Member Avatar for ana_eht

hi everyone
I'm trying to use cisco vpn client on my new win 8.1 machine. I had installation error 27850 at first but updated DNE and was able to successfully intall it. but now I cannot connect to the vpn that I want. I receive this error:
Secure VPN Connection terminated locally by the client. Reason 414: failed to establish a TCP connection.

I disabled my internet security software and windows firewall but still get this error message.
Does anyone have any idea what's wrong?

  • 3 Contributors
  • 7 Replies
  • 2K Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by laah.wrizz

Dani AI

Generated

Reason 414 on the legacy Cisco IPsec client almost always means the client tried to use IPsec-over-TCP and could not open a TCP session to the VPN gateway. By default that TCP listener is port 10000 on the ASA, and it must be enabled on the ASA and also selected in the client. If the ASA is not configured for it, the port is mismatched, or a firewall/proxy blocks it, you will see 414. Note that IPsec-over-TCP takes precedence when enabled, but it does not work through proxy-based firewalls. (cisco.com)

Practical checks:

  • In the Cisco VPN Client entry, open Properties -> Transport. If "IPSec over TCP" is selected, try switching to "Enable Transparent Tunneling" with "IPSec over UDP (NAT/PAT)". That uses UDP 500 and 4500 (NAT‑T) and avoids the TCP listener requirement. (cisco.com)

  • If you must use TCP, ask the VPN admin to confirm the ASA has the matching port configured, for example:

    show run | include ipsec-over-tcp
crypto ikev1 ipsec-over-tcp port 10000

    And from your PC, verify reachability of that port:

    # PowerShell (TCP test)
Test-NetConnection vpn.company.com -Port 10000

    (cisco.com)

  • If you sit behind a web proxy, test from a non‑proxied network; IPsec-over-TCP is not supported across proxy-based firewalls. (cisco.com)

Good call by on enabling the client log; also make sure the "Cisco Systems, Inc. VPN Service" is running before you test so the log captures the IKE/TCP handshake. If the tunnel still fails and this is a new Windows 8.1 build, consider moving to AnyConnect/Secure Client; the old Cisco VPN Client 5.x reached end of support on July 30, 2014. (cisco.com)

Recommended Answers

All 7 Replies

Member Avatar for CimmerianX

In the VPN client, enable the LOG then attempt the connection. Review the log or post a sanitized log file here for review.

Member Avatar for ana_eht

I saved the log and here it is:
Cisco Systems VPN Client Version 5.0.07.0440
Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 6.2.9200
Config file directory: C:\Program Files (x86)\Cisco Systems\VPN Client\

Member Avatar for CimmerianX

Thats it? I see no connection attempt.
You might want to remove and reinstall.

Member Avatar for ana_eht

i did a few times :(

Member Avatar for CimmerianX

Well if that is all the log has, then the VPN client is really hosed.

A sanity check: YOu did run this as admin correct?

Member Avatar for ana_eht

lol.. yes.

Member Avatar for laah.wrizz

Please make sure below services are Running
-SMS agent host
-Background intelligence service

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.