[SOLVED] Cisco VPN Client on Windows 10 (Including the new build April 2018 Update) - This works!

***Updated 05/14/18 **
***Please see my edits below for notes on builds 1803, 1709, and back.**

Here's how to get it working in 2 easy steps:

1. Download and install the Sonicwall 64-bit VPN client from HERE (as of this writing).

2. Install the Cisco VPN client.  Edit:  If you get an error that it cannot run on this operating system then just extract the .exe file using WinRar or a similar program and run the .msi file.  Problem solved.

• 64-bit file download (vpnclient-winx64-msi-5.0.07.0440-k9.exe)
• 32-bit file download (vpnclient-win-msi-5.0.07.0410-k9.exe)

3. Perform a quick registry edit: (This step is almost always not optional any longer)

• Open Regedit
• Browse to the registry key HKLM\SYSTEM\CurrentControlSet\Services\CVirtA
• Select the display name to modify:
• x86 - "@oem8.ifn,%CVirtA_Desc%;Cisco Systems VPN Adapter" to "Cisco Systems VPN Adapter"
• x64 - "@oem8.ifn,%CVirtA_Desc%;Cisco Systems VPN Adapter for 64-bit Windows" to "Cisco Systems VPN Adapter for 64-bit Windows"
• Reboot

The first two steps worked for me without the need for registry edit.  I checked and the settings were already spelled correctly on my machine.  Full disclosure my systems are clean Windows 10 installs without being upgrades.

Without installing the Sonicwall client first you will get Error 433 after trying to connect.  Checking the logs shows that it cannot download the key to complete the secure connection.

What happens is that the Sonicwall client adds the DNE Lightweight filter network client on the machine.  I tried getting it directly from Citrix and installing it that way but was unsuccessful.

Using this method you can now get some more use out of the Cisco VPN client.  If you prefer you can uninstall the Sonicwall client afterward.  I've been told by several people that the DNE software remains even after the Sonicwall client is removed.

Build 1803

WARNING:  You should uninstall the Cisco VPN client prior to running this upgrade so repairing it afterward will make it much easier.  All of the steps above still work on this latest build 1803 (OS Build 17134.1).  No other edits required to keep it running.

Build 1709 Fall Creator's Update

WARNING:  You should uninstall the Cisco VPN client prior to running this upgrade so repairing it afterward will make it much easier.  All of the steps above still work on this latest "Fall Creator's Update" upgrade of Windows 10.

Build 1703 Creator's Update EDIT: Updated 04/11/2017

WARNING:  You should uninstall the Cisco VPN client prior to running this upgrade so repairing it afterward will make it much easier.  All of the steps above still work on this latest "Creator's Build" upgrade of Windows 10.

Now for the not-so-fun-details.  I didn't uninstall prior to the upgrade and proceeded to spend the next 30 minutes clearing out registry entries until I finally found the right one to let me reinstall the product using the .MSI file.  After doing that, and making the registry edit, my VPN client is again working properly.

Version 1607 Build 14393.10 EDIT: Updated 08/03/2016

All of the steps above still work on this latest "Anniversary" build of Windows 10.  As with the 1511 build mentioned below, you will have to run a repair on the program or just do a clean install to get it working because Microsoft yet again determined that they would control which program we use.

You can go HERE to download the latest version of the media downloader and get version 1607.

And not to be left out HERE is a link to all of the new features in 1607 for IT pros.

As I update my Windows 10 machines I'll post updates if there are any issues or errors I run across with this build.  As I always say.... good luck.

BUILD 1511 EDIT: Updated 1/20/2016

I'm getting a lot of feedback about networking being broken after 1511.  I would highly advise you remove the Cisco VPN client and Sonic Global client software prior to installing build 1511.

I have now upgraded three different systems to 1511.  By removing both the Sonicwall and Cisco VPN software first, I had zero issues with it working properly afterward.

