Ubuntu 9.10 - the vpn connection 'xxx' failed because there were no valid vpn secrets

[J117]

I'm using Xubuntu 9.10 installed yesterday.

I followed your steps (pptp) (except introducing the user and pass which i did it) and it didn't work in the first time. I restarted the network manager with

sudo /etc/init.d/network-manager restart

And it asked me for my pass (weird because is already there), it also asked me if I wanted to save the pass to the keyring, but I denied everything. Finally it worked. Are you still having troubles?

That fixed my issues with the no secrets stuff.

[isaac_liu]

I am using UBUNTU 9.10 (64 bit) on AMD. I followed all the steps but I got the following messages in the log after I entered my password. I also tried using different options and even command line but this is the best I got. Please help.

Jan 31 14:47:06 Traverse NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.pptp'...
Jan 31 14:47:06 Traverse NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.pptp' started (org.freedesktop.NetworkManager.pptp), PID 2684
Jan 31 14:47:06 Traverse NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.pptp' just appeared, activating connections
Jan 31 14:47:06 Traverse NetworkManager: <info> VPN plugin state changed: 1
Jan 31 14:47:13 Traverse NetworkManager: <info> VPN plugin state changed: 3
Jan 31 14:47:13 Traverse pppd[2687]: Plugin /usr/lib/pppd/2.4.5//nm-pptp-pppd-plugin.so loaded.
Jan 31 14:47:13 Traverse NetworkManager: <info> VPN connection 'AnsoftVPN' (Connect) reply received.
Jan 31 14:47:13 Traverse pppd[2687]: pppd 2.4.5 started by root, uid 0
Jan 31 14:47:13 Traverse pptp[2689]: nm-pptp-service-2684 log[mainptp.c:314]: The synchronous pptp option is NOT activated
Jan 31 14:47:13 Traverse pppd[2687]: Using interface ppp0
Jan 31 14:47:13 Traverse pppd[2687]: Connect: ppp0 <--> /dev/pts/3
Jan 31 14:47:13 Traverse NetworkManager: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/ppp0, iface: ppp0)
Jan 31 14:47:13 Traverse NetworkManager: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/ppp0, iface: ppp0): no ifupdown configuration found.
Jan 31 14:47:44 Traverse pppd[2687]: LCP: timeout sending Config-Requests
Jan 31 14:47:44 Traverse pppd[2687]: Connection terminated.
Jan 31 14:47:44 Traverse NetworkManager: <info> VPN plugin failed: 1
Jan 31 14:47:44 Traverse NetworkManager: SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/ppp0, iface: ppp0)
Jan 31 14:47:44 Traverse pppd[2687]: Modem hangup
Jan 31 14:47:44 Traverse NetworkManager: <info> VPN plugin failed: 1
Jan 31 14:47:49 Traverse pppd[2687]: Exit.
Jan 31 14:47:49 Traverse NetworkManager: <info> VPN plugin failed: 1
Jan 31 14:47:49 Traverse NetworkManager: <info> VPN plugin state changed: 6
Jan 31 14:47:49 Traverse NetworkManager: <info> VPN plugin state change reason: 0
Jan 31 14:47:49 Traverse NetworkManager: <WARN> connection_state_changed(): Could not process the request because no VPN connection was active.
Jan 31 14:47:49 Traverse NetworkManager: <info> Policy set 'Auto default' (wlan0) as default for routing and DNS.
Jan 31 14:48:02 Traverse NetworkManager: <debug> [1264967282.001826] ensure_killed(): waiting for vpn service pid 2684 to exit
Jan 31 14:48:02 Traverse NetworkManager: <debug> [1264967282.002028] ensure_killed(): vpn service pid 2684 cleaned up

[isaac_liu]

I entered the wrong IP for the VPN host. Now I managed to connect. But the speed is too slow to be of any use. I remember that I have seen posts talking about speed. I will work on it later.

Thanks to everyone who has posted helpful information everywhere!

