Cisco Network Security Troubleshooting Handbook

1.

At Phase I of the IPsec tunnel negotiation of the Remote Access VPN connection request, the VPN client sends the group name (also called tunnel group) and password to the VPN 3000 Concentrator. If the group is configured internally, the VPN 3000 Concentrator validates the group name/password against its internal database. If the group is configured externally, the VPN 3000 Concentrator tries to authenticate the group name and password against an external server, for example, Cisco Secure Access Control Server (CS ACS), Microsoft Active Directory (Microsoft AD) and so on. If the group name and password are invalid, you receive this error message: Unable to negotiate IPsec. You can see the error in the event log with debug (1-9) turned on for AUTH, AUTHDBG, AUTHDECODE, IPSEC, IPSECDBG, and IPSECDECODE.

2.

If the group name is valid, the Group is authenticated via RADIUS if the password for the Group is stored on the RADIUS Server. The RADIUS server can return many attributes for the group or none at all. At a minimum, the RADIUS server should return the Cisco/Altiga attribute "IPsec Authentication = RADIUS" to tell the concentrator how to authenticate the user. If not, the base group's IPsec Authentication method should be set to "RADIUS." Otherwise, the local user authentication on the VPN 3000 Concentrator will occur.

3.

Once the group is authenticated and gets attributes from the Radius Server, the VPN client is asked to enter a username and password. If the group is authenticated locally, the concentrator obtains configuration information such as whether the user should be authenticated against the internal or external database. If authentication was accomplished through the RADIUS server, the concentrator gets this information as a reply attribute. In either case, if the group attribute indicates that the user should be authenticated against an internal server, the concentrator will see if the user is defined internally and will try to authenticate. If the user's authenticity is to be tested against an external server, the concentrator forwards that user's name and password information to the external database, such as a Cisco Secure ACS as configured on the concentrator.

4.

If the user is authenticated via RADIUS, the RADIUS server can return many attributes for the user or none at all. If the RADIUS server returns the attribute CLASS (standard RADIUS attribute #25), the VPN 3000 Concentrator uses that attribute as a group name and moves to Step 6, or else it goes to Step 7.

5.

If the authentication method in the group is set to NONE, the client machine is not prompted to enter its username and password, and the client machine can establish a tunnel via group name and password only.

6.

(Optional) If the user is part of another group, this group is authenticated next. If the user does not belong to another group or the tunnel group, the user defaults to the base group and this step does not occur.

7.

The tunnel group from Step 1 is authenticated again. (This is done in case the Group Lock feature is being used. This feature is available in version 2.1 or later.) If the Group Lock feature is turned on in the tunnel group and user belongs to a different group, then authentication fails at this stage.

8.

If the user is successfully authenticated, the concentrator pushes down the mode configuration to the client machine. Mode configuration includes network lists, banners, assignment of IP addresses, and so on. If the client connection hangs at this point with just "Negotiating IPsec policy" and never establishes a connection, you need to check these logs: IKE, IKEDBG, IKEDECODE (debug should be 1-9). If everything goes well, you should receive this message: "Your Link is now secure."