Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

VPN Client Connectivity Problems

I am trying to connect to our network via VPN 3000 Client Dialer. I have no problems connecting from any location except for one site. And I can take the same equipment from the one site and it will work at any other site so I believe my problem is site specific and not a concentrator or software problem.

The only site specific items are a DSL connection through Verizon and the ISP .

One workstation cannot connect at all. The other workstation gets a connection only about 75% of the time.

I can get onto the internet on both workstations without a problem. I can always ping the VPN server.

I've tried changing the MTU down to as low as 300. My connection is through a Fujitsu speedport DSL modem. I do use a Linksys BEFSR41 router, but I have the same problems when I connect directly from the DSL modem.

I've used my log viewer and filtered the IKE to high.

The following is the log on a good connection:

1 13:54:30.075 06/11/02 Sev=Info/6 IKE/0x6300003B

Attempting to establish a connection with 64.65.113.146.

2 13:54:30.135 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID, VID, VID) to 64.65.113.146

3 13:54:30.405 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

4 13:54:30.405 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

5 13:54:30.405 06/11/02 Sev=Info/5 IKE/0x63000059

Vendor ID payload = 12F5F28C457168A9702D9FE274CC0100

6 13:54:30.405 06/11/02 Sev=Info/5 IKE/0x63000001

Peer is a Cisco-Unity compliant peer

7 13:54:30.405 06/11/02 Sev=Info/5 IKE/0x63000059

Vendor ID payload = AFCAD71368A1F1C96B8696FC77570100

8 13:54:30.405 06/11/02 Sev=Info/5 IKE/0x63000001

Peer supports DPD

9 13:54:30.405 06/11/02 Sev=Info/5 IKE/0x63000059

Vendor ID payload = CFE5E554E5BA09A82BF49BB3FC2A434B

10 13:54:30.425 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) to 64.65.113.146

11 13:54:33.459 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

12 13:54:33.459 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 64.65.113.146

13 13:54:33.459 06/11/02 Sev=Info/5 IKE/0x63000044

RESPONDER-LIFETIME notify has value of 86400 seconds

14 13:54:33.459 06/11/02 Sev=Info/5 IKE/0x63000046

This SA has already been alive for 3 seconds, setting expiry to 86397 seconds from now

15 13:54:33.459 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

16 13:54:33.459 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 64.65.113.146

17 13:54:38.476 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 64.65.113.146

18 13:54:38.816 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

19 13:54:38.816 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 64.65.113.146

20 13:54:38.826 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 64.65.113.146

21 13:54:38.917 06/11/02 Sev=Info/5 IKE/0x6300005D

Client sending a firewall request to concentrator

22 13:54:38.917 06/11/02 Sev=Info/5 IKE/0x6300005C

Firewall Policy: Product=Cisco Integrated Client, Capability= (Centralized Policy Push).

23 13:54:38.917 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 64.65.113.146

24 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

25 13:54:39.117 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 64.65.113.146

26 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 192.168.2.9

27 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 192.168.1.11

28 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 192.168.1.13

29 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = aritapoulson.com

30 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

31 13:54:39.117 06/11/02 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #1

subnet = 192.168.1.0

mask = 255.255.255.0

protocol = 0

src port = 0

dest port=0

32 13:54:39.137 06/11/02 Sev=Info/5 IKE/0x63000055

Received a key request from Driver for IP address 64.65.113.146, GW IP = 64.65.113.146

33 13:54:39.137 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 64.65.113.146

34 13:54:40.238 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

35 13:54:40.238 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 64.65.113.146

36 13:54:40.238 06/11/02 Sev=Info/5 IKE/0x63000044

RESPONDER-LIFETIME notify has value of 28800 seconds

37 13:54:40.238 06/11/02 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 4608000 kb

38 13:54:40.238 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH) to 64.65.113.146

39 13:54:40.238 06/11/02 Sev=Info/5 IKE/0x63000058

Loading IPsec SA (Message ID = 0x634A97CD OUTBOUND SPI = 0x48109C01 INBOUND SPI = 0x1A37E4EC)

40 13:54:40.238 06/11/02 Sev=Info/5 IKE/0x63000025

Loaded OUTBOUND ESP SPI: 0x48109C01

41 13:54:40.238 06/11/02 Sev=Info/5 IKE/0x63000026

Loaded INBOUND ESP SPI: 0x1A37E4EC

42 13:54:40.579 06/11/02 Sev=Info/5 IKE/0x63000055

Received a key request from Driver for IP address 192.168.1.11, GW IP = 64.65.113.146

43 13:54:40.579 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 64.65.113.146

44 13:54:44.284 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

45 13:54:44.284 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 64.65.113.146

46 13:54:44.284 06/11/02 Sev=Info/5 IKE/0x63000044

RESPONDER-LIFETIME notify has value of 28800 seconds

47 13:54:44.284 06/11/02 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 4608000 kb

48 13:54:44.284 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH) to 64.65.113.146

49 13:54:44.284 06/11/02 Sev=Info/5 IKE/0x63000058

Loading IPsec SA (Message ID = 0x75B7F909 OUTBOUND SPI = 0xA3D4CF8E INBOUND SPI = 0xB89A1AAB)

50 13:54:44.284 06/11/02 Sev=Info/5 IKE/0x63000025

Loaded OUTBOUND ESP SPI: 0xA3D4CF8E

51 13:54:44.284 06/11/02 Sev=Info/5 IKE/0x63000026

Loaded INBOUND ESP SPI: 0xB89A1AAB

52 13:54:48.930 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

53 13:54:48.930 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:INVALID_SPI) from 64.65.113.146

