Calling all CiscoVPN server admins

[Patrick]

I have the Ciscovpn client running on my laptop. I'm trying to connect into my work network and I get the following message:
Secure VPN Connection terminated by Peer.
Reason: Firewall Policy Mismatch

I setup the log and trapped this:
132 13:30:18.625 11/15/2006 Sev=Info/4 IKE/0x43000081
Delete Reason Code: 11 --> PEER_DELETE-IKE_DELETE_FIREWALL_MISMATCH.

159 13:30:19.623 11/15/2006 Sev=Info/4 IKE/0x4300004B
Discarding IKE SA negotiation (I_Cookie=8AB99B019B62AC27 R_Cookie=D14664CFB23BBB31) reason = PEER_DELETE-IKE_DELETE_FIREWALL_MISMATCH

It appears that the vpn server requires a stateful firewall setting that's only available on the windows client. In effect a stateful firewall prevents the client logging in from accessing any IP addresses except for those within the network you are connecting to.
I found these threads as reported by OSX users:
http://www.macwindows.com/news0105.html
http://forums.macosxhints.com/archive/i ... 55270.html

Anyone know how to set this on the linux client or trick the server? If I can get this working I can throw away the one windows system I have left and use it for something more meaningful. I really detest having to boot into windows.

Thanks in advance.

[Chess]

Sounds like a question for the Experts Exchange.

[Patrick]

I still haven't solved this.
I'm the first person in my company attempting to connect with the Linux client. I know some of the unix guys are able to get in without issue. I'm thinking the server is configured to allow connections with machines running firewall software and only accepting TCP/IP traffic originating from the VPN.

I also noticed this script at the end of the 4.8 release notes:
# Firewall configuration written by Cisco Systems
# Designed for the Linux VPN Client 4.8.00.0490 Virtual Adapter
# Blocks ALL traffic on eth0 except for tunneled traffic
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Allow all traffic in both directions through the VA adapter
-A INPUT -i cipsec0 -j ACCEPT
-A OUTPUT -o cipsec0 -j ACCEPT

# Accept all encrypted VPN Client traffic in either direction on eth0
-A INPUT -i eth0 -p udp -s 0/0 --sport 500 -d 0/0 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp -s 0/0 --sport 500 -d 0/0 --dport 500 -j ACCEPT

-A INPUT -i eth0 -p udp -s 0/0 --sport 4500 -d 0/0 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp -s 0/0 --sport 4500 -d 0/0 --dport 4500 -j ACCEPT

-A OUTPUT -o eth0 -p udp -s 0/0 --sport 1024: -d 0/0 --dport 29747 -j ACCEPT

# Block all other traffic in either direction on eth0
-A INPUT -i eth0 -j REJECT
-A OUTPUT -o eth0 -j REJECT
COMMIT

It's not clear where this should go. Anyone have some tips?

I'll follow up with unix guys at work to see if they're running iptables or something comparable. Anyone else run into this?