Hi, I have encountered the same problem with Mutual RSA + XAUTH authentication. My client version is 2.1.7 and I use it with ASA 5505 (soft ver.6.2) with mutual PSK authentication. Cisco ASA is configured the same as in this tutorial:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080930f21.shtml <http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080930f21.shtml> I also have Microsoft`s CA. It works perfectly with Cisco VPN Client but doesn`t with Shrew. Has any of you used such dual authentication with success? I have tried probably every option in access manager and I don`t know if there`s any bug in access manager or my configuration is wrong. Logs from ASA are as following: Sep 29 09:06:22 hutmenasa %ASA-6-302015: Built inbound UDP connection 250884 for outside:95.41.84.136/4500 (95.41.84.136/4500) to identity:172.18.1.16/4500 (172.18.1 .16/4500) Sep 29 09:06:22 hutmenasa %ASA-6-713172: Group = Uzytkownicy, IP = 95.41.84.136, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end IS behind a NAT device Sep 29 09:06:22 hutmenasa %ASA-6-717022: Certificate was successfully validated. serial number: 626A0CC20004000000AD, subject name: [email protected],c n=<C5>\201ukasz Trzewiczek,ou=FI,ou=DG,ou=Hutmen,ou=Uzytkownicy,dc=hutmen,dc=pl. Sep 29 09:06:22 hutmenasa %ASA-6-717028: Certificate chain was successfully validated with warning, revocation status was not checked. Sep 29 09:06:22 hutmenasa %ASA-5-713050: Group = Uzytkownicy, IP = 95.41.84.136, Connection terminated for peer . Reason: Peer Terminate Remote Proxy N/A, Local Pr oxy N/A Sep 29 09:06:22 hutmenasa %ASA-3-713902: Group = Uzytkownicy, IP = 95.41.84.136, Removing peer from peer table failed, no match! Sep 29 09:06:22 hutmenasa %ASA-4-713903: Group = Uzytkownicy, IP = 95.41.84.136, Error: Unable to remove PeerTblEntry Sep 29 09:06:22 hutmenasa %ASA-4-113019: Group = , Username = , IP = 0.0.0.0, Session disconnected. Session Type: , Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: Unknown Any help will be appreciated. Regards Lukas On 3/17/2010 7:19 AM, Stefano Lassi wrote: > Hi > I'm using, with very good success, Shrew VPN Client in order to connect > Cisco VPN gateways (IOS, ASA/PIX, VPN3000), using PSK authentication. > Now, I'm trying to connect to same Cisco VPN gateways using Ibrid (RSA + > XAuth) authentication, without success. > Main problem I got is Cisco VPN Server seem not recognizing VPN Group > (profile), normally specified using certificate OU field. > I tested few different client authentication "Identification Type" > options (ASN.1, Key Identifier, etc.) without success: Cisco gateways > report no "group association" were present from client request. > Somebody has got some hints how configure Shrew VPN Client to > correctelly propose right OU field <-> VPN profile association to Cisco > VPN Gateways (correct OU mapping is already correctelly in place on VPN > servers, because they are working fine with RSA authentication against > Cisco VPN Clients ...). > Thank you very much and see you soon > Stefano >
_______________________________________________ vpn-help mailing list [email protected] http://lists.shrew.net/mailman/listinfo/vpn-help
