Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

new VPN tunnel won't work

we setup an IPsec VPN tunnel in ASDM 7.1 (for ASA 5515-X version 9.11) through a wizard... it was working fine for a while and then connection could no longer be established. we made a new tunnel through the wizard again and deleted the old tunnel. it still won't work. we are getting a:

Secure VPN Connection terminated locally by the Client. Reason 412: The remote peer is no longer responding. (this is on VPN Client Version 5.0.07.0290)

I've already turned off Windows Firewall.

Need your expertise! Thank you so much!

the "show run" config is attached for your reference with the public IP edited out!

 

2 REPLIES

Hi Everose, You have created

Hi Everose,

 

You have created multiple tunnel which is confusing in troubleshooting. You can refer the below mentioned sample configs to understand and configure for your network.

 

Configuration Examples for Remote Access IPsec VPNs

The following example shows how to configure a remote access IPsec/IKEv1 VPN:


 

 

hostname(config)# interface ethernet0
hostname(config-if)# ip address 10.10.4.200 255.255.0.0
hostname(config-if)# nameif outside
hostname(config-if)# no shutdown
hostname(config)# crypto ikev1 policy 1
hostname(config-ikev1-policy)# authentication pre-share
hostname(config-ikev1-policy)# encryption 3des
hostname(config-ikev1-policy)# hash sha
hostname(config-ikev1-policy)# group 2
hostname(config-ikev1-policy)# lifetime 43200
hostname(config)# crypto ikev1 outside
hostname(config)# ip local pool testpool 192.168.0.10-192.168.0.15
hostname(config)# username testuser password 12345678
hostname(config)# crypto ipsec ikev1 transform set FirstSet esp-3des esp-md5-hmac
hostname(config)# tunnel-group testgroup type remote-access
hostname(config)# tunnel-group testgroup general-attributes
hostname(config-general)# address-pool testpool
hostname(config)# tunnel-group testgroup ipsec-attributes
hostname(config-ipsec)# ikev1 pre-shared-key 44kkaol59636jnfx
hostname(config)# crypto dynamic-map dyn1 1 set ikev1 transform-set FirstSet
hostname(config)# crypto dynamic-map dyn1 1 set reverse-route
hostname(config)# crypto map mymap 1 ipsec-isakmp dynamic dyn1
hostname(config)# crypto map mymap interface outside
hostname(config)# write memory
 

The following example shows how to configure a remote access IPsec/IKEv2 VPN:


 

 

hostname(config)# interface ethernet0
hostname(config-if)# ip address 10.10.4.200 255.255.0.0
hostname(config-if)# nameif outside
hostname(config-if)# no shutdown
hostname(config)# crypto ikev2 policy 1
hostname(config-ikev2-policy)# group 2
hostname(config-ikev2-policy)# integrity sha
hostname(config-ikev2-policy)# lifetime 43200
hostname(config-ikev2-policy)# prf sha
hostname(config)# crypto ikev2 outside
hostname(config)# ip local pool testpool 192.168.0.10-192.168.0.15
hostname(config)# username testuser password 12345678
hostname(config)# crypto ipsec ikev2 ipsec-proposal FirstSet
hostname(config-ipsec-proposal)# protocol esp encryption 3des aes
hostname(config)# tunnel-group testgroup type remote-access
hostname(config)# tunnel-group testgroup general-attributes
hostname(config-general)# address-pool testpool
hostname(config)# tunnel-group testgroup webvpn-attributes
hostname(config-webvpn)# authentication aaa certificate
hostname(config)# crypto dynamic-map dyn1 1 set ikev2 ipsec-proposal FirstSet
hostname(config)# crypto dynamic-map dyn1 1 set reverse-route
hostname(config)# crypto map mymap 1 ipsec-isakmp dynamic dyn1
hostname(config)# crypto map mymap interface outside
hostname(config)# write memory
 
 
Apart from these there are some other reasons behind for getting such error.
 
  • The user is behind a firewall that is blocking ports UDP 4500/500 and/or ESP.
  • The VPN client is using connecting on TCP and the default TCP port 10000 for NAT is blocked.
  • The internet connection is not stable and some packets are not reaching the ASA or the replies from the ASA aren’t getting to the client, hence the client thinks the server is no longer available.
  • The VPN client is behind a NAT device and the ASA doesn’t have NAT-T enabled. In this case the user will not be able to send or receive traffic at all. It will be able to connect but that’s all. After some time the software client deletes the VPN tunnel.

Suggested solutions:

  • If you are using wireless, try to connect with cable
  • Turn your firewall off, then test the connection to see whether the problem still occurs. If it doesn’t then you can turn your firewall back on, add exception rules for port 500, port 4500 and the ESP protocol in your firewall
  • Turn on NAT-T/TCP in your profile ( remember to unblock port 10000 in your firewall)
  • Edit your profile with your editor and change ForceKeepAlive=0 to 1

Hope this helps.

Regards

Karthik

VIP Green

Have you checked the logs on

Have you checked the logs on the ASA while you are trying to connect to the VPN?

Could you also debug the VPN connection when trying to connect.

debug crypto ikev1 ipsec sa

debug crypto isakmp sa

Although these commands should not have an impact on your ASA's performance, it is always best to do these types of tests in a service window.

--

Please select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
265
Views
0
Helpful
2
Replies
CreatePlease login to create content