With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.
The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community
Your Input Matters Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.
If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.
I have a PIX 515E Unrestricted License located at my collocation facility. I have remote access IPSec set up on this firewall and we use the Cisco Systems VPN Client ver. 4.8.01.0300. I have no problems connecting and establishing my tunnel. The problem is that anytime I am idle for more than just a few minutes my connection drops. For me this is not a problem because when I have my tunnel open I am usually actively working throgh an RDP session, there is enough activity to keep the tunnel alive when I work this way, in fact I have never had an active tunnel drop on me. There are a few other remote workers who have some Oracle tools loaded on a work laptop, when they work from home they are often just trying to monitor the state of some of our databases. This connection drops on my DBA constantly. At this point my only working work-around is to have him constantly ping a server behind my firewall (ping 192.168.xxx.xxx - t), this pings a server's internal IP address once every second and keeps the tunnel active for as long as needed. I really don't like this workaround and am trying to fix my config so that this idle drop issue goes away.
(if i missed anything pertinent in this config let me know and I'll add more information)
I was also tring to find a way to initate a keep alive from the client side as well. I found a document that stated I could edit the C:\Program Files\Cisco Systems\VPN Client\profiles\Profile_Name.pcf with wordpad. Changing the line that stated ForceKeepAlives=0 to =1 was supposed to activate the client keep alive. There was no such line in my config file so I added a ForceKeepAlives=1 statement to the end of my config and restarted the Cisco Software. This did not seem to help at all.
I have some debug logging on my firewall, when I connect from my client I see the following output from the CLI interface of my PIX:
ISAKMP: extended auth pre-share (init) ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 256 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 2 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash MD5 ISAKMP: default group 2 ISAKMP: extended auth pre-share (init) ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 256 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 3 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash SHA ISAKMP: default group 2 ISAKMP: auth pre-share ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 256 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 4 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash MD5 ISAKMP: default group 2 ISAKMP: auth pre-share ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 256 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 5 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash SHA ISAKMP: default group 2 ISAKMP: extended auth pre-share (init) ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 128 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 6 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash MD5 ISAKMP: default group 2 ISAKMP: extended auth pre-share (init) ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 128 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 7 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash SHA ISAKMP: default group 2 ISAKMP: auth pre-share ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 128 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 8 against priority 10 policy ISAKMP: encryption AES-CBC ISAKMP: hash MD5 ISAKMP: default group 2 ISAKMP: auth pre-share ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP: keylength of 128 ISAKMP (0): atts are not acceptable. Next payload is 3 ISAKMP (0): Checking ISAKMP transform 9 against priority 10 policy ISAKMP: encryption 3DES-CBC ISAKMP: hash SHA ISAKMP: default group 2 ISAKMP: extended auth pre-share (init) ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9b ISAKMP (0): atts are not acceptable. crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 OAK_AG exchange ISAKMP (0): processing HASH payload. message ID = 0 ISAKMP (0): processing NOTIFY payload 24578 protocol 1 spi 0, message ID = 0 ISAKMP (0): processing notify INITIAL_CONTACTIPSEC(key_engine): got a queue event... IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP IPSEC(key_engine_delete_sas): delete all SAs shared with 67.90.66.14 ISADB: reaper checking SA 0x133bb3c, conn_id = 0 ISAKMP (0): processing vendor id payload ISAKMP (0): speaking to another IOS box! ISAKMP (0): processing vendor id payload ISAKMP (0): speaking to a Unity client ISAKMP (0): SA has been authenticated ISAKMP: Created a peer struct for 67.90.66.14, peer port 62465 return status is IKMP_NO_ERROR ISAKMP (0): sending phase 1 RESPONDER_LIFETIME notify ISAKMP (0): sending NOTIFY message 24576 protocol 1 VPN Peer: ISAKMP: Added new peer: ip:67.90.66.14/500 Total VPN Peers:1 VPN Peer: ISAKMP: Peer