1841 VPN Interface module

Similar Questions

• Working with USB high speed Interface Modul 2.7 in LabVIEW

  Hello

  is there an example works with a USB high speed Interface Modul 2.7 in LabVIEW?

  The EGG is a "Cypress CY7C68013A-56PVXC»

  Thank you

  Best regards, patrick

  Hi patrick,

  I searched on google for the module. The manufacturer is Braintechnology.
  If you need a LabVIEW driver ask them please, maybe it's that they can provide you with a.

  Braintechnology offers a DLL - USB. With a little work, you can include this dll in your LabVIEW project (call library function node).

  The following documents explain how to:

  Integration of external Code with the Shared Library Import Wizard (requires a corresponding header dll)
  http://zone.NI.com/DevZone/CDA/tut/p/ID/2818

  Writing Win32 dynamic link (dll) libraries and qualifying of LabVIEW
  http://zone.NI.com/DevZone/CDA/tut/p/ID/4877

  Example: Passing a variety of Data Types in the DLL for LabVIEW
  http://zone.NI.com/DevZone/CDA/EPD/p/ID/1288

  Kind regards
  N. Ralf
  NIG.

• Tunnel VPN, Interface Dialer, 1841, ASA

  We have Cisco 1841 looked with a Cisco ASA 5520 for a VPN tunnel. The 1841 will carry the PPPOE client and the DSL router is in bridge mode. We have a problem with the card encryption were not applied to the dialer interface after the router is rolled power. The startup configuration to display the map encryption applied. Everyone has seen this problem before and the workaround?

  RUNNING THIS IOS:

  Cisco IOS Software, 1841 (C1841-ADVIPSERVICESK9-M), Version 12.4 (25), R

  SENSE SOFTWARE (fc2)

  This is a known bug in 12.4 (25):

  CSCsz41177 Card crypto missing from the interface to reload

  It is set to 12.4(25a).

  The solution is to manually apply the encryption card to the interface after reloading :)

• The 1841 VPN performance

  Hello

  I wonder if there are some figures about the execution of a standard 1841 with the IOS image:

  12.4 (18) AdvipserviceK9

  I've configured 2 1841 with a simple example (see attachment) but can not get a higher speed than the lows of 6 to 11 Mbit a tunnel.

  I'm testing with default Iperf and 2 laptops which can achieve speeds of 75 to 81 Mbps without a tunnel.

  I wonder what kind of performance you would expext with a Setup like that, but I can't find any figures in the Cisco online documentation

  ROUTER1:

  crypto ISAKMP policy 10

  preshared authentication

  !

  ISAKMP crypto key ciscokey address 200.1.1.1

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer 200.1.1.1

  Set transform-set RIGHT

  ! - Include the private-network-private-network traffic

  ! - in the encryption process:

  match address 101

  !

  !

  !

  interface Ethernet0/0

  IP 172.16.1.1 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  !

  interface Ethernet1/0

  IP 100.1.1.1 255.255.255.0

  NAT outside IP

  IP virtual-reassembly

  myvpn card crypto

  !

  IP classless

  IP route 0.0.0.0 0.0.0.0 100.1.1.254

  !

  IP http server

  no ip http secure server

  !

  ! - Except the private network of the NAT process:

  overload of IP nat inside source list 175 interface Ethernet1/0

  !

  ! - Include the private-network-private-network traffic

  ! - in the encryption process:

  access-list 101 permit ip 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255

  ! - Except the private network of the NAT process:

  access-list 175 deny ip 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255

  access-list 175 permit ip 172.16.1.0 0.0.0.255 any

  ROUTER2

  crypto ISAKMP policy 10

  preshared authentication

  ISAKMP crypto key ciscokey address 100.1.1.1

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  !

  myvpn 10 ipsec-isakmp crypto map

  defined by peer 100.1.1.1

  Set transform-set RIGHT

  ! - Include the private-network-private-network traffic

  ! - in the encryption process:

  match address 101

  !

  !

  !

  interface Ethernet0/0

  10.1.1.1 IP address 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  !

  interface Ethernet1/0

  200.1.1.1 IP address 255.255.255.0

  NAT outside IP

  IP virtual-reassembly

  myvpn card crypto

  !

