I'm trying to set up a L2TP/IPSec VPN on a Windows 7 client, to a Cisco ASA 5505 SecPlus license.
ASA have dual WAN connections:
- wan1: a mobile 3G connection behind the ISP router, used for Internet browsing.
- wan2: a DSL connection with "static" DHCP IP, used for incoming firewall traffic.
A static route with tracking is set so if the 3G is down it will failover to DSL:
route wan1 0.0.0.0 0.0.0.0 192.168.98.1 1 track 1
wan2 have this config:
dhcp client route distance 200 ip address dhcp setroute
All that is working fine.
Now I have tried to make a L2TP/IPsec VPN connection from a Windows 7 client to the wan2 interface, I get these errors:
Duplicate first packet detected. Ignoring packet.
Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2
The first error I'm also getting with the "old" Cisco VPN client, using the ASDM Wizard.
ASA version is: 9.1
Question is: Do I miss something? I suspect the dual wan setup to be the problem. Do the ASA send VPN reply back on the default route (wan1)?