The Cisco VPN on a laptop won't work at home but will anywhere else.

Could be GRE protocol being blocked on your home router.  Your ISP can be contacted to see if they are blocking GRE traffic.

It is Cisco VPN not AnyConnect.  I can't seem to find the "IPsec passthrough" option anywhere in the VPN software configuration on the workstation.

No DivinsX2, I think he meant that IPSec Passthrough may be blocked by your ISP device or ISP.  I think that was what he meant.

Correct Jeff....     IPSEC passthrough must be enabled on the outbound router and must be supported by the outbound devices.    

Since the laptop works away from this location, it must be either your equipment or the ISP that is causeing the issue.  

Either way, it sounds like you need to make a call to Time Warner Support (you have my sympathy) and complain about the issue.   Get their tech support to update the firmware on your device, or (if its manageable) have them show you where to enable the ipsec passthrough.   If its not the equipment, then raise hell with the ISP.    

This is a pretty commonplace solution.  A large ISP shouldn't block this.

According to Time Warner level 2-3 tech support along with their supervisors, there is no way to check to ensure that IPSEC is enabled.  I did notice that the modem was almost 10 years old though, so we are going to swap that out and see if that changes anything.  

I also reinstalled the Cisco VPN on the laptop.  The user now gets an error message: Secure VPN Connection Terminated Locally by the Client.  Contacting security gateway.  Reason 412 The remote peer is no longer responding.

Well the problem still hasn't been fixed, so I'm not 100% sure why this was closed........................  The new modem did nothing. The router did nothing.  Laptop still works everywhere but the house.  Time Warner is saying they know nothing about IPSEC and how to check to see if it is enabled.

In those cases I start a network capture at the client, each with working VPN and when failing. You can either use WireShark or Microsoft NetMon 3.3 for this, both are free.

Cisco VPN uses some strange ports, depending on the device it connects to. IPSec itself uses 500/udp, if NAT-T is involved additionally either 4500/udp or 10000/tcp.

I'll give these a try and get back to you.  

One update to this: the user took his old work laptop home to see if it would work and he got the same thing.  So that is 2 work laptops with VPN that will work everywhere else except at his house.  

He's bypassed the router already.  So I know it's not in there.  I'm thinking it has to do with some setting in the VPN program or something on the company's end.

Would it matter if the IP subnet was the same at home as in the office?  Is that possible?  How would I change it?

The official statement is you need different networks on each side. The inofficial is it can work with the same network, but there are a lot of pitfalls, and it is not reliable.

Best is to change the home network, since that is done more easily than changing the office one. If you are lucky, narrowing the subnet mask for home is sufficient - a more specific route has precedence over the more general one. Since Cisco VPN is not using a filter driver but a virtual network interface (which is routable), there is a chance of working.

The user still cannot connect to the VPN using his username/password from home.  We tried 2 laptops and a desktop.  They work everywhere else except there.

Then, he tried a different username and password. Now it works from all computers.  

So the solution to this was to use a different username and password to connect. Still not sure why he is blocked using his name only from home.  All the settings are identical.

W/E

Really strange. I have absolutely no idea why this should be a constraint of the VPN user ... But glad you found the culprit. However, can you explain why you want to accept any answer here? I would suggest to delete the question instead.

I don't want to delete it because there are a lot of good suggestions here and I think it may prove valuable for someone else in the future. The solution also is not solved.  I simply posted my work around.

Why is this only limited to this user in one area?  

The Cisco client does not store information related to the VPN user. The Cisco device might, however. I'm off with any guess why this does not work with that user.

I do not agree to the answers accepted. It is ok to accept your own answer, but I do not see why you should accept MikeKane's answer in addition without accepting other answers, too. I suggest to accept your own answer/workaround only, nothing else, as you want to have it in the PAQ database.