</P> <P>>23 21:27:26.968 07/03/06 Sev=3DInfo/4 IPSEC/0x63700008</P> <P>>IPSec driver successfully started</P> <P>>24 21:27:26.968 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014</P> <P>>Deleted all keys</P> <P>>25 21:27:27.046 07/03/06 Sev=3DInfo/5 IKE/0x6300002F</P> <P>>Received ISAKMP packet: peer =3D X.X.X.X</P> <P>>26 21:27:27.046 07/03/06 Sev=3DInfo/4 IKE/0x63000014</P> <P>>RECEIVING <<< ISAKMP OAK INFO *(HASH, = NOTIFY:STATUS_RESP_LIFETIME)</P> <P>>from X.X.X.X</P> <P> >27 21:27:27.046 07/03/06 Sev=3DInfo/5 IKE/0x63000045</P> <P>>RESPONDER-LIFETIME notify has value of 86400 seconds</P> <P>>28 21:27:27.046 07/03/06 Sev=3DInfo/5 IKE/0x63000047</P> <P>>This SA has already been alive for 1 seconds, setting expiry = to</P> <P>>86399 seconds from now</P> <P>>29 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300002F</P> <P>>Received ISAKMP packet: peer =3D X.X.X.X</P> <P>>30 21:27:27.109 07/03/06 Sev=3DInfo/4 IKE/0x63000014</P> <P>>RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from = X.X.X.X</P> <P>>31 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x63000010</P> <P>>MODE_CFG_REPLY: Attribute =3D INTERNAL_IPV4_ADDRESS: , value = =3D X.X.X.X</P> <P>>32 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x63000010</P> <P> >MODE_CFG_REPLY: Attribute =3D INTERNAL_IPV4_NETMASK: , value = =3D</P> <P>>255.255.255.0</P> <P>>33 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0xA3000017</P> <P>>MODE_CFG_REPLY: The received (INTERNAL_ADDRESS_EXPIRY) = attribute and</P> <P>>value (-256) is not supported</P> <P>>34 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000D</P> <P>>MODE_CFG_REPLY: Attribute =3D MODECFG_UNITY_SAVEPWD: , value = =3D</P> <P>>0x00000000</P> <P>>35 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000D</P> <P>>MODE_CFG_REPLY: Attribute =3D MODECFG_UNITY_SPLIT_INCLUDE (# = of</P> <P>>split_nets), value =3D 0x00000007</P> <P>>36 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #1</P> <P>>subnet =3D X.X.X.X </P> <P>>mask =3D 255.255.255.0 </P> <P>>protocol =3D 0</P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>37 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #2</P> <P>>subnet =3D X.X.X.X</P> <P>>mask =3D 255.255.0.0</P> <P>>protocol =3D 0 </P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>38 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #3</P> <P>>subnet =3D X.X.X.X</P> <P>>mask =3D 255.255.0.0</P> <P>>protocol =3D 0</P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>39 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #4</P> <P>>subnet =3D X.X.X.X </P> <P>>mask =3D 255.255.0.0</P> <P>>protocol =3D 0</P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>40 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #5</P> <P>>subnet =3D X.X.X.X</P> <P>>mask =3D 255.255.0.0</P> <P>>protocol =3D 0</P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>41 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #6</P> <P>>subnet =3D X.X.X.X </P> <P>>mask =3D 255.255.0.0</P> <P>>protocol =3D 0</P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>42 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000F</P> <P>>SPLIT_NET #7 </P> <P>>subnet =3D X.X.X.X </P> <P>>mask =3D 255.255.0.0</P> <P>>protocol =3D 0</P> <P>>src port =3D 0</P> <P>>dest port=3D0</P> <P>>43 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0xA3000015</P> <P>>MODE_CFG_REPLY: Received MODECFG_UNITY_SPLITDNS_NAME attribute = with</P> <P>>no data</P> <P>>44 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000E</P> <P>>MODE_CFG_REPLY: Attribute =3D APPLICATION_VERSION, value =3D = Cisco IOS</P> <P>>Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version = 12.4(7a),</P> <P>>RELEASE SOFTWARE (fc3)</P> <P>>Technical Support: http://www.cisco.com/techsupport</P> <P>>Copyright (c) 1986-2006 by Cisco Systems, Inc.