fustrating vpn phase 1 problem

cormon · Mar 21, 2007

Hi

I'm having some trouble setting up a Cisco 871 router running 12.4 to accept vpn client connections . I have tried two different P.C and have tried both version 4.8 and version 5.0 of the Cisco vpn client to no avail . The P.C's are directly into the Ethernet ports of the router so there other devices involved.

From what I can see the connection is failing to negotiate Phase 1 Isakmp , I have had a good look around on line but can see any real solutions . I may be incorrect here but I understood that the client negotiates a isakmp policy with the router and that's it . As I said this appears to be a common issue with no resolution so it would be great to get to the bottom of it . Find attached config and debug isakmp
outputs.

thanks alot in advance.

******************************************************
ersion 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router1
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
!
aaa session-id common
!
--More-- resource policy
!
ip cef
!
!
!
!
!
!
key chain SECURE
key 1024
key-string cisco
key 2048
key-string cisco2
!
!
username ******** ****** 0 cisco
!
!
!
crypto isakmp policy 5
encr 3des
hash md5
--More-- hare
group 2
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco address 172.30.0.* no-xauth
!
crypto isakmp client configuration group RAS
key cisco
dns 10.90.0.1 10.90.0.2
pool RAS
acl 108
firewall are-u-there
banner ^C
You are now Connected to the Cisco 871 Router1
Disconnect Immediately if you are not Authorized! --More--
**************************************************
^C
!
crypto isakmp peer address 172.30.0.2
!
!
crypto ipsec transform-set STRONG esp-aes 256 esp-sha-hmac
crypto ipsec transform-set MEDIUM esp-3des esp-sha-hmac
!
crypto dynamic-map DYNMAP 10
set transform-set MEDIUM
!
!
crypto map MYMAP client authentication list userauthen
crypto map MYMAP isakmp authorization list groupauthor
crypto map MYMAP client configuration address initiate
crypto map MYMAP client configuration address respond
crypto map MYMAP 10 ipsec-isakmp
set peer 172.30.0.2
set transform-set STRONG
set pfs group5
match address VPN
--More-- crypto map MYMAP 10000 ipsec-isakmp dynamic DYNMAP
!
!
!
!
!
interface Loopback100
ip address 100.100.100.100 255.255.255.255
!
interface FastEthernet0
!
interface FastEthernet1
shutdown
!
interface FastEthernet2
!
interface FastEthernet3
shutdown
!
interface FastEthernet4
description *** WAN Connection to Router2 ***
ip address 172.30.0.1 255.255.255.252
no ip unreachables
--More-- ip ospf authentication message-digest
ip ospf authentication-key SECURE
duplex auto
speed auto
crypto map MYMAP
!
interface Vlan1
description *** Connection to Pilot-LAB LAN ***
ip address 10.90.0.252 255.255.255.0
!
router ospf 100
router-id 100.100.100.100
log-adjacency-changes
redistribute connected subnets
network 172.30.0.0 0.0.0.255 area 0
distribute-list 10 out
!
ip local pool RAS 10.90.0.175 10.90.0.180
ip route 0.0.0.0 0.0.0.0 172.30.0.2
ip route 10.100.0.0 255.255.255.0 172.30.0.2
!
!
no ip http server
--More-- no ip http secure-server
!
ip access-list extended VPN
permit ip 10.90.0.0 0.0.0.255 10.100.0.0 0.0.0.255
!
access-list 10 permit 100.100.100.100
access-list 10 deny any
access-list 108 permit ip any any
!
!
!
!
control-plane
!
!
line con 0
no modem enable
transport output all
line aux 0
line vty 0 4
!
scheduler max-task-time 5000
!
--More-- t_context
ssl authenticate verify all
!
no inservice
!
end

************************************************************
************************************************************

*Mar 2 01:21:41.022: ISAKMP (0:0): received packet from 172.30.0.2 dport 500 sp
ort 1381 Global (N) NEW SA
*Mar 2 01:21:41.022: ISAKMP: Created a peer struct for 172.30.0.2, peer port 13
81
*Mar 2 01:21:41.022: ISAKMP: New peer created peer = 0x8410C930 peer_handle = 0
x8000001D
*Mar 2 01:21:41.022: ISAKMP: Locking peer struct 0x8410C930, refcount 1 for cry
pto_isakmp_process_block
*Mar 2 01:21:41.022: ISAKMP

0):Setting client config settings 83E9E4F8
*Mar 2 01:21:41.022: ISAKMP: local port 500, remote port 1381
*Mar 2 01:21:41.022: insert sa successfully sa = 82F06C1C
*Mar 2 01:21:41.022: ISAKMP

0): processing SA payload. message ID = 0
*Mar 2 01:21:41.022: ISAKMP

0): processing ID payload. message ID = 0
*Mar 2 01:21:41.022: ISAKMP (0:0): ID payload
next-payload : 13
type : 11
group id : RAS
protocol : 17
port : 500
length : 11
*Mar 2 01:21:41.022: ISAKMP

0):: peer matches *none* of the profiles
*Mar 2 01:21:41.022: ISAKMP

0): processing vendor id payload
*Mar 2 01:21:41.022: ISAKMP

0): vendor ID seems Unity/DPD but major 215 mismat
ch
*Mar 2 01:21:41.022: ISAKMP

0): vendor ID is XAUTH
*Mar 2 01:21:41.022: ISAKMP

0): processing vendor id payload
*Mar 2 01:21:41.022: ISAKMP

0): vendor ID is DPD
*Mar 2 01:21:41.026: ISAKMP

0): processing vendor id payload
*Mar 2 01:21:41.026: ISAKMP

0): vendor ID seems Unity/DPD but major 194 mismat
ch
*Mar 2 01:21:41.026: ISAKMP

0): processing vendor id payload
*Mar 2 01:21:41.026: ISAKMP

0): vendor ID seems Unity/DPD but major 123 mismat
ch
*Mar 2 01:21:41.026: ISAKMP

0): vendor ID is NAT-T v2
*Mar 2 01:21:41.026: ISAKMP

0): processing vendor id payload
*Mar 2 01:21:41.026: ISAKMP

0): vendor ID is Unity
*Mar 2 01:21:41.026: ISAKMP : Scanning profiles for xauth ...
*Mar 2 01:21:41.026: ISAKMP

0):Checking ISAKMP transform 1 against priority 5
policy
*Mar 2 01:21:41.026: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.026: ISAKMP: hash SHA
*Mar 2 01:21:41.026: ISAKMP: default group 2
*Mar 2 01:21:41.026: ISAKMP: auth XAUTHInitPreShared
*Mar 2 01:21:41.026: ISAKMP: life type in seconds
*Mar 2 01:21:41.026: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.026: ISAKMP: keylength of 256
*Mar 2 01:21:41.026: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.026: ISAKMP

0):atts are not acceptable. Next payload is 3
*Mar 2 01:21:41.026: ISAKMP

0):Checking ISAKMP transform 2 against priority 5
policy
*Mar 2 01:21:41.026: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.026: ISAKMP: hash MD5
*Mar 2 01:21:41.026: ISAKMP: default group 2
*Mar 2 01:21:41.026: ISAKMP: auth XAUTHInitPreShared
*Mar 2 01:21:41.026: ISAKMP: life type in seconds
*Mar 2 01:21:41.026: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.026: ISAKMP: keylength of 256
*Mar 2 01:21:41.026: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.026: ISAKMP

0):atts are not acceptable. Next payload is 3
*Mar 2 01:21:41.026: ISAKMP

0):Checking ISAKMP transform 3 against priority 5
policy
*Mar 2 01:21:41.026: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.026: ISAKMP: hash SHA
*Mar 2 01:21:41.026: ISAKMP: default group 2
*Mar 2 01:21:41.026: ISAKMP: auth pre-share
*Mar 2 01:21:41.026: ISAKMP: life type in seconds
*Mar 2 01:21:41.026: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.026: ISAKMP: keylength of 256
*Mar 2 01:21:41.030: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.030: ISAKMP

0):atts are not acceptable. Next payload is 3
*Mar 2 01:21:41.030: ISAKMP

0):Checking ISAKMP transform 4 against priority 5
policy
*Mar 2 01:21:41.030: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.030: ISAKMP: hash MD5
*Mar 2 01:21:41.030: ISAKMP: default group 2
*Mar 2 01:21:41.030: ISAKMP: auth pre-share
*Mar 2 01:21:41.030: ISAKMP: life type in seconds
*Mar 2 01:21:41.030: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.030: ISAKMP: keylength of 256
*Mar 2 01:21:41.030: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.030: ISAKMP

0):atts are not acceptable. Next payload is 3
*Mar 2 01:21:41.030: ISAKMP

0):Checking ISAKMP transform 5 against priority 5
policy
*Mar 2 01:21:41.030: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.030: ISAKMP: hash SHA
*Mar 2 01:21:41.030: ISAKMP: default group 2
*Mar 2 01:21:41.030: ISAKMP: auth XAUTHInitPreShared
*Mar 2 01:21:41.030: ISAKMP: life type in seconds
*Mar 2 01:21:41.030: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.030: ISAKMP: keylength of 128
*Mar 2 01:21:41.030: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.030: ISAKMP

0):atts are not acceptable. Next payload is 3
*Mar 2 01:21:41.030: ISAKMP

0):Checking ISAKMP transform 6 against priority 5
policy
*Mar 2 01:21:41.030: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.030: ISAKMP: hash MD5
*Mar 2 01:21:41.030: ISAKMP: default group 2
*Mar 2 01:21:41.030: ISAKMP: auth XAUTHInitPreShared
*Mar 2 01:21:41.030: ISAKMP: life type in seconds
*Mar 2 01:21:41.030: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.030: ISAKMP: keylength of 128
*Mar 2 01:21:41.030: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.030: ISAKMP

0):atts are not acceptable. Next payload is 3
*Mar 2 01:21:41.030: ISAKMP

0):Checking ISAKMP transform 7 against priority 5
policy
*Mar 2 01:21:41.030: ISAKMP: encryption AES-CBC
*Mar 2 01:21:41.030: ISAKMP: hash SHA
*Mar 2 01:21:41.030: ISAKMP: default group 2
*Mar 2 01:21:41.030: ISAKMP: auth pre-share
*Mar 2 01:21:41.030: ISAKMP: life type in seconds
*Mar 2 01:21:41.030: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Mar 2 01:21:41.030: ISAKMP: keylength of 128
*Mar 2 01:21:41.030: ISAKMP

0):Encryption algorithm offered does not match pol
icy!
*Mar 2 01:21:41.034: ISAKMP