<font size=2 face="sans-serif">We are using a Cisco ISR with Easy VPN
Server to connect remote users to our network. We've been using it for
quite some time with Cisco VPN Client but obviously need a 64 bit VPN Client.
I came across shrewsoft VPN Client not too long ago, and would love if
I could get this software working as it seems too good to be true.. In
any case Here's what we have:</font>
<br>
<br><font size=2 face="sans-serif">Cisco ISR 2821 Running IPSEC VPN , doing
radius authentication to a Windows Server 2003 Radius Server. Everything's
configured properly as we use it successfully with the Cisco VPN Client.</font>
<br>
<br><font size=2 face="sans-serif">I installed shrewsoft 2.1.5, and it
successfully imported the existing cisco PCF File we had. When I attempt
to connect it asks me for username and password (No Domain field like Cisco
VPN Though) I enter in credentials of a user that has permission's to connect..
Here is the output of shrewsoft:</font>
<br>
<br><font size=2 face="sans-serif">config loaded for site 'MyCompany.pcf'</font>
<br><font size=2 face="sans-serif">configuring client settings ...</font>
<br><font size=2 face="sans-serif">attached to key daemon ...</font>
<br><font size=2 face="sans-serif">peer configured</font>
<br><font size=2 face="sans-serif">iskamp proposal configured</font>
<br><font size=2 face="sans-serif">esp proposal configured</font>
<br><font size=2 face="sans-serif">client configured</font>
<br><font size=2 face="sans-serif">local id configured</font>
<br><font size=2 face="sans-serif">pre-shared key configured</font>
<br><font size=2 face="sans-serif">bringing up tunnel ...</font>
<br><font size=2 face="sans-serif">user authentication error</font>
<br><font size=2 face="sans-serif">tunnel disabled</font>
<br><font size=2 face="sans-serif">detached from key daemon </font>
<br>
<br><font size=2 face="sans-serif">I did a Debug RADIUS on the cisco ISR
and get the following:</font>
<br>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: ISAKMP:(0):Support
for IKE Fragmentation not enabled</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS/ENCODE(000064C7):Orig.
component type = VPN_IPSEC</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: AAA
Unsupported Attr: interface [175] 13</font>
<br>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS:
31 39 32 2E 31 36 38 2E 32 35 32</font>
<br><font size=2 face="sans-serif"> [192.168.252]</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS/ENCODE(000064C7):
dropping service type, "radius-se</font>
<br><font size=2 face="sans-serif">rver attribute 6 on-for-login-auth"
is off</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS(000064C7):
Config NAS IP: removed-ip-address</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS/ENCODE(000064C7):
acct_session_id: 25799</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS(000064C7):
sending</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS(000064C7):
Send Access-Request to 192.168.32.2:1645</font>
<br><font size=2 face="sans-serif"> id 1645/5, len 161</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: authenticator
97 70 52 F6 D5 AD D2 3F - 57 93 56</font>
<br><font size=2 face="sans-serif">2F 79 6D C5 3F</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: User-Name
[1] 9 "testinguser"</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: Calling-Station-Id
[31] 17 "removed-ip-address"</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: Vendor,
Microsoft [26] 24</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS:
MS-CHAP-Challenge [11] 18</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS:
97 70 52 F6 D5 AD D2 3F 57 93 56 2F 79 6D C5 3F</font>
<br><font size=2 face="sans-serif"> [?pR?????W?V/ym??]</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: Vendor,
Microsoft [26] 58</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS:
MS-CHAP-V2-Response[25] 52 *</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: NAS-Port-Type
[61] 6 Virtual</font>
<br><font size=2 face="sans-serif"> [5]</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: NAS-Port
[5] 6 9</font>
<br>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: NAS-Port-Id
[87] 15 "removed-ip-address"</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: NAS-IP-Address
[4] 6 removed-ip-address</font>
<br>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: Received
from id 1645/5 removed-ip-address:1645, Access-</font>
<br><font size=2 face="sans-serif">Reject, len 42</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: authenticator
