This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

iOS 7 IPSec client not connecting to UTM 9.1

Hi everyone,

I recently upgraded my iPhone 5 to iOS 7, which previously had a working VPN profile for the native Cisco IPSec client to my UTM 9.105-9 gateway (software appliance for home use running on a reprovisioned ASG-220 Rev 4). Since the GM of iOS 7, it appears my iPhone can no longer establish a connection to my UTM. Just in case the profile hadn't made its way over to iOS 7 completely intact, I deleted it and then reinstalled it via the UTM user site. I saw the same behavior after that.

An excerpt from the VPN log follows. Not sure if this is an incompatibility issue with iOS 7, or if Verizon FIOS has suddenly started interfering with inbound VPN traffic. Any thoughts or suggestions?

Thanks,
Martin.

2013:09:20-09:08:52 gateway pluto[5595]: packet from 198.228.199.242:36983: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2013:09:20-09:08:52 gateway pluto[5595]: packet from 198.228.199.242:36983: received Vendor ID payload [XAUTH]
2013:09:20-09:08:52 gateway pluto[5595]: packet from 198.228.199.242:36983: ignoring Vendor ID payload [Cisco-Unity]
2013:09:20-09:08:52 gateway pluto[5595]: packet from 198.228.199.242:36983: ignoring Vendor ID payload [FRAGMENTATION 80000000]
2013:09:20-09:08:52 gateway pluto[5595]: packet from 198.228.199.242:36983: received Vendor ID payload [Dead Peer Detection]
2013:09:20-09:08:52 gateway pluto[5595]: "D_for bilbo to Internal (Network)"[7] 198.228.199.242:36983 #9: responding to Main Mode from unknown peer 198.228.199.242:36983
2013:09:20-09:08:52 gateway pluto[5595]: "D_for bilbo to Internal (Network)"[7] 198.228.199.242:36983 #9: NAT-Traversal: Result using RFC 3947: both are NATed
2013:09:20-09:08:53 gateway pluto[5595]: "D_for bilbo to Internal (Network)"[7] 198.228.199.242:36983 #8: max number of retransmissions (2) reached STATE_MAIN_R2
2013:09:20-09:10:03 gateway pluto[5595]: "D_for bilbo to Internal (Network)"[7] 198.228.199.242:36983 #9: max number of retransmissions (2) reached STATE_MAIN_R2
2013:09:20-09:10:03 gateway pluto[5595]: "D_for bilbo to Internal (Network)"[7] 198.228.199.242:36983: deleting connection "D_for bilbo to Internal (Network)"[7] instance with peer 198.228.199.242 {isakmp=#0/ipsec=#0

This thread was automatically locked due to age.

Parents

0 MarCow over 11 years ago

Weird thing is that it's been working just fine for me for the last several years; I've always just set up the UTM box as the DMZ host for my FIOS router, and it's worked perfectly with the iOS Cisco client until now. The iOS 7 Cisco client still works fine for my work VPN (via a Cisco ASA), but I'm not sure if that's also behind a NAT or not. One difference is that it uses a shared secret, rather than the certificate-based authentication on the UTM.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago in reply to MarCow

I've always just set up the UTM box as the DMZ host for my FIOS router...

Hi, there are alternatives, especially if you have CAT5/ethernet coming out of the ONT to the router; see my post at
https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/20490

for more info.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BarryG over 11 years ago in reply to MarCow

I've always just set up the UTM box as the DMZ host for my FIOS router...

Hi, there are alternatives, especially if you have CAT5/ethernet coming out of the ONT to the router; see my post at
https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/20490

for more info.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 MarCow over 11 years ago in reply to BarryG

Thanks - I'll look into that too - the main thing I fund puzzling is that I was using the iOS Cisco VPN client just fine until maybe a couple of weeks ago, so this seems more like an iOS 7 GM issue (which maybe they'll fix, maybe not) as opposed to FIOS, although I wouldn't be surprised if Verizon have done something toi mess things up and the timing is coincidental. Something's certainly changed for me in the last few weeks which broke my VPN setup, and iOS 7 is the most obvious thing.

OpenVPN was very quick to set up just now, and works correctly on iOS 7 as well as on Mac OS 10.8 via the Tunnelblick client.
Cancel
Vote Up 0 Vote Down

Cancel
0 gsx over 11 years ago in reply to MarCow

I've been using Cisco VPN client with my UTM9 and Iphone since ios6 and upgraded some days ago to ios7. I can confirm that it's still working fine.
Rigt after upgrading to ios7 I've deleted the old VPN profile on my iphone and reinstalled the certificate from the UTM user portal. I didn't come across any bugs/restrictions so far [:)] ...
Cancel
Vote Up 0 Vote Down

Cancel

iOS 7 IPSec client not connecting to UTM 9.1

Submitted a Tech Support Case lately from the Support Portal?