[Wildfire General] akopov:
Hi,

I'm facing a strange problem with my Wildfire when trying to connect to my office VPN. The connection type is L2TP/IPSec with a pre-shared key (PSK), and with my desktop client (CISCO VPN client particularly) it works seamlessly.

The credentials that I have are passphrase which I enter in the pre-shared key field, and username with password which I enter in the corresponding dialog.

L2TP Secret checkbox is unchecked.

I'm sure that I enter all the strings without any typos as I have performed many attempts and was extremely careful. But the result is always the same - my Wildfire tells me that it "Can't connect" with no other details. So the only details of what's going on is server-side log, and a snippet of it is quoted at the end of this message.

I hoped that the problem will go away with Froyo, but it is still here after upgrade to Android 2.2.

Can anybody give me an advice of that? I have no idea if this can be avoided or not.

Thank you.

P.S. The server-side log is quoted below (real IPs are replaced with 111.111.111.111, 222.222.222.222 etc):

Dec 17 10:21:44 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 352
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing SA payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, Oakley proposal is acceptable
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received NAT-Traversal RFC VID
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received NAT-Traversal ver 02 VID
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received Fragmentation VID
Dec 17 10:21:44 111.111.111.111 %ASA-7-715064: IP = 178.100.105.187, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False
Dec 17 10:21:44 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing IKE SA payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715028: IP = 178.100.105.187, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 2
Dec 17 10:21:44 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing ISAKMP SA payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing Fragmentation VID + extended capabilities payload
Dec 17 10:21:44 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:21:45 111.111.111.111 %ASA-4-106023: Deny tcp src outside:222.222.222.222/223 dst inside:123.123.123.123/222 by access-group "outside_access_in" [0x0, 0x0]
Dec 17 10:21:52 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:00 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:08 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:10 111.111.111.111 %ASA-4-106023: Deny tcp src outside:184.154.126.182/38680 dst inside:84.22.185.71/113 by access-group "outside_access_in" [0x0, 0x0]
Dec 17 10:22:13 111.111.111.111 %ASA-5-713201: IP = 178.100.105.187, Duplicate Phase 1 packet detected. Retransmitting last packet.
Dec 17 10:22:13 111.111.111.111 %ASA-6-713905: IP = 178.100.105.187, P1 Retransmit msg dispatched to MM FSM
Dec 17 10:22:13 111.111.111.111 %ASA-7-715065: IP = 178.100.105.187, IKE MM Responder FSM error history (struct &0x42196e8) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_RESEND_MSG-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent
Dec 17 10:22:13 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, IKE SA MM:65aed466 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Dec 17 10:22:13 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, sending delete/delete with reason message
Dec 17 10:22:13 111.111.111.111 %ASA-3-713902: IP = 178.100.105.187, Removing peer from peer table failed, no match!
Dec 17 10:22:13 111.111.111.111 %ASA-4-713903: IP = 178.100.105.187, Error: Unable to remove PeerTblEntry
Dec 17 10:22:13 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 352
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing SA payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, Oakley proposal is acceptable
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received NAT-Traversal RFC VID
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received NAT-Traversal ver 02 VID
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received Fragmentation VID
Dec 17 10:22:13 111.111.111.111 %ASA-7-715064: IP = 178.100.105.187, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False
Dec 17 10:22:13 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing IKE SA payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715028: IP = 178.100.105.187, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 2
Dec 17 10:22:13 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing ISAKMP SA payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing Fragmentation VID + extended capabilities payload
Dec 17 10:22:13 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:13 111.111.111.111 %ASA-5-713201: IP = 178.100.105.187, Duplicate Phase 1 packet detected. Retransmitting last packet.
Dec 17 10:22:13 111.111.111.111 %ASA-6-713905: IP = 178.100.105.187, P1 Retransmit msg dispatched to MM FSM
Dec 17 10:22:13 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:13 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:13 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:13 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:13 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:13 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:21 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:21 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:29 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:22:30 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside
