Cisco Reason 422

[Oceanik]

I'm trying to connect from my home computer to my office network using a cisco client

I succeeded to connect once

I was disconnected abruptly (w/o a proper disconnection)

Since then, when I try to connect, I'm connected for 3-5 seconds and then Cisco VPN Client displays the message
"Reason 422: Lost contact with the security gateway.
Check your network connection"

I desinstalled the client, cleaned the registry, re-installed but I still have the same issue

What's wrong ?

 

[themut]

You need to analyze the VPN client and headend device logs simultaneously. On the client click on Log then Log Settings and make sure all settings are set to HIGH. Then click on Log again and select enable, if disable is displayed then it is already enabled.

 

[Oceanik]

Here is the log (well, the interesting part)

[.......]

63 20:31:06.140 03/21/05 Sev=Info/6 CM/0x63100036
The routing table was updated for the Virtual Adapter

64 20:31:06.156 03/21/05 Sev=Info/4 CM/0x6310001A
One secure connection established

65 20:31:06.187 03/21/05 Sev=Info/4 CM/0x63100038
Address watch added for 192.168.2.2. Current address(es): 127.0.0.1.

66 20:31:06.187 03/21/05 Sev=Info/4 CM/0x63100038
Address watch added for 192.168.2.6. Current address(es): 127.0.0.1.

67 20:31:06.250 03/21/05 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

68 20:31:06.250 03/21/05 Sev=Info/4 IPSEC/0x63700010
Created a new key structure

69 20:31:06.250 03/21/05 Sev=Info/4 IPSEC/0x6370000F
Added key with SPI=0x12f1114b into key list

70 20:31:06.265 03/21/05 Sev=Info/4 IPSEC/0x63700010
Created a new key structure

71 20:31:06.265 03/21/05 Sev=Info/4 IPSEC/0x6370000F
Added key with SPI=0x0003753f into key list

72 20:31:06.265 03/21/05 Sev=Info/4 IPSEC/0x6370002E
Assigned VA private interface addr 192.168.2.6

73 20:31:09.343 03/21/05 Sev=Info/6 IKE/0x63000054
Sent a keepalive on the IPSec SA

74 20:31:11.343 03/21/05 Sev=Warning/3 CM/0xA310002C
Adapter address changed from 192.168.2.2. Current address(es): 127.0.0.1.

75 20:31:11.343 03/21/05 Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection

76 20:31:11.343 03/21/05 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 67.69.**.**

77 20:31:11.343 03/21/05 Sev=Info/5 IKE/0x63000018
Deleting IPsec SA: (OUTBOUND SPI = 4B11F112 INBOUND SPI = 3F750300)

78 20:31:11.343 03/21/05 Sev=Info/4 IKE/0x63000048
Discarding IPsec SA negotiation, MsgID=0B1F529F

79 20:31:11.343 03/21/05 Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion (I_Cookie=3925D19EBABC0931 R_Cookie=F42573366A261339) reason = DEL_REASON_ADDRESS_CHANGE

80 20:31:11.343 03/21/05 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 67.69.**.**

81 20:31:11.343 03/21/05 Sev=Info/4 IKE/0x6300004A
Discarding IKE SA negotiation (I_Cookie=3925D19EBABC0931 R_Cookie=F42573366A261339) reason = DEL_REASON_ADDRESS_CHANGE

82 20:31:11.343 03/21/05 Sev=Info/4 CM/0x63100013
Phase 1 SA deleted cause by DEL_REASON_ADDRESS_CHANGE. 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

83 20:31:11.343 03/21/05 Sev=Info/5 CM/0x63100025
Initializing CVPNDrv

84 20:31:11.359 03/21/05 Sev=Info/6 CM/0x63100031
Tunnel to headend device 67.69.**.** disconnected: duration: 0 days 0:0:5

 

[themut]

If you haven't changed any information on the logs then I believe there may be something misconfigured on your PC. The IPSec is braking because it sees an IP address change:

65 20:31:06.187 03/21/05 Sev=Info/4 CM/0x63100038
Address watch added for 192.168.2.2. Current address(es): 127.0.0.1.

66 20:31:06.187 03/21/05 Sev=Info/4 CM/0x63100038
Address watch added for 192.168.2.6. Current address(es): 127.0.0.1.


The VPN also isn't looking at the current IP address correctly, 127.0.0.1 is the loopback address and it should not be configured on the NIC. On a working session the VPN should see the log as follows:

67 07:26:00.267 03/22/05 Sev=Info/4 CM/0x63100038
Address watch added for 10.6.2.50. Current hostname: cr-gbm, Current address(es): 10.6.2.50, 192.168.5.6.


where 192.168.5.6 is the IP address configured on my PC's NIC card. Look into your PC's configuration and try to determine where the problem lies