  !

  IP classless

  IP route 0.0.0.0 0.0.0.0 200.1.1.254

  !

  no ip address of the http server

  no ip http secure server

  !

  ! - Except the private network of the NAT process:

  overload of IP nat inside source list 122 interface Ethernet1/0

  ! - Except the static NAT traffic from the NAT process if destined

  ! - top of the encrypted tunnel:

  IP nat inside source static 10.1.1.3 200.1.1.25 road-map sheep

  !

  access-list 101 permit ip 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255

  ! - Except the private network of the NAT process:

  access-list 122 refuse ip 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255

  access-list 122 allow ip 10.1.1.0 0.0.0.255 any

  ! - Except the static NAT traffic from the NAT process if destined

  ! - top of the encrypted tunnel:

  access-list 150 deny ip host 10.1.1.3 172.16.1.0 0.0.0.255

  access-list 150 allow the host ip 10.1.1.3 any

  !

  sheep allowed 10 route map

  corresponds to the IP 150

  Here is a link on most routers - VPN performance

  http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps7180/prod_brochure09186a00801f0a72_ns125_Networking_Solutions_Brochure.html

  The effect of the flow rate could be due to various reasons-

  (a) Fragmentation of packets due to IPSEC and MTU issues

  (b) higher ACL of treatment on the router for the Crypto and NAT

  (c) other services that may be running.

  45mbps is the maximum flow, our practice is to only use 1841 to 5Mbps of IPSEC.

  Let me know if it helps

• ASA to 1841 VPN Tunnel

  Hello

  I am trying to establish a VPN tunnel from site to site between 2 offices. An agency has a Cisco 1841 and the other a pair of ASA 5510. I get the tunnel to establish without problem. The problem is that traffic will the intended to the ASA 1841 will not encrypt to this particular tunnel. I get decaps on the session, but no program. I've reconfigured the tunnel several times but keep getting the same result:

  Interface: FastEthernet0/1
  The session state: UP-ACTIVE
  Peer: 202.41.148.5 port fvrf 500: (none) ivrf: (none)
  Phase1_id: 202.41.148.5
  DESC: (none)
  IKE SA: local 81.218.42.130/500 remote 202.41.148.5/500 Active
  Capabilities: (None) connid:98 life time: 23:45:02
  FLOW IPSEC: allowed ip 192.168.5.0/255.255.255.0 10.0.96.0/255.255.240.0
  Active sAs: 2, origin: card crypto
  On arrival: dec #pkts'ed 17 drop 0 life (KB/s) 4569995/2704
  Outbound: #pkts enc'ed drop 0 0 life (KB/s) 4569996/2704

  Any suggestions would be greatly appreciated.

  Andy

  Your ACL 100 is not exempt traffic 192.168.5.0-> 10.0.96.0 of the NAT process.  Please add the line below above the permit statement and test again.

  access-list 100 deny ip 192.168.5.0 0.0.0.255 10.0.96.0 0.0.15.255

• Urgent! L2l ASA 5005 & 1841 VPN, publishes QM WSF error

  Hi all

  We are facing a problem on a l2l between Asa 5005 & 1841 router vpn connection.

  crypto ISAKMP policy 100

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key * address aaa.aaa.aaa.aaa

  Crypto ipsec transform-set $$ _ $ $ esp-3des esp-md5-hmac

  BG 100 ipsec-isakmp crypto map

  the value of aaa.aaa.aaa.aaa peer

  Set security-association second life 28800

  the transform-set value $$ _ $$$

  set the pfs Group 2

  match address 111

  interface FastEthernet0/0.2

  encapsulation dot1Q 3338

  IP address aaa.aaa.aaa.aaa 255.255.255.252

  NAT outside IP

  IP virtual-reassembly

  card crypto BG 100

  IP nat pool nat_pool xx.xx.xx.xx xx.xx.xx.xx prefix length 29

  # NOTE: 10.70.200.0/24 is correctly exempted from NAT translation above

  access-list 101 deny ip 10.70.200.0 0.0.0.255 any

  access-list 101 permit ip 10.70.0.0 0.0.255.255 everything

  # NOTE: crypto ACL is correct

  access-list 111 allow ip 10.70.200.0 0.0.0.255 host 172.40.10.100

  I'm going to

  enjoy emergency assistance.

