Arun’s Blog

Skip to comment form »

1. Pedro Sousa said on May 2, 2008 at 4:51 pm

   Hi,

   I’ve had Ubuntu 7.10 with Cisco VPN Client up and running. It was somewhat difficult to set up but I managed with this tutorial (http://www.longren.org/2007/05/17/how-to-cisco-vpn-client-on-ubuntu-704-feisty-fawn/). Yesterday I’ve upgraded my distro from 7.10 to 8.0.4 and VPN Client stopped working. I knew this might happen because this is not my first upgrade… Tried several ways to make it work again but with no success.
   Today I stumbled with your tutorial but, like others, you use this option:

   Directory containing linux kernel source code [/lib/modules/2.6.24-16-generic/build]

   I don’t have a build folder!!! Tried to simlink it to /usr/src/ but with no success either…

   Any ideias?!?!? A clean Ubuntu 8.0.4 install is not an option for me, to much work…

   Thanks,
   Pedro

2. Pedro Sousa said on May 2, 2008 at 5:10 pm

   I should have posted my message earlier!!! I’VE GOT IT…. So stupid!!! I was missing linux-headers-2.6.24-16-generic… Only when I posted the previous message that I checked with dpkg If that package was installed… You can guess the answer!!!
   Works like a charm…

   Thanks,
   Pedro

3. Arun said on May 3, 2008 at 2:10 pm

   Glad to know you found it. I don’t get time to check my blog during weekends generally.

4. Patrick said on May 3, 2008 at 7:26 pm

   Thanks for the information, saved me some frustration!

5. Lenwe said on May 4, 2008 at 10:18 pm

   thanks a lot!!!!

6. Russ said on May 5, 2008 at 8:46 am

   Thanks! this was just what I needed. I was in the right area (interceptor.c) but was not a skilled enough kernel hacker to fix it myself. thanks.

   BTW – I did get the Cisco VPN to work with firestarter by opening up the input and output chains to the company class b subnet, e.g.:

   iptables -A INPUT -j ACCEPT -s xxx.xxx.0.0/16 -p all
   iptables -A OUTPUT -j ACCEPT -s xxx.xxx.0.0/16 -p all

   where xxx.xxx is the company internal subnet.

   not pretty, and probably not the most secure arrangement, but with the cisco VPN client running the machine presents no open ports or ping response to the local net, so it probably is ok, i would guess.

   r.

7. Arun said on May 5, 2008 at 9:32 am

   Thank you Russ for the tips. I will give it a try.

8. Jason said on May 6, 2008 at 6:40 am

   I tried the same thing you did but to no avail. I’m running the 64-bit version of 8.04. Could that be the reason? Which version are you running?

9. Arun said on May 6, 2008 at 7:52 am

   I use 32 bit. The problem could be 64 bit, but I’m not sure. From what I could check in Ubuntu forums, it’s the 64-bit kernel problem.

10. Steven Osborn said on May 6, 2008 at 7:21 pm

    Hey, this was a life saver. Thanks a million.

11. Arun said on May 7, 2008 at 5:49 am

    Good to hear that.

12. Tom said on May 13, 2008 at 6:58 am

    This did not work for me.

    vpnclient$ patch < ./vpnclient-linux-2.6.24-final.diff
    patching file GenDefs.h
    patching file interceptor.c
    Hunk #1 succeeded at 24 (offset -4 lines).
    Hunk #2 succeeded at 48 (offset -4 lines).
    Hunk #3 FAILED at 107.
    Hunk #4 succeeded at 123 (offset -23 lines).
    Hunk #5 FAILED at 350.
    Hunk #6 succeeded at 849 (offset -86 lines).
    Hunk #7 succeeded at 891 (offset -86 lines).
    2 out of 7 hunks FAILED — saving rejects to file interceptor.c.rej

    Any ideas?

13. Arun said on May 13, 2008 at 8:01 am

    The problem could be with the version of the client you are using. If you are using vpnclient-linux-x86_64-4.8.01.0640-k9.tar.gz, it will work. If you are using the older version, say vpnclient-linux-4.8.00.0490-k9.tar.gz, then it may not work. You have to download the new version.

14. Tom said on May 13, 2008 at 8:11 am

    That was it. I was using an older version from my company’s internal download site. I’m up and running again. thx.

15. Prabhat said on May 20, 2008 at 9:46 pm

    Hi,
    I have also installed Ubuntu 8.0 (LTS Desktop on by IBM T43 laptop). I alaso faced he exact same errors as what you have stated & went through the steps that you have posted,. But even after that I am facing the below errors:

    prabhat@pubs:~/cisco applications/vpnclient$ su
    Password:
    root@pubs:/home/prabhat/cisco applications/vpnclient# ./vpn_install
    Cisco Systems VPN Client Version 4.8.01 (0640) Linux Installer
    Copyright (C) 1998-2006 Cisco Systems, Inc. All Rights Reserved.

    By installing this product you agree that you have read the
    license.txt file (The VPN Client license) and will comply with
    its terms.

    Directory where binaries will be installed [/usr/local/bin]

    Automatically start the VPN service at boot time [yes]

    In order to build the VPN kernel module, you must have the
    kernel headers for the version of the kernel you are running.

    Directory containing linux kernel source code [/lib/modules/2.6.24-16-generic/build]

    * Binaries will be installed in “/usr/local/bin”.
    * Modules will be installed in “/lib/modules/2.6.24-16-generic/CiscoVPN”.
    * The VPN service will be started AUTOMATICALLY at boot time.
    * Kernel source from “/lib/modules/2.6.24-16-generic/build” will be used to build the module.

    Is the above correct [y]

    Making module
    make -C /lib/modules/2.6.24-16-generic/build SUBDIRS=/home/prabhat/cisco applications/vpnclient modules
    make[1]: Entering directory `/usr/src/linux-headers-2.6.24-16-generic’
    make[1]: *** No rule to make target `applications/vpnclient’. Stop.
    make[1]: Leaving directory `/usr/src/linux-headers-2.6.24-16-generic’
    make: *** [default] Error 2
    Failed to make module “cisco_ipsec.ko”.

16. Arun said on May 21, 2008 at 5:53 am

    Are you getting this error even after you installed the patch? This is the error you get if you don’t install the patch. You have to install the patch and then install the client.

17. Jason said on May 21, 2008 at 5:59 am

    Face it….it’s busted.

18. Prabhat said on May 22, 2008 at 4:20 am

    Yes Arun. I am getting the same errors even after the patch. Here let me paste the steps once more:

    prabhat@pubs:~/cisco applications/abc/vpnclient$ patch < vpnclient-linux-2.6.24-final.diff
    patching file GenDefs.h
    patching file interceptor.c
    prabhat@pubs:~/cisco applications/abc/vpnclient$
    prabhat@pubs:~/cisco applications/abc/vpnclient$ sudo ./vpn_install
    [sudo] password for prabhat:
    Cisco Systems VPN Client Version 4.8.01 (0640) Linux Installer
    Copyright (C) 1998-2006 Cisco Systems, Inc. All Rights Reserved.

    By installing this product you agree that you have read the
    license.txt file (The VPN Client license) and will comply with
    its terms.

    Directory where binaries will be installed [/usr/local/bin]

    Automatically start the VPN service at boot time [yes]

    In order to build the VPN kernel module, you must have the
    kernel headers for the version of the kernel you are running.

    Directory containing linux kernel source code [/lib/modules/2.6.24-16-generic/build]

    * Binaries will be installed in “/usr/local/bin”.
    * Modules will be installed in “/lib/modules/2.6.24-16-generic/CiscoVPN”.
    * The VPN service will be started AUTOMATICALLY at boot time.
    * Kernel source from “/lib/modules/2.6.24-16-generic/build” will be used to build the module.

    Is the above correct [y]

    Making module
    make -C /lib/modules/2.6.24-16-generic/build SUBDIRS=/home/prabhat/cisco applications/abc/vpnclient modules
    make[1]: Entering directory `/usr/src/linux-headers-2.6.24-16-generic’
    make[1]: *** No rule to make target `applications/abc/vpnclient’. Stop.
    make[1]: Leaving directory `/usr/src/linux-headers-2.6.24-16-generic’
    make: *** [default] Error 2
    Failed to make module “cisco_ipsec.ko”.

19. Arun said on May 22, 2008 at 10:40 am

    Prabhat, I’m sorry, I’m not sure why it’s not working for you.

20. Sandeep pathivada said on May 24, 2008 at 9:43 pm

    I’m also facing the same issue. If you guys figured out how to get vpn installed please mail me at sandeep048@gmail.com

21. Arun said on May 25, 2008 at 6:17 pm

    Did you have linux header and build essentials installed?

22. Omar Samad said on May 26, 2008 at 11:58 am

    HI, i followed directions for 8.04 and installed successfully, now im having an issue with computer crashing after about 10-15 min of use of vpn connect + rdesktop.

    anyone else experiencing this issue?

23. skramstad said on May 26, 2008 at 9:58 pm

    There are a couple extra steps that have to be done prior to the steps in this article:

    1) Change CFLAGS to EXTRA_CFLAGS in Makefile

    2) wget -q http://projects.tuxx-home.at/ciscovpn/patches/cisco_skbuff_offset
    patch < ../cisco_skbuff_offset

    Then

    patch <../vpnclient-linux-2.6.24-final.diff
    ./vpn_install

24. Arun said on May 27, 2008 at 5:31 am

    I’m not sure why. It didn’t crash for me.

