Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
3920
Views
0
Helpful
1
Replies

Error when VPN Client Tries To Connect To IOS Router VPN server

networkwise
Level 1
Level 1

‎02-22-2010 01:53 PM

I have three routers configured as HQ and two branches using DMVPN. Im routing between the sites usning eigrp all working fine.

I have configured Easy VPN also for VPN clients. When the client connects using the VPN client on an XP lapatop I recieve the error

"Secure VPN Connection Terminaed by Peer Reason 433"

I have run a number of debugs and Im able to authenticate via AAA using a local defined username and password. However after logging in I recieve the message on the client laptop. "Secure VPN Connection Terminaed by Peer Reason 433"

*************************When I connect from the client I recieve the following debug it looks like phase one passes

I recieve the following HQ router debug out put with Crypto ISAKMP debugging is on

*Feb 22 22:40:27.719: ISAKMP:(0):atts are acceptable. Next payload is 3
*Feb 22 22:40:27.719: ISAKMP:(0): processing KE payload. message ID = 0
*Feb 22 22:40:27.767: ISAKMP:(0): processing NONCE payload. message ID = 0
*Feb 22 22:40:27.771: ISAKMP:(0): vendor ID is NAT-T v2
*Feb 22 22:40:27.771: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
*Feb 22 22:40:27.771: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_AM_AAA_AWAIT

*Feb 22 22:40:27.771: ISAKMP:(1021): constructed NAT-T vendor-02 ID
*Feb 22 22:40:27.771: ISAKMP:(1021):SA is doing pre-shared key authentication plus XAUTH using id type ID_IPV4_ADDR
*Feb 22 22:40:27.775: ISAKMP (0:1021): ID payload
        next-payload : 10
        type         : 1
        address      : 50.50.50.3
        protocol     : 17
        port         : 0
        length       : 12
*Feb 22 22:40:27.775: ISAKMP:(1021):Total payload length: 12
*Feb 22 22:40:27.775: ISAKMP:(1021): sending packet to 10.10.20.103 my_port 500 peer_port 49827 (R) AG_INIT_EXCH
*Feb 22 22:40:27.775: ISAKMP:(1021):Sending an IKE IPv4 Packet.
*Feb 22 22:40:27.775: ISAKMP:(1021):Input = IKE_MESG_FROM_AAA, PRESHARED_KEY_REPLY
*Feb 22 22:40:27.775: ISAKMP:(1021):Old State = IKE_R_AM_AAA_AWAIT  New State = IKE_R_AM2

*Feb 22 22:40:27.791: ISAKMP (0:1021): received packet from 10.10.20.103 dport 500 sport 49827 Global (R) AG_INIT_EXCH
*Feb 22 22:40:27.791: ISAKMP:(1021): processing HASH payload. message ID = 0
*Feb 22 22:40:27.791: ISAKMP:(1021): processing NOTIFY INITIAL_CONTACT protocol 1
        spi 0, message ID = 0, sa = 46F1D818
*Feb 22 22:40:27.791: ISAKMP:received payload type 20
*Feb 22 22:40:27.791: ISAKMP:received payload type 20
*Feb 22 22:40:27.795: ISAKMP:(1021):SA authentication status:
        authenticated
*Feb 22 22:40:27.795: ISAKMP:(1021):SA has been authenticated with 10.10.20.103
*Feb 22 22:40:27.795: ISAKMP:(1021):SA authentication status:
        authenticated
*Feb 22 22:40:27.795: ISAKMP:(1021): Process initial contact,
bring down existing phase 1 and 2 SA's with local 50.50.50.3 remote 10.10.20.103 remote port 49827
*Feb 22 22:40:27.795: ISAKMP:(1021):returning IP addr to the address pool
*Feb 22 22:40:27.795: ISAKMP: Trying to insert a peer 50.50.50.3/10.10.20.103/49827/,  and inserted successfully 46F1DF6C.
*Feb 22 22:40:27.795: ISAKMP: set new node 1434433346 to CONF_XAUTH
*Feb 22 22:40:27.795: ISAKMP:(1021):Sending NOTIFY RESPONDER_LIFETIME protocol 1
        spi 1208117752, message ID = 1434433346
*Feb 22 22:40:27.795: ISAKMP:(1021): sending packet to 10.10.20.103 my_port 500 peer_port 49827 (R) QM_IDLE
*Feb 22 22:40:27.795: ISAKMP:(1021):Sending an IKE IPv4 Packet.
*Feb 22 22:40:27.795: ISAKMP:(1021):purging node 1434433346
*Feb 22 22:40:27.799: ISAKMP: Sending phase 1 responder lifetime 86400