  Thank you.

  Your crypto acl must be exact mirror of the other.

  If your router acl is

  access-list 111 allow ip 10.70.200.0 0.0.0.255 host 172.40.10.100

  then your ASA acl should be

  outside_cryptomap_320 list extended access allowed host ip 172.40.10.100 10.70.200.0 255.255.255.0

  Just give it a shot and see if it helps.

• Scosche Bluefusion Interface module

  Please bear with me. I came to a 3 g iPhone and before that, I had WM 6.5 on an AT & T tilt, so I'm really new to Android. I am happy with my ATRIX.

  I have an iPhone/iPod connector that allows me to listen to music and change the track using radio controls and factory driving in my car. Obviously, it's a paperweight now, so I'm considering the Scosche Bluefusion module:

  http://www.Amazon.com/Scosche-Bluefusion-interface-factory-hands-free/DP/B001TL2P0C/ref=sr_1_23?s=au...

  Who should, if I'm reading this right, give me stereo A2DP streaming my music and I would take the phone calls as well.

  The question is, can I expect to get along with my ATRIX?

  I contacted Scosche and they said that everything should work exactly as planned, as long as I have a certain stereo installed in the car which was available from the manufacturer, what I'm doing.

  Thus, on their word and impressive return policy for Amazon, I ordered the parts!

• Even IOS VPN Interface Internet Access issue

  Hi all

  I was wondering if there was any equivalent to these orders of ASA 5510 to put on a cisco IOS router 2811.

  Split-tunnel-policy excludespecified

  value of Split-tunnel-network-list LOCAL_LAN_ACCESS

  What I want to achieve is to give internet access to my vpn users without creating a split tunnel, which means the vpn user turns off the Internet on the same interface on that their vpn router ends.

  Is a 2811 for this there docs? I could not find the doc for it...

  TIA,

  -Fred

  Try this link

  Public Internet on a stick

  http://www.Cisco.com/en/us/products/sw/secursw/ps2308/products_configuration_example09186a008073b06b.shtml#intro

  Rgds

  Jorge

• Cisco 1841 VPN

  Hello

  I have a router 1841 to site A is connected to site B (Fortinet FW) via the L2L VPN via internet. If a remote access user would connect to the site-A, through RA VPN over the internet, it would be able to connect to the site B as well? Is this also possible if I have a FW ASA instead of a 1841 router?

  Thank you! :)

  If his support, it would be the same as the ASA (in a crypto map configuration).

  Concerning

  Farrukh

• table names the interface and interface modules of oracle programs

  Hi all
  I need urgent and specific information on the names of the tables of the interface and the following oracle R12 modules interface programs, or either ther are custom made. Any specific link by referring to information of desire would be much appreciated.
  In addition, I need a clear and simple definition and the purpose of the tables of the interface and the program interface and what other names are known in the industry.
  
  Data object, Oracle Module
  Chart of accounts, General Ledger Oracle
  Oracle General Ledger, trial balance
  
  Main provider, Oracle Payables
  Open invoices from suppliers, Oracle Payables
  Open the provider of credit / debit memos, Oracle Payables
  Open the Advanced provider, Oracle Payables
  
  Master Bank, Oracle cash management
  
  Master client, Oracle to receive
  
  Categories of assets, assets of Oracle
  Master asset, active Oracle
  
  Master point, Oracle inventory
  Categories of items, inventory of Oracle
  Void / inventory and locators, Oracle inventory
  Point of share sales, Oracle inventory
  Point wise / unit cost, Oracle inventory
  
  Nomenclature, Oracle discrete manufacturing
  Departments, Oracle discrete manufacturing
  Operations, Oracle discrete manufacturing
  Routings, Oracle discrete manufacturing
  Resources, Oracle discrete manufacturing
  Oracle discrete manufacturing overhead
  
  Principal of the employee, trust hierarchy
  Trust hierarchy, trust hierarchy
  
  Open customer invoices, claims Oracle
  Open the customer credit / debit memos, Oracle receivables
  Open customer advances, Oracle receivables
  
  Pending purchase orders, purchase of the Oracle
  Pending purchase orders, purchase of the Oracle
  
  Open sales orders, Oracle order management
  Price list, Oracle order management

  Salvation;

  His metalink note you need connection with valid CSI number metalink (support ID customer) can notice via using the note number.