</P> <P>>Compiled Tue 25-Apr-06 02:54 by ssearch</P> <P>>45 21:27:27.109 07/03/06 Sev=3DInfo/5 IKE/0x6300000D</P> <P>>MODE_CFG_REPLY: Attribute =3D Received and using NAT-T port = number ,</P> <P>>value =3D 0x00001194</P> <P>>46 21:27:27.109 07/03/06 Sev=3DInfo/4 CM/0x63100019</P> <P>>Mode Config data received</P> <P>>47 21:27:27.109 07/03/06 Sev=3DInfo/4 IKE/0x63000056</P> <P>>Received a key request from Driver: Local IP =3D Y.Y.Y.Y, GW = IP =3D</P> <P>>X.X.X.X, Remote IP =3D 0.0.0.0</P> <P>>48 21:27:27.109 07/03/06 Sev=3DInfo/4 IKE/0x63000013</P> <P>>SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to = X.X.X.X</P> <P>>49 21:27:27.312 07/03/06 Sev=3DInfo/5 IKE/0x6300002F</P> <P>>Received ISAKMP packet: peer =3D X.X.X.X</P> <P>>50 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000014</P> <P>>RECEIVING < << ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN)</P> <P>>from X.X.X.X</P> <P>>51 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000013</P> <P>>SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to = X.X.X.X</P> <P>>52 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000049</P> <P>>Discarding IPsec SA negotiation, MsgID=3D9C889DF0</P> <P>>53 21:27:27.312 07/03/06 Sev=3DInfo/4 IKE/0x63000017</P> <P>>Marking IKE SA for deletion (I_Cookie=3D4A3797BB0E9DACC7</P> <P>>R_Cookie=3D67C4C5E4CD6CD6AD) reason =3D = DEL_REASON_IKE_NEG_FAILED</P> <P>>54 21:27:27.484 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014</P> <P>>Deleted all keys</P> <P>>55 21:27:30.453 07/03/06 Sev=3DInfo/4 IKE/0x6300004B</P> <P>>Discarding IKE SA negotiation (I_Cookie=3D4A3797BB0E9DACC7</P> <P>>R_Cookie=3D67C4C5E4CD6CD6AD) reason =3D = DEL_REASON_IKE_NEG_FAILED</P> <P>>56 21:27:30.453 07/03/06 Sev=3DInfo/4 CM/0x63100012</P> <P>>Phase 1 SA deleted before first Phase 2 SA is up cause by</P> <P>>"DEL_REASON_IKE_NEG_FAILED ". 0 Crypto Active IKE SA, 0 User</P> <P>>Authenticated IKE SA in the system</P> <P>>57 21:27:30.453 07/03/06 Sev=3DInfo/5 CM/0x63100025</P> <P>>Initializing CVPNDrv</P> <P>>58 21:27:30.453 07/03/06 Sev=3DInfo/4 IKE/0x63000001</P> <P> >IKE received signal to terminate VPN connection</P> <P>>59 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014</P> <P>>Deleted all keys</P> <P>>60 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014</P> <P>>Deleted all keys</P> <P>>61 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x63700014</P> <P>>Deleted all keys</P> <P>>62 21:27:30.468 07/03/06 Sev=3DInfo/4 IPSEC/0x6370000A</P> <P>>IPSec driver successfully stopped</P> <P>> </P> <P>> </P> <P>>= ---------------------------------------------------------------------<= /P> <P>>= -----------------------------------------------------------------</P> <P>>Resumed log:</P> <P>> </P> <P>>2 21:20:47.953 = 07/03/06 Sev=3DWarning/3 IKE/0xA3000029<br> No keys</P> <P>>are available to decrypt the received ISAKMP payload</P> <P>> </P> <P>> </P> <P>> </P> <P>>Thank you all! :)</P> <P>>[]'s</P> </BLOCKQUOTE> </BODY> </HTML> --====_389028280803163_====_-- --===============0199417258== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ VPN mailing list [email protected] http://lists.shmoo.com/mailman/listinfo/vpn --===============0199417258==--