*Feb 22 22:40:27.799: ISAKMP:(1021):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
*Feb 22 22:40:27.799: ISAKMP:(1021):Old State = IKE_R_AM2  New State = IKE_P1_COMPLETE

*Feb 22 22:40:27.799: ISAKMP:(1021):Need XAUTH
*Feb 22 22:40:27.799: ISAKMP: set new node -40414287 to CONF_XAUTH
*Feb 22 22:40:27.799: ISAKMP/xauth: request attribute XAUTH_USER_NAME_V2
*Feb 22 22:40:27.799: ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2
*Feb 22 22:40:27.799: ISAKMP:(1021): initiating peer config to 10.10.20.103. ID = -40414287
*Feb 22 22:40:27.799: ISAKMP:(1021): sending packet to 10.10.20.103 my_port 500 peer_port 49827 (R) CONF_XAUTH
*Feb 22 22:40:27.799: ISAKMP:(1021):Sending an IKE IPv4 Packet.
*Feb 22 22:40:27.803: ISAKMP:(1021):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Feb 22 22:40:27.803: ISAKMP:(1021):Old State = IKE_P1_COMPLETE  New State = IKE_XAUTH_REQ_SENT

*******************************************At this point I have not input my username or password on the VPN client.

*******************************************Below I enter my username and password andrewb and password.****************************************

lab-HQ-rtr#
*Feb 22 22:41:56.983: ISAKMP (0:1021): received packet from 10.10.20.103 dport 500 sport 49827 Global (R) CONF_XAUTH
*Feb 22 22:41:56.983: ISAKMP:(1021):processing transaction payload from 10.10.20.103. message ID = -40414287
*Feb 22 22:41:56.983: ISAKMP: Config payload REPLY
*Feb 22 22:41:56.983: ISAKMP/xauth: reply attribute XAUTH_USER_NAME_V2
*Feb 22 22:41:56.983: ISAKMP/xauth: reply attribute XAUTH_USER_PASSWORD_V2
*Feb 22 22:41:56.983: ISAKMP:(1021):deleting node -40414287 error FALSE reason "Done with xauth request/reply exchange"
*Feb 22 22:41:56.983: ISAKMP:(1021):Input = IKE_MESG_FROM_PEER, IKE_CFG_REPLY
*Feb 22 22:41:56.983: ISAKMP:(1021):Old State = IKE_XAUTH_REQ_SENT  New State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT

*Feb 22 22:41:56.987: %CRYPTO-6-VPN_TUNNEL_STATUS: (Server)  Authentication PASSED  User=andrewb  Group=tele-mobile  Client_p
ublic_addr=10.10.20.103  Server_public_addr=50.50.50.3
*Feb 22 22:41:56.987: ISAKMP: set new node 1065737635 to CONF_XAUTH
lab-HQ-rtr#
*Feb 22 22:41:56.987: ISAKMP:(1021): initiating peer config to 10.10.20.103. ID = 1065737635
*Feb 22 22:41:56.987: ISAKMP:(1021): sending packet to 10.10.20.103 my_port 500 peer_port 49827 (R) CONF_XAUTH
*Feb 22 22:41:56.987: ISAKMP:(1021):Sending an IKE IPv4 Packet.
*Feb 22 22:41:56.987: ISAKMP:(1021):Input = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN
*Feb 22 22:41:56.987: ISAKMP:(1021):Old State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT  New State = IKE_XAUTH_SET_SENT

*Feb 22 22:41:56.995: ISAKMP (0:1021): received packet from 10.10.20.103 dport 500 sport 49827 Global (R) CONF_XAUTH
*Feb 22 22:41:56.995: ISAKMP:(1021):processing transaction payload from 10.10.20.103. message ID = 1065737635
*Feb 22 22:41:56.995: ISAKMP: Config payload ACK
*Feb 22 22:41:56.995: ISAKMP:(1021):       (blank) XAUTH ACK Processed
*Feb 22 22:41:56.995: ISAKMP:(1021):deleting node 1065737635 error FALSE reason "Transaction mode done"
*Feb 22 22:41:56.995: ISAKMP:(1021):Input = IKE_MESG_FROM_PEER, IKE_CFG_ACK
*Feb 22 22:41:56.995: ISAKMP:(1021):Old State = IKE_XAUTH_SET_SENT  New State = IKE_P1_COMPLETE

*Feb 22 22:41:56.995: ISAKMP:(1021):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Feb 22 22:41:56.995: ISAKMP:(1021):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

*Feb 22 22:41:56.999: ISAKMP:(1021):peer does not do paranoid keepalives.