  Please see:

  Oracle EBS based tables and Interface
  Oracle EBS based tables and Interface

  Respect of
  HELIOS

• VPN site to Site in 1841

  Hello

  VPN site to site how can establish ourselves in router cisco 1841. When we start to 1841, we get the message that VPN Module 1. What is the meaning of it, this means that we can establish that a VPN. How about you, the limitation of Tunnel VPN free WILL.

  Thanks in advance

  -Giri Tawil

  Hi Alain,

  The maximum number of IPSec tunnels on the 1841 would be 50 not 1. The message from Module 1 you see refers to the embedded encryption module that comes with the 1841. This module allows the router to encrypt the traffic via the hardware rather than software to improve its performance.

  You can consult the data sheet specifications. Scroll down to the section IPSec and VPN for details of the plug VPN.

  http://www.Cisco.com/en/us/prod/collateral/routers/ps5853/ps6184/product_data_sheet0900aecd8028a95f_ps5853_Products_Data_Sheet.html

  I don't think there is a limit on the number of Tunnels since they are just logical interfaces through which you wrap and carry traffic.

  I hope this helps.

  Raga

  PS: don't forget to mark this question as answered if you have other questions. Thank you!

• Please ME TELL WHAT Cisco VPN internal Service Module

  I do not know what is the internal service of cisco vpn module, how it words, and where we can use it.

  Hello

  Cisco internal VPN Service Module is a Cisco ISR G2.

  I would say that the main goal is the ability to offload the encryption to a dedicated service module. Dedicated encryption protects performance when CPU utilization for other services.

  You can find the data sheet here:

  http://www.Cisco.com/en/us/prod/collateral/modules/ps2706/ps12202/data_sheet_c78-682436.html

  Also on the card you will find what routers support this module.

  Please evaluate the useful messages

  Best regards

  Eugene

• Several Interfaces of VPN - Pix 6.3 (5)

  Hi all

  I'm trying to establish a secondary VPN interface off our PIX for reasons of split tunneling. Unfortunately, I can't upgrade to 7.0 + to provide the functionality of routing same interface.

  I want to keep our card crypto in place current production until the transition is complete. Is it possible to have a 'map outside_map interface outside crypto' and a 'card crypto interface ExternalVPN ExternalVPN' or will be the new command to destroy the existing?

  Thank you.

  -Dominique

  This version of Pix follows the same principle that any 7.x or 8.x or cisco devices, there can only be one card encryption interface, in your case, I think you are applying cryptographic cards various different interfaces so the substitution them shouldn't be your concerned, rather ensuring the flow and routing.

• Site-2-Site VPn problem

  Guys,

  I'm new in the world of IP VPN. I am setting up a site 2 site between 2 routers Cisco 1841 vpn. I have SDSL connection on both ends and I am able to ping outside intellectual property both ok but with vpn configuration problems. The VPN tunnel is not come and show crypto isakmp its shows me nothing. I enabled debugging on isakmp and ipsec but no display of the trace. Attached is my router config, I have a similar config on the other end.

  Help, please!

  See you soon,.

  K

  This ping will never work, ping now you will from the dialer interface, go ahead and do

  source of ping 192.168.1.1 192.168.0.254

• Access to the administration via VPN to 887 after config setup pro

  Hi all

  Ive just made a three 887w for a client in a few branches, and as this is the first time I have deployed these devices, I decided to go with the GUI (downloaded config pro 2.3) to get the configuration made that I had some constraints of time to get them in place (sometimes I go with the graphical interface first and then look back at the CLI to see what as its been) (, then hand it in Notepad to get a better understanding of the new features of the CLI may be gone and allowed).