25. Arun said on May 27, 2008 at 5:35 am

    Sandeep and Prabhat, could you try what skramstad has suggested?

26. Omar Samad said on May 27, 2008 at 6:12 am

    ill try that out also, and see if it still causes the crashing. skramstad is that command in number 2) what chances CFLAGS to EXTRA_CFLAGS ?? or that is still an aditional step

27. Sandeep pathivada said on May 27, 2008 at 6:17 am

    i didn’t get what this command will do.

    “wget -q http://projects.tuxx-home.at/ciscovpn/patches/cisco_skbuff_offset.patch < ../cisco_skbuff_offset”

    I have got vpnc working and will figure out this issue in free time.

28. Omar Samad said on May 27, 2008 at 6:21 am

    VPNC doesnt seem to authenticate for me =/

29. Sandeep pathivada said on May 27, 2008 at 7:37 am

    Hi Omar,
    How do you generate passwords for vpnc. Did you run pcf2vpnc script to generate the required conf files.

    Thanks
    Sandeep

30. Omar Samad said on May 27, 2008 at 8:02 am

    I just typed them in as plain text in the conf file, well for the group Password, and the user password i typed manually at the prompt, and after that it failed to authenticate,
    no i havent tried pcf2vpnc either, is that a seperate package needed to be installed?? i didnt see it anywhere

31. Vijaya Raghavan said on June 5, 2008 at 5:31 am

    Hi Arun, Just wanted to say ‘thank you’ for the information your provided here. You put in effort to document your work and it has really helped me and I am sure others. Thanks very much for the selflessness of your work. Rgds, Vijay

32. Arun said on June 5, 2008 at 5:48 am

    Thanks Vijay. I’m just passing what I learned from others.

33. Roy Montenegro said on June 9, 2008 at 2:51 pm

    Hey Arun,
    Just wanted to say thanks a bunch for the instruction. Upgraged to 8.04 over the weekend and just checked that it would boot and open a browser. Got up this morning and couldn’t connect VPN. Uninstalled and re-installed a couple of times this afternoon to no avail and right before I thought about blowing the whole thing away, I came across your instructions. Saved me a couple of hours (and some additional gray hairs). Works like a charn.

34. Arun said on June 9, 2008 at 3:47 pm

    Happy to know it worked

35. Alex said on June 13, 2008 at 11:58 am

    I’m also seeing kernel crashes while using the cisco_ipsec module under 2.6.24-18-generic i686. It seems to happen most reliably when I’m doing simultaneous traffic both over the VPN connection and externally.

    I’ll give skramstad’s suggestions a try and see if that fixes it.

36. Omar Samad said on June 13, 2008 at 12:09 pm

    yeah, 2.6.24-18-generic i686 is giving me the same result, tried it under 16, and 17 also

37. Alex said on June 13, 2008 at 12:21 pm

    Just had another crash – skramstad’s patch didn’t fix the issue.

38. JW said on June 21, 2008 at 3:59 am

    I have found the need to recompile the modules for VMware after kernel updates as well. At this point, I’m seeing something like this as quite normal given the interaction required with the kernel.

39. omar samad said on June 21, 2008 at 7:39 am

    ok, anyone tried 19 kernel ?/ i’ll do it again at some point. *crosses fingers*

40. JW said on June 21, 2008 at 9:44 am

    I can connect with it using the 19 kernel. I am having a problem with Evolution, but I don’t know if it has to do with the VPN.

41. Rick said on June 22, 2008 at 11:15 am

    I’m getting complete lockups as well when using my patched vpnclient. It’ll work for a while, but I’ll always end up with a kernel panic or whatever at some point. (When not using vpnclient things are always stable.) I’m on an hp compaq 6910p kernel: 2.6.24-18-generic

    Is there something else I can try to get this to work? I can’t have the computer locking up like this when trying to vpn.

42. Oleg L said on July 20, 2008 at 7:02 am

    Cisco recently released the new VPN Client that does not require patch and works under latest kernel. I have Ubuntu Hardy 8.04 and after installing the new client it works well.
    1. Download the new client from Cisco’s website. You need an account to download that file.
    http://www.cisco.com/pcgi-bin/tablebuild.pl?topic=270636499
    There is an option to register on the page.
    2. Untar the new file:
    tar xvfz vpnclient-linux-x86_64-4.8.02.0030-k9.tar.gz
    3. Open the new folder:
    cd vpnclient/
    4. Run the installer:
    sudo ./vpn_install
    5. Choose all of the default options.
    6. Installation creates a service that will start upon reboot. The first time it needs to be started manually :
    /etc/init.d/vpnclient_init start
    7. Copy the .pcf profile file to:
    /etc/opt/cisco-vpnclient/profiles
    8. Connect to VPN from terminal window:
    vpnclient connect “your profile name”

    Following the instructions above worked for me perfectly and only took a couple of minutes. Good luck !