ip:67.90.66.14/500 Ref cnt incremented to:1 Total VPN Pee rs:1 ISAKMP: peer is a remote access client crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 ISAKMP_TRANSACTION exchange ISAKMP (0:0): processing transaction payload from 67.90.66.14. message ID = 17382092 ISAKMP: Config payload CFG_REQUEST ISAKMP (0:0): checking request: ISAKMP: attribute IP4_ADDRESS (1) ISAKMP: attribute IP4_NETMASK (2) ISAKMP: attribute IP4_DNS (3) ISAKMP: attribute IP4_NBNS (4) ISAKMP: attribute ADDRESS_EXPIRY (5) Unsupported Attr: 5 ISAKMP: attribute UNKNOWN (28672) Unsupported Attr: 28672 ISAKMP: attribute UNKNOWN (28673) Unsupported Attr: 28673 ISAKMP: attribute ALT_DEF_DOMAIN (28674) ISAKMP: attribute ALT_SPLIT_INCLUDE (28676) ISAKMP: attribute ALT_SPLITDNS_NAME (28675) ISAKMP: attribute ALT_PFS (28679) ISAKMP: attribute UNKNOWN (28683) Unsupported Attr: 28683 ISAKMP: attribute ALT_BACKUP_SERVERS (28681) ISAKMP: attribute APPLICATION_VERSION (7) ISAKMP: attribute UNKNOWN (28680) Unsupported Attr: 28680 ISAKMP: attribute UNKNOWN (28682) Unsupported Attr: 28682 ISAKMP: attribute UNKNOWN (28677) Unsupported Attr: 28677 ISAKMP (0:0): responding to peer config from 67.90.66.14. ID = 4291110672 return status is IKMP_NO_ERROR crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 OAK_QM exchange oakley_process_quick_mode: OAK_QM_IDLE ISAKMP (0): processing SA payload. message ID = 3567171031
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-MD5 ISAKMP: key length is 256 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_proposal) : transform proposal (prot 3, trans 12, hmac_alg 1) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP (0): skipping next ANDed proposal (1) ISAKMP : Checking IPSec proposal 2
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-SHA ISAKMP: key length is 256 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 2) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP (0): skipping next ANDed proposal (2) ISAKMP : Checking IPSec proposal 3
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-MD5 ISAKMP: key length is 128 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 1) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP (0): skipping next ANDed proposal (3) ISAKMP : Checking IPSec proposal 4
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-SHA ISAKMP: key length is 128 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 2) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP (0): skipping next ANDed proposal (4) ISAKMP : Checking IPSec proposal 5
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-MD5 ISAKMP: key length is 256 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 1) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP : Checking IPSec proposal 6
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-SHA ISAKMP: key length is 256 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 2) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP : Checking IPSec proposal 7
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-MD5 ISAKMP: key length is 128 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_propos al): transform proposal (prot 3, trans 12, hmac_alg 1) not supported
ISAKMP (0): atts not acceptable. Next payload is 0 ISAKMP : Checking IPSec proposal 8
ISAKMP: transform 1, ESP_AES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-SHA ISAKMP: key length is 128 ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b IPSEC(validate_propos al): transform proposal (prot 3, trans 12, hmac_alg 2) not supported crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 OAK_QM exchange oakley_process_quick_mode: OAK_QM_AUTH_AWAIT ISAKMP (0): Creating IPSec SAs inbound SA from 67.90.66.14 to xxx.yyy.zzz.84 (proxy 192.168.99.1 to 0.0.0.0) has spi 3971608385 and conn_id 3 and flags 4 lifetime of 2147483 seconds outbound SA from xxx.yyy.zzz.84 to 67.90.66.14 (proxy 0.0.0.0 to 192.168.99.1) has spi 2575934584 and conn_id 4 and flags 4 lifetime of 2147483 secondsIPSEC(key_engine): got a queue event... IPSEC(initialize_sas): , (key eng. msg.) dest= xxx.yyy.zzz.84, src= 67.90.66.14, dest_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), src_proxy= 192.168.99.1/0.0.0.0/0/0 (type=1), protocol= ESP, transform= esp-des esp-md5-hmac , lifedur= 2147483s and 0kb, spi= 0xecb9ef41(3971608385), conn_id= 3, keysize= 0, flags= 0x4 IPSEC(initialize_sas): , (key eng. msg.) src= xxx.yyy.zzz.84, dest= 67.90.66.14, src_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), dest_proxy= 192.168.99.1/0.0.0.0/0/0 (type=1), protocol= ESP, transform= esp-des esp-md5-hmac , lifedur= 2147483s and 0kb, spi= 0x9989a478(2575934584), conn_id= 4, keysize= 0, flags= 0x4
VPN Peer: IPSEC: Peer ip:67.90.66.14/500 Ref cnt incremented to:2 Total VPN Peers:1 VPN Peer: IPSEC: Peer ip:67.90.66.14/500 Ref cnt incremented to:3 Total VPN Peers:1 return status is IKMP_NO_ERROR helm-pix01config# helm-pix01config#
Then after about 5 minutes of inactivity I see the firewall send these notify messages. In the Cisco VPN Client logs I see no sign of the client receiving these notify messages, then the firewall drops my connection.