  One thing I again, that I was going to do face was my first experience of the firewall IOS area type of config...

  At this point, I'm still unclear on the config (where why Im posting here I guess!) - but the main problem I have at the moment is with managing access to devices.

  Particularly with regard to access to the administration of headquarters inside the IP address of the branch routers.

  I should mention that the branch routers are connected to Headquarters by connections IPSec site-to-site VPN and these connections are all very good, all connectivity (PC server, PC, printer, etc.) is very well... I can also send packets (using the inside of the interface as a source) ping from branch routers to servers on the headquarters LAN.

  Set up access to administration using config pro to allow access to the router on the subnet headquarters (on its inside interface), as well as the local subnet and also SSH access to a specific host from the internet - the local subnet and the only host on the internet can access the router very well.

  I'm not sure if the problem is with the ZBF config or if its something really obvious Im missing! -Ive done routers branch several times previously, so with this being the first config ZBF I did, so I came to the conclusion that there must be something in the absence of my understanding.

  Any help greatly appreciated... sanitized config below!

  Thanks in advance

  Paul

  version 15.1
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  sequence numbers service
  !
  hostname name-model
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered 51200
  recording console critical
  enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxx
  !
  No aaa new-model
  !
  iomem 10 memory size
  clock timezone PCTime 0
  PCTime of summer time clock day March 30, 2003 01:00 October 26, 2003 02:00
  Service-module wlan-ap 0 autonomous bootimage
  !
  Crypto pki trustpoint TP-self-signed-2874941309
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2874941309
  revocation checking no
  rsakeypair TP-self-signed-2874941309
  !
  !
  TP-self-signed-2874941309 crypto pki certificate chain
  certificate self-signed 01
  

  no ip source route
  !
  !
  DHCP excluded-address IP 10.0.0.1 10.0.0.63
  DHCP excluded-address IP 10.0.0.193 10.0.0.254
  !
  DHCP IP CCP-pool
  import all
  Network 10.0.0.0 255.255.255.0
  default router 10.0.0.1
  xxxxxxxxx.com domain name
  Server DNS 192.168.xx.20 194.74.xx.68
  Rental 2 0
  !
  !
  IP cef
  no ip bootp Server
  IP domain name xxxxxxx.com
  name of the server IP 192.168.XX.20
  name of the server IP 194.74.XX.68
  No ipv6 cef
  !
  !
  Authenticated MultiLink bundle-name Panel

  parameter-card type urlfpolicy websense cpwebpara0
  Server 192.168.xx.25
  source-interface Vlan1
  allow mode on
  parameter-card type urlf-glob cpaddbnwlocparapermit0
  model citrix.xxxxxxxxxxxx.com