43. Arun said on July 21, 2008 at 7:32 am

    Thank you for the information Oleg.

44. Michael said on July 21, 2008 at 6:44 pm

    The new version that Oleg recommends still gives me the same error:
    make[1]: Entering directory `/usr/src/linux-headers-2.6.24-19-generic’
    scripts/Makefile.build:46: *** CFLAGS was changed in “/home/miguel/vpnclient/Makefile”. Fix it to use EXTRA_CFLAGS.

45. Arun said on July 22, 2008 at 6:14 am

    Michael,

    To fix that error, you have to edit the Makefile file in the vpnclient folder and change CFLAGS to EXTRA_CFLAGS.
    Change CFLAGS += -mcmodel=kernel -mno-red-zone
    to EXTRA_CFLAGS += -mcmodel=kernel -mno-red-zone
    If you are using 64 bit Linux, then you have to apply 64 bit patch. Refer to
    http://www.lamnk.com/blog/domain/how-to-install-cisco-vpn-client-on-ubuntu-hardy-heron-804/

46. Jan Kowalski said on July 26, 2008 at 5:37 pm

    I did register with CISCO but you have to be a partner to be able to download the VPN client. Is there other source for this client?

47. cesar_spain said on September 4, 2008 at 8:07 am

    I wrote a script for Cisco Client installation in Ubuntu 8.

    http://ubuntuforums.org/showthread.php?p=5725544&posted=1#post5725544

    For using it, probably best way is using KVPNC GUI.

    It should be easy to adapt it to other platforms and even applications.

    Cesar

48. Arun said on September 5, 2008 at 5:32 am

    Thanks for the information Cesar.

49. vpn service said on October 2, 2008 at 6:30 am

    Thanks for the information, saved me some frustration! he he

50. sideburns said on December 12, 2008 at 3:32 pm

    It seems that worked for me accept when I run
    “sudo /etc/init.d/vpnclient_init start”

    this is what happens…

    sideburns@Sideburns2:~/vpnclient$ sudo /etc/init.d/vpnclient_init start
    sudo: /etc/init.d/vpnclient_init: command not found

    I’m pretty new to Ubuntu and I have a lower level of understanding, but I am running Hardy Heron and trying to install VPN client 4.8.02 for my university. My schools download pages provides a profile but I can’t get to the point where im suppose to put it in :/

    any help would be very much appriciated,
    sideburns

51. Arun said on December 14, 2008 at 5:59 pm

    If the installation went fine, then sudo /etc/init.d/vpnclient_init start should work. Did you get any error message when you typed ./vpn_install?

52. sideburns said on December 14, 2008 at 6:07 pm

    no i didnt get any error messages, and i’ve tried it twice now, plus i can’t find the folder it supposedly installed too. Like i said im fairly new to Ubuntu and the linux OS’s in general but if i cant make this work i cant get internet on campus for my classes,

    which is a big time bummer.

53. Arun said on December 15, 2008 at 6:57 am

    If the installation went through, then that directory should be there. Did you install the patch? Did you try comment number 42? If you tried all, then I’m not sure why it’s not working. Try Ubuntuforums.org.

54. Tux said on December 16, 2008 at 10:03 am

    Thanks for the information! My vpn

55. vpn said on February 20, 2009 at 3:44 pm

    Have you tried OpenVPN? I just got through setting it up on my network.
    It works really well. Setup can be a little hairy,
    but I found a quickstart tutorial on the web and got everything squared away in about an hour.
    It also has a lot of functionality (complexity) if you need to go down that road.

56. Marion Delgado said on April 2, 2009 at 3:34 pm

    I did what skramstad suggested, on blind faith (albeit he should have said cisco_skbuff_offset.patch, and even though when I got to the directory to get what the real name was, I was sorely tempted to use instead the 4.8.01.patch instead of the 2.6.24.final.diff.

    At any rate, on my Acer netbook running Ibex 2.6.17-24-generic, only skramstead’s method worked. Just to be cautious, I didn’t fix the CFLAGS until I had applied both patches. The first seems to let you compile cisco_ipsec.ko and the 2nd, Interceptor.

    after the fact i sandboxed it and tried the 4.802 and 4.8.01 and neither work, they will both fix the CFLAGS, which is easy to do by hand reliably, but are incompatible with cisco_skbuff_offset.patch, you can apply either but not both.

57. Arun said on April 3, 2009 at 7:52 am

    Thanks for the updates Marion.

58. Arun’s Blog » Installing Cisco VPN and VPNC in Ubuntu said on May 20, 2009 at 2:53 pm

    [...] note: Read this post before you continue, if you have all the latest kernel updates in Hardy [...]

Leave a comment

RSS feed for comments on this post.

TrackBack URI