Newsgroup: it.comp.reti.cisco
Titolo: Problemi con connessioni VPN Cisco

Ciao a tutti
Ho una problema con una connessione VPN Cisco.
Le mie impostazioni sono:
S.O. win xp pro service pack 2
I.E. 6.0
Firewall disattivato
Cisco VPN Client 4.6
Impostazioni Cisco (che mi sono state fornite tramite un file di
configurazione)
Transport- Enable Transparent Tunneling
IPSecover TCP TCP port 10000
Allow Lan Access
La connessione avviene tramite pagina web, che inizialmente richiede
l'installazione di un ocx (VPN.ocx)
Dopo il login sulla pagina, non riesce a connettersi ,va in timeout e
mi chiede di effettuare nuovamente il login
Ho appena cambaito computer e nel vecchio PC(stessa configurazione)
tutto funzionava regolarmente.
Gradirei qualche consiglio su cosa fare per capire da cosa dipende
tutto questo.
Grazie a tutti.


cosa c'e' dall'altra parte (lato server)?
Al server arriva la tua richiesta?
se si, perche' il server  l'abbatte? (vedere sui log)
se no, l'ip del server inserito sul client  e' corretto?
ciao M.

 On Fri, 21 Mar 2008 23:01:28 -0700 (PDT), 
elisacarl...@gmail.com

Ciao Max
L'ip del server è corretto, poichè il file mi è stato fornito
dall'azienda.
Non so cosa arriva  al server, ma loro non sono molto collaborativi e
sostengono che sia un problema di client.
Come posso fare ad escludere almeno questo punto con assoluta
certezza? C'è un modo per fare un test di collaudo da qualche parte
per dimostrare così che il mio client in altri contesti funziona?
Grezie e saluti

Prova a disabilitare il transparent tunnelling... 

per dimostrare cosě che il mio client in altri contesti >funziona?
Fare un test verso qualche altro apparato sarebbe una buona idea, peccato 
che pochi sarebbero disposti a dare accesso alla propria vpn ad uno 
sconosciuto, anche solo per un test.
In alternativa potresti attivare il log sul client (log - log settings e 
metti tutto ad high) e poi mandare il file di log (log - log window) dopo un 
paio di tentativi di connessione alla ditta e se vuoi anche qui.
Ciao,
        Tosh. 