*Feb 22 22:41:56.999: ISAKMP:(1021):deleting SA reason "P1 delete notify (in)" state (R) QM_IDLE       (peer 10.10.20.103)
*Feb 22 22:41:56.999: ISAKMP: set new node 1307928607 to QM_IDLE
*Feb 22 22:41:56.999: ISAKMP:(1021): sending packet to 10.10.20.103 my_port 500 peer_port 49827 (R) QM_IDLE
*Feb 22 22:41:56.999: ISAKMP:(1021):Sending an IKE IPv4 Packet.
*Feb 22 22:41:56.999: ISAKMP:(1021):purging node 1307928607
*Feb 22 22:41:57.003: ISAKMP:(1021):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Feb 22 22:41:57.003: ISAKMP:(1021):Old State = IKE_P1_COMPLETE  New State = IKE_DEST_SA

*Feb 22 22:41:57.003: ISAKMP:(1021):deleting SA reason "P1 delete notify (in)" state (R) QM_IDLE       (peer 10.10.20.103)
*Feb 22 22:41:57.003: ISAKMP:(0):Can't decrement IKE Call Admission Control stat incoming_active since it's already 0.
*Feb 22 22:41:57.003: ISAKMP: Unlocking peer struct 0x46F1DF6C for isadb_mark_sa_deleted(), count 0
*Feb 22 22:41:57.003: ISAKMP: Deleting peer node by peer_reap for 10.10.20.103: 46F1DF6C
*Feb 22 22:41:57.003: ISAKMP:(1021):deleting node -40414287 error FALSE reason "IKE deleted"
*Feb 22 22:41:57.003: ISAKMP:(1021):deleting node 1065737635 error FALSE reason "IKE deleted"
*Feb 22 22:41:57.003: ISAKMP:(1021):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Feb 22 22:41:57.007: ISAKMP:(1021):Old State = IKE_DEST_SA  New State = IKE_DEST_SA

*Feb 22 22:41:57.007: ISAKMP (0:1021): received packet from 10.10.20.103 dport 500 sport 49827 Global (R) MM_NO_STATE
lab-HQ-rtr#
lab-HQ-rtr#

And thats as far as I get, this is a 2811 router that I have DMVPN configured on already. Im trying to ass VPN also for client access.

I have included my config as an attachment. I noticed that I could not add any tunnel config under the virtual template. However when I added the interface I was able to add it as a tunnel.

lab-HQ-rtr(config)#interface Virtual-Template2 type tunnel

!
interface Virtual-Template2
description Dynamic Virtual Tunnel For EZVPN Teleworkers
ip unnumbered Loopback0
ip nat inside
ip virtual-reassembly

cant add tunnel commands here not sure if thats a problem????

Any insight into this would appreciated.

Andy

Labels:
61350-ezvpn with DMVPN config.txt.zip
0 Helpful
1 Reply 1

networkwise
Level 1
Level 1

‎02-23-2010 02:10 PM

This problem is now resolved. It turned out to be a virtual template problem. I was unable to create a "interface Virtual-Template2 type tunnel"

I could create a interface Virtual-Template2 without the tunnel part.

When I tried to add the lines under the template config:

tunnel mode ipsec ipv4***********Could not add these
tunnel protection ipsec profile tele-mobile***********Could not add these

I could not add them, tunnel was not an option, thats why the VPN clinet was receiving the log in error. I was missing the

tunnel mode ipsec ipv4

tunnel protection ipsec profile tele-mobile

I had created an "interface Virtual-Template2" earlier with no type tunnel at the end of the line.

Even though I deleted the interface to try and add the interface "Virtual-Template2 type tunnel" the router still seemed to hod it in its config of the

interface Virtual-Template2 config it didnt show up in the running config. It looked like it had gone.

I had to reboot the router then add the interface Virtual-Template2 type tunnel the router took the command then I could add the

tunnel mode ipsec ipv4

tunnel protection ipsec profile tele-mobile

This fixed the problem I could then dial in using the VPN client and was assigned an IP address with no error message..

Andy

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents