Useful if you’re:
- on OS X
- using the Cisco VPN Client 4.9.01 or below
- are behind a router/NAT
- and having intermittent connectivity issues with the Berkeley Campus Full Tunnel VPN
You might also be able to use this info if you have a similar network setup and having similar problems, but I’m not going to claim that.
Basically, the problem for me was that three connections out of four would get an IP address from the VPN, but the actual network is unreachable. No IP can be ping’ed successfully. The VPN GUI reports “Bytes In: 0, Bytes Out: xxxx”. The VPN log is stuck in a loop of:
Sending DPD request to xx.xx.xx.xx, our seq# = 1234
...
Received DPD ACK from xx.xx.xx.xx, seq# received = 1234, seq# expected =
1234
...
The solution that I’ve found is to switch on Enable Transparent Tunneling -> IPSec over UDP ( NAT / PAT ). This can be done by hitting Modify on the GUI, for the appropriate Connection Entry. Then, use the Transport tab and tick on the appropriate box. For good measure, I also forwarded ports 500 and 4500 on my router’s NAT, to ensure that the conventional Cisco VPN ports are open to the network (and just to do some irrational voodoo). The IPSec over TCP option, btw, does not appear to work, despite what Berkeley IT say in the instructions page. The client refuses to connect with that option active, though in theory it should have worked. Perhaps I’m not forwarding the right ports for it.
In any case, finally, after 1.5 years of this nonsense, the Berkeley VPN doesn’t choke on me anymore (too bad I’ll be leaving here in 6 months. Argh.). Every connection I make gets through on the first time, rather than on the fourth or fifth time. It still doesn’t make sense how I was able to connect to the VPN before, though. Why would it fail intermittently, and not always?
This is why I am not a network engineer. It already gives me a headache.
Thank you SO much Liming – you’re fanatastic advice here just saved my ass. I’ve been trying to connect to a VPN via different type of router and although I could, I couldn’t receive any data. In my case the trick was to DESELECT Channel Tunneling. I knew it was something to do with NAT (whatever that means) and I was searching “VPN, Cisco, NAT” etc via google and got your page.
I don’t blame you for getting out of engineering (Who the hell can really understand the complexities of modern networks today anyway – there’s too many variables and things that go wrong for humans to know) but your knowledge has certainly helped me greatly today. Thanks again so much.