  license udi pid xxxxxxxxxxx sn CISCO887MW-GN-E-K9
  !
  !
  username xxxxxxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxx
  username privilege 15 secret 5 xxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx
  !
  !
  !
  !
  synwait-time of tcp IP 10
  !
  type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-1
  game group-access 106
  type of class-card inspect entire game SDM_SHELL
  match the name of group-access SDM_SHELL
  type of class-card inspect entire game SDM_SSH
  match the name of group-access SDM_SSH
  type of class-card inspect entire game SDM_HTTPS
  match the name of group-access SDM_HTTPS
  type of class-card inspect all match sdm-mgmt-cls-0
  corresponds to the SDM_SHELL class-map
  corresponds to the SDM_SSH class-map
  corresponds to the SDM_HTTPS class-map
  type of class-card inspect entire game SDM_AH
  match the name of group-access SDM_AH
  type of class-card inspect entire game SDM_ESP
  match the name of group-access SDM_ESP
  type of class-card inspect entire game SDM_VPN_TRAFFIC
  match Protocol isakmp
  match Protocol ipsec-msft
  corresponds to the SDM_AH class-map
  corresponds to the SDM_ESP class-map
  type of class-card inspect the correspondence SDM_VPN_PT
  game group-access 105
  corresponds to the SDM_VPN_TRAFFIC class-map
  type of class-card inspect entire game PAC-cls-insp-traffic
  match Protocol cuseeme
  dns protocol game
  ftp protocol game
  h323 Protocol game
  https protocol game
  match icmp Protocol
  match the imap Protocol
  pop3 Protocol game
  netshow Protocol game
  Protocol shell game
  match Protocol realmedia
  match rtsp Protocol
  smtp Protocol game
  sql-net Protocol game
  streamworks Protocol game
  tftp Protocol game
  vdolive Protocol game
  tcp protocol match
  udp Protocol game
  inspect the class-map match PAC-insp-traffic type
  corresponds to the class-map PAC-cls-insp-traffic
  type of class-map urlfilter match - all cpaddbnwlocclasspermit0
  Server-domain urlf-glob cpaddbnwlocparapermit0 match
  type of class-card inspect entire game PAC-cls-icmp-access
  match icmp Protocol
  tcp protocol match
  udp Protocol game
  class-map type urlfilter websense match - all cpwebclass0
  match any response from the server
  type of class-card inspect correspondence ccp-invalid-src
  game group-access 100
  type of class-card inspect correspondence ccp-icmp-access
  corresponds to the class-ccp-cls-icmp-access card
  type of class-card inspect sdm-mgmt-cls-ccp-permit-0 correspondence
  corresponds to the class-map sdm-mgmt-cls-0
  game group-access 103
  type of class-card inspect correspondence ccp-Protocol-http
  http protocol game
  !
  !
  type of policy-card inspect PCB-permits-icmpreply
  class type inspect PCB-icmp-access
  inspect
  class class by default
  Pass
  type of policy-card inspect sdm-pol-VPNOutsideToInside-1
  class type inspect sdm-cls-VPNOutsideToInside-1
  inspect
  class class by default
  drop
  type of policy-card inspect urlfilter cppolicymap-1
  urlfpolicy websense cpwebpara0 type parameter
  class type urlfilter cpaddbnwlocclasspermit0
  allow
  Journal
  class type urlfilter websense cpwebclass0
  Server-specified-action
  Journal
  type of policy-map inspect PCB - inspect
  class type inspect PCB-invalid-src
  Drop newspaper
  class type inspect PCB-Protocol-http
  inspect
  service-policy urlfilter cppolicymap-1
  class type inspect PCB-insp-traffic
  inspect
  class class by default
  drop
  type of policy-card inspect PCB-enabled
  class type inspect SDM_VPN_PT
  Pass
  class type inspect sdm-mgmt-cls-ccp-permit-0
  inspect
  class class by default
  drop
  !
  security of the area outside the area
  safety zone-to-zone
  zone-pair security PAC-zp-self-out source destination outside zone auto
  type of service-strategy inspect PCB-permits-icmpreply
  zone-pair security PAC-zp-in-out source in the area of destination outside the area
  type of service-strategy inspect PCB - inspect
  source of PAC-zp-out-auto security area outside zone destination auto pair
  type of service-strategy inspect PCB-enabled
  sdm-zp-VPNOutsideToInside-1 zone-pair security source outside the area of destination in the area
  type of service-strategy inspect sdm-pol-VPNOutsideToInside-1
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key address 194.105.xxx.xxx xxxxxxxxxxxx
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to194.105.xxx.xxx
  the value of 194.105.xxx.xxx peer
  game of transformation-ESP-3DES-SHA
  match address VPN - ACL
  !
  !
  !
  !
  !
  interface BRI0
  no ip address
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  encapsulation hdlc
  Shutdown
  Multidrop ISDN endpoint
  !
  ATM0 interface
  no ip address
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  No atm ilmi-keepalive
  !
  point-to-point interface ATM0.1
  Description $ES_WAN$
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  PVC 0/38
  aal5mux encapsulation ppp Dialer
  Dialer pool-member 1
  !
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  wlan-ap0 interface
  description of the Service interface module to manage the embedded AP
  IP unnumbered Vlan1
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  ARP timeout 0
  !
  interface GigabitEthernet0 Wlan
  Description interface connecting to the AP the switch embedded internal
  !
  interface Vlan1
  Description $ETH - SW - LAUNCH, INTF-INFO-HWIC $$ $4ESW $FW_INSIDE$
  the IP 10.0.0.1 255.255.255.0
  IP access-group 104 to
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  IP nat inside
  IP virtual-reassembly
  Security members in the box area
  IP tcp adjust-mss 1452
  !
  interface Dialer0
