Improve company productivity with a Business Account.Sign Up

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 860
  • Last Modified:

Cisco PIX 501 Client VPN Problem!

Hi, long time viewer, first time poster!

I have set up a site to site Cisco VPN for a client, but am having a couple of issues. I am only concerned with one part of it at the moment because until I test this succesfully I cannot connect this new connection and Cisco Box to the main network.
I have a new SDSL connection, and have configured a PIX 501 with a public IP. I can sit behind it and access the internet.

At the moment however, when i try and use the CISCO remote VPN client to connect to it  I can't. I get the following in the log:
Cisco Systems VPN Client Version
Copyright (C) 1998-2006 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 5.1.2600 Service Pack 2

691    18:15:54.828  11/20/07  Sev=Info/4      CM/0x63100002
Begin connection process

692    18:15:54.828  11/20/07  Sev=Info/4      CM/0x63100004
Establish secure connection

693    18:15:54.828  11/20/07  Sev=Info/4      CM/0x63100024
Attempt connection with server ""

694    18:15:54.843  11/20/07  Sev=Info/4      IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to

695    18:15:55.250  11/20/07  Sev=Info/4      IPSEC/0x63700008
IPSec driver successfully started

696    18:15:55.250  11/20/07  Sev=Info/4      IPSEC/0x63700014
Deleted all keys

697    18:15:55.937  11/20/07  Sev=Info/4      IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, VID(Xauth), VID(dpd), VID(Unity), VID(?), KE, ID, NON, VID(?), VID(Nat-T), NAT-D, NAT-D, HASH) from

698    18:15:55.937  11/20/07  Sev=Info/4      IKE/0x63000013

699    18:15:55.937  11/20/07  Sev=Info/4      IKE/0x63000083
IKE Port in use - Local Port =  0x0B80, Remote Port = 0x1194

700    18:15:55.937  11/20/07  Sev=Info/4      CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

701    18:15:55.937  11/20/07  Sev=Info/4      CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

702    18:15:55.953  11/20/07  Sev=Info/4      IKE/0x63000013

703    18:15:55.968  11/20/07  Sev=Info/4      IKE/0x63000014

704    18:15:55.984  11/20/07  Sev=Info/4      IKE/0x63000014

705    18:15:55.984  11/20/07  Sev=Info/4      CM/0x63100019
Mode Config data received

706    18:15:55.984  11/20/07  Sev=Info/4      IKE/0x63000056
Received a key request from Driver: Local IP =, GW IP =, Remote IP =

707    18:15:55.984  11/20/07  Sev=Info/4      IKE/0x63000013

708    18:15:56.031  11/20/07  Sev=Info/4      IKE/0x63000014

709    18:15:56.031  11/20/07  Sev=Info/4      IKE/0x63000013

710    18:15:56.031  11/20/07  Sev=Info/4      IKE/0x63000049
Discarding IPsec SA negotiation, MsgID=EB4C9C43

711    18:15:56.031  11/20/07  Sev=Info/4      IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=A7EBC229B7E5D221 R_Cookie=E76DC8D38E01865F) reason = DEL_REASON_IKE_NEG_FAILED

712    18:15:56.250  11/20/07  Sev=Info/4      IPSEC/0x63700014
Deleted all keys

713    18:15:59.250  11/20/07  Sev=Info/4      IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=A7EBC229B7E5D221 R_Cookie=E76DC8D38E01865F) reason = DEL_REASON_IKE_NEG_FAILED

714    18:15:59.250  11/20/07  Sev=Info/4      CM/0x63100012
Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_IKE_NEG_FAILED".  0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

715    18:15:59.250  11/20/07  Sev=Info/4      IKE/0x63000001
IKE received signal to terminate VPN connection

