July 8, 2008 07:54pm pdt

1. batry_boy 585,226
2. lrmoore 194,385
3. mkielar 101,500
4. Voltz-dk 84,970
5. MrHusy 83,695
6. Cyclops3590 75,700
7. PeteLong 70,000
8. grblades 40,275
9. nodisco 34,125
10. from_exp 32,120
11. JFrederi... 31,100
12. rsivanandan 30,980
13. 2PiFL 25,575
14. stuknhawaii 25,425
15. clearacid 23,225

1. lrmoore 2,141,666
2. batry_boy 953,350
3. grblades 343,160
4. rsivanandan 333,609
5. nodisco 270,712
6. PeteLong 256,841
7. calvinetter 254,590
8. MrHusy 205,396
9. Voltz-dk 192,909
10. Cyclops3590 192,606
11. tim_holman 120,177
12. carribea... 108,132
13. mkielar 101,500
14. keith_al... 101,419
15. JFrederi... 88,100

12.13.2007 at 12:10PM PST, ID: 23022037

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.2

Cisco VPN Client on Vista

Zone: Cisco PIX Firewall

Tags: vpn, cisco, vista, client

I have a Cisco PIX 501. I used it to connect two sites together and to allow users VPN capabilities from home. I've had no problems when using window XP L2TP VPN client, but I just had a user upgrade there home computer to Vista and I could not get windows vpn to work on Vista. I read that MS-CHAPv1 is not supported on Vista and the Cisco PIX only has MS-CHAPv1. I decided to try and install Cisco VPN client (version 5.0.02.0090) on Vista, because I heard that would solve my problem. When I setup the connection and try to connect, I cannot estabilsh a connection and I keep getting "Received a NOTIFY message with an invalid protocol id (0)" in the log.

Below is my running config on my PIX. Please help

Result of firewall command: "show runn"

: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password eiJMrecdnxIabPEK encrypted
passwd ********** encrypted
hostname hostservername
domain-name office.local
clock timezone CST -6
clock summer-time CDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
no names
name 192.168.0.111 cypress
name xxx.xxx.xx.88 SIEMENS
name 192.168.0.161 ecamscanner
name 192.168.0.160 ecamworkstation
name xx.xx.xxx.193 SRS_PEER
name 206.180.162.105 ascient
name 10.130.105.25 EP_Clinic
name 10.130.105.0 STJ_EP_CLINIC
access-list acl_out permit tcp any host xxx.xxx.xx.83 eq 3389
access-list acl_out permit udp any host xxx.xxx.xx.83 eq 3389
access-list acl_out permit icmp any any
access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 xx.xx.xxx.88 255.255.255.248
access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 10.130.105.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list outside_access_in permit tcp any host xxx.xxx.xx.99 eq 3389
pager lines 23
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xx.98 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN 192.168.2.1-192.168.2.100
ip local pool VPN2 172.16.0.1-172.16.0.50 mask 255.255.255.0
pdm location 192.168.0.99 255.255.255.255 inside
pdm location 192.168.0.111 255.255.255.255 inside
pdm location 192.168.0.160 255.255.255.255 inside
pdm location 192.168.0.161 255.255.255.255 inside
pdm location xxx.xx.xxx.88 255.255.255.248 outside
pdm location 192.168.0.0 255.255.255.0 inside
pdm location 192.168.1.0 255.255.255.0 inside
pdm location 192.168.1.0 255.255.255.0 outside
pdm location 64.0.0.0 255.0.0.0 outside
pdm location xx.xx.0.0 255.255.0.0 outside
pdm location xx.xx.xxx.193 255.255.255.255 outside
pdm location 192.168.2.0 255.255.255.128 outside
pdm location 192.168.2.0 255.255.255.0 outside
pdm location 0.0.0.0 255.255.255.0 inside
pdm location 0.0.0.0 255.255.255.0 outside
pdm location xxx.xxx.xxx.105 255.255.255.255 outside
pdm location xx.x.x.0 255.0.0.0 outside
pdm location 192.168.1.1 255.255.255.255 inside
pdm location 10.130.105.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 1 xxx.xxx.xx.85 netmask 255.255.255.248
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xxx.xxx.xx.99 192.168.0.99 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.161 192.168.0.161 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.160 192.168.0.160 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.111 192.168.0.111 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xx.97 1
route outside xxx.xxx.xx.98 255.255.255.255 xxx.xxx.xx.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:00:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 216.146.75.90
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address xxx.xxx.xx.90 netmask 255.255.255.255 no-xauth no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 28800
vpngroup pricard address-pool VPN2
vpngroup pricard idle-time 1800
vpngroup pricard password ********
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 45
ssh xx.xx.0.0 255.255.0.0 outside
ssh 0.0.0.0 0.0.0.0 outside
ssh xx.xx.xxx.193 255.255.255.255 outside
ssh timeout 60
management-access inside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto required
vpdn group PPTP-VPDN-GROUP client configuration address local VPN
vpdn group PPTP-VPDN-GROUP client configuration dns 192.168.0.99 192.168.0.99
vpdn group PPTP-VPDN-GROUP client configuration wins 192.168.0.99 192.168.0.99
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username mnardone password *********
vpdn username itradmin password *********
vpdn username dbromet password *********
vpdn username jburks password *********
vpdn username pnguyen password *********
vpdn username stjoevpn password *********
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.0.2-192.168.0.129 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
vpnclient server 192.168.0.1
vpnclient mode client-mode
vpnclient vpngroup stjoevpn password ********
terminal width 80
Cryptochecksum:991aa67691777510e26b7eaca1829fe8
: end

