You are on page 1of 4

10 common Cisco VPN problems and how to resolve them

This list is based on the article "Fix 10 common Cisco VPN problems." By Scott Lowe

Version 1.0 November 20, 2006

Cisco offers many ways to handle VPN connectivity, making troubleshooting and problem-solving a little tricky. From VPN capabilities included in some routers to the VPN services offered by PIX firewalls to the Cisco VPN Concentrator, each has its own quirks. Given the diversity of options, these tips won't necessarily pertain to every VPN configuration available from Cisco. However, they will give you a place to start as you work on fixing problems with your VPN.

A user running Internet Connection Sharing is having trouble installing the Cisco 3000 VPN client

This is an easy one to fix. The user needs to disable ICS on his or her machine before installing the VPN client. I recommend that the user replace ICS with a decent home router with a firewall. Note that this is not necessary if the VPN machine simply connects through another machine that's using ICS. To disable ICS, go to Start | Control Panel | Administrative Tools | Services | Internet Connection Sharing and disable the Load On Startup option. On a somewhat unrelated note, make sure users are also aware that the VPN client disables the XP welcome screen and Fast User Switching, which are commonly used on multiuser home machines. The old standby, [Ctrl][Alt][Delete], still works, though, and users will need to type their usernames and passwords instead of clicking a picture of a cat. (Note: Fast User Switching can be enabled by disabling the client's Start Before Login feature. But this could have its own problems, so I wouldn't recommend it unless you really, really need Fast User Switching.) One more thing regarding the client installCisco does not recommend installing multiple VPN clients on the same PC. If you have a problem and need to call support, uninstall other clients and test before making that call.

Logs indicate a problem with keys

If you're getting errors in your logs related to preshared keys, you may have mismatched keys on either end of the VPN connection. If this is the case, your logs may indicate that exchanges between the client and VPN server are fine well into the IKE main mode security associations. Some time after this part of the exchange, logs will indicate a problem with keys. On the concentrator, go to the Configuration | System | Tunneling Protocols | IPSec LAN-to-LAN option and select your IPSec configuration. In the Preshared Key field, enter your preshared key. On a Cisco PIX firewall used in conjunction with the concentrator, use the command isakmp key password address xx.xx.xx.xx netmask 255.255.255.255, where password is your preshared key. The key used in your concentrator and on your PIX should match exactly.

Users running firewall software are reporting errors when trying to connect to the VPN

Some ports need to be open in firewall software, such as BlackIce (BlackIce has other problems with regard to the Cisco VPN client, too. Refer to the client's release notes for more information), Zone Alarm, Symantec, and other Internet security programs for Windows, as well as ipchains and iptables on Linux machines. In general, if your users open the following ports in their software, you should see a stop to the complaints: UDP ports 500, 1000 and 10000 IP protocol 50 (ESP) TCP port configured for IPSec/TCP NAT-T port 4500 You may also have custom configured ports for IPSec/UDP and IPSec/TCP. Make sure the ports you configured are also open on the client software. Page 1
Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

10 common Cisco VPN problems and how to resolve them

Home VPN users complain that they cannot access other resources on their home network when the VPN connection is established

This generally happens as a result of split-tunneling being disabled. While split-tunneling can pose security risks, these risks can be mitigated to a point by having strong, enforced security policies in place and automatically pushed to the client upon connection (for example, a policy could require that current antivirus software be installed or that a firewall be present). On a PIX, use this command to enable split tunneling: vpngroup vpngroupname split-tunnel split_tunnel_acl You should have a corresponding access-list command that defines what will come through the encrypted tunnel and what will be sent out in the clear. For example, access-list split_tunnel_acl permit ip 10.0.0.0 255.255.0.0 any, or whatever your IP range is. On a Cisco Series 3000 VPN Concentrator, you need to tell the device what networks should be included over the encrypted tunnel. Go to Configuration | User Management | Base Group and, from the Client Config tab, choose the Only Tunnel Networks In The List option and create a network list of all of the networks at your site that should be covered by the VPN and choose this network list from the Split Tunneling Network List drop down box.

A user's remote network is using the same IP address range as the VPN server's local network (Client VPN release 4.6 with virtual adapter, Windows 2000/XP)

This is somewhat specific to these particular operating systems, but could be quite frustrating to troubleshoot. Version 4.6 of the Cisco VPN client tries to handle these kinds of IP address conflicts, but isn't always able to do so. In these cases, traffic that is supposed to be traversing the VPN tunnel stays local, due to the conflict. On the affected client, go to Start | Control Panel | Network And Dialup Connections | local adapter. Right-click on the adapter and choose Properties. From the Properties page, choose TCP/IP and click the Properties button. Now, click the Advanced option, find the Interface Metric option, and increase the number in the box by 1.This effectively tells your computer to use the local adapter second. The VPN adapter will probably have a metric of 1 (lower than this new metric), making it the first choice as a traffic destination.