4D 85 12 70 89 79 43 60 - 5B 76 6B</font>
<br><font size=2 face="sans-serif">BA 80 20 92 D3</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS: Vendor,
Microsoft [26] 22</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS:
MS-CHAP-ERROR [2] 16</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS:
00 45 3D 36 39 31 20 52 3D 30 20 56 3D 33</font>
<br><font size=2 face="sans-serif"> [?E=691 R=0 V=3]</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS(000064C7):
Received from id 1645/5</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS/DECODE:
Failure message in the MS-Chap-Error attrib</font>
<br><font size=2 face="sans-serif">ute is E=691 R=0 V=3</font>
<br><font size=2 face="sans-serif">*Feb 10 15:08:16 NST: RADIUS/DECODE:
Authentication failure</font>
<br>
<br>
<br><font size=2 face="sans-serif">Any ideas/help would be greatly appreciated..</font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks,<br>
Shawn Edwards<br>
Sr. Network Analyst<br>
Pathix ASP<br>
A Division of Vector Aerospace Corporation <br>
Ph: 709-724-8564<br>
Fax: 709-724-8545<br>
sedwards@pathix.com</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">From:</font>
<td><font size=1 face="sans-serif">"Mike Parsons" <mike.parsons@mynetwiz.com></font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">To:</font>
<td><font size=1 face="sans-serif">"'Lukasz Sokol'" <el.es.cr@googlemail.com>,
<vpn-help@lists.shrew.net></font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">Date:</font>
<td><font size=1 face="sans-serif">02/11/2010 12:59 PM</font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">Subject:</font>
<td><font size=1 face="sans-serif">Re: [vpn-help] Using VPN Trace utility</font></table>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>Thanks, Lukasz--<br>
<br>
You're referring to the open log button I assume and not the trace log?<br>
What is the trace log ubutton used for?<br>
<br>
Why aren't log files showing up in the shrew soft directory under the debug<br>
folder?<br>
<br>
Thanks in advance.<br>
<br>
Mike Parsons -- CISSP, IAM, IEM<br>
Chief Technical Officer<br>
mike.parsons@mynetwiz.com<br>
cell: 336-403-9710 <br>
office: 336-306-5573 <br>
<br>
Information security architecture and consulting <br>
Risk assessment<br>
Compliance readiness assessment<br>
Design and implementation services <br>
JNCIA -- Firewalls, SSL/VPN, IDP <br>
JNSS -- UAC, Security, Routers, DX <br>
Ironport, Bluecoat and Tipping Point certified <br>
Graduate Certificate in Information Security and Privacy <br>
Security+<br>
MCP <br>
</font></tt><a href=www.mynetwiz.com><tt><font size=2>www.mynetwiz.com</font></tt></a><tt><font size=2><br>
******************************************************* <br>
Managing information risk through the application of sound technology <br>
If you know me, you can trust me.<br>
<br>
Galatians 2:20 <br>
<br>
-----Original Message-----<br>
From: Lukasz Sokol [</font></tt><a href=mailto:el.es.cr@googlemail.com><tt><font size=2>mailto:el.es.cr@googlemail.com</font></tt></a><tt><font size=2>]
<br>
Sent: Thursday, February 11, 2010 11:22 AM<br>
To: Mike Parsons<br>
Subject: Re: [vpn-help] Using VPN Trace utility<br>
<br>
Hello Mike,<br>
<br>
On 11/02/2010 15:57, Mike Parsons wrote:<br>
> Hello-<br>
> <br>
> <br>
> <br>
> I am trying to debug a vpn client connect issue using Shrew Soft 2.1.5
on<br>
> windows 7 and connecting to a Juniper SSG<br>
> <br>
> <br>
> <br>
> I started the VPN trace application and then attempted top connect
to the<br>
> SSG. No output showed up in any of the VPN trace application
tabs nor did<br>
> anything show up in the log files of the client.<br>
> <br>
> <br>
> <br>
> Any thoughts?<br>
> <br>
<br>
When you start Shrew Trace Utility, you need to go to File -> Options,<br>
there select Log Output Level (I select Informational), click OK,<br>
then in the main window click on Open Log button in each tab.<br>
(ver 2.1.5 had it so)<br>
<br>
Lukasz<br>
<br>
_______________________________________________<br>
vpn-help mailing list<br>
vpn-help@lists.shrew.net<br>
</font></tt><a href="http://lists.shrew.net/mailman/listinfo/vpn-help"><tt><font size=2>http://lists.shrew.net/mailman/listinfo/vpn-help</font></tt></a><tt><font size=2><br>
</font></tt>
<br>
<br><font size=2 face="sans-serif"><br>
<br>
<br>
</font>
<hr><font size=1 face="sans-serif"><i><br>
This e-mail may contain confidential information and the sender does not
waive any related rights and obligations. If you are not the intended recipient
please notify the sender and discard it.</i></font>