Start your free trial to view this solution

Question Stats

Zone: Security

Question Asked By: flip0110

Solution Provided By: lrmoore

Participating Experts: 5

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

12.13.2007 at 12:25PM PST, ID: 20467309

Rank: Guru

PeteLong:

You cant run it on a PC that was upgraded from XP to Vista - its unsupported cause it wont work :(

12.13.2007 at 12:26PM PST, ID: 20467318

Rank: Guru

PeteLong:

you need a cisco login to open this link
http://download-sj.cisco.com/cisco/crypto/3DES/vpn/client/windows/vpnclient-windows-5.0.02.0090-readme.txt

quote

vpnclient-win-msi-5.0.02.0090-k9.exe - Windows 2000, XP and Vista - 32bit only.

Advisory:
CSCsk37470 provides the ability for users to upgrade from an IS based install to
MSI using without having to manually remove the IS package first.

The Cisco VPN Client for Windows Vista does NOT support the following:

* System upgraded from Windows XP to Vista (clean OS installation required).
* Start Before Logon
* SmartCard Authentication
* Integrated Firewall
* InstallShield
* 64bit support
* AutoUpdate
* Translated Online Help - Provided only in English

12.13.2007 at 12:58PM PST, ID: 20467623

flip0110:

OK, I guess I should be a bit more careful on my comments. When I said they upgraded to Vista, I mean they replaced there laptop with a new laptop that came with Vista. And, I already installed the latest Cisco VPN Client on that new laptop.

12.13.2007 at 01:23PM PST, ID: 20467829

2PiFL:

What version of Vista?

12.13.2007 at 02:13PM PST, ID: 20468218

flip0110:

Vista Home Premium

12.13.2007 at 08:14PM PST, ID: 20469693

Rank: Genius

lrmoore:

You cannot use the Cisco VPN client without setting up the ASA for IPSEC VPN client
Use the VPN wizard to setup IPSEC VPN client access and then try

12.14.2007 at 12:59AM PST, ID: 20470523

Rank: Guru

PeteLong:

:) See http://www.petenetlive.com/Tech/Firewalls/Cisco/c2svpn.htm

12.14.2007 at 06:52AM PST, ID: 20471822

flip0110:

Looks like running the VPN wizard as Irmoore suggested worked. I'm getting connectivity, but I keep getting these messages in the Cisco VPN Client log:

20 08:48:53.274 12/14/07 Sev=Warning/2      CVPND/0xE3400013
AddRoute failed to add a route: code 5010
      Destination      0.0.0.0
      Netmask      0.0.0.0
      Gateway      172.16.0.2
      Interface      172.16.0.1

21 08:48:53.275 12/14/07 Sev=Warning/2      CM/0xA3100024
Unable to add route. Network: 0, Netmask: 0, Interface: ac100001, Gateway: ac100002.

22 08:48:53.275 12/14/07 Sev=Warning/2      CVPND/0xA3400015
Error with call to IpHlpApi.DLL: DeleteIpForwardEntry, error 1168

23 08:48:53.276 12/14/07 Sev=Warning/2      CM/0xA3100025
Unable to delete route. Network: ac10ffff, Netmask: ffffffff, Interface: ac10012d, Gateway: ac10012d.

Are these messages normal?

12.14.2007 at 02:07PM PST, ID: 20474864

Rank: Genius

lrmoore:

Yes, these are normal unless you enable split-tunneling.

Accepted Solution

jryan1099

01.03.2008 at 08:04AM PST, ID: 20573842

I am also having problems with the half-working VPN client for Vista. It is very buggy for being a production program from Cisco. I think they are going to have to fix their bugs because many people on the blogging sites want it fixed and done right.

loveboatexpress

02.21.2008 at 10:07PM PST, ID: 20955032

http://www.cisco.com/en/US/products/sw/secursw/ps2308/prod_release_note09186a0080884df5.html

Release notes, doesn't require login.

20080236-EE-VQP-29 / EE_QW_2_20070628