However, if the upgrade went through already, here's what you can do to help mitigate these issues.  There's no guarantee this is going to work but I have had two instances where the Cisco VPN software was removed by the 1511 upgrade and I was able to get it working by following the next steps below:

First just reinstall the VPN client using the .MSI file and not the .EXE file.  This will bypass Windows 10 checking the compatibility as I listed at the top.  Next just make the registry edits again and you'll be good to go.  After the registry edits, I have not had to restart but you can if you feel the need just to be sure.

If this does not work as an extra effort you will need to reset all networking on Windows 10.  Luckily this is pretty easy to do.

- Open an administrator command prompt
- Run "netcfg -d"
- Reboot and reconfigure your networking as needed.

Here's a sample of the output you will see:

Microsoft Windows [Version 10.0.10586]
(c) 2016 Microsoft Corporation.  All rights reserved.

C:\WINDOWS\system32\netcfg -d
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
NetSetup object deleted successfully on MUX
Successfully commited changes to the registry
Successfully commited changes to the registry
We are going to reboot now to complete the clean up. Save all of your work.

Press any key to continue…

I hope this helps out with the additional headaches caused by 1511.  As always if I find any more useful information with future updates to Windows 10 that affect this software, I'll be sure to update the post.

Good luck!

UCS login Error: Java.io.IOException: Invalid HTTP Response

So trying to check our UCS server I ran into this issue today.

If you aren't running the latest UCS software then certain versions of Java will toss this error.  If you need to get logged in and don't have the option for updating the UCS software right away then here's how you can get around it.

Just enable HTTP via SSH and you can then login.  Remember to disable this once you have your UCS software and Java versions current because until you do everything is transmitted in clear text.

UCS# scope system
UCS /system# scope services
UCS /system/services# enable http
UCS /system/services# disable http-redirect
Warning: When committed, this closes all web sessions
UCS /system/services# commit

Once this is done now you can connect to the UCS Manager without the error.

Convert Cisco 1700/2700 Series APs to Autonomous Mode

For smaller environments it's not always cost effective to buy a WLC so the need arises to put the APs into autonomous mode.

Since the 1700/2700 series APs ship in lightweight mode, here's how to change them over to autonomous mode:

1.  Log in to www.cisco.com
2.  Click on "Support" at the top of the page.
3.  Click the "Downloads" button.
4.  Select "Wireless" from the left side.
5.  Select "Access Points".
6.  Select "Cisco 1700 Series Access Points".
7.  Select Cisco Aironet 1702i Access Points".
8.  Click "Autonomous AP IOS Software".  As of this writing the latest version is 15.3.3-JBB1(ED)
9.  Connect to the AP using a console cable.
10.  Power on the AP.  If you have a POE switch then that way is best.  If not use a power injector or power cord for the AP.
11.  Start a TFTP server on your laptop or PC and set the LAN interface to 10.0.0.1 255.25.255.0
12.  Open a serial connection to the AP.  Once the boot up finishes log in.  Remember the default password is Cisco.
13.  Enter the following commands in this order:

• enable
• debug capwap console cli
• debug capwap client no-reload
• capwap ap ip address 10.0.0.2 255.255.255.0
• capwap ap ip default-gateway 10.0.0.1
• archive download-sw /force /overwrite tftp://10.0.0.1/filename.tar

14.  Once the upload, extraction, and installation is complete (3 to 5 minutes) the AP will restart.

15.  Once the restart is completed log in and do a show version command.

16.  Verify the AP now provides access to the full suite of IOS commands.

17.  Configure as needed.

If you get any errors from the AP while it is still in lightweight mode during this process I find it easiest to just put these commands into a text file and then paste them into Putty vs trying to type them in with the lines scrolling.

I hope this helps you get your APs setup faster and don't have to deal with a complicated process.

Good luck.

Backup Cisco WLC Configuration (Without Cisco Prime)

This article is part of a new mini-series here on my blog as I work toward obtaining my Cisco Wireless 640-722 CCNA certification.

