Astaro User Bulletin Board
Go Back   Astaro User Bulletin Board > Astaro Gateway Products > VPN: Site to Site and Remote Access
Reload this Page Ipsec and iphone v3
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Welcome to the Astaro User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Page 2 of 2 1 2
Reply
 
LinkBack Thread Tools Display Modes
  #11 (permalink)  
Old 06-26-2009, 12:43 AM
Jack Daniel's Avatar
Moderator
  
Join Date: Jul 2008
Location: Cape Cod, Mass, US
Posts: 381
Default
@Wingman, this appears to be a new issue with the 3.0 software on the iPhone/iPod Touch. We have an open case on the issue and QA is working on it. Apple has apparently changed the behavior of the Cisco IPSec client in 3.0 and is not accepting the certificates as they were in prior versions.

The best temporary workaround is to use L2TP over IPSec until we can sort out what Apple did to certificate handling int he "Cisco" VPNs.


Jack
__________________
Are you Linkedin to Astaro? http://www.linkedin.com/e/gis/139679/189D6C60EC64

Random Rants from an InfoSec Curmudgeon, UnCommon Sense Security Blog http://blog.uncommonsensesecurity.com
Reply With Quote
  #12 (permalink)  
Old 06-26-2009, 07:57 AM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Default
Quote:
Originally Posted by Jack Daniel View Post
@Wingman, this appears to be a new issue with the 3.0 software on the iPhone/iPod Touch. We have an open case on the issue and QA is working on it. Apple has apparently changed the behavior of the Cisco IPSec client in 3.0 and is not accepting the certificates as they were in prior versions.

The best temporary workaround is to use L2TP over IPSec until we can sort out what Apple did to certificate handling int he "Cisco" VPNs.


Jack
thanks Jack
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Reply With Quote
  #13 (permalink)  
Old 06-26-2009, 05:12 PM
Jack Daniel's Avatar
Moderator
  
Join Date: Jul 2008
Location: Cape Cod, Mass, US
Posts: 381
Default
Wingman-

Can you check your X.509 cert and make sure that the listed hostname both matches the ASG's hostname and is in a FQDN (host.domain.ext) format?

Also, please check under Site-to-site VPN > IPSec > Advanced tab, and make sure Strict Policy is not selected in the CRL Box.

Thanks
Jack
__________________
Are you Linkedin to Astaro? http://www.linkedin.com/e/gis/139679/189D6C60EC64

Random Rants from an InfoSec Curmudgeon, UnCommon Sense Security Blog http://blog.uncommonsensesecurity.com
Reply With Quote
  #14 (permalink)  
Old 06-26-2009, 06:36 PM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Default
I haven't configured Site-to-site at all. I only configured remote access>>ipsec and remote access>>cisco vpn client

however, I dont have the strict policy enabled in neither site-to-site nor remote access
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Reply With Quote
  #15 (permalink)  
Old 06-26-2009, 09:04 PM
Jack Daniel's Avatar
Moderator
  
Join Date: Jul 2008
Location: Cape Cod, Mass, US
Posts: 381
Default
OK, thanks- that setting actually carries over to Remote access. Did you get a chance to chack and compare the hostname on the ASG to the X.509 cert?

Jack
__________________
Are you Linkedin to Astaro? http://www.linkedin.com/e/gis/139679/189D6C60EC64

Random Rants from an InfoSec Curmudgeon, UnCommon Sense Security Blog http://blog.uncommonsensesecurity.com
Reply With Quote
  #16 (permalink)  
Old 06-26-2009, 09:44 PM
BAlfson's Avatar
Moderator
  
Join Date: Mar 2007
Location: Oklahoma City
Posts: 5,385
Default
Jack, do you mean that the selection of 'Strict policy' in S-t-S IPsec or Remote Access IPsec affects that for both AND for the Cisco VPN? If that's the case, then I think that you should submit it as a bug in the 7.5 beta contest... you need to get on the scoreboard!

Seriously, since this is some kind of global setting, at least the documentation should be reworked. The good news is that selecting it in S-t-S results in it being selected in Remote Access, too.

Cheers - Bob
PS Does it also affect L2TP over IPsec if using a cert instead of a PSK?
__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!
Last edited by BAlfson; 06-26-2009 at 10:19 PM. Reason: PS
Reply With Quote
  #17 (permalink)  
Old 07-16-2009, 08:32 AM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Exclamation
Quote:
Originally Posted by Jack Daniel View Post
OK, thanks- that setting actually carries over to Remote access. Did you get a chance to chack and compare the hostname on the ASG to the X.509 cert?

Jack
Yes Jack,the hostnames are then same. There is a relevant thread I've opened where my connection is being dropped when trying to connect my iphone. I would appreciate if you could have a look
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Reply With Quote
  #18 (permalink)  
Old 09-05-2009, 12:05 AM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Default
i 've just tested v 7.490 and it seems to work with iphone v3 I am able to connect to user portal and webadmin and trying to resolve why I can't connect to the internet
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Last edited by wingman; 09-05-2009 at 09:34 AM.
Reply With Quote
  #19 (permalink)  
Old 09-05-2009, 09:53 AM
Junior Member
  
Join Date: Aug 2009
Posts: 2
Default
Cisco VPN with iPhone is working with 7.490.

Quote:
I am able to connect to user portal and webadmin and trying to resolve why I can't connect to the internet
Do you have allow http proxy access to the VPN Pool(Cisco) in the allowed networks?
I also have to configure the proxy in the vpn configuration of the iPhone.


Joachim
Reply With Quote
  #20 (permalink)  
Old 09-05-2009, 09:57 AM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Default
haven't done the configuration proxy on my iphone as I am using transparent proxy on ASG
(I've opened a new thread for the issue )

Thanks
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Last edited by wingman; 09-05-2009 at 10:11 AM.
Reply With Quote
Reply
Page 2 of 2 1 2

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 08:20 PM.

 
Contact Us - Astaro User Bulletin Board - Archive - Top

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.


These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases. issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.