Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN client error 422, when using wireless

I installed the Cisco VPN client version on a fresh install of WinXP/SP2 and when the PC is connected via ethernet to my DSL router, I can VPN just fine. When I disconnect from ethernet and use wireless to the DSL router, within seconds of brining up the VPN tunnel it is torn down with the dreaded 422 error "Secure VPN connection terminated locally by the Client. Reason 422:Lost contact with the security gateway. Check your network connection"

The client log shows the underlying IP address changes after Address watch is initiated, to the IP address that our headend concentrator gives out to VPN clients. Then the errors start to show up in the log like:

87 22:08:53.234 03/26/08 Sev=Warning/3 IKE/0xE3000069

Failed to send 76 bytes to (the IP of out headend concentrator), error = 0xFFFFFFF0

88 22:08:53.234 03/26/08 Sev=Info/5 IKE/0x63000018

Deleting IPsec SA: (OUTBOUND SPI = A553FFB INBOUND SPI = 574F7608)

89 22:08:53.234 03/26/08 Sev=Info/4 IKE/0x63000049

Discarding IPsec SA negotiation, MsgID=17610B7E

90 22:08:53.234 03/26/08 Sev=Info/4 IKE/0x63000017

Marking IKE SA for deletion (I_Cookie=6777C38CD571D27F R_Cookie=7F54F6FE73061972) reason = DEL_REASON_ADDRESS_CHANGE

...then lots of errors in log as phase I, keys and everything else is deleted.

This is repeatable every time I load the VPN client while I'm using wireless. The wireless adapter is a Realtek USB adapter. I've googled error 422 and other people are getting the same problem, but there is no solution, and most cases are when users are on Windows Vista.

Is this a known Cisco problem and is there a fix for it?

New Member

Re: VPN client error 422, when using wireless

Is there a firmware upgrade available for your router? Sometimes it's usefull to enable the "IPSec/VPN passthrough" option on your router.

And, if configured on the concentrator, you may enable nat-traversal, udp or tcp encapsulation for the vpn traffic in the vpn client.