AnyConnect not able to establish a connection to the specified secure gateway

AnyConnect was not able to establish a connection to the specified secure gateway – Cisco VPN Linux / RedHat and RHEL / Ubuntu, Debian:

Scenario:

When using the Linux Cisco AnyConnect client x64 (like MAC, Ubuntu, Redhat RHEL and Debian) you might get the error above or if you connect through command like you might get the following errors:

>/opt/cisco/anyconnect/bin/vpn connect vpn.domain.com
Cisco AnyConnect Secure Mobility Client (version 3.1.02043) .

Copyright (c) 2004 - 2013 Cisco Systems, Inc.  All Rights Reserved.

  >> state: Disconnected
  >> state: Disconnected
  >> notice: Ready to connect.
  >> registered with local VPN subsystem.
  >> contacting host (vpn.domain.com) for login information...
  >> notice: Contacting vpn.domain.com.
VPN> AnyConnect cannot verify the VPN server: vpn.domain.com
Connecting to this server may result in a severe security compromise!
AnyConnect is configured to block untrusted VPN servers by default.  
Most users choose to keep this setting.
If this setting is changed, 
AnyConnect will no longer automatically block connections to potentially malicious network devices.

Change the setting that blocks untrusted connections? [y/n]: y

Changing this VPN Preference may result in a severe security compromise!

Change the setting that blocks untrusted connections? [y/n]: y
  >> warning: Connection attempt has failed.
  >> state: Disconnected


>sudo /opt/cisco/anyconnect/bin/vpn connect vpn.domain.com
Cisco AnyConnect Secure Mobility Client (version 3.0.07059) .

Copyright (c) 2004 - 2012 Cisco Systems, Inc.
All Rights Reserved.


>> state: Disconnected
>> state: Disconnected
>> notice: Ready to connect.
>> registered with local VPN subsystem.
>> contacting host (vpn.domain.com) for login information...
>> notice: Contacting vpn.domain.com.
VPN>
>> Please enter your username and password.
Group: VPNGroup

Username: [UserName] UserName
Password:
>> state: Connecting
>> notice: Establishing VPN session...
>> error: AnyConnect was not able to establish a connection to the 
specified secure gateway. Please try connecting again.
>> notice: Connection attempt has failed.
>> state: Disconnected

Resolution:

1- Before you start troubleshooting the issue on the client side, make sure SSL certificates are installed and configured properly on the ASA. Go to http://www.digicert.com/help/ and test your server SSL certificate, if you see any issues, talk to your system admin to fix. In addition to your company SSL certificate, intermediate certificate from the ssl provider needs to be installed on the asa too, and that web tool can show you any issues in that regard (this is a common issue – missing intermediate cert) .

2- Important: Upgrade to the latest Cisco AnyConnect client. You can download that from the cisco TAC site but you need a username and a password. The latest version of Anyconnect as of this article is 3.1.04066.

3- In one of the cases the Cisco ASA had a Go Daddy SSL Certificate. Copying Go Daddy certificate from that Linux SSL Certificate folder to Cisco SSL certificate folder on the linux machine forced Anyconnect to trust that certificate.

sudo cp /etc/ssl/certs/Go* /opt/.cisco/certificates/ca/

If you are using a different 3rd party SSL certificate on the ASA, then you need to copy that certificate the same way

You can also copy all the certificates from /etc/ssl/certs/ to /opt/.cisco/certificates/ca/ if you are not sure what certificate you are using.

If you get this error in Windows make sure you stop Internet Sharing service in Windows services

If you find this article helpful, please send us a note to Mike@bostonIT.com so I can keep on adding quality hands-on articles.

Downgrading Windows 8 to Windows 7 Freezes and hangs

Downgrading Windows 8 to Windows 7 Freezes and hangs – How to install Windows 7:

Scenario:

I had a brand new HP ProBook 4440s Laptop that came preloaded with Windows 8. Customer wanted to downgrade it to Windows 7 x64 but during the very initial steps of the Windows 7 installation, the Windows installation screen would freeze and it wouldn’t go on:

Resolution:

That was basically a BIOS UEFI setting. Reboot PC and go to BIOS, go to System Configuration, Boot Options and change setting there to “Legacy” mode. Change setting, save and reboot. That should fix it. Try installing Windows 7 again and it should work this time.