  Description $FW_OUTSIDE$
  IP address 81.142.xxx.xxx 255.255.xxx.xxx
  IP access-group 101 in
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  NAT outside IP
  IP virtual-reassembly
  outside the area of security of Member's area
  encapsulation ppp
  Dialer pool 1
  Dialer-Group 1
  Authentication callin PPP chap Protocol
  PPP chap hostname xxxxxxxxxxxxxxxx
  PPP chap password 7 xxxxxxxxxxxxxxxxx
  No cdp enable
  map SDM_CMAP_1 crypto
  !
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  !
  IP nat inside source overload map route SDM_RMAP_1 interface Dialer0
  IP route 0.0.0.0 0.0.0.0 Dialer0
  !
  SDM_AH extended IP access list
  Note the category CCP_ACL = 1
  allow a whole ahp
  SDM_ESP extended IP access list
  Note the category CCP_ACL = 1
  allow an esp
  SDM_HTTP extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq www
  SDM_HTTPS extended IP access list
  Note the category CCP_ACL = 0
  permit any any eq 443 tcp
  SDM_SHELL extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq cmd
  SDM_SNMP extended IP access list
  Note the category CCP_ACL = 0
  allow udp any any eq snmp
  SDM_SSH extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq 22
  SDM_TELNET extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq telnet
  scope of access to IP-VPN-ACL list
  Note ACLs to identify a valuable traffic to bring up the VPN tunnel
  Note the category CCP_ACL = 4
  Licensing ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
  Licensing ip 10.0.0.0 0.0.0.255 10.128.xx.0 0.0.255.255
  Licensing ip 10.0.0.0 0.0.0.255 160.69.xx.0 0.0.255.255
  !
  recording of debug trap
  Note category of access list 1 = 2 CCP_ACL
  access-list 1 permit 10.0.0.0 0.0.0.255
  access-list 23 allow 193.195.xxx.xxx
  Note access-list 23 category CCP_ACL = 17
  access-list 23 permit 192.168.xx.0 0.0.0.255
  access-list 23 allow 10.0.0.0 0.0.0.255
  Access-list 100 category CCP_ACL = 128 note
  access-list 100 permit ip 255.255.255.255 host everything
  access-list 100 permit ip 127.0.0.0 0.255.255.255 everything
  access-list 100 permit ip 81.142.xxx.xxx 0.0.0.7 everything
  Access-list 101 remark self-generated by SDM management access feature
  Note access-list 101 category CCP_ACL = 1
  access-list 101 permit tcp host 193.195.xxx.xxx host 81.142.xxx.xxx eq 22
  access-list 101 permit tcp host 193.195.xxx.xxx host 81.142.xxx.xxx eq 443
  access-list 101 permit tcp host 193.195.xxx.xxx host 81.142.xxx.xxx eq cmd
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq telnet
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq 22
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq www
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq 443
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq cmd
  access-list 101 deny udp any host 81.142.xxx.xxx eq snmp
  access-list 101 permit ip 160.69.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  access-list 101 permit ip 10.128.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  access-list 101 permit ip 192.168.xx.0 0.0.0.255 10.0.0.0 0.0.0.255
  access-list 101 permit udp host 194.105.xxx.xxx host 81.142.xxx.xxx eq non500-isakmp
  access-list 101 permit udp host 194.105.xxx.xxx host 81.142.xxx.xxx eq isakmp
  access-list 101 permit host 194.105.xxx.xxx host 81.142.xxx.xxx esp
  access-list 101 permit ahp host 194.105.xxx.xxx host 81.142.xxx.xxx
  access list 101 ip allow a whole
  Note access-list 102 CCP_ACL category = 1
  access-list 102 permit ip 192.168.xx.0 0.0.0.255 everything
  access-list 102 permit ip host 193.195.xxx.xxx all
  access-list 102 permit ip 10.0.0.0 0.0.0.255 any
  Note access-list 103 self-generated by SDM management access feature
  Note access-list 103 CCP_ACL category = 1
  access-list 103 allow ip host 193.195.xxx.xxx host 81.142.xxx.xxx
  Note access-list 104 self-generated by SDM management access feature
  Note access-list 104 CCP_ACL category = 1
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq telnet
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq telnet
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 eq on host 10.0.0.1 22
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq 22
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq www
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 eq to host 10.0.0.1 www
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq 443
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq 443
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq cmd
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq cmd
  access-list 104 tcp refuse any host 10.0.0.1 eq telnet
  access-list 104 tcp refuse any host 10.0.0.1 eq 22
  access-list 104 tcp refuse any host 10.0.0.1 eq www
  access-list 104 tcp refuse any host 10.0.0.1 eq 443
  access-list 104 tcp refuse any host 10.0.0.1 eq cmd
  access-list 104 deny udp any host 10.0.0.1 eq snmp
  104 ip access list allow a whole
  Note access-list 105 CCP_ACL category = 128
  access-list 105 permit ip host 194.105.xxx.xxx all
  Note access-list 106 CCP_ACL category = 0
  access-list 106 allow ip 192.168.xx.0 0.0.0.255 10.0.0.0 0.0.0.255
  access-list 106 allow ip 10.128.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  access-list 106 allow ip 160.69.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  Note category from the list of access-107 = 2 CCP_ACL
  access-list 107 deny ip 10.0.0.0 0.0.0.255 160.69.0.0 0.0.255.255
  access-list 107 deny ip 10.0.0.0 0.0.0.255 10.128.0.0 0.0.255.255
  access-list 107 deny ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
  access-list 107 allow ip 10.0.0.0 0.0.0.255 any
  Dialer-list 1 ip protocol allow
  not run cdp

