Cisco VPN - Connected but unable to access sites

Hi Nick,

Is this over WiFi or Edge/3G? If WiFi, what ip address range are you using on your local network and what addresses does your VPN connection provide? Is this IPSec or L2TP/PPTP?

-Henry Stukenborg

We have exactly same problem. We use Cisco VPN to access. I am able to access Exchange server when I connect to wireless router that is inside the private network. At the same time when I use 3G and connect to the VPN server (connection works fine, according to VPN logs I complete Phase1 properly), I am unable to access resources behind the VPN (including Exchange). We tried to troubleshoot this with IT guys and it looks like it gives an error connected to some "attribute 5". This error shows up in the VPN logs during authentication.

I checked online - there are a lot of discussions about people being able to connect to the VPN, but not able to go through the VPN itself to private resources.

We have exactly same problem. We use Cisco VPN to access. I am able to access Exchange server when I connect to wireless router that is inside the private network. At the same time when I use 3G and connect to the VPN server (connection works fine, according to VPN logs I complete Phase1 properly), I am unable to access resources behind the VPN (including Exchange). We tried to troubleshoot this with IT guys and it looks like it gives an error connected to some "attribute 5". This error shows up in the VPN logs during authentication.

I checked online - there are a lot of discussions about people being able to connect to the VPN, but not able to go through the VPN itself to private resources.

I have the same issue. I filed a bug, radar number: 6073855 for this problem. Please feel free to file a second bug, and if you can link it to this one, that would be great. The more noise we can make around this issue the better.

Cisco ASA and iphone IPSEC using pre-shared key: I get "connected" but cannot access anything. ISAKMP phase 1 completes fine, but phase 2 never does, so I am puzzled why it says "connected!" - I tweaked the ipsec transform sets and the dynamic mapping, swithed from tunnel-mode to transport mode, enabled NAT-T, since IPSEC-over-TCP is not supported, but still no luck. The regular Cisco IPSEC-VPN client works fine. I checked with Cisco and they said they got the following to work (I'm in the process of tweaking my setup to match this one, but still no luck)- let me know if you get it to work:

crypto ipsec transform-set AES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA mode transport
crypto ipsec transform-set IPSEC_AES256 esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyno 10 set transform-set AES-SHA IPSEC_AES256
crypto dynamic-map dyno 10 set security-association lifetime seconds 28800
crypto dynamic-map dyno 10 set security-association lifetime kilobytes 4608000
crypto map vpn 20 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isamkp policy 20
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
...

When I do connect to my Cisco 1801, i repeatedly get the following log messages:

01:14:40: IPSEC(validate proposalrequest): proposal part #1,
(key eng. msg.) INBOUND local= 91.41.160.32, remote= 80.187.106.1,
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
remote_proxy= 192.168.113.9/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-aes 256 esp-sha-hmac (Tunnel-UDP),
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0

01:14:40: IPSEC(crypto ipsec_processproposal): transform proposal not supported for identity:
{esp-aes 256 esp-sha-hmac }


The AES-thing really confuses me because I intentionally use 3des because the iPhone is told to use 3des?!

IT IS WORKING FOR ME!!

I use a Cisco 1801 Router

crypto isakmp policy 1
encr aes
authentication pre-share
group 2

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes 256 esp-sha-hmac

crypto isakmp client configuration group Group1
key MOSTSECRETKEY
dns XXX.XXX.XXX.XXX
domain pierburg
pool SDM POOL1
save-password
max-logins 1
banner ^C It works ^C
!

crypto dynamic-map SDM DYNMAP1 1
set transform-set ESP-AES-256-SHA
reverse-route
!

interface Dialer1
crypto map SDM CMAP1


The iPhone is using AES.

I got it working too!

I'm using AES-256 + SHA + pre-share. This was a good opportunity to cleanup old IKE policies. I'll try using certs next...

Working with a PIX. Tried it, but no luck. Can you give more details? Still get the "Enter your user authentication" dialog... 😟

TIA,

Joe