54 13:54:48.930 06/11/02 Sev=Info/5 IKE/0x63000018

Deleting IPsec SA: (OUTBOUND SPI = A3D4CF8E INBOUND SPI = B89A1AAB)

55 13:54:49.311 06/11/02 Sev=Info/5 IKE/0x63000055

Received a key request from Driver for IP address 192.168.1.11, GW IP = 64.65.113.146

56 13:54:49.311 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 64.65.113.146

57 13:54:50.562 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

58 13:54:50.562 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 64.65.113.146

59 13:54:50.562 06/11/02 Sev=Info/5 IKE/0x63000044

RESPONDER-LIFETIME notify has value of 28800 seconds

60 13:54:50.562 06/11/02 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 4608000 kb

61 13:54:50.562 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH) to 64.65.113.146

62 13:54:50.562 06/11/02 Sev=Info/5 IKE/0x63000058

Loading IPsec SA (Message ID = 0x4B5752BD OUTBOUND SPI = 0xF4753EF8 INBOUND SPI = 0x79BE5B87)

63 13:54:50.562 06/11/02 Sev=Info/5 IKE/0x63000025

Loaded OUTBOUND ESP SPI: 0xF4753EF8

64 13:54:50.562 06/11/02 Sev=Info/5 IKE/0x63000026

Loaded INBOUND ESP SPI: 0x79BE5B87

65 13:54:54.377 06/11/02 Sev=Info/6 IKE/0x6300003D

Sending DPD request to 64.65.113.146, seq# = 1852414286

66 13:54:54.377 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 64.65.113.146

67 13:54:55.258 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

68 13:54:55.258 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 64.65.113.146

69 13:54:55.258 06/11/02 Sev=Info/5 IKE/0x6300003F

Received DPD ACK from 64.65.113.146, seq# received = 1852414286, seq# expected = 1852414286

70 14:00:26.422 06/11/02 Sev=Info/6 IKE/0x6300003D

Sending DPD request to 64.65.113.146, seq# = 1852414287

71 14:00:26.422 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 64.65.113.146

72 14:00:26.462 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

73 14:00:26.462 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 64.65.113.146

74 14:00:26.462 06/11/02 Sev=Info/5 IKE/0x6300003F

Received DPD ACK from 64.65.113.146, seq# received = 1852414287, seq# expected = 1852414287

75 14:08:30.079 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

76 14:08:30.079 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

77 14:08:30.079 06/11/02 Sev=Info/4 IKE/0x63000057

Received an ISAKMP message for a non-active SA

78 14:08:35.076 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

79 14:08:35.076 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

80 14:08:35.076 06/11/02 Sev=Info/4 IKE/0x63000057

Received an ISAKMP message for a non-active SA

81 14:08:49.295 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

82 14:08:49.295 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

83 14:08:49.295 06/11/02 Sev=Info/4 IKE/0x63000057

Received an ISAKMP message for a non-active SA

84 14:08:52.279 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

85 14:08:52.279 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

86 14:08:52.279 06/11/02 Sev=Info/4 IKE/0x63000057

Received an ISAKMP message for a non-active SA

87 14:09:04.345 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

88 14:09:04.345 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

89 14:09:04.345 06/11/02 Sev=Info/4 IKE/0x63000057

Received an ISAKMP message for a non-active SA

90 14:09:07.319 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

91 14:09:07.319 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, KE, ID, NON, HASH) from 64.65.113.146

92 14:09:07.319 06/11/02 Sev=Info/4 IKE/0x63000057

Received an ISAKMP message for a non-active SA

93 14:15:31.893 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

94 14:15:31.893 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) from 64.65.113.146

95 14:15:31.893 06/11/02 Sev=Info/5 IKE/0x63000040

Received DPD request from 64.65.113.146, new seq# = 611704812, last seq# = 0

96 14:15:31.893 06/11/02 Sev=Info/6 IKE/0x6300003E

Sending DPD ACK to 64.65.113.146, seq# = 611704812

97 14:15:31.893 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) to 64.65.113.146

98 14:20:32.265 06/11/02 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = 64.65.113.146

99 14:20:32.265 06/11/02 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) from 64.65.113.146

100 14:20:32.265 06/11/02 Sev=Info/5 IKE/0x63000040

Received DPD request from 64.65.113.146, new seq# = 611704813, last seq# = 611704812

101 14:20:32.265 06/11/02 Sev=Info/6 IKE/0x6300003E

Sending DPD ACK to 64.65.113.146, seq# = 611704813

102 14:20:32.265 06/11/02 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) to 64.65.113.146

When I can't connect I get either a "CM peer not responding" after an "exceeded 3 IKE SA negotiation retransmits"

Any help would be greatly appreciated.

2 REPLIES
New Member

Re: VPN Client Connectivity Problems

Sounds to me like you have a signaling problem with the ISP, though the trace looks relatively clean. The fact you can take the same equipment to another site and it works well solidifies this. Definitely make sure you don’t have some sort of layer 2 issues at your local DSLAM, which can cause all sorts of anomalies.

New Member

Re: VPN Client Connectivity Problems

Hi,

I am not exactly aware of how you are connecting to the intenet and re-distributing it over your LAN , one thing i can say ..

Since you are using a DSL modem to connect to the ISP it gets one public IP address (correct me i i am wrong ) this is probaly NAT ed into your private IP address. if your DSL modem does not support NAT ing then this public IP address can be assigned to one internal IP and the moment the second user connects the first user shall be disconnected.

How are the other locations connected. .... ?

can contact me at gouthamb@hotmail.com

Cheers,

360
Views
0
Helpful
2
Replies
CreatePlease to create content