If you find this article helpful, please send us a note to Mike@bostonIT.com so I can keep on adding quality hands-on articles.

The directory service is missing mandatory configuration

The operation failed because: Active Directory Domain Services could not transfer the remaining data in directory partition DC=ForestDnsZones,DC=domain-name,DC=com to Active Directory Domain Controller \\DC.domain-name.com.
“The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles.”

Scenario:

When trying to demote one of Windows 2008 Domain Controllers, you get the above error message.

Resolution:

Copy the script below into a file and call it Script.vbs.

const ADS_NAME_INITTYPE_GC = 3
const ADS_NAME_TYPE_1779 = 1
const ADS_NAME_TYPE_CANONICAL = 2

set inArgs = WScript.Arguments

if (inArgs.Count = 1) then
' Assume the command line argument is the NDNC (in DN form) to use.
NdncDN = inArgs(0)
Else
Wscript.StdOut.Write "usage: cscript fixfsmo.vbs NdncDN"
End if

if (NdncDN <> "") then

' Convert the DN form of the NDNC into DNS dotted form.
Set objTranslator = CreateObject("NameTranslate")
objTranslator.Init ADS_NAME_INITTYPE_GC, ""
objTranslator.Set ADS_NAME_TYPE_1779, NdncDN
strDomainDNS = objTranslator.Get(ADS_NAME_TYPE_CANONICAL)
strDomainDNS = Left(strDomainDNS, len(strDomainDNS)-1)

Wscript.Echo "DNS name: " & strDomainDNS

' Find a domain controller that hosts this NDNC and that is online.
set objRootDSE = GetObject("LDAP://" & strDomainDNS & "/RootDSE")
strDnsHostName = objRootDSE.Get("dnsHostName")
strDsServiceName = objRootDSE.Get("dsServiceName")
Wscript.Echo "Using DC " & strDnsHostName

' Get the current infrastructure fsmo.
strInfraDN = "CN=Infrastructure," & NdncDN
set objInfra = GetObject("LDAP://" & strInfraDN)
Wscript.Echo "infra fsmo is " & objInfra.fsmoroleowner

' If the current fsmo holder is deleted, set the fsmo holder to this domain controller.

if (InStr(objInfra.fsmoroleowner, "\0ADEL:") > 0) then

' Set the fsmo holder to this domain controller.
objInfra.Put "fSMORoleOwner", strDsServiceName
objInfra.SetInfo

' Read the fsmo holder back.
set objInfra = GetObject("LDAP://" & strInfraDN)
Wscript.Echo "infra fsmo changed to:" & objInfra.fsmoroleowner

End if
End if

 

Now go to command line on that DC and run the script by typing the following:

cscript Script.vbs DC=ForestDNSZones,DC=contoso,DC=com

Where:
DC=costoso is the Windows Domain. My Windows Domain was called Domain1.com so I replaced costoso with Domain1. So the command for me was:

cscript Script.vbs DC=ForestDNSZones,DC=Domain1,DC=com

Now try the dcpromo again.

If that doesn’t work go to command line and type:

DCPromo out fails with: The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles. | zero hour sleep

dsquery * CN=Infrastructure,DC=ForestDnsZones,DC=domain,DC=int -attr fSMORoleOwner

and see if the result show an old DC you had and had demoted previously but still have traces in domain.  Use edsiedit to clean up remove that DC.  
the following article might help you

http://www.zerohoursleep.com/2011/07/dcpromo-out-fails-with-the-directory-service-is-missing-mandatory-configuration-information-and-is-unable-to-determine-the-ownership-of-floating-single-master-operation-roles/

If you find this article helpful, please send us a note to Mike@bostonIT.com so I can keep on adding quality hands-on articles.

BurFlags – D4

Reinitializing/Forcing File Replication Service FRS using Registry key BurFlags D4:

Have you been in the situation where you’re unable to replicate AD changes made across 2003 Domain Controllers? I have been there several times, and the last time was when I was attempting to transfer the Global Catalog role for an Exchange Server migration, however any AD changes I had made never replicated across DCs. Also had failing SYSVOL replication problems. The only thing that worked for me was when I did an Authoritative FRS restore by changing the BurFlags registry key to D4 and then restarting the File Replication service – that was done on the DC that had replication and SYSLOG issues.