716    18:15:59.250  11/20/07  Sev=Info/4      IPSEC/0x63700014
Deleted all keys

717    18:15:59.250  11/20/07  Sev=Info/4      IPSEC/0x63700014
Deleted all keys

718    18:15:59.250  11/20/07  Sev=Info/4      IPSEC/0x63700014
Deleted all keys

719    18:15:59.250  11/20/07  Sev=Info/4      IPSEC/0x6370000A
IPSec driver successfully stopped

here is my cisco config:

londonpix# show run
: Saved
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 1iwWUtCZbeXI9x7r encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname londonpix
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
name mail
name Munich-Lan
name munich
name munichpix
object-group service Webmail tcp
  description Secure webmail access
  port-object eq www
  port-object eq https
  port-object eq smtp
access-list inside_outbound_nat0_acl permit ip any                                                                              
access-list inside_outbound_nat0_acl permit ip munich                                                                     
access-list outside_cryptomap_dyn_20 deny ip any
access-list outside_access_in remark Remoteweb workplace
access-list outside_access_in permit tcp any eq 4125 any eq 4125
access-list outside_cryptomap_20 permit ip munich 255                                                                              .255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool remote mask
ip local pool vpnpool
pdm location inside
pdm location inside
pdm location Munich-Lan inside
pdm location mail inside
pdm location outside
pdm location Munich-Lan outside
pdm location munich outside
pdm location munichpix outside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0 0
access-group outside_access_in in interface outside
route outside 1
route outside munich 1
route outside munichpix 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http Munich-Lan inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer munichpix
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address netmask no-xauth no-c                                                                              onfig-mode
isakmp key ******** address munichpix netmask no-xauth no-config                                                                              -mode
isakmp key ******** address netmask no-xauth no-config-m                                                                              ode
isakmp nat-traversal 300
isakmp log 1
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup users address-pool remote
vpngroup users dns-server
vpngroup users idle-time 1800
vpngroup users password ********
telnet outside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group users accept dialin pptp
vpdn group users ppp authentication pap
vpdn group users client configuration address local remote
vpdn group users pptp echo 60
vpdn group users client authentication local
vpdn username magnus password *********
dhcpd address inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username lmiles password C2KmXgyDJjL27vvz encrypted privilege 5
username dvago password WXHm1TBh5B6VgDIo encrypted privilege 5
username nlarsen password QtvepTrpg8fR1r86 encrypted privilege 5
username sfallgren password j75viSdKsDioff67 encrypted privilege 5
username treiss password 84cqV/yi9n6c6nuT encrypted privilege 5
username jcgas password uTOiBOn/rmqRSV.v encrypted privilege 5
username akoch password 8KaL7ZAowyWxZxhN encrypted privilege 5
username magnus password qu7pouLeRTTVAQBg encrypted privilege 15
username eyblood password whhCrfoivSj9zJwC encrypted privilege 5
vpnclient server
vpnclient mode client-mode
vpnclient vpngroup users password ********
terminal width 80
: end

I hope someone can help me! It's really doing my head in...I've been working on it for 3 straight days and I have trawled through the internet trying to find out why it won't work. I've tried different clients on different machines too!

Thanks in advance..

  • 4
  • 3
1 Solution
Do you ever receive a login prompt from the VPN client software?  What is the exact behavior you see from the VPN client side when trying to connect?
magnus911Author Commented:
it says a couple of things, then "securing commincations channel" and then "no connection"
Remove this line

access-list outside_cryptomap_dyn_20 deny ip any
NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

magnus911Author Commented:
Thanks, only thing is I'm not sure exactly how to remove a line using SSH - what command would I use to do that? Sorry for being slow...
once in config mode enter

no access-list outside_cryptomap_dyn_20 deny ip any
Oh and ...

no crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
magnus911Author Commented:
Ok thanks for your help - tried those but the second line threw up an error:

londonpix# conf t
londonpix(config)# no access-list outside_cryptomap_dyn_20 deny ip any 192.168$
londonpix(config)# no crypto dynamic-map outside_dyn_map 20 match address outs$
ERROR: unable to clear match address
londonpix(config)# no crypto dynamic-map outside_dyn_map 20 match address outs$
ERROR: unable to clear match address

any ideas?
magnus911Author Commented:
Genius. Thanks!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now