PIX 506E VPN error "Reason 433" HELP!!!!

[tsap]

This is driving me nuts. I setup ipsec vpn on my cisco pix with the wizard. It works fine...., but when I get a 2nd user to access the VPN it boots the 1st user off and gives this error code....

"Secure VPN Connection terminated by Perr. Reason 433: (Reason Not Specified by Peer)"


I'm using Cisco VPN client Version 4.6.03.0021

PIX version 6.3(4), PDM 3.0(2)

 

[tsap]

I've been looking for a fix since I posted this. I have found nothing with cisco or any other newsgroup or site...

Someone has to know this!!!, HELP!!

 

[N0ktar]

If peer gave no reason for disconnecting the tunnel you should check the peer logs for details. There should be some more information available on this on the client side.

 

[N0ktar]

Is it true in your case that when a second client does connect, it has have the same IP address as the first client and disconnect within seconds?

 

[tsap]

Yes, when it boots off the 2nd client it will have the same IP address as the 1st client had.

I turned logging on, then tested the connections once more. This is what I got. Also note I have a ip pool of 25 addresses..., So I have no idea, why they are fighting over the same one...., But that appers to be happening...


Cisco Systems VPN Client Version 4.6.03.0021
Copyright (C) 1998-2005 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 5.1.2600 Service Pack 2
Config file directory: C:\Program Files\Cisco Systems\VPN Client\

1 15:42:33.400 07/19/05 Sev=Warning/2 IKE/0xA3000067
Received an IPC message during invalid state (IKE_MAIN:507)

 

[N0ktar]

You should test with a different VPN client version, can you than replicate the problem?

 

[tsap]

I have used version 4.6.00.0045, and the same thing happens.

what other version should I try?

 

[N0ktar]

I found a forum thread dealing with a problem similar to yours and the solution there was a client upgrade from 3.6 to 4.0, this is why I suggested using a different client version first.
(

http://www.opennet.ru/openforum/vsluhforumID6/4589.html)

 

[tsap]

Fixed!

After I entered the command "isakmp nat-t"

This allows multple connections from same nat/pat address with encapsulation with UDP 4500

I can now have as many people as I want connected to the vpn. I no longer get the Reason 433 error.