[gladstone1990]

Sweisler,

Your instructions on pptp were excellent and worked perfectly.

You've saved me a lot of annoyance walking back and forth to Uni to get data.

Cheers dude.

[RayDeCampo]

I have posted sweisler's excellent synopsis to https://wiki.ubuntu.com/VPN. I would encourage anybody who has any additions or edits to update there as well.

[emab]

Here's a synopsis of my VPN setups. I have proven this to work on both x86 and x64 for all 3 VPN types.

Important note/disclaimer: I tested these configurations on VMware Workstation 7 VM's and a Dell Vostro 220. All installations were fresh installs, not upgrades. Also, please notice that I detail what type of firewall/VPN I am connecting to for each VPN type. There are so many variations on these VPN implementations that it is extremely difficult to generalize a known-good configuration for each.

1. Install various VPN components

a. PPTP

• pptp-linux
• network-manager-pptp

b. VPNC

• vpnc
• network-manager-vpnc

c. OpenConnect

• openconnect
• network-manager-openconnect

2. Reboot

3. PPTP VPN Configuration - This setup works for connecting to ISA 2004/2006 PPTP VPNs. It should work for connecting to MS PPTP VPN implementations in general. I can't speak for other PPTP VPN implementations.

a. Create new PPTP connection

• VPN Tab Settings

• Set Connection name
• Set Gateway
• Set username (for domain-based user accounts, use domain\username)
• DO NOT SET PASSWORD
• DO NOT SET NT DOMAIN

• PPTP Advanced Options (Advanced button)

• uncheck all auth methods EXCEPT MSCHAPv2
• check "Use Point-to-Point encryption (MPPE)"
  
  

  • leave Security set at "All Available (Default)"
  • trying to force encryption level causes this option to become unset
• check "Allow stateful inspection"
• uncheck "Allow BSD Data Compression"
• uncheck "Allow Deflate Data Compression"
• uncheck "Use TCP Header Compression"
• uncheck "Send PPP Echo Packets" (although connection works either checked or unchecked)

• save configuration

b. Initial Connection attempt

• enter password in login box
• DO NOT check either password save box at this time
• once connection establishes, verify remote connectivity - ping, rdp, ssh, etc.
• disconnect VPN session

c. 2nd connection attempt

• enter password in login box
• check both password save option boxes
• once again verify remote connectivity
• disconnect VPN session

d. Subsequent connection attempts

• VPN session should automatically connect using saved auth credentials

4. VPNC VPN Configuration - This setup works connecting to an ASA5510 - software version 8.2(1). I didn't have any other Cisco devices to test against.

a. Create new VPNC connection

• set connection name
• set Gateway
• set Group Name
• set User Password to "Saved" and enter password
• set Group Password to "Saved" and enter password
• set username
• set domain (if applicable)
• leave Encryption Method at "Secure (Default)"
• set NAT traversal to "NAT-T"
• save configuration

b. Initial Connection attempt

• open VPNC connection
• if prompted, select "Always Allow" if you want connection to be automatic
• verify remote connectivity - ping, rdp, ssh, etc.
• disconnect VPN session

c. Subsequent connection attempts

• open VPNC connection - session should automatically connect

5. OpenConnect VPN Configuration - This setup works connecting to an ASA5510 - software version 8.2(1). I didn't have any other Cisco devices to test against.

a. Create new OpenConnect connection

• set connection name
• set Gateway
• set Authentication type to "Password/SecurID"
• no need to set username, OpenConnect won't store it yet
• save configuration

b. Initial connection attempt

• open VPN connection
• check "Automatically start connecting next time"
• click Close
• you will get the "No Valid VPN Secrets" VPN failure message

c. 2nd connection attempt

• open VPN connection
• accept certificate (if prompted)
• change Group (if necessary)
• enter username (may need to be domain\username)
• enter password
• click Login
• if VPN connection fails, see note below
• verify remote connectivity - ping, rdp, ssh, etc.
• disconnect session

d. Subsequent connection attempts

• open VPN connection
• enter password
• session should connect

Note: If you get the "Login Failed" message, cancel and wait 15-30 minutes before attempting to connect again. Also, I ended up having to use the NT style domain\username pair for authentication, even though a Cisco AnyConnect client connecting to the same ASA only requires username.