         Tosh.
Ciao Tosh
Ti ringrazio per l'indicazione
Ecco il file log
Cisco Systems VPN Client Version 4.6.02.0011
Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 5.1.2600 Service Pack 2
26     15:35:50.343  03/25/08  Sev=Info/4	CLI/0x63900002
Started vpnclient:
Cisco Systems VPN Client Version 4.6.02.0011
Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 5.1.2600 Service Pack 2
27     15:35:50.359  03/25/08  Sev=Info/4	CM/0x63100002
Begin connection process
28     15:35:50.375  03/25/08  Sev=Info/4	CVPND/0xE3400001
Microsoft IPSec Policy Agent service stopped successfully
29     15:35:50.375  03/25/08  Sev=Info/4	CM/0x63100004
Establish secure connection using Ethernet
30     15:35:50.375  03/25/08  Sev=Info/4	CM/0x63100024
Attempt connection with server "195.8.15.55"
31     15:35:50.375  03/25/08  Sev=Info/6	CM/0x6310002F
Allocated local TCP port 1056 for TCP connection.
32     15:35:50.671  03/25/08  Sev=Info/4	IPSEC/0x63700008
IPSec driver successfully started
33     15:35:50.687  03/25/08  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
34     15:35:50.687  03/25/08  Sev=Info/6	IPSEC/0x6370002B
Sent 10 packets, 0 were fragmented.
35     15:35:50.687  03/25/08  Sev=Info/6	IPSEC/0x6370001F
TCP SYN sent to 195.8.15.55, src port 1056, dst port 10000
36     15:35:50.687  03/25/08  Sev=Info/6	IPSEC/0x6370001C
TCP SYN-ACK received from 195.8.15.55, src port 10000, dst port 1056
37     15:35:50.687  03/25/08  Sev=Info/6	IPSEC/0x63700020
TCP ACK sent to 195.8.15.55, src port 1056, dst port 10000
38     15:35:50.687  03/25/08  Sev=Info/4	CM/0x63100029
TCP connection established on port 10000 with server "195.8.15.55"
39     15:35:51.171  03/25/08  Sev=Info/4	CM/0x63100024
Attempt connection with server "195.8.15.55"
40     15:35:51.171  03/25/08  Sev=Info/6	IKE/0x6300003B
Attempting to establish a connection with 195.8.15.55.
41     15:35:51.171  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd),
VID(Unity)) to 195.8.15.55
42     15:35:51.671  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
43     15:35:51.828  03/25/08  Sev=Info/5	IKE/0x6300002F
Received ISAKMP packet: peer = 195.8.15.55
44     15:35:51.828  03/25/08  Sev=Info/4	IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity),
VID(Xauth), VID(dpd), VID(Frag), VID(?)) from 195.8.15.55
45     15:35:51.828  03/25/08  Sev=Info/5	IKE/0x63000001
Peer is a Cisco-Unity compliant peer
46     15:35:51.828  03/25/08  Sev=Info/5	IKE/0x63000001
Peer supports XAUTH
47     15:35:51.828  03/25/08  Sev=Info/5	IKE/0x63000001
Peer supports DPD
48     15:35:51.828  03/25/08  Sev=Info/6	IKE/0x63000001
IOS Vendor ID Contruction successful
49     15:35:51.828  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT,
VID(?), VID(Unity)) to 195.8.15.55
50     15:35:51.828  03/25/08  Sev=Info/4	IKE/0x63000083
IKE Port in use - Local Port =  0x01F4, Remote Port = 0x01F4
51     15:35:51.828  03/25/08  Sev=Info/4	CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated
IKE SA in the system
52     15:35:52.171  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
53     15:35:52.421  03/25/08  Sev=Info/5	IKE/0x6300002F
Received ISAKMP packet: peer = 195.8.15.55
54     15:35:52.421  03/25/08  Sev=Info/4	IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 195.8.15.55
55     15:35:52.421  03/25/08  Sev=Info/4	CM/0x63100015
Launch xAuth application
56     15:35:52.437  03/25/08  Sev=Info/4	CM/0x63100017
xAuth application returned
57     15:35:52.437  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 195.8.15.55
58     15:35:52.671  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
59     15:35:53.031  03/25/08  Sev=Info/5	IKE/0x6300002F
Received ISAKMP packet: peer = 195.8.15.55
60     15:35:53.031  03/25/08  Sev=Info/4	IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 195.8.15.55
61     15:35:53.031  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 195.8.15.55
62     15:35:53.031  03/25/08  Sev=Info/4	CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated
IKE SA in the system
63     15:35:53.093  03/25/08  Sev=Info/5	IKE/0x6300005E
Client sending a firewall request to concentrator
64     15:35:53.093  03/25/08  Sev=Info/5	IKE/0x6300005D
Firewall Policy: Product=Cisco Systems Integrated Client, Capability=
(Centralized Protection Policy).
65     15:35:53.093  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 195.8.15.55
66     15:35:53.203  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
67     15:35:53.203  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
68     15:35:58.171  03/25/08  Sev=Info/4	IKE/0x63000021
Retransmitting last packet!
69     15:35:58.171  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(Retransmission) to 195.8.15.55
70     15:35:58.171  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
71     15:36:03.171  03/25/08  Sev=Info/4	IKE/0x63000021
Retransmitting last packet!
72     15:36:03.171  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(Retransmission) to 195.8.15.55
73     15:36:03.171  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
74     15:36:08.171  03/25/08  Sev=Info/4	IKE/0x63000021
Retransmitting last packet!
75     15:36:08.171  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(Retransmission) to 195.8.15.55
76     15:36:08.171  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
77     15:36:13.171  03/25/08  Sev=Info/4	IKE/0x6300002D
Phase-2 retransmission count exceeded: MsgID=25AC7E7D
78     15:36:13.171  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 195.8.15.55
79     15:36:13.171  03/25/08  Sev=Info/6	IKE/0x6300003D
Sending DPD request to 195.8.15.55, our seq# = 2358087483
80     15:36:13.171  03/25/08  Sev=Info/4	IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=D99AAF564ACEB88E
R_Cookie=3860D85EE0C7D0CC) reason = DEL_REASON_IKE_NEG_FAILED
81     15:36:13.171  03/25/08  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 195.8.15.55
82     15:36:13.171  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
83     15:36:13.171  03/25/08  Sev=Warning/2	IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
84     15:36:16.171  03/25/08  Sev=Info/4	IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=D99AAF564ACEB88E
R_Cookie=3860D85EE0C7D0CC) reason = DEL_REASON_IKE_NEG_FAILED
85     15:36:16.171  03/25/08  Sev=Info/4	CM/0x6310000F
Phase 1 SA deleted before Mode Config is completed cause by
"DEL_REASON_IKE_NEG_FAILED".  0 Crypto Active IKE SA, 0 User
Authenticated IKE SA in the system
86     15:36:16.171  03/25/08  Sev=Info/5	CM/0x63100025
Initializing CVPNDrv
87     15:36:16.171  03/25/08  Sev=Info/4	CM/0x6310002D
Resetting TCP connection on port 10000
88     15:36:16.171  03/25/08  Sev=Info/6	CM/0x63100030
Removed local TCP port 1056 for TCP connection.
89     15:36:16.171  03/25/08  Sev=Info/4	IKE/0x63000001
IKE received signal to terminate VPN connection
90     15:36:16.187  03/25/08  Sev=Info/4	IKE/0x63000086
Microsoft IPSec Policy Agent service started successfully
91     15:36:16.718  03/25/08  Sev=Info/6	IPSEC/0x63700022
TCP RST sent to 195.8.15.55, src port 1056, dst port 10000
92     15:36:16.718  03/25/08  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
93     15:36:16.718  03/25/08  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
94     15:36:16.718  03/25/08  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
95     15:36:16.718  03/25/08  Sev=Info/4	IPSEC/0x6370000A
IPSec driver successfully stopped

42     15:35:51.671  03/25/08  Sev=Warning/2 IPSEC/0x6370001E
Unexpected TCP control packet received from 195.8.15.55, src port
10000, dst port 1056, flags 10h
Sembrerebbe che il tuo client sia configurato per fare ipsec over tcp e che 
il server per qualche motivo non lo gestisca o comunque non si capiscano, 
tant'è che la fase 1 viene terminata correttamente ma non parte la fase 2, 
hai provato a disattivare l'opzione "ipsec over tcp" nel menu a tendina 
"transport" e lasciare attivo solo "ipsec over udp"?
Ciao,
        Tosh. 


Grazie Tosh
Adesso é andata (almeno per il momento e spero che non risucceda
qualche problema)
Saluti