topic using vpnc with Palo Alto 4.1 IPSEC/Xauth in General Topics

using vpnc with Palo Alto 4.1 IPSEC/Xauth

DougHughes1 — Sat, 18 Feb 2012 20:48:57 GMT

It seems like the freely and widely available vpnc client should work just fine with the palo alto ipsec/xauth setup, however I must be missing something. I have it working with IPAD with the shared secret + XAUTH with group/password, but with vpnc on linux I get this in the system log:

IKE phase-1 negotiation is failed. Couldn't find configuration for failed IKE phase-1 request for peer IP $IP_ADDRESS[500], ID keyid:646473726573

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

DougHughes1 — Sat, 18 Feb 2012 21:34:29 GMT

one thing of note. I see the udp 500 isakmp queries going to the palo alto, but no replies coming back. This may be normal given the message.

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

DougHughes1 — Sun, 19 Feb 2012 04:03:48 GMT

I got it working with vpnc. It seems like it may have been a case sensitivity or other issue in the group password that was hidden by the opacity of the log message.

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

amansour — Mon, 04 Mar 2013 20:51:38 GMT

Any chance you can post how? Think this would work with Anyconnect?

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

DougHughes1 — Mon, 04 Mar 2013 21:18:04 GMT

Here are the instructions for debian:

as root apt-get install vpnc
And add the following to /etc/vpnc.conf

IPSec gateway <your gateway>

IPSec ID <group name>

IKE Authmode psk

NAT Traversal Mode natt

IPSec secret <your secret>

Xauth interactive

I don't know if it will work with AnyConnect, but it works fine with vpnc and StrongSwan, modulo linux kernel bugs with forced re-keying and disconnects.

Ubuntu:

as root apt-get install network-manager-strongswan
Then, add a new VPN connection from the NetworkManager GUI and select the IPsec/IKE type.
Configuration options are the same as for VPNC

Fedora, Centos, RHEL and other rpm based distros

as root yum install vpnc
and add the following to /etc/vpnc/<policy>.conf

sudo vpnc <policy>

replace <policy> with whatever you want to call your vpn connection.

-----

the following may be useful to help with disconnects:

/etc/vpnc/desres.conf: DPD idle timeout (our side) 0

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

ericgearhart — Tue, 05 Mar 2013 00:29:08 GMT

Just FYI I was able to get vpnc working on both Linux and Mac... XAUTH works great.

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

amansour — Tue, 05 Mar 2013 14:39:06 GMT

Great suggestion, there is a VPNC for Windows and MAC.

Re: using vpnc with Palo Alto 4.1 IPSEC/Xauth

ericgearhart — Tue, 05 Mar 2013 18:29:16 GMT

There's a GUI for Mac too apparently... I haven't test it though:

vpntool - Graphical user interface for VPNC, the open source Cisco VPN client - Google Project Hosting