topic Re: Global Protect and Android 4.0.4 - problem in General Topics

Global Protect and Android 4.0.4 - problem

_slv_ — Fri, 09 Aug 2013 14:54:28 GMT

Hello

I have working VPN for Windows machines. I need to extend it for Android devices, using client from Android OS.

I'm using login and passwords (not certs) in my VPN config.

I followed by the GlobalProtect-Config-Android-RevB.pdf - part 3

When I try to start VPN on Sony Ericsson Xperia S smartfon I see connecting and after 2-3 minuts - connection timeout.

On PA in logs I have:

1: (ike-nego-p1-start) IKE phase-1 negotiation is started as responder, aggressive mode. Initiated SA: XXX.XXX.14.140[500]-YYY.YYY.124.120[23744] cookie:010170c511f3d5d2:9d6cb13fb537cabb.

2. (ike-nego-p1-fail) IKE phase-1 negotiation is failed as responder, aggressive mode. Failed SA: XXX.XXX.14.140[500]-YYY.YYY.124.120[23744] cookie:010170c511f3d5d2:9d6cb13fb537cabb. Due to timeout.

3. (ike-nego-p1-delete) IKE phase-1 SA is deleted SA: 94.124.14.140[500]-46.77.124.120[23744] cookie:010170c511f3d5d2:9d6cb13fb537cabb.

My portal has commercial SSL certificate.

I can open portal web page without any cert warning (ssl cert is marked as a green and trusted), so I think that isn't a GP certyficate problem.

I tryed to change user password, IKE secret, group name.

Have you any idea what is wrong in my config?

Regards

Slawek

Re: Global Protect and Android 4.0.4 - problem

Retired Member — Fri, 09 Aug 2013 15:25:37 GMT

Hi,

how many routes do you have ? (gateway access route)

Re: Global Protect and Android 4.0.4 - problem

_slv_ — Fri, 09 Aug 2013 16:02:36 GMT

I have only one 0.0.0.0/0

Re: Global Protect and Android 4.0.4 - problem

Retired Member — Fri, 09 Aug 2013 16:18:23 GMT

did you try with another phone ?

Re: Global Protect and Android 4.0.4 - problem

_slv_ — Sat, 10 Aug 2013 10:38:42 GMT

no ... I haven't any other android based phone.

Could someone help me to diagnose this problem on CLI level?

Re: Global Protect and Android 4.0.4 - problem

Retired Member — Sat, 10 Aug 2013 11:33:48 GMT

Any Android device above 4.0.3 should be able to connect (as long as the manufacturer has not made changes to the VPN mechanism which some do)

we had similar issue and after upgrade phone to 4.1.x it was fixed.

any extra logs when using the command less mp-log ikemgr ?

Re: Global Protect and Android 4.0.4 - problem

Retired Member — Sat, 10 Aug 2013 11:37:29 GMT

Also if you haven't read yet, you may see the comments on bottom which have similar issue

Re: Global Protect and Android 4.0.4 - problem

_slv_ — Sat, 10 Aug 2013 11:57:17 GMT

I cant (officially) upgrade to 4.1.x my smartfon

I tryed to make some troubleshooting according to but without success. I need to try it but with WiFi connection (now I was using HSDPA/3G)

I alredy read comments, so like other people I need to open case at support.

Thank You for your help

Regards

SLawek

Re: Global Protect and Android 4.0.4 - problem

_slv_ — Mon, 12 Aug 2013 08:16:03 GMT

I have one information more ... The same android smartfon when is connected via WiFi can estabilish VPN connection without errors!!!

but... there isn't any traffic on VPN tunnel

Re: Global Protect and Android 4.0.4 - problem

_slv_ — Mon, 12 Aug 2013 09:00:35 GMT

My GSM operator change my APN settings in phone and now I can connect by VPN to my PAN device.

Problem with no traffc still exist. If someone has a idea how to solve it please drop a massage.

With regards

Slawek

Re: Global Protect and Android 4.0.4 - problem

Retired Member — Mon, 12 Aug 2013 09:08:30 GMT

that is strange.

if you have another public ip try to add another global protect gateway(no portal needed) and write an access route as internal subnet and see if you have access.

Re: Global Protect and Android 4.0.4 - problem

_slv_ — Tue, 13 Aug 2013 07:34:18 GMT

I did it - nothing has changed. My phone still displayed 0 packet up/down.