The official way Cisco wants you to do this is to buy and implement Cisco Prime.

One way you can get around this is to use SolarWinds CatTools to send commands to your devices.

Using this I configured a job to connect to the WLC via SSH and push a backup of the config to my TFTP server.  Here's how:


>transfer upload mode tftp
>transfer upload datatype config
>transfer upload filename WLC-Config-Backup_%DateISO%.txt
>transfer upload path .
>transfer upload serverip 192.168.1.5
>transfer upload start

Once you select "Y" to begin the backup you'll see in the text a warning that file encryption is disabled.  Solarwinds CatTools can answer this Y or Yes if needed.  After this the config will push to your TFTP directory.

The variable in the command %DateISO% will automaticaly fill out the date of the file for you.  As of now the freeware version is limited to 5 devices and 5 activities only.

If you need more it can scale up from there.

Archive Cisco Switch and Router Configs Using TFTP and Configuration Archive

The worst time to realize you don't have a current backup of your switch or router is when that device is having issues or worst case dies and it is actually needed.  For a great comprehensive list of Cisco IOS commands I recommend THIS BOOK.  It's for Amazon Kindle.

Administrators have the ability to run a manual backup of the configs or you can set it to do this automatically or every time you do a "write memory" to save a config change.

Given how easy this is to setup there's no reason for you not to have this on your switches.

Let's dive into how easy this is to setup.

First you'll need a good TFTP server program.  Personally I like the free Solarwinds TFTP Server.  This like is for the Windows version.  You can run it on a server or a workstation if needed.  The price is right, setup is simple, and you'll have this going in a couple of minutes.

Next it's time to setup the switch or router to do the automatic backups for you.

Let's look at a couple of way to set this up.

The first way is to just backup each time you do a "write memory".  This is my favorite setup as it does not generate unnecessary network traffic and I know that the files on my TFTP server are the latest config as long as they were saved.

R1(config)#archive R1(config-archive)#path tftp://192.168.1.10/R1-config R1(config-archive)#write-memory R1(config-archive)#exit

Now one of the details I add after the IP address and forward slash is the name of the device so when it creates the automatic backup file I know which device it came from based on the device's host name.

Another way to set this up is to do backups daily for you automatically without the need to a manual update.  This setup will archive every day or if you do a "write memory" command on the switch.

R1(config)#archive R1(config-archive)#path tftp://192.168.1.10/R1-config R1(config-archive)#write-memory R1(config-archive)#time-period 1440

Now these two methods ensure your switch configs are backed up either as you do a change and save it or automatically each day.

Finally the great thing about these auto backups is you can also restore them using the same functions.  One thing to note is that this command does not merge the settings with what is currently running, it fully replaces it so use caution.

R1# configure replace tftp://192.168.1.10/R1-config-3 This will apply all necessary additions and deletions to replace the current running configuration with the contents of the specified configuration file, which is assumed to be a complete configuration, not a partial configuration. Enter Y if you are sure you want to proceed. ? [no]: Y Loading R1-config-3 ! [OK - 3113/4096 bytes]

Capture Cisco confgs with Putty

You can easily capture the configuration file from any network devices like Cisco Routers, Switches etc.. with Putty.  Download Putty

Follow below steps..

1. Launch Putty and connect to your Cisco router/switch/ASA

2. Enter the user exec mode (router> enable)

3. Enter the terminal length 0 command (router# terminal length 0) in order to force the router to return the entire response at once, rather than one screen at a time.  

 

NOTE:  If this is an ASA the command is a bit different (ASA#terminal pager 0)

This allows you to capture the configuration without extraneous −−more−− prompts generated when the router responds one screen at a time.

 

4. Right-click on the menu bar of the putty screen and select “change Settings”

5. Go to Session and click on Logging, select “Log all session output”

6. Click on Browse and choose the location and name of the file (I like to place my config file on my desktop – C:\Documents and Settings\Administrator\Desktop\ASAconfig.txt or SW1config.txt)

7. Click apply

8. Now enter the show run command (router# show running-config), Logout and see the output in config.txt on your desktop (or the location you chose).

