topic Re: SSL-VPN: Unable to receive vpn status from service in General Topics

SSL-VPN: Unable to receive vpn status from service

optimumtic — Mon, 10 Jan 2011 10:02:36 GMT

We have a problem to connect a client with Mac OSX v.10.6.6 with netconnect: Error message: Unable to receive vpn status from service.

In the FW we can see that vpn client configuration is generated successfully: slvpn-config-succ SSL VPN client configuration generated. User name: test, Private IP: 172.20.60.6, Client version 1.2.0-402, Client OS: Mac OSX (Version 10.6.6).

Does ssl-vpn client 1.2.0 have any problem with client Mac OSX v.10.6.6?

Re: SSL-VPN: Unable to receive vpn status from service

gsamuels — Tue, 11 Jan 2011 03:42:40 GMT

Hi,

There are no known issues with Mac OSX version 10.6.6, please confirm this device is not running any additional antivirus or firwall settings as this has been the most common cause of ssl connectivity issues.

Regards,

Gary S.

Re: SSL-VPN: Unable to receive vpn status from service

gswcowboy — Tue, 11 Jan 2011 13:12:40 GMT

Hi,

Could you please confirm that popup blocker is disabled along with cookies allowed in Safari?

Thanks,

Renato

Re: SSL-VPN: Unable to receive vpn status from service

Arrowsight — Mon, 24 Jan 2011 17:07:29 GMT

I am receiving the same symptom as well with mac os x 10.6.6 - firewall is set to disable, no antivirus

popup blocker not enabled.

Re: SSL-VPN: Unable to receive vpn status from service

gswcowboy — Mon, 24 Jan 2011 18:20:05 GMT

Hi Arrowsight,

I would suggest calling Support and opening up a case. We'll possibly need to investigate further.

Regards,

Renato

Re: SSL-VPN: Unable to receive vpn status from service

optimumtic — Tue, 25 Jan 2011 08:22:41 GMT

Hi, finally I opened a support ticket and PA support solved me this issue.

My problem was that I needed a new rule that allow traffic UDP 4501 with source zone untrust to my public IP with vpn services. This port is used to establish IPSec connection in Mac OS X 10.6.6.

With windows clients this port is not necessary and vpn works successfully.

I hope it help you.

Re: SSL-VPN: Unable to receive vpn status from service

Arrowsight — Tue, 25 Jan 2011 16:48:27 GMT

Yes, that is correct. After I posted the question, I found that one of the application on the firewall was blocked. I was surprise MAC uses IPSEC instead of SSL.

Re: SSL-VPN: Unable to receive vpn status from service

garretta — Thu, 17 Feb 2011 16:00:16 GMT

thanks for posting the results -- the inbound UDP/4501 was the solution.

It's interesting to note this UDP/4501 conversation is required from netconnect 1.2 on OS_X (10.6.6).

Once NetConnect connection establlished, the subsequent traffic logged as SSL. (assumign this is IPsec encapsulated inside SSL ).

Note that VPN User session information (/network tab/ssl-vpn/more users info) lists connection as IPsec.

UDP/4501 part of some RFC for IPSEC and NAT-transversal.

Re: SSL-VPN: Unable to receive vpn status from service

Arrowsight — Thu, 17 Feb 2011 16:21:57 GMT

So the question is, why would some vpn user post as IPSEC and some as SSL on the Network Tab -> SSL VPN information? Shouldnt the table be more consistent in outputing the information if IPSEC is encapsulated within the SSL. I've noticed once we open the floodgate of IPSEC for vpn users, it seems that IPSEC is now showing up more on SSL VPN information than before.

Thanks.