VPN connections issues

[sonic8or]

I've been working on a 501 just for training purposes and have been dealing with it for 2 weeks now trying to get remote VPN access to work. I've checked threads and clicked on every Google result. I've even tried copying setups and I still cannot get remote connections to work and now believe I'm just making a mess of things. Any insight would be appreciated at this point. Here's my setup at home:

Cable modem --> PIX --> 3550 switch

I have a dynamic public IP I'm dealing with

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password *** encrypted
passwd *** encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name **.**.**.** Outside_IP
access-list no_nat permit ip any 192.168.100.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.100.0 255.255.255.128 192
.168.101.0 255.255.255.240
access-list inside_outbound_nat0_acl permit tcp any any eq 10000
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.100.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_Pool 192.168.101.0-192.168.101.5
pdm location 192.168.100.2 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no_nat
nat (inside) 1 192.168.100.0 255.255.255.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server Running protocol tacacs+
http server enable
http 192.168.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt route dnat
crypto ipsec transform-set TRANSFORM esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 86400 kilobytes 50000
crypto dynamic-map outside_dyn_map 20 set transform-set TRANSFORM
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds
28800 kilobytes 4608000
crypto map CRYPT_MAP 20 ipsec-isakmp dynamic outside_dyn_map
crypto map CRYPT_MAP interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 255.255.255.255
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup Remote address-pool Remote_Pool
vpngroup Remote dns-server 209.18.47.61 209.18.47.62
vpngroup Remote default-domain pixremote.com
vpngroup Remote split-tunnel inside_outbound_nat0_acl
vpngroup Remote idle-time 1800
vpngroup Remote password ********
telnet 192.168.100.100 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
vpdn username ***** password *********
dhcpd address 192.168.100.32-192.168.100.63 inside
dhcpd dns 209.18.47.61 209.18.47.62
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

This is the log I'm getting in the logs for the VPN client:

44 00:40:51.203 04/10/10 Sev=Info/4 CM/0x63100002
Begin connection process

45 00:40:51.203 04/10/10 Sev=Info/4 CM/0x63100004
Establish secure connection

46 00:40:51.203 04/10/10 Sev=Info/4 CM/0x63100024
Attempt connection with server "**.**.**.**"

47 00:40:51.203 04/10/10 Sev=Info/6 CM/0x6310002F
Allocated local TCP port 1309 for TCP connection.

48 00:40:51.312 04/10/10 Sev=Info/4 IPSEC/0x63700008
IPSec driver successfully started

49 00:40:51.312 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

50 00:40:51.312 04/10/10 Sev=Info/6 IPSEC/0x63700020
TCP SYN sent to **.**.**.**, src port 1309, dst port 10000

51 00:40:56.312 04/10/10 Sev=Info/6 IPSEC/0x63700020
TCP SYN sent to **.**.**.**, src port 1309, dst port 10000

52 00:41:01.812 04/10/10 Sev=Info/6 IPSEC/0x63700020
TCP SYN sent to **.**.**.**, src port 1309, dst port 10000

53 00:41:06.812 04/10/10 Sev=Info/6 IPSEC/0x63700020
TCP SYN sent to **.**.**.**, src port 1309, dst port 10000

54 00:41:11.312 04/10/10 Sev=Info/4 CM/0x6310002A
Unable to establish TCP connection on port 10000 with server "**.**.**.*"

55 00:41:11.312 04/10/10 Sev=Info/5 CM/0x63100025
Initializing CVPNDrv

56 00:41:11.312 04/10/10 Sev=Info/4 CM/0x6310002D
Resetting TCP connection on port 10000

57 00:41:11.328 04/10/10 Sev=Info/6 CM/0x63100030
Removed local TCP port 1309 for TCP connection.

58 00:41:11.328 04/10/10 Sev=Info/6 CM/0x63100046
Set tunnel established flag in registry to 0.