Dec 17 10:22:37 111.111.111.111 %ASA-7-715065: IP = 178.100.105.187, IKE MM Responder FSM error history (struct &0x421a130) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent
Dec 17 10:22:37 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, IKE SA MM:ac345d79 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Dec 17 10:22:37 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, sending delete/delete with reason message
Dec 17 10:22:37 111.111.111.111 %ASA-3-713902: IP = 178.100.105.187, Removing peer from peer table failed, no match!
Dec 17 10:22:37 111.111.111.111 %ASA-4-713903: IP = 178.100.105.187, Error: Unable to remove PeerTblEntry
Dec 17 10:22:39 111.111.111.111 %ASA-4-106023: Deny tcp src outside:200.234.30.120/4261 dst inside:84.22.185.71/445 by access-group "outside_access_in" [0x0, 0x0]
Dec 17 10:22:42 111.111.111.111 %ASA-4-106023: Deny tcp src outside:200.234.30.120/4261 dst inside:84.22.185.71/445 by access-group "outside_access_in" [0x0, 0x0]
Dec 17 10:24:21 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 352
Dec 17 10:24:21 111.111.111.111 %ASA-7-713906: IP = 178.100.105.187, Oakley proposal is acceptable
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing SA payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received NAT-Traversal RFC VID
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received NAT-Traversal ver 02 VID
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing VID payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715049: IP = 178.100.105.187, Received Fragmentation VID
Dec 17 10:24:21 111.111.111.111 %ASA-7-715064: IP = 178.100.105.187, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False
Dec 17 10:24:21 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing IKE SA payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715028: IP = 178.100.105.187, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 2
Dec 17 10:24:21 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing ISAKMP SA payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing Fragmentation VID + extended capabilities payload
Dec 17 10:24:21 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Dec 17 10:24:22 111.111.111.111 %ASA-7-713236: IP = 178.100.105.187, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180
Dec 17 10:24:22 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing ke payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing ISA_KE payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715047: IP = 178.100.105.187, processing nonce payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing ke payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing nonce payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing Cisco Unity VID payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing xauth V6 VID payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715048: IP = 178.100.105.187, Send IOS VID
Dec 17 10:24:22 111.111.111.111 %ASA-7-715038: IP = 178.100.105.187, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Dec 17 10:24:22 111.111.111.111 %ASA-7-715046: IP = 178.100.105.187, constructing VID payload
Dec 17 10:24:22 111.111.111.111 %ASA-7-715048: IP = 178.100.105.187, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Dec 17 10:24:22 111.111.111.111 %ASA-4-713903: Group = 178.100.105.187, IP = 178.100.105.187, Can't find a valid tunnel group, aborting...!
Dec 17 10:24:22 111.111.111.111 %ASA-7-715065: Group = 178.100.105.187, IP = 178.100.105.187, IKE MM Responder FSM error history (struct &0x41d98b0) <state>, <event>: MM_DONE, EV_ERROR-->MM_BLD_MSG4, EV_GROUP_LOOKUP-->MM_BLD_MSG4, EV_TEST_CERT-->MM_BLD_MSG4, EV_BLD_MSG4-->MM_BLD_MSG4, EV_TEST_CRACK-->MM_BLD_MSG4, EV_SECRET_KEY_OK-->MM_BLD_MSG4, NullEvent-->MM_BLD_MSG4, EV_GEN_SECRET_KEY
Dec 17 10:24:22 111.111.111.111 %ASA-7-713906: Group = 178.100.105.187, IP = 178.100.105.187, IKE SA MM:9b56f8f3 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Dec 17 10:24:22 111.111.111.111 %ASA-7-713906: Group = 178.100.105.187, IP = 178.100.105.187, sending delete/delete with reason message
Dec 17 10:24:22 111.111.111.111 %ASA-3-713902: Group = 178.100.105.187, IP = 178.100.105.187, Removing peer from peer table failed, no match!
Dec 17 10:24:22 111.111.111.111 %ASA-4-713903: Group = 178.100.105.187, IP = 178.100.105.187, Error: Unable to remove PeerTblEntry
Dec 17 10:24:32 111.111.111.111 %ASA-4-713903: IP = 178.100.105.187, Header invalid, missing SA payload! (next payload = 4)
Dec 17 10:24:32 111.111.111.111 %ASA-7-713236: IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 68
Dec 17 10:24:43 111.111.111.111 %ASA-4-713903: IP = 178.100.105.187, Header invalid, missing SA payload! (next payload = 4)
Dec 17 10:24:43 111.111.111.111 %ASA-7-713236: IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 68
Dec 17 10:24:51 111.111.111.111 %ASA-4-713903: IP = 178.100.105.187, Header invalid, missing SA payload! (next payload = 4)
Dec 17 10:24:51 111.111.111.111 %ASA-7-713236: IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 68
Dec 17 10:24:54 111.111.111.111 %ASA-3-313001: Denied ICMP type=3, code=3 from 178.100.105.187 on interface outside