That's all there is to it.  I highly recommend that each time you make a config change you do a quick backup like this.  There's nothing easier to do to come back from a failure than to have a recent config just waiting to be pasted in to get your device back online as quickly as possible.

How to Cluster IronPort C-Series Appliances

This will explain the quick overview of how to cluster two of these devices together to provide an easy way to administer multiple IronPorts on the same network.

1. Login to the IronPort using SSL.  I prefer Putty.

2. Enter CLUSTERCONFIG

3. The CLI will ask if you want to enter cluster mode.  Select Y.

4. You will then see a list of cluster commands.

5. At this point if you have no cluster enter the option to create a cluster.

6. Follow the prompts.  Give it a name, select the ports, etc.  I always recommend setting the cluster to communicate on the internal management IP address.

7. Once the cluster config is complete the IronPort will apply the changes which only takes a minute or so.

8. To add other machines repeat this exact process only selecting the option to join an existing cluster.

9. During the join select the IP address of the first IronPort you put into the cluster.  Follow the prompts and complete the join.

I have found this process very helpful if an IronPort fails because I don't have to take the time to configure the replacement from scratch.  

This setup shares the configs so all you do is bring the replacement IronPort online, give it a static IP address and the same name as the unit you are replacing, login to it via the CLI and join it to the cluster.  

Once you have done that it will copy the configuration  from your cluster and will be ready to run.

Good luck on your cluster setups.

Configure Two Ironport C-Series Devices Where the Backup Hosts the Quarantine

These steps come straight from Cisco and it works like a charm.  This allows the primary device to focus on email filtering and the second device to take care of the quarantine work.  I have another post on how to sync the SLBL on these two devices since users will be getting their information from the backup IronPort.

How to configure two C-Series devices where the backup hosts the Quarantine 

Question: How to configure two C-Series devices where the backup hosts the Quarantine Answer All-in-one-plus-one IronPort Spam Quarantine Configuration

Note: This approach will not work if using Centralized Management.

Many sites will run two IronPort appliances, one that is designated as the "Primary MX" server and processes the majority of mail, and a second appliance as a hot spare that is designated as the "Secondary MX."  If the Primary MX should become unavailable for any reason, then the normal SMTP protocol will redirect traffic to the Secondary MX until the primary is available again.  For sites that wish to deploy the IronPort Spam Quarantine feature for their end-users but do not have enough traffic to justify a dedicated M-Series appliance, we offer the below configuration hints to allow you to configure the Secondary MX system to act as a centralized quarantine for both appliances, and to tell the Primary MX that messages detected as spam should be sent to that central quarantine on the Secondary MX system.

Please note that this configuration should only be used by sites that are not at or near the peak performance throughput on their Primary MX server, or doing equal-weighted load balancing between two appliances, as the additional load of processing end-user quarantined messages could result in reduced throughput in the event of a Primary-to-Secondary fail-over.  For high-volume sites whose multiple appliances are running at or near peak throughput, we recommend deployment of the M-Series appliance to offload quarantine duties from your C-Series appliances.

The second IronPort MGA that will contain the IronPort Spam Quarantine, must be able to identify messages coming from the Primary MTA and force the messages to the Quarantine.  This can be accomplished by using an X-Header once a messages is identified as spam.

To avoid having two IronPort C-Series MGA's scanning the same message be sure to perform the following steps.