BurFlags registry key contains REG_DWORD values, and is located in the following location in the registry:
“HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\ Backup/Restore\Process at Startup”

The most common values for the BurFlags registry key are:

D2: also known as a non-authoritative mode restore.
D4: also known as an authoritative mode restore.

Changing the BurFlags key to D4 will reinitialize replication.

For more instructions, please refer to the following Knowledgebase article:

http://support.microsoft.com/kb/290762

If you find this article helpful, please send us a note to Mike@bostonIT.com so I can keep on adding quality hands-on articles.

Registry Caution: Do not use registry editor to edit the registry directly unless you have no alternative and directed by Microsoft. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows. We recommend you have a full backup of the system before making changes to registry. Do it at your risk. bostonIT doesn’t assume any unintended consequences.

Cisco ASA rommon – Error 15: File not found unable to boot an image

Cisco ASA rommon – Error 15: File not found unable to boot an image:

The above error could be occurring on startup because the ASA didn’t have a boot file image, loaded with the wrong boot image or configured to boot from unavailable source. It might also be a hardware issue with the ASA like a bad flash which means you would have to take it with Cisco or a hardware support provider!

The following instructions will walk you through how to configure the ASA in rommon to boot from a TFTP server, load it to normal mode, copy boot image file from TFTP to ASA again, and then re-load it to boot normally.

– We will assign the ASA Ethernet 0/0 IP 10.1.1.200.
– The name of the Cisco ASA Image file that will be uploaded to the ASA through TFTP is asa-k9.bin.
– Connect the ASA ethernet 0/0 and your computer ethernet to the same network switch.
– Download and install a free TFTP server on your computer and put the asa image asa-k9.bin on the root directory of the tftp server. TFTP server is a very simple software that you can google and download one. www.solarwinds.com has one for instance.
– The ASA and computer are connected to the same network. We are going to use Ethernet0/0 of the asa. The IP Address of TFTP Server (your machine) will be 10.1.1.100 (So you need to manually assign your machine the IP Address 10.1.1.100 and Subnet Mask 255.255.255.0 – No need to assign a gateway or a DNS)

Connect your computer through console to ASA, while the firewall is booting and once you are prompted to “Use BREAK or ESC to interrupt boot”, hit escape and that takes you to rommon: (rommon is like Safe Mode in Windows). Start typing the following:

rommon #0> PORT=ETHERNET0/0
Ethernet0/0
Link is UP MAC Address: 0005-9858-df5g-e21d
rommon #1> ADDRESS=10.1.1.200
rommon #2> SERVER=10.1.1.100
rommon #3> GATEWAY=10.1.1.100
rommon #4> IMAGE=asa-k9.bin
rommon #5> tftp

Booting starts automatically…

Go into enable mode with blank password
ciscoasa# en
hit enter

Go to the Config Mode
ciscoasa# Conf t
hit enter

You might want to format the flash here. Formatting the flash will erase everything on it including OS images and config files which means you will need to load IOS (as explained below). And after you boot normally, you will need to manually reconfigure the asa unless you have a backup configuration to work with.
ciscoasa(config)# format flash
ciscoasa(config)# wr mem

Assign an IP Address to the firewall, default route and copy image file from TFTP:
ciscoasa(config)# interface ethernet 0/0
ciscoasa(config-if)# ip address 10.1.1.200 255.255.0.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# exit
ciscoasa(config)# route outside 0.0.0.0 0.0.0.0 10.1.1.200
ciscoasa(config)# copy tftp: flash:
.
.
.
ciscoasa# write mem

Find out the config register of the ASA, change it to 0x1 to make sure it boots up from flash not TFTP and change boot file name to match the one uploaded to ASA.

ciscoasa# show version
Look toward the end of “show version” and you should see something similar to:
Configuration register is 0x2014

Change Config-Register to 0x1
ciscoasa#Conf t
ciscoasa#(config)> config-register 0x1

ciscoasa#(config)>boot system flash:/asa-k9.bin (if you have different .bin image name, update it here)

Save and reboot.
ciscoasa#Wr mem
ciscoasa#Reload

This will restart the ASA.

If you find this article helpful, please send me a note to Mike@bostonIT.com so I can keep on adding more hands-on knowledgebase articles.