{"id":2113,"date":"2009-06-20T19:04:48","date_gmt":"2009-06-21T02:04:48","guid":{"rendered":"http:\/\/www.sheer.us\/wordpress\/?p=2113"},"modified":"2009-06-20T19:04:48","modified_gmt":"2009-06-21T02:04:48","slug":"cisco-501-w-vpn-configuration-file","status":"publish","type":"post","link":"https:\/\/www.sheer.us\/weblogs\/uncategorized\/cisco-501-w-vpn-configuration-file","title":{"rendered":"Cisco 501 w\/ VPN configuration file"},"content":{"rendered":"<p>These lines are from a configuration file that will allow the current (4.x) Cisco VPN client to connect to the 501. They took me a couple of hours to derive &#8211; hopefully sharing this with other people will help save someone some time.<\/p>\n<p>The problem: You&#8217;ve got a cisco 501, and users using the Cisco VPN client. They can&#8217;t connect, and you don&#8217;t know why. If you turn on ipsec debugging with<\/p>\n<p># logging on<\/p>\n<p># debug crypto ipsec<\/p>\n<p># debug crypto isakmp<\/p>\n<p>You get things like this:<\/p>\n<p>&#8212;&#8212;&#8211;<br \/>\n<PRE><br \/>\nISAKMP (0): Checking ISAKMP transform 1 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash SHA<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 extended auth pre-share (init)<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 256<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 2 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash MD5<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 extended auth pre-share (init)<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 256<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 3 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash SHA<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 auth pre-share<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 256<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 4 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash MD5<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 auth pre-share<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 256<br \/>\nISAKMP (0): Proposed key length does not match policy<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 5 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash SHA<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 extended auth pre-share (init)<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 128<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 6 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash MD5<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 extended auth pre-share (init)<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 128<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 7 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash SHA<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 auth pre-share<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 128<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 8 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption AES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash MD5<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 auth pre-share<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 keylength of 128<br \/>\nISAKMP (0): atts are not acceptable. Next payload is 3<br \/>\nISAKMP (0): Checking ISAKMP transform 9 against priority 1 policy<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 encryption 3DES-CBC<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 hash SHA<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 default group 2<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 extended auth pre-share (init)<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life type in seconds<br \/>\nISAKMP:\u00a0\u00a0\u00a0\u00a0\u00a0 life duration (VPI) of\u00a0 0x0 0x20 0xc4 0x9b<br \/>\ncrypto_isakmp_process_block:src:10.101.1.61, dest:10.101.2.4 spt:500 dpt:500<br \/>\nVPN Peer:ISAKMP: Peer Info for 10.101.1.61\/500 not found &#8211; peers:0<br \/>\n<\/PRE><br \/>\n&#8212;&#8212;&#8212;&#8212;<\/p>\n<p>The solution: Try this<\/p>\n<p><PRE><br \/>\nsysopt connection permit-ipsec<br \/>\ncrypto ipsec transform-set default esp-3des esp-md5-hmac<br \/>\ncrypto dynamic-map dynmap 50 set transform-set default<br \/>\ncrypto map mymap 10 ipsec-isakmp dynamic dynmap<br \/>\ncrypto map mymap client configuration address initiate<br \/>\ncrypto map mymap interface outside<br \/>\nisakmp enable outside<br \/>\nisakmp identity address<br \/>\nisakmp policy 1 authentication pre-share<br \/>\nisakmp policy 1 encryption 3des<br \/>\nisakmp policy 1 hash md5<br \/>\nisakmp policy 1 group 1<br \/>\nisakmp policy 1 lifetime 86400<br \/>\nisakmp policy 2 authentication pre-share<br \/>\nisakmp policy 2 encryption 3des<br \/>\nisakmp policy 2 hash md5<br \/>\nisakmp policy 2 group 2<br \/>\nisakmp policy 3 authentication pre-share<br \/>\nisakmp policy 3 encryption 3des<br \/>\nisakmp policy 3 hash md5<br \/>\nisakmp policy 3 group 5<br \/>\nisakmp policy 3 lifetime 86400<br \/>\n<\/PRE><\/p>\n","protected":false},"excerpt":{"rendered":"<p>These lines are from a configuration file that will allow the current (4.x) Cisco VPN client to connect to the 501. They took me a couple of hours to derive &#8211; hopefully sharing this with other people will help save someone some time. The problem: You&#8217;ve got a cisco 501, and users using the Cisco [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/posts\/2113"}],"collection":[{"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/comments?post=2113"}],"version-history":[{"count":0,"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/posts\/2113\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/media?parent=2113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/categories?post=2113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sheer.us\/weblogs\/wp-json\/wp\/v2\/tags?post=2113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}