  !
  !
  !
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 107
  !
  !
  control plan
  !
  !
  Line con 0
  local connection
  no activation of the modem
  line to 0
  line 2
  no activation-character
  No exec
  preferred no transport
  transport of entry all
  line vty 0 4
  access-class 102 in
  privilege level 15
  local connection
  transport input telnet ssh
  !
  Scheduler allocate 4000 1000
  Scheduler interval 500
  NTP-Calendar Update
  130.159.196.118 source Dialer0 preferred NTP server
  end

  Hi Paul,.

  Here is the relevant configuration:

  type of policy-card inspect PCB-enabled

  class type inspect sdm-mgmt-cls-ccp-permit-0
  inspect

  
  

  type of class-card inspect sdm-mgmt-cls-ccp-permit-0 correspondence
  corresponds to the class-map sdm-mgmt-cls-0
  game group-access 103

  
  

  type of class-card inspect all match sdm-mgmt-cls-0
  corresponds to the SDM_SHELL class-map
  corresponds to the SDM_SSH class-map
  corresponds to the SDM_HTTPS class-map

  
  

  type of class-card inspect entire game SDM_SHELL
  match the name of group-access SDM_SHELL
  type of class-card inspect entire game SDM_SSH
  match the name of group-access SDM_SSH
  type of class-card inspect entire game SDM_HTTPS
  match the name of group-access SDM_HTTPS

  
  

  SDM_SHELL extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq cmd
  SDM_SSH extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq 22
  SDM_HTTPS extended IP access list
  Note the category CCP_ACL = 0
  permit any any eq 443 tcp

  
  

  Note access-list 103 self-generated by SDM management access feature
  Note access-list 103 CCP_ACL category = 1
  access-list 103 allow ip host 193.195.xxx.xxx host 81.142.xxx.xxx

  The above configuration will allow you to access the router on the 81.142.xxx.xxx the IP address of the host 193.195.xxx.xxx using HTTPS/SSH/SHELL. To allow network 192.168.16.0/24 access to the router's IP 10.0.0.1, add another entry to the access list 103 as below:

  access-list 103 allow ip 192.168.16.0 0.0.0.255 host 10.0.0.1

  This should take enable access to this IP address for hosts using ssh and https. Try this out and let me know how it goes.

  Thank you and best regards,

  Assia