Certain router/firmware combinations introduce client VPN connection problems

The Cisco VPN client has problems with some older (and sometimes newer) home routers, usually with specific firmware versions. If you have users with consistent connection problems, ask them to upgrade the firmware in their router, particularly if they have an older unit. Among the router models that are known to have problems with the Cisco client are: Linksys BEFW11S4 with firmware releases lower than 1.44 Asante FR3004 Cable/DSL Routers with firmware releases lower than 2.15 Nexland Cable/DSL Routers model ISB2LAN

If all else fails, have a spare router on hand to lend to a user to help narrow down the potential problems. Ultimately, the router may need to be replaced.

Page 2
Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

10 common Cisco VPN problems and how to resolve them

Users report that the client is terminating when they try to establish a connection

In this situation, users will see an error message is similar to VPN Connection terminated locally by the Client. Reason 403: Unable to contact the security gateway. This error can be caused by a couple of things: The user might have entered an incorrect group password The user may not have typed the right name or IP address for the remote VPN endpoint. The user may be having other problems with his Internet connection. Basically, for some reason, the IKE negotiation failed. Check the client logs, enabled by going to Log | Enable, and try to find errors that have Hash Verification Failed to try to further narrow down the problem.

You're having trouble establishing a VPN connection from behind a NAT device or to a VPN server behind a NAT device

This problem can run across all of Cisco's VPN hardware since it's inherent in the way that IPSec worked before the introduction of standards that allowed modification of packet headers during transmission. To correct this problem, enable NAT-Traversal (NAT-T) on your hardware and allow UDP port 4500 to go through your firewall. If you're using a PIX firewall as both your firewall and VPN endpoint, open port 4500 and enable NAT-Traversal in your configuration with the command isakmp nat-traversal 20, where 20 is the NAT keepalive time period. If you have a separate firewall and a Cisco VPN Concentrator, open up UDP port 4500 on your firewall with a destination of the concentrator. Then, on the concentrator, go to Configuration | Tunneling And Security | IPSec | NAT Transparency and check the IPSec Over NAT-T option. Further, make sure that any client that's in use on the user end also supports NAT-T.

Users successfully establish a VPN connection, but the connection periodically drops

Again, there are a number of places you can check to try to nail down this problem. First, verify that the user's computer did not go into standby mode, hibernate, or that a screen saver did not pop up. Standby and hibernation can interrupt your network connection when the VPN client expects a constant link to a VPN server. Your user may also have configured their machine to shut down a network adapter after a certain amount of time to save power. If wireless is in use, your user may have wandered to a location with a low (or nonexistent) wireless signal, and the VPN might have dropped as a result. Further, your user might have a bad network cable, a problem with the router or Internet connection, or any number of other physical connection problems. There have also been some reports that a VPN endpoint (PIX or 3000 Concentrator) that has exhausted its pool of IP addresses may also result in this error on the client, although I have personally never seen this.

10

A user reports that the machine is no longer "visible" on the local network, even when the VPN client is disabled

Other symptoms may include an inability for any other machines on the user's network to ping the VPN machine even though that machine is perfectly capable of seeing all other machines on the network. If this is the case, the user may have enabled the VPN client's built-in firewall. If this firewall is enabled, it will stay running, even when the client is not running. To change this, open the client and from the options page, deselect the check box next to the stateful firewall option.

Page 3
Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

10 common Cisco VPN problems and how to resolve them

Additional resources
TechRepublic's Downloads RSS Feed Sign up for TechRepublic's Downloads Weekly Update newsletter Sign up for our Cisco Routers and Switches newsletter Check out all of TechRepublic's free newsletters "Provide secure reliable VPN connections with IPSec authentication and authorization" (TechRepublic download) "Configure VPN 3000 concentrators to accept PPTP, L2TP/IPsec, and WebVPN remote access sessions" (TechRepublic download) "10 things you should know about troubleshooting VPN connections" (TechRepublic download)

Version history
Version: 1.0 Published: November 20, 2006

Tell us what you think


TechRepublic downloads are designed to help you get your job done as painlessly and effectively as possible. Because we're continually looking for ways to improve the usefulness of these tools, we need your feedback. Please take a minute to drop us a line and tell us how well this download worked for you and offer your suggestions for improvement. Thanks! The TechRepublic Downloads Team

Page 4
Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

You might also like