ISADB: reaper checking SA 0x133bb3c, conn_id = 0 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): DPD: peer not responding! ISAKMP (0): deleting IPSEC SAs with peer at 67.90.66.14IPSEC(key_engine): got a queue event... IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP IPSEC(key_engine_delete_sas): delete all SAs shared with 67.90.66.14
VPN Peer: ISAKMP: Peer ip:67.90.66.14/500 Ref cnt decremented to:0 Total VPN Peers:1 VPN Peer: ISAKMP: Deleted peer: ip:67.90.66.14/500 Total VPN peers:0IPSEC(key_en gine): got a queue event... IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP IPSEC(key_engine_delete_sas): delete all SAs shared with 67.90.66.14
Once the firewall drops the client, if I attempt to ping anything that should be inside the tunnel it just times out and I see the following in my firewall
crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 ISAKMP: sa not found for ike msg
crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 ISAKMP: sa not found for ike msg
crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 ISAKMP: sa not found for ike msg
crypto_isakmp_process_block:src:67.90.66.14, dest:xxx.yyy.zzz.84 spt:500 dpt:500 ISAKMP: sa not found for ike msg
Then a few moments later on the client side I will get an error stating:
Secure VPN Connection terminated by the client. Reason 412: The remote peer is no longer responding
Can anyone see something wrong with my PIX config or know of some other way to make an idle IPSec tunnel stay alive without having to ping a host behind my firewall?
Try removing the Keepalive statement from the PIX no isakmp keepalive 120 25 Be sure to remove that ForceKeepAlives=1 from the .pcf file also
The default is no keepalive. I've never had a problem when using the default setting. While you "can" edit the .pcf file, the manual edits don't necessarily make any difference because the client is designed to be given its behavior by the vpn endpoint - a VPN3000 concentrator. The fact that it works with PIX is a bonus, but the PIX can't push real client behavior to the client, so you get a very limited feature set. PIX 7.x gives you much more control over client behavior with profiles on the PIX.
as I refresh the stats I see the sa timing: remaining key lifetime (k/sec): (4608000/28780) entry counting down but the connection drops before the sa lifetime runs out......
I don't see anything in the logs of my Cisco VPN Client, I see the following when monitoring the firewall ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): sending NOTIFY message 36136 protocol 1 ISAKMP (0): DPD: peer not responding! ISAKMP (0): deleting IPSEC SAs with peer at 67.90.66.14IPSEC(key_engine): got a queue event... IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP IPSEC(key_engine_delete_sas): delete all SAs shared with 67.90.66.14
VPN Peer: ISAKMP: Peer ip:67.90.66.14/500 Ref cnt decremented to:0 Total VPN Pee rs:1 VPN Peer: ISAKMP: Deleted peer: ip:67.90.66.14/500 Total VPN peers:0IPSEC(key_en gine): got a queue event... IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP IPSEC(key_engine_delete_sas): delete all SAs shared with 67.90.66.14
the lifetime on my tunnel showed as sa timing: remaining key lifetime (k/sec): (4608000/28465) just before it dropped. I'm just not quite sure what I'm missing here, any help would be greatly appreciated!
