Cisco IPSec cannot connect to server

Question

Level 1

0 points

Cisco IPSec cannot connect to server

Hey folks,

Running 10.6.2 and tried to connect to my works VPN on my mac, but all I get is the message "The VPN server did not respond. Verify the server address and try reconnecting."

I have verified my IP address in the server address field and it appears correct. I can even ping the IP address from a terminal with no problems.
I have tried it both as the name and the actual number IP address with the same result.

I'm fairly certain all other details of my username, pwd, grp name and shared secret are correct. I am not entering any options under the advanced section for items like search domain and dns servers.

I am sitting behind a linksys WRT54G box, but interestingly enough I can connect through wifi with my iphone 3GS, and my windoze XP laptop using the cisco vpn client software. So it would seem that my router is behaving okay.

My mac firewall is turned off. I have other co-workers VPNing in with Snow Leopard since the Cisco VPN support was added.

I'm at a loss as to what to try next since it seems like it should just work.

Thanks.

iMac, Mac OS X (10.6.2)

Posted on Dec 4, 2009 5:59 PM

Reply

Answer 1

PVZ

Level 1

0 points

Dec 5, 2009 2:28 PM in response to thebruce69

I am in the same boat as you. I have been struggling with this for some time now, in both 10.6.1 and 10.6.2 (never tried it in 10.6.0).

I can ping the server but the OS X VPN client refuses to see the server via hostname nor IP address.

I asked an Apple Genius about this and he blamed it on my router. However, my iPhone is able to connect to the same VPN server behind the same router.

I have seen other threads on this issue, but never a clear solution. Has anyone been able to solve this problem?

Reply

Answer 2

MOVA

Level 1

0 points

Dec 7, 2009 12:40 PM in response to thebruce69

Similar problem here and no answer yet. I can connect my VPN at most locations (home, some wifi spots), but some places (some wifi spots, some client sites), it won't connect. Any guidance would be much appreciated.

Help!

Reply

Answer 3

direwolf8

Level 4

1,286 points

Dec 7, 2009 2:17 PM in response to MOVA

Double NAT'ting will kill a lot of VPN's. When you're in a hotspot or using a corporate Wi-Fi network there's a good chance you're being NAT'ted twice.

Reply

Answer 4

MOVA

Level 1

0 points

Dec 9, 2009 11:41 AM in response to direwolf8

Thanks for the response. I have no idea what that means though. Anything I can do on my end to make sure I am not NAT'ing twice?

Reply

Answer 5

thebruce69 Author

Level 1

0 points

Dec 15, 2009 6:44 AM in response to PVZ

A couple of days ago I connected my mac directly to the cable modem, and still exactly the same problem as before. So its definitely not the router.

Reply

Answer 6

direwolf8

Level 4

1,286 points

Dec 15, 2009 10:08 AM in response to MOVA

No, it's really part of the network architecture. For example: You have a cable "modem" that uses NAT to translate its IP address. Then your local router serves you a NAT'd address. You're double NAT'd and a lot of VPN clients won't work. One solution would be to use an outside non-Nat'd address, but you may not have that ability on someone else's network.

Reply

Answer 7

thebruce69 Author

Level 1

0 points

Dec 17, 2009 6:49 PM in response to thebruce69

I'm finally able to connect to my works VPN - although I turned off the firewall in system preferences, the ipfw firewall was blocking my vpn access.

When I first got my Mac I'd used a tool called 'NoobProof' under some default configuration, and some time later removed the app, not realising it had added some rules to ipfw permanently.

Once I removed these rules from ipfw, hey presto working VPN.

I used this command to list the rules I had, and I could see a bunch of ports being blocked.

% sudo ipfw list - to view any rules you might have set up

I then ran this command to clear all but the default which essentially opened up everything.

% sudo ipfw flush - this is what I used to clear the rules I'd set so long ago

Reply