	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.8

secure VPN Connection terminated by peer reason 433 (reason not specified by Peer)

Asked by ghmangus in Miscellaneous Security, Virtual Private Networking (VPN)

Tags: Cisco, VPN, ASA 5510, reason 433, terminated by peer

We have an ASA 5510 with IOA 8.0(2), were using XP systems with VPN client ver. 5.0.2.0090
We have been getting an intermittent error "secure VPN Connection terminated by peer reason 433 (reason not specified by Peer)"
If the users keep trying they are eventually able to connect, (sometimes after 1-3 attempts, sometimes not for 8+hrs)

We have users at various field sites using Comcast cable, Qwest DSL, Verizon 3G, and various other ISP's. We have tried going through wireless and directly connected to broadband modems. It doesn't seem to be vendor, WLAN, WWAN, or router platform specific
I set the one of the VPN clients for logging and tried connecting and received the following log, at the same time the ASA SYSLOG showed the results listed in the ASA-Log.

the log client logs are as follows

Cisco Systems VPN Client Version 5.0.02.0090
Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 5.1.2600 Service Pack 3

17 11:49:57.480 04/29/09 Sev=Info/4 IPSEC/0x63700008
IPSec driver successfully started

18 11:49:57.480 04/29/09 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

19 11:49:58.480 04/29/09 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Unity)) to 204.131.84.3

20 11:49:58.559 04/29/09 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?)) from 204.131.84.3

21 11:49:58.559 04/29/09 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 204.131.84.3

22 11:49:58.559 04/29/09 Sev=Info/4 IKE/0x63000083
IKE Port in use - Local Port = 0x0715, Remote Port = 0x01F4

23 11:49:58.637 04/29/09 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 204.131.84.3

24 11:50:04.449 04/29/09 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 204.131.84.3

25 11:50:04.543 04/29/09 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 204.131.84.3

26 11:50:04.543 04/29/09 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 204.131.84.3

27 11:50:04.559 04/29/09 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 204.131.84.3

28 11:50:04.637 04/29/09 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, DEL) from 204.131.84.3

29 11:50:04.637 04/29/09 Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion (I_Cookie=0DC42AEA44EC6C1C R_Cookie=8ADA701705B148FA) reason = PEER_DELETE-IKE_DELETE_UNSPECIFIED

30 11:50:05.480 04/29/09 Sev=Info/4 IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=0DC42AEA44EC6C1C R_Cookie=8ADA701705B148FA) reason = PEER_DELETE-IKE_DELETE_UNSPECIFIED

31 11:50:05.512 04/29/09 Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection

32 11:50:05.512 04/29/09 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

33 11:50:05.512 04/29/09 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

34 11:50:05.512 04/29/09 Sev=Info/4 IPSEC/0x63700014
Deleted all keys

35 11:50:05.512 04/29/09 Sev=Info/4 IPSEC/0x6370000A
IPSec driver successfully stopped

I've seen numerous posts concerning this error message and resolving it by setting NAT-T but if I'm not mistaken that is if you're using IPSec over UDP and we're using IPSec over TCP (port 10000) I still tried setting ADSM to NAT-T and tried several different timeouts (20sec, 30 sec, 60 sec, 120 sec) we want to keep IPSec over TCP because of TCP being more robust.

View the Solution FREE for 30 Days

Attachments:

ASA-log.JPG (424 KB) (Possible File Type Mismatch)

ASA SYSLOG entries

error-433.bmp (212 KB) (File Type Details)

error 433

NAT-T.bmp (3.9 MB) (File Type Details)

NAT-T config screen

	Title
1	What's wrong with my VPN config?
2	VPN with hard wire works... VPN …
3	thoughputs & disk seek

secure VPN Connection terminated by peer reason 433 (reason not specified by Peer)

Asked by ghmangus in Miscellaneous Security, Virtual Private Networking (VPN)

Tags: Cisco, VPN, ASA 5510, reason 433, terminated by peer

About this solution