mac vpn behind cisco firewall

When using an iphone or MacBook to connect to a vpn setup on a remote cisco ASA, it works fine from outside the local ASA, but always shows "negotiation failed" when trying the vpn from behind the local ASA.    I setup debugs on the remote asa and see the connnections coming in, but it always stops at the same point.     I have tried the vpn setup to other remote ASAs and get the same issue.    It appears to be an issue with just the macs, as the cisco vpn client on a pc works fine from behind the firewall.

I have enabled nat traversal on both ASAs.

Not sure if there is a command on the ASA or a setting on the mac that will fix this.

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
it works fine from outside the local ASA, but always shows "negotiation failed" when trying the vpn from behind the local

Situation Normal in my experience with VPN. You need an arm's length outside connection for VPN to negotiate and work,
tiptechsAuthor Commented:
It is just with the MAC though.  On a Windows PC running the cisco vpn client I have no issues with the vpn connecting.
JohnBusiness Consultant (Owner)Commented:
Perhaps I misunderstand, because I use Windows VPN all the time and you cannot VPN from inside.

Is your Windows "inside" VPN on a different IP or subnet?  That is maybe something to explore here.
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

tiptechsAuthor Commented:
Everything is the same with the internal network.   Windows PC using the cisco vpn client software works to the same vpn termination point behind the firewall and the mac doesn't.

Got the same results with an iPhone that was connected to the internal wireless behind the firewall.  vpn wouldn't work, but through the cellular it worked with no issues.
JohnBusiness Consultant (Owner)Commented:
I am not sure what to say. I have never seen a Windows VPN machine work from inside a network. So I do not know why yours do. That is unique in my experience.
tiptechsAuthor Commented:
I don't think you are understanding the layout.  

This works.

Windows PC (with vpn software terminating to for example) -> Local ASA Firewall -> Internet -> Remote ASA Firewall (  

This doesn't work

Mac (builtin vpn terminating to -> Local ASA Firewall -> Internet -> Remote ASA (

This does work

Mac (builtin vpn terminating to -> Internet -> Remote ASA (

Issue seems to be with just macs when behind the local ASA.
JohnBusiness Consultant (Owner)Commented:
Thank you. That was helpful indeed.

Windows PC (with vpn software terminating to for example) -> Local ASA Firewall -> Internet -> Remote ASA Firewall (  

I changed the above to because remote must be on a different subnet than local. I assume the points are on different subnets but you can post back that this is true.

So now replace with MAC and it does not work.  Try uninstalling the MAC VPN software and profile and remake it.

have enabled NAT traversal on both ASAs. <-- Try NAT on one, then other, then both, then not at all.  See if there is a setting for Aggressive mode and try turning that off.
tiptechsAuthor Commented:
I upgraded the local ASA to 9.x code and it is now working.    It was on 8.4 code.   a reboot of the ASA could have fixed it too, so not sure if the local ASA just needed rebooted or the issue was a bug with 8.4 code.  Either way it is working now with the mac and iphone.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tiptechsAuthor Commented:
upgraded ios and that fixed the issue.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.