Procedure overview:

1. On the Primary

1. Ensure messages received from Primary MX MGA are scanned for Anti-Spam filtering

2. When Spam Positive and/or Suspect Positive, send to the IronPort Spam Quarantine and add X-Header: X-Ironport-Quarantine

2. On the Secondary

1. add a Mail Flow Policy which by-passes Anti-Spam scanning

2. Add a new Sender Group called "Quarantine_From_Primary", set the order # to 1.

3. Configure this Sender Group to accept messages from the Primary appliance

4. Configure this Sender Group to use the Mail Flow Policy created previously

5. Configure the local quarantine on the "secondary" MGA

6. Edit Log Global Settings to monitor the X-header: X-Ironport-Quarantine

3. Test

If this is not setup correctly one message will actually be scanned by both MGA’s before ending up in the quarantine.  

(The following example is using a Sender Group on the secondary MX MGA called "QUARANTINE_FromMail2")

Primary Server

Thu Apr 27 15:05:45 2006 Info: New SMTP ICID 1348 interface Mail (192.168.1.2) address 1.1.1.1 reverse dns host pproxy.gmail.com verified yes

Thu Apr 27 15:05:45 2006 Info: ICID 1348 ACCEPT SG SUSPECTLIST match sbrs[-2.0:-0.5] SBRS -1.4

Thu Apr 27 15:05:45 2006 Info: Start MID 1661 ICID 1348

Thu Apr 27 15:05:45 2006 Info: MID 1661 ICID 1348 From:

Thu Apr 27 15:05:45 2006 Info: MID 1661 ICID 1348 RID 0 To:

Thu Apr 27 15:05:45 2006 Info: Start MID 1661 ICID 1348

Thu Apr 27 15:05:45 2006 Info: MID 1661 ICID 1348 From:

Thu Apr 27 15:05:45 2006 Info: MID 1661 ICID 1348 RID 0 To:

Thu Apr 27 15:05:45 2006 Info: MID 1661 Message-ID '<16ac64320604271305o755483cdx28677153c5e4032@mail.spammer.com>'

Thu Apr 27 15:05:45 2006 Info: MID 1661 Subject 'Fwd: Impotenc-e hellp no doc visilt'

Thu Apr 27 15:05:45 2006 Info: MID 1661 ready 13559 bytes from

Thu Apr 27 15:05:45 2006 Info: MID 1661 matched all recipients for per-recipient policy DEFAULT in the inbound table

Thu Apr 27 15:05:51 2006 Info: MID 1661 using engine: CASE spam positive

Thu Apr 27 15:05:51 2006 Info: EUQ: Tagging MID 1661 for quarantine

Thu Apr 27 15:05:51 2006 Info: MID 1661 antivirus negative

Thu Apr 27 15:05:51 2006 Info: EUQ: Tagging MID 1661 for quarantine (X-Ironport-Quarantine)

Thu Apr 27 15:05:51 2006 Info: MID 1661 queued for delivery

Thu Apr 27 15:05:51 2006 Info: Delivery start DCID 4789 MID 1661 to RID [0] to offbox IronPort Spam Quarantine

Thu Apr 27 15:05:51 2006 Info: Message done DCID 4789 MID 1661 to RID [0]

Thu Apr 27 15:05:51 2006 Info: MID 1661 RID [0] Response 'ok:  Message 22017 accepted'

Thu Apr 27 15:05:51 2006 Info: Message finished MID 1661 done

Secondary Server

Thu Apr 27 15:05:50 2006 Info: New SMTP ICID 121070 interface Mail (192.168.1.2) address 192.168.1.2 reverse dns host unknown verified no

Thu Apr 27 15:05:50 2006 Info: ICID 121070 ACCEPT SG QUARANTINE_FromMail2 match 192.168.1.2 SBRS rfc1918

Thu Apr 27 15:05:50 2006 Info: Start MID 22017 ICID 121070

Thu Apr 27 15:05:50 2006 Info: MID 22017 ICID 121070 From:

Thu Apr 27 15:05:50 2006 Info: MID 22017 ICID 121070 RID 0 To:

Thu Apr 27 15:05:55 2006 Info: ICID 121070 close

Thu Apr 27 15:05:50 2006 Info: Start MID 22017 ICID 121070

Thu Apr 27 15:05:50 2006 Info: MID 22017 ICID 121070 From:

