Hello,
I have a strange problem with the SSL VPN for the phones. It is working but the phone displays " VPN Authentication Failed". To log in I need to press retry button 2-5 times on the phone.
Setup looks as follows :
CUCM version - 8.0.3a
2801 router as a gatway - IOS 151-4.M2
Phone 7945 - firmware 9-2-1S
Gateway config:
crypto pki trustpoint test
fqdn test.com
subject-name cn=test.com
revocation-check none
rsakeypair test
!
crypto pki certificate chain test
certificate self-signed 02
308205BA 308203A2 A0030201 02020102 300D0609 2A864886 F70D0101 05050030
.....
!
ip local pool sslvpn 192.168.50.2 192.168.50.100
!
webvpn gateway sslvpn
ip address 192.168.21.50 port 443
ssl trustpoint test
inservice
!
webvpn install svc flash:/webvpn/anyconnect-dart-win-2.5.2019-k9.pkg sequence 1
!
webvpn context sslvpn
ssl authenticate verify all
!
!
policy group sslvpn
functions svc-enabled
svc address-pool "sslvpn"
svc default-domain "test.local"
svc keep-client-installed
svc dns-server primary 192.168.20.11
svc dns-server secondary 192.168.20.12
svc dtls
default-group-policy sslvpn
aaa authentication list default
gateway sslvpn
inservice
CUCM configuration according to :
https://supportforums.cisco.com/docs/DOC-12173
I have tried different things without any change to the problem :
- different certificates
- IOS version 151-3.T2
- changing timeouts on CUCM (Fail to Connect) and ssl vpn timeouts on the router
- changed aaa to use local database instead of RADIUS
- turned off Host ID Check on CUCM
- moved gateway to a public ip address (no static NAT)
- also tried ip address as an url instead of domain name
What really bothers me is that it is working but users need to retry connection a few times. Annyconnect client on windows is working without any problems.
I have enabled logging for the webvpn.
Unsuccessful connection log (VPN authentication failed on the phone) :
Nov 10 09:49:34.162: %SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: sslvpn i_vrf: 0 f_vrf: 0 status: SSL/TLS connection successful with remote at 46.64.24.155:52944
Nov 10 09:49:34.386: %SSLVPN-5-HTTP_REQUEST_NOT_AUTHORIZED: vw_ctx: sslvpn vw_gw: sslvpn remote_ip: 46.64.24.155 status: HTTP request without login cookie resource: /
Nov 10 09:49:34.414: %SSLVPN-5-SSL_TLS_ERROR: vw_ctx: sslvpn vw_gw: sslvpn i_vrf: 0 f_vrf: 0 status: SSL/TLS connection error with remote at 46.64.24.155:52944
Nov 10 09:49:39.570: %SSLVPN-5-LOGIN_AUTH_PASSED: vw_ctx: sslvpn vw_gw: sslvpn remote_ip: 46.64.24.155 user_name: lukasz, Authentication successful, user logged in
Successful connection :
Nov 10 09:51:08.607: %SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: sslvpn i_vrf: 0 f_vrf: 0 status: SSL/TLS connection successful with remote at 46.64.24.155:53168
Nov 10 09:51:08.831: %SSLVPN-5-HTTP_REQUEST_NOT_AUTHORIZED: vw_ctx: sslvpn vw_gw: sslvpn remote_ip: 46.64.24.155 status: HTTP request without login cookie resource: /
Nov 10 09:51:08.859: %SSLVPN-5-SSL_TLS_ERROR: vw_ctx: sslvpn vw_gw: sslvpn i_vrf: 0 f_vrf: 0 status: SSL/TLS connection error with remote at 46.64.24.155:53168
Nov 10 09:51:13.815: %SSLVPN-5-LOGIN_AUTH_PASSED: vw_ctx: sslvpn vw_gw: sslvpn remote_ip: 46.64.24.155 user_name: lukasz, Authentication successful, user logged in
Logs look excatly the same.
I will appreciate any help or guidance.
Thanks
Lukasz