59 00:41:11.828 04/10/10 Sev=Info/6 IPSEC/0x63700023
TCP RST sent to **.**.**.**, src port 1309, dst port 10000

60 00:41:11.828 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

61 00:41:11.828 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

62 00:41:11.828 04/10/10 Sev=Info/4 IPSEC/0x6370000A
IPSec driver successfully stopped

 

[unclerico]

it looks like you have the VPN Client software set to use transparent tunneling using TCP/10000. Have you tried to use UDP instead?

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[sonic8or]

Sorry, forgot to post the UDP log as well.

Just to add, there's nothing configured other than factory defaults on the 3550 in case any one is wondering. Not that there'd be much it can do based on where I placed it...


1 16:28:52.671 04/10/10 Sev=Info/4 PPP/0x63200015
Processing enumerate phone book entries command

2 16:28:53.031 04/10/10 Sev=Info/4 PPP/0x6320000D
Retrieved 3 dial entries

3 16:29:00.062 04/10/10 Sev=Info/4 CM/0x63100002
Begin connection process

4 16:29:00.093 04/10/10 Sev=Info/4 CM/0x63100004
Establish secure connection

5 16:29:00.093 04/10/10 Sev=Info/4 CM/0x63100024
Attempt connection with server "xx.xx.xx.xx"

6 16:29:00.140 04/10/10 Sev=Info/6 IKE/0x6300003B
Attempting to establish a connection with xx.xx.xx.xx.

7 16:29:00.171 04/10/10 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to xx.xx.xx.xx

8 16:29:00.187 04/10/10 Sev=Info/4 IPSEC/0x63700008
IPSec driver successfully started

9 16:29:00.187 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

10 16:29:00.187 04/10/10 Sev=Info/4 IPSEC/0x6370000D
Key(s) deleted by Interface (192.168.5.101)

11 16:29:05.640 04/10/10 Sev=Info/4 IKE/0x63000021
Retransmitting last packet!

12 16:29:05.640 04/10/10 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to xx.xx.xx.xx

13 16:29:10.640 04/10/10 Sev=Info/4 IKE/0x63000021
Retransmitting last packet!

14 16:29:10.640 04/10/10 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to xx.xx.xx.xx

15 16:29:15.640 04/10/10 Sev=Info/4 IKE/0x63000021
Retransmitting last packet!

16 16:29:15.640 04/10/10 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to xx.xx.xx.xx

17 16:29:20.640 04/10/10 Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion (I_Cookie=6647B6D580881047 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING

18 16:29:21.140 04/10/10 Sev=Info/4 IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=6647B6D580881047 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING

19 16:29:21.140 04/10/10 Sev=Info/4 CM/0x63100014
Unable to establish Phase 1 SA with server "xx.xx.xx.xx" because of "DEL_REASON_PEER_NOT_RESPONDING"

20 16:29:21.140 04/10/10 Sev=Info/5 CM/0x63100025
Initializing CVPNDrv

21 16:29:21.156 04/10/10 Sev=Info/6 CM/0x63100046
Set tunnel established flag in registry to 0.

22 16:29:21.156 04/10/10 Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection

23 16:29:21.171 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

24 16:29:21.171 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

25 16:29:21.171 04/10/10 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

26 16:29:21.171 04/10/10 Sev=Info/4 IPSEC/0x6370000A
IPSec driver successfully stopped

 

[North323]

all you see are syn packets. looks like the peer is not repsonding. what is the remote side? what does that config look like? there is not return traffic.

 

[sonic8or]

All right. After endless config changes and testing, I figured the problem. I can establish connection using 3des and md5; but, if i enable 3des and sha, I cannot get a connection started. Is there something else I need to be doing to allow 3des and sha?

 

[sonic8or]

If anyone cares or finds this having the same problem as I was, I figured it out. For some reason I can only get the VPN connection to work with a certain combination of 3DES encryption and MD5 hash.