SOLVED: IPSec VPN + IOS "On Demand"
-
Hello. I am hoping someone has heard of this issue and/or knows how to fix it…
I have a VPN setup successfully with IPsec and Certificate. Everything works fine until I tell the IOS device to use the VPN "On Demand" in the profile setup. This forces the VPN to connect when you access a specific site/domain.
When I do this, it breaks the VPN. The iPhone says "An unexpected error occurred." and can't connect. Here are the logs... Is this a known IOS issue maybe?
Dec 23 13:45:58 charon: 13[ENC] <24> parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ] Dec 23 13:45:58 charon: 13[IKE] <24> received NAT-T (RFC 3947) vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-08 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-07 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-06 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-05 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-04 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-03 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-02 vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received XAuth vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received Cisco Unity vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received FRAGMENTATION vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> received DPD vendor ID Dec 23 13:45:58 charon: 13[IKE] <24> 0.0.0.0 is initiating a Main Mode IKE_SA Dec 23 13:45:58 charon: 13[ENC] <24> generating ID_PROT response 0 [ SA V V V V V ] Dec 23 13:45:58 charon: 13[NET] <24> sending packet: from 1.1.1.1[500] to 0.0.0.0[4708] (180 bytes) Dec 23 13:45:58 charon: 14[NET] <24> received packet: from 0.0.0.0[4708] to 1.1.1.1[500] (228 bytes) Dec 23 13:45:58 charon: 14[ENC] <24> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ] Dec 23 13:45:58 charon: 14[IKE] <24> remote host is behind NAT Dec 23 13:45:58 charon: 14[IKE] <24> sending cert request for "C=XX, ST=XXXXXX, L=XXXXXX, O=XXXXXX, E=XXXX@XXXXXX.XXX, CN=XXXXXX" Dec 23 13:45:58 charon: 14[ENC] <24> generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ] Dec 23 13:45:58 charon: 14[NET] <24> sending packet: from 1.1.1.1[500] to 0.0.0.0[4708] (389 bytes) -
Ok. I hate replying to my own topic, but incase anyone else is having this problem, I thought I would update status…
I found out it is indeed an IOS issue.... I was running IOS 9.0.2...
Updated to latest IOS 9.2 and it solved the problem.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.