More Detail: OpenConnect has been brutal to get connected. I got failed attempt after failed attempt. When I checked the NPS (IAS) log and the Security Event log on the W2K8 domain controller, I could see my user account authenticating properly via RADIUS from the ASA. Yet the OpenConnect client came back with a "Login Failed" message. I'm not an ASA expert, so I have no idea what to check in the ASA configuration to troubleshoot this problem, other than the basic AAA configuration. But I believe the problem lies in the ASA configuration because when I get the OpenConnect "Login Failed" message, the AnyConnect client from my Windows laptop fails as well. I think it may be a ridiculously short timeout or max failure setting. Whatever the issue is, I have to wait for some length of time (~15-30 minutes) for whatever the problem is to reset.

However, once I finally get the OpenConnect client to successfully connect, it worked from then on. (Just don't mess with the connection configuration, or you will get to go thru this whole process again.)

-----------------------------

P.S. Please leave me feedback for what worked and didn't work for you. Also, if you can, please post a short description documenting what firewall/VPN device you were connecting to and any modifications you may have made to the VPN connection configuration. Maybe we can make this a thread for known-good configurations.

Thanks.

thank you very useful

[marge123]

Hi, Sweisler --

Reporting here on the happy result of your instructions above.

After installing and verifying the installation of the packages you listed, I set up a PPTP connection as described. It succeeded on the 2nd attempt with both "password save option boxes" checked.

Thank you so much for this information -- I'd been troubleshooting this for about 6 hours when i made one last attempt using the error message for search criteria.

My connection is to a corporate VPN server on a Microsoft network with Active Directory. Can't tell you what the version is. LDAP is v3.

I access the server through a LAN, that is maintained by my son, who runs Debian. I presume that the firewall is a Debian package.

Again, thanks so much.

Marge123

[lajfi]

Here's a synopsis of my VPN setups. I have proven this to work on both x86 and x64 for all 3 VPN types.

Important note/disclaimer: I tested these configurations on VMware Workstation 7 VM's and a Dell Vostro 220. All installations were fresh installs, not upgrades. Also, please notice that I detail what type of firewall/VPN I am connecting to for each VPN type. There are so many variations on these VPN implementations that it is extremely difficult to generalize a known-good configuration for each.

1. Install various VPN components

a. PPTP

• pptp-linux
• network-manager-pptp

b. VPNC

• vpnc
• network-manager-vpnc

c. OpenConnect

• openconnect
• network-manager-openconnect

2. Reboot

3. PPTP VPN Configuration - This setup works for connecting to ISA 2004/2006 PPTP VPNs. It should work for connecting to MS PPTP VPN implementations in general. I can't speak for other PPTP VPN implementations.

a. Create new PPTP connection

• VPN Tab Settings

• Set Connection name
• Set Gateway
• Set username (for domain-based user accounts, use domain\username)
  
• DO NOT SET PASSWORD
  
• DO NOT SET NT DOMAIN

• PPTP Advanced Options (Advanced button)

• uncheck all auth methods EXCEPT MSCHAPv2
• check "Use Point-to-Point encryption (MPPE)"
  
  • leave Security set at "All Available (Default)"
  • trying to force encryption level causes this option to become unset
• check "Allow stateful inspection"
• uncheck "Allow BSD Data Compression"
• uncheck "Allow Deflate Data Compression"
• uncheck "Use TCP Header Compression"
• uncheck "Send PPP Echo Packets" (although connection works either checked or unchecked)

