Firewall Wizards mailing list archives
Remote access VPN and Cisco PIX 515E connection problems
From: Prabhu Gurumurthy <pgurumu () gmail com>
Date: Thu, 30 Mar 2006 13:06:28 -0800
We have a Cisco PIX 515E configured as a VPN server. It runs 7.0(2), with 16 MB flash, 128MB RAM. Configuration for VPN is below: Problems that I am facing:Lot of VPN users who are using Cisco VPN client say that their session drops midway, when they have their session up and running. As you can see from the group-policy, there is no timeout set either for idle or for session. I asked my users about the network setup that they have at home and asked them to enable logging on their Cisco VPN client and send me the logs, which couple of them did. I have not attached any logs with this email, but I see only 2 things when the VPN session dies.
1. DEL_REASON_ADDRESS_CHANGE 2. DEL_REASON_PEER_NOT_RESPONDINGI know about DEL_REASON_ADDRESS_CHANGE, it means that either the, client address got changed somehow when it renewed it IP, or their wireless is flaky, I strongly suspect the latter.
When I googled DEL_REASON_PEER_NOT_RESPONDING, I got this linkhttps://access.llnl.gov/vpn/vpn3000-moreinfo.html of the many, which explains the error type. Other links also point to 1. as the possible scenario. Cisco TAC confirms that there is no apparent problem with my configuration. I have a separate network setup, where I have 2 laptops connecting over Linksys WAP11 Access point (remember it acts a just AP, it does not do DHCP or DNS or routing or firewalling) to the VPN and the connection has been up for more than 2 days as I type.
Most VPN users who are facing problems, are running MAC, not MBP just MAC 10.3.X and above.
BTW, Lan 2 Lan tunnel works like a charm, with no problems whatsoever, apart from some latency involved, but that understandable and it is variable as well.
I have also asked my users to test the VPN connection using wired connection, but some of them are reluctant to do so, their theory is that how come it was working with our previous VPN before. We used to have Cisco 2621XM with VPN module acting as a VPN server, before we got Cisco PIX 515E. I am kind of stumbled at this point. FWIW, many users do face this problem at all, infact they say that this VPN is better than before.
Any suggestion, related links, solutions will be very much appreciated. Thanks Prabhu Here is the configuration for remote access VPN and Lan to Lan VPN: ---------------- crypto ipsec transform-set GW_SET esp-3des esp-md5-hmac crypto ipsec transform-set RAVPN_SET esp-aes-256 esp-sha-hmac crypto ipsec transform-set VPN29_SET esp-aes-256 esp-sha-hmac crypto ipsec security-association lifetime seconds 3600 crypto ipsec df-bit clear-df dmz crypto ipsec df-bit clear-df outside crypto dynamic-map RA_MAP 1 set transform-set RAVPN_SET crypto dynamic-map RA_MAP 1 set security-association lifetime seconds 1800 crypto map VPN_MAP 1 match address SSN29 crypto map VPN_MAP 1 set pfs group5 crypto map VPN_MAP 1 set peer C501_2929 crypto map VPN_MAP 1 set transform-set VPN29_SET crypto map VPN_MAP 1 set nat-t-disable crypto map VPN_MAP 2 match address GW_VPN crypto map VPN_MAP 2 set pfs group1 crypto map VPN_MAP 2 set peer GW_014500FC94 crypto map VPN_MAP 2 set transform-set GW_SET crypto map VPN_MAP 2 set nat-t-disable crypto map VPN_MAP 65535 ipsec-isakmp dynamic RA_MAP crypto map VPN_MAP interface outside isakmp identity auto isakmp enable outside isakmp policy 1 authentication pre-share isakmp policy 1 encryption aes-256 isakmp policy 1 hash sha isakmp policy 1 group 2 isakmp policy 1 lifetime 1800 isakmp policy 2 authentication pre-share isakmp policy 2 encryption 3des isakmp policy 2 hash md5 isakmp policy 2 group 2 isakmp policy 2 lifetime 1800 ---------------------------------------------- Corresponding tunnel group information: tunnel-group X.X.X.X type ipsec-l2l tunnel-group X.X.X.X ipsec-attributes pre-shared-key * tunnel-group Y.Y.Y.Y type ipsec-l2l tunnel-group Y.Y.Y.Y ipsec-attributes pre-shared-key * tunnel-group SilverPix type ipsec-ra tunnel-group SilverPix general-attributes address-pool RAVPN_POOL authentication-server-group RADIUS LOCAL default-group-policy RAVPN_POLICY tunnel-group SilverPix ipsec-attributes pre-shared-key * ----------------------------------------------- Corresponding group policy information: group-policy RAVPN_POLICY internal group-policy RAVPN_POLICY attributes banner value Welcome to Silver Spring Networks! wins-server value SILVER_NS1 dns-server value SILVER_NS1 SILVER_NS2 dhcp-network-scope 10.206.0.0 vpn-idle-timeout none vpn-session-timeout none pfs enable ipsec-udp enable split-tunnel-policy tunnelspecified split-tunnel-network-list value RAVPN default-domain value silverspringnet.com ------------------------------------------------
Attachment:
pgurumu.vcf
Description:
Current thread:
- Remote access VPN and Cisco PIX 515E connection problems Prabhu Gurumurthy (Mar 31)