Cisco VPN Client Connection to Concentrator-Reason 414:Failed to Establish a TCP connections

Hi

1) Does the new PC have WiF & are you using that to connect? If so, has it connected to your router? Even if you aren' using it intentionally, has it managed to get a WiFi connection to somewhere?
Yes it does have WiFi and I am using that to connect.  My wireless access point at home that I am trying to connect through is also my router which is a Linksys WRT54G.  The last question of " Even if you aren' using it intentionally, has it managed to get a WiFi connection to somewhere?" please clarify.


2) Do you have any other security product on the new PC. Some AV products also have some firewall functionality.
I am not running any security products besides the windows firewall and Antivir antivirus.  I opened Antivir and found no reference to any firewalling functionality in the program itself.

3) Is there Web acceleration software on the machine? If so, I'd guess it'd interfere with your use of TCP port 80.
Nope.

4) Can you try it on another port, or even on UDP? You should not have to configure anything on the router to allow that to work as the client is using transparent tunnelling.
I can change that on the client easily.  However, how hard is that to change on the concentrator.  I manage the concentrator as best I can but know little about it. How do you set up udp or different ports for tcp?

5) I can't check at this point but IIRC, not all versions of the Cisco VPN client will work with all concentrators (I'm not entirely sure about this& will check). Which concentrator are you using?
VPN Concentrator Type: 3005
Bootcode Rev: Cisco Systems, Inc./VPN 3000 Concentrator Series Version 2.5.Rel Jun 21 2000 18:57:52
Software Rev: Cisco Systems, Inc./VPN 3000 Concentrator Version 4.0.1.Rel May 06 2003 13:13:03

Thanks,
Danny

Hi

Thanks for the concise, helpful answers.

>The last question of " Even if you aren' using it intentionally, has it managed to get a WiFi connection to somewhere?" please clarify.

I had meant:  if you were using a cable to connect but WiFi present on the PC had managed to find an open connection. If that happens, you get two routes to the Internet & windows can get confused :) However, that bit is now irrelevant as you know where the WiFi is going & it's your router/AP.

The default setup for VPN client access on a 3000 is UDP (NAT/PAT) AFAIK. You can check what your VPN group is set to when logged on to the 3000: expand User Management, then Groups. Select the Group you are using for the VPN & clickon Modify. Click on the Client Config tab. make sure the IPSEC over UDP box is checked and that the port says 10000 (or something else if you have reason to change it - see the rules to the right of that screen). Click on Apply at the bottom of the page but don't save the changes until you see if they work! Make sure your client VPN config is set up to use IPSec over UDP.

I've just realised that the client & the 3000 don't match. In the client, you can select IPSecover UDP or TCP, & for the latter you can select a port. On the 3000 you can select IPSec over UDP as an option & a port. But not for TCP. Odd. I'll look into that later.

Obviously, if the changes work, you'll have to set up the other PC's VPN client to match.

In my group configuration, even thought the UDP Port was set to 10000 the checkbox next to "IPSec over UDP" was unckecked.  I also added a few different ports to try with TCP.  I don't know why they are in a different place but this is where I found the TCP Settings: Configuration | System | Tunneling Protocols | IPSec | NAT Transparency.
I will try to connect with the two new TCP ports that I set-up and then I will try to connect over UDP now that the checkbox is selected.  I will be trying it this afternoon.
Thanks,
Danny

Hello,
I tried three different TCP ports, none of which worked.  I then tried UDP.  It was really strange.  I was able to log in with the VPN Client, but then I still had no access to the remote network.
I tried uninstalling the VPN client and reinstalled it.  It didn't work.
Then, just to see if it would work, I tried a wired connection to the Router.  Sure enough, it worked.  I tried two TCP connections and the UDP connection on the client all of which worked wonderfully.  However, as soon as I switched back to wireless it didn't work.
The other computer I have at home is has a wire connection to the router and that is why the VPN works on that machine.  
So now the question is, why does the wireless create problems with the VPN and how do I get the wireless to work.
Thanks for your help so far.  We are making progress.
Thanks,
Danny

As an additional note:  The VPN connection does not work from college either where I am connected wirelessly.  For this reason, I don't think that it is a router setting.  

I figured it out.  For those that are getting this same problem: the key was that I am using a Dell Wireless 1390 WLAN Mini-card.  After realizing that it must be the wireless cards that was stopping the connection.  I looked on dells site for new firmware.  I had the most recent version.  I then came across a knowledgebase article describing how this particular wireless card has problems with VPN client versions 4.6 or higher.  It detailed a workaround that was simply disableing VLAN Priority Support on the network card.  I tried this and everything worked as it should.
Here is the dell knowledgebase page: http://support.dell.com/support/topics/global.aspx/support/dsn/en/document?c=us&docid=152D7D67033477DFE0401E0A5517188F&journalid=BDF081B355A211DB97C60767E62D0E13&l=en&s=gen

The knowledgebase article was Journal: 06279SP2HZ and document number 300602 if the link ever gets broken.

mmetrics,  
I am new to the posting questions thing.
Even though you didn't end up answering the question, you did ask some questions that lead me to the answer.
Is there a way to still award partial points to you?
Is there a way to mark my own comment as the answer?
Thanks,
Danny

Hi Danny

Glad you found the answer - sometimes someone asking questions, even dumb ones :) is all it takes to set you on the track.

As for the points & accepted answer things, I don't know - we'll have to leave that to a moderator...