[ previous ] [ next ] [ threads ]
 
 From:  "Soren Vanggaard Jensen" <svanggaard at hotmail dot com>
 To:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Cisco VPN Client drops connections- Help needed ugently
 Date:  Mon, 03 Oct 2005 15:21:33 +0000
I have a problem with random Cisco VPN client disconnects. Http, Streaming 
media, ssh - everything works. But Cisco VPN Client version 4.0.2 (D) 
disconnects randomly with the below logentries. Running VPN over 
TCP/dport10000. Monowall v1.2b10  Any ideas why the connection is dropped?



55    16:53:14.671  10/03/05  Sev=Info/4	PPP/0x63200015
Establish connection with client application

256    16:53:14.671  10/03/05  Sev=Info/4	PPP/0x6320001C
Processing enumerate phone book entries command

257    16:53:14.750  10/03/05  Sev=Info/4	PPP/0x6320000D
Retrieved 1 dial entries

258    16:53:14.750  10/03/05  Sev=Info/4	PPP/0x63200017
Terminate connection with client application

259    16:53:18.828  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688458

260    16:53:18.828  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

261    16:53:23.828  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688459

262    16:53:23.828  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

263    16:53:28.828  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688460

264    16:53:28.828  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

265    16:53:33.828  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688461

266    16:53:33.828  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

267    16:53:38.828  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688462

268    16:53:38.828  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

269    16:53:43.843  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688463

270    16:53:43.843  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

271    16:53:49.343  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688464

272    16:53:49.343  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

273    16:53:54.828  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688465

274    16:53:54.828  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

275    16:53:59.890  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688466

276    16:53:59.890  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

277    16:54:05.328  10/03/05  Sev=Info/6	IKE/0x6300003D
Sending DPD request to myVPNSERVERADR, seq# = 2172688467

278    16:54:05.328  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to myVPNSERVERADR

279    16:54:10.328  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to myVPNSERVERADR

280    16:54:10.328  10/03/05  Sev=Info/5	IKE/0x63000018
Deleting IPsec SA: (OUTBOUND SPI = 109340D8 INBOUND SPI = BA4EA393)

281    16:54:10.328  10/03/05  Sev=Info/4	IKE/0x63000048
Discarding IPsec SA negotiation, MsgID=20C66902

282    16:54:10.328  10/03/05  Sev=Info/4	IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=9C9BB3F4E3F5EA2E 
R_Cookie=C28B7BCED2464E32) reason = DEL_REASON_PEER_NOT_RESPONDING

283    16:54:10.328  10/03/05  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to myVPNSERVERADR

284    16:54:10.890  10/03/05  Sev=Info/4	IKE/0x6300004A
Discarding IKE SA negotiation (I_Cookie=9C9BB3F4E3F5EA2E 
R_Cookie=C28B7BCED2464E32) reason = DEL_REASON_PEER_NOT_RESPONDING

285    16:54:10.890  10/03/05  Sev=Info/4	CM/0x63100013
Phase 1 SA deleted cause by DEL_REASON_PEER_NOT_RESPONDING.  0 Crypto Active 
IKE SA, 0 User Authenticated IKE SA in the system

286    16:54:10.890  10/03/05  Sev=Info/5	CM/0x63100025
Initializing CVPNDrv

287    16:54:10.890  10/03/05  Sev=Info/4	CM/0x6310002D
Resetting TCP connection on port 10000

288    16:54:10.890  10/03/05  Sev=Info/6	CM/0x63100030
Removed local TCP port 1234 for TCP connection.

289    16:54:10.890  10/03/05  Sev=Info/6	CM/0x63100031
Tunnel to headend device myVPNSERVERADR disconnected: duration: 0 days 
0:2:10

290    16:54:10.890  10/03/05  Sev=Info/4	IKE/0x63000001
IKE received signal to terminate VPN connection

291    16:54:10.890  10/03/05  Sev=Info/5	CVPND/0x63400016
    Destination           Netmask           Gateway         Interface   
Metric
        0.0.0.0           0.0.0.0           0.0.0.0     192.168.0.249        
2
        0.0.0.0           0.0.0.0           0.0.0.0   192.168.136.201        
1
      127.0.0.0         127.0.0.0         127.0.0.0         127.0.0.1        
1
    192.168.0.0       192.168.0.0       192.168.0.0     192.168.0.249        
1
    192.168.0.0       192.168.0.0       192.168.0.0   192.168.136.201        
1
    192.168.0.1       192.168.0.1       192.168.0.1     192.168.0.249        
1
  192.168.0.249     192.168.0.249     192.168.0.249         127.0.0.1        
1
  192.168.0.255     192.168.0.255     192.168.0.255     192.168.0.249        
1
  192.168.136.0     192.168.136.0     192.168.136.0   192.168.136.201        
1
192.168.136.201   192.168.136.201   192.168.136.201         127.0.0.1        
1
192.168.136.255   192.168.136.255   192.168.136.255   192.168.136.201        
1
  myVPNSERVERADR     myVPNSERVERADR     myVPNSERVERADR     192.168.0.249     
    1
      224.0.0.0         224.0.0.0         224.0.0.0     192.168.0.249        
1
      224.0.0.0         224.0.0.0         224.0.0.0   192.168.136.201        
1
255.255.255.255   255.255.255.255   255.255.255.255     192.168.0.249        
1


292    16:54:10.906  10/03/05  Sev=Info/5	CVPND/0x63400016
    Destination           Netmask           Gateway         Interface   
Metric
        0.0.0.0           0.0.0.0           0.0.0.0     192.168.0.249        
1
        0.0.0.0           0.0.0.0           0.0.0.0   192.168.136.201        
1
      127.0.0.0         127.0.0.0         127.0.0.0         127.0.0.1        
1
    192.168.0.0       192.168.0.0       192.168.0.0     192.168.0.249        
1
    192.168.0.0       192.168.0.0       192.168.0.0   192.168.136.201        
1
  192.168.0.249     192.168.0.249     192.168.0.249         127.0.0.1        
1
  192.168.0.255     192.168.0.255     192.168.0.255     192.168.0.249        
1
  192.168.136.0     192.168.136.0     192.168.136.0   192.168.136.201        
1
192.168.136.201   192.168.136.201   192.168.136.201         127.0.0.1        
1
192.168.136.255   192.168.136.255   192.168.136.255   192.168.136.201        
1
      224.0.0.0         224.0.0.0         224.0.0.0     192.168.0.249        
1
      224.0.0.0         224.0.0.0         224.0.0.0   192.168.136.201        
1
255.255.255.255   255.255.255.255   255.255.255.255     192.168.0.249        
1


293    16:54:10.906  10/03/05  Sev=Info/6	CM/0x63100037
The routing table was returned to orginal state prior to Virtual Adapter

294    16:54:11.531  10/03/05  Sev=Info/4	CM/0x63100035
The Virtual Adapter was disabled

295    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x63700013
Delete internal key with SPI=0x93a34eba

296    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x6370000C
Key deleted by SPI 0x93a34eba

297    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x63700013
Delete internal key with SPI=0xd8409310

298    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x6370000C
Key deleted by SPI 0xd8409310

299    16:54:11.531  10/03/05  Sev=Info/6	IPSEC/0x63700022
TCP RST sent to myVPNSERVERADR, src port 1234, dst port 10000

300    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x63700014
Deleted all keys

301    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x63700014
Deleted all keys

302    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x63700014
Deleted all keys

303    16:54:11.531  10/03/05  Sev=Info/4	IPSEC/0x6370000A
IPSec driver successfully stopped