Thu Apr 27 15:05:50 2006 Info: MID 22017 ICID 121070 RID 0 To:

Thu Apr 27 15:05:50 2006 Info: MID 22017 Message-ID '<16ac64320604271305o755483cdx28677153c5e4032@mail.spammer.com>'

Thu Apr 27 15:05:50 2006 Info: MID 22017 Subject '[SPAM] Fwd: Impotenc-e hellp no doc visilt'

Thu Apr 27 15:05:50 2006 Info: MID 22017 ready 13907 bytes from

Thu Apr 27 15:05:50 2006 Info: MID 22017 matched all recipients for per-recipient policy DEFAULT in the inbound table

Thu Apr 27 15:05:50 2006 Info: EUQ: Tagging MID 22017 for quarantine (X-Ironport-Quarantine)

Thu Apr 27 15:05:50 2006 Info: MID 22017 queued for delivery

Thu Apr 27 15:05:54 2006 Info: RPC Delivery start RCID 10882 MID 22017 to local IronPort Spam Quarantine

Thu Apr 27 15:05:54 2006 Info: EUQ: Quarantined MID 22017

Thu Apr 27 15:05:54 2006 Info: RPC Message done RCID 10882 MID 22017

Thu Apr 27 15:05:54 2006 Info: Message finished MID 22017 done

Detailed Steps for Primary Server

1. Ensure messages received from Primary MX MGA are scanned for Anti-Spam filtering

1. Ensure that Anti-Spam scanning is enabled

2. Configure the appropriate Anti-Spam policies on the Incoming Mail Policies page to send Positive and/or Suspect spam to the IronPort Spam Quarantine (now hosted on the Secondary MX appliance)

1. (Mail Policies -> Email Security Manager -> Incoming Mail Policies)

2. Configure the default Mail Policies: Anti-Spam settings ; Positively-Identified Spam Settings actions also to include additional X-header:

1. Header Name: X-Ironport-Quarantine

2. header Text: offbox (any text value will work)

3. If desired, repeat the above for Suspected Spam Settings

4. Setup an External Quarantine

1. Designate the Secondary MX appliance as an External Quarantine host by navigating to Monitor -> Quarantines -> External Quarantines 

2. Click the "Add Quarantine..." button

3. Enter a descriptive name so you know you are routing to your Secondary MX appliance

4. Enter the IP address of the Secondary MX appliance

5. Change the default port from 6025 to 25

6. Submit

7. Commit changes

Detailed Steps for Secondary Server

1. On IronPort that will host the Quarantine (Secondary) add a Mail Flow Policy

1. Select the Mail Flow Policies, beneath the HAT Overview

2. Click the Add Policy, button

3. Name the policy, example: SpamQuarantine 

4. Connection Behavior set to Accept    

5. In the Security Features, turn off Virus Protection and Spam Protection

6. Turn Off Sender Verification

7. Select  Submit

2. Add a new Sender Group called "Quarantine_From_Primary", set the order # to 1.

1. Open the HAT Overview, add a new Sender Group

2. Click Add Sender Group

3. Name: Quarantine_From_Primary

4. Set Order to 1

5. Add comments

6. Select the new Policy created, example SpamQuarantine

7. Leave other fields, unchecked

8. Click the Submit and Add Senders, at the bottom right.

9. Enter the IP of the Primary IronPort.

10. Add comments

11. Check Submit

12. Configure Local Quarantine

13. Enable Local quarantines 

14. Monitor-> Quarantines-> Local Quarantines

3. Edit Log Settings

1. System Administration > Log Subscriptions -> "Global Settings" box,

2. click "Edit Settings..."

3. In the "Headers (Optional)" text box add: X-Ironport-Quarantine

4. Test 

1. Send messages that have spam (use X-header: X-Advertisement: spam)

2. Send messages that do not contain spam

3. Review the logs