• save configuration

b. Initial Connection attempt

• enter password in login box
• DO NOT check either password save box at this time
• once connection establishes, verify remote connectivity - ping, rdp, ssh, etc.
• disconnect VPN session

c. 2nd connection attempt

• enter password in login box
• check both password save option boxes
• once again verify remote connectivity
• disconnect VPN session

d. Subsequent connection attempts

• VPN session should automatically connect using saved auth credentials

4. VPNC VPN Configuration - This setup works connecting to an ASA5510 - software version 8.2(1). I didn't have any other Cisco devices to test against.

a. Create new VPNC connection

• set connection name
• set Gateway
• set Group Name
• set User Password to "Saved" and enter password
• set Group Password to "Saved" and enter password
• set username
• set domain (if applicable)
• leave Encryption Method at "Secure (Default)"
• set NAT traversal to "NAT-T"
• save configuration

b. Initial Connection attempt

• open VPNC connection
• if prompted, select "Always Allow" if you want connection to be automatic
• verify remote connectivity - ping, rdp, ssh, etc.
• disconnect VPN session

c. Subsequent connection attempts

• open VPNC connection - session should automatically connect

5. OpenConnect VPN Configuration - This setup works connecting to an ASA5510 - software version 8.2(1). I didn't have any other Cisco devices to test against.

a. Create new OpenConnect connection

• set connection name
• set Gateway
• set Authentication type to "Password/SecurID"
• no need to set username, OpenConnect won't store it yet
• save configuration

b. Initial connection attempt

• open VPN connection
• check "Automatically start connecting next time"
• click Close
• you will get the "No Valid VPN Secrets" VPN failure message

c. 2nd connection attempt

• open VPN connection
• accept certificate (if prompted)
• change Group (if necessary)
• enter username (may need to be domain\username)
• enter password
• click Login
• if VPN connection fails, see note below
• verify remote connectivity - ping, rdp, ssh, etc.
• disconnect session

d. Subsequent connection attempts

• open VPN connection
• enter password
• session should connect

Note: If you get the "Login Failed" message, cancel and wait 15-30 minutes before attempting to connect again. Also, I ended up having to use the NT style domain\username pair for authentication, even though a Cisco AnyConnect client connecting to the same ASA only requires username.

More Detail: OpenConnect has been brutal to get connected. I got failed attempt after failed attempt. When I checked the NPS (IAS) log and the Security Event log on the W2K8 domain controller, I could see my user account authenticating properly via RADIUS from the ASA. Yet the OpenConnect client came back with a "Login Failed" message. I'm not an ASA expert, so I have no idea what to check in the ASA configuration to troubleshoot this problem, other than the basic AAA configuration. But I believe the problem lies in the ASA configuration because when I get the OpenConnect "Login Failed" message, the AnyConnect client from my Windows laptop fails as well. I think it may be a ridiculously short timeout or max failure setting. Whatever the issue is, I have to wait for some length of time (~15-30 minutes) for whatever the problem is to reset.

However, once I finally get the OpenConnect client to successfully connect, it worked from then on. (Just don't mess with the connection configuration, or you will get to go thru this whole process again.)

-----------------------------

P.S. Please leave me feedback for what worked and didn't work for you. Also, if you can, please post a short description documenting what firewall/VPN device you were connecting to and any modifications you may have made to the VPN connection configuration. Maybe we can make this a thread for known-good configurations.

Thanks.

just letting you know the above works perfectly! thanks a million !

[samjam]

I'm using Xubuntu 9.10 installed yesterday.

I followed your steps (pptp) (except introducing the user and pass which i did it) and it didn't work in the first time. I restarted the network manager with

sudo /etc/init.d/network-manager restart

And it asked me for my pass (weird because is already there), it also asked me if I wanted to save the pass to the keyring, but I denied everything. Finally it worked. Are you still having troubles?

Fixed it for me too! I wasted half a day until I found your suggestion.

Thanks

Sam

[fishtron]

Thanks a billion. On Lucid, only took two tries to get through to my university's cisco vpn configuration.

Steps: installed everything and created a new configuration, failed to connect the first time ("VPN Service ended unexpectedly"). Certificate prompt did not come up. Second time, certificate popped up, then I entered my credentials, and was able to log in.