Cisco VPN not working

Question

I want to connect to my university's Cisco VPN from home, but it always fails. Today I took my laptop to university to see if the IT guys could help (they couldn't) and it worked there so the configuration is ok. The router is not blocking anything since it works in windows (I have linux installed alongside windows 7)

I followed this pdf guide from my university and installed vpnc and network-manager-vpnc-gnome for the setup.

After doing

$ less /var/log/syslog | grep NetworkManager

the results were

 NetworkManager[591]: <info> Starting VPN service 'vpnc'...
 NetworkManager[591]: <info> VPN service 'vpnc' started (org.freedesktop.NetworkManager.vpnc), PID 14877
 NetworkManager[591]: <info> VPN service 'vpnc' appeared; activating connections
 NetworkManager[591]: <info> VPN plugin state changed: init (1)
 NetworkManager[591]: <info> VPN plugin state changed: starting (3)
 NetworkManager[591]: <info> VPN connection 'TUDelft' (Connect) reply received.
 NetworkManager[591]:    SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/tun0, iface: tun0)
 NetworkManager[591]:    SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.
 NetworkManager[591]:    SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/tun0, iface: tun0)
 NetworkManager[591]: <warn> VPN plugin failed: 1
 NetworkManager[591]: <info> VPN plugin state changed: stopped (6)
 NetworkManager[591]: <info> VPN plugin state change reason: 0
 NetworkManager[591]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
 NetworkManager[591]: <info> Policy set 'PoptN164' (wlan0) as default for IPv4 routing and DNS.
 NetworkManager[591]: <info> VPN service 'vpnc' disappeared

I also have tried Kvpnc, and it still doesn't work. Kvpnc says: "error: Unable to find "vpnclient" at usr/local/bin/vpnclient"

I'm a newbie to Linux, so if you need any other information, please ask and I'll try to provide it.

I'm using ubuntu 12.04.

Solution 1

Here's how I got this working with Ubuntu 12.10:

First install the following

sudo apt-get install vpnc
sudo apt-get install network-manager-vpnc
sudo apt-get install network-manager-vpnc-gnome

Using the network-manager create a new VPN connection, set at least the following:

Gateway
User name
Group name

If the given group password is encrypted you can decrypt it here (ecrypted password probably will not work):
http://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode

Once these are set if you still have problems connecting try setting the IP address instead of domain name to the Gateway (this is what fixed it for me).

nslookup vpn.provider.com

Solution 2

I found that in my case the plugin was failing because vpnc was not happy about the encryption method

peer selected (single) DES as "encryption" method.
This algorithm is considered too weak today
If your vpn concentrator admin still insists on using DES
use the "--enable-1des" option.

This message could be only discovered by stracing the vpnc process.

In order to add --enable-1des option to vpnc command line I performed the following:

sudo -s

mv /usr/sbin/vpnc /usr/sbin/vpnc.real

cat <<EOF > /usr/sbin/vpnc
#!/bin/sh
exec /usr/sbin/vpnc.real --enable-1des $*
EOF

chmod +x /usr/sbin/vpnc

Basically I replaced the vpnc binary with a wrapper script that supplied the necessary parameter.

Now NetworkManager VPNC plugin can connect properly.

Solution 3

I've just upgraded my system to Ubuntu 12.04 64-bit.

Here is my working solution, that does not need any command line magics. So you have to install some packages to work it correctly.

1. vpnc
2. network-manager-vpnc
3. *network-manager-vpnc-gnome (if you're using gnome)

Now you can access VPN via clicking Network icon on Notification Area.

Comments

[Ashith VL]

Hi, the information on the link is what I already had done, so no luck there. I tried making my own config file, but when I ask to connect, it says: "vpnc: no response from target"

[Philippe]

try adding NAT Traversal Mode cisco-udp at the bottom of the conf file. I added it in the example above

[Ashith VL]

nope, still the same thing

[Ferruccio]

Another way to do this is to add the line Enable Single DES in /etc/vpnc.conf

[djjeck]

OP says he already installed those.