3005 L2L question

Similar Questions

• VPN/IPSec-L2L - Question?

  Hello!

  Recently, I was doing some troubleshooting on a connection VPN/IPSec Lan-to-Lan between a Cisco PIX515E and a Linux firewall. My question concerns the configuration and is not the problem itself.

  Traffic interesting (encrypted traffic) defined and configured the LAN of PIX (inside) and the distance public IP? Which means that the Peer IKE and the interesting remote control LAN/IP are the same... and it works!

  Any ideas?

  Thank you

  JP

  As long as you source the package from the local network of Pix to remote public IP, the tunnel will work well and works :-)

  So, if you really look at the fluidity of the traffic, you're sourcing traffic from Pix LAN intended to public IP remote that corresponds to the defined access list. Thus, the pix knows he has encrypt traffic and now seeks the cryptographic endpoint points (pix outside IP public IP remotely) and sends the encrypted packets. So, this configuration works perfectly.

  In fact, Pix will not allow Telnet the external of the pix interface unless the traffic is through an IPSEC Tunnel and it was one of the establishment who gave a telnet access to the external interface of the Pix, it's LAN to the public IP of Pix through an IPSEC Tunnel.

  Kind regards

  Arul

  * Please note all useful messages *.

• Ask about site to site VPN

  Hi Experts,

  We gave connectivity VPN site-to-site to our customer. They report that they are not able to access the network because of VPN downwards.

  I checked on my router, it's showing to Port 4500 & down to 500.

  Below, find the exit

  crypto session #sh remote 152.69.248.225

  Current state of the session crypto

  Interface: GigabitEthernet0/0/2

  The session state: UP-ACTIVE

  Peer: 152.69.248.225 port 4500

  IKE SA: local 3.148.197.4/4500 remote 152.69.248.225/4500 Active

  FLOW IPSEC: allowed host 3.148.197.0/255.255.255.0 ip 170.69.246.2

  Active sAs: 2, origin: card crypto

  Interface: GigabitEthernet0/0/2

  The session state: down

  Peer: 152.69.248.225 port 500

  FLOW IPSEC: allowed host 3.110.96.0/255.255.255.0 ip 152.69.246.2

  Active sAs: 0, origin: card crypto

  FLOW IPSEC: allowed host 3.110.97.0/255.255.255.0 ip 152.69.246.2

  Active sAs: 0, origin: card crypto

  #sh crypto session short distance 152.69.248.225

  Status: A - Active, upward, D - Down, I - S - U - verse Standby, N - Idle, negotiation

  K - no IKE

  ivrf = (none)

  I peer / group/Phase1_id F Username availability status

  152.69.248.225 Gi0/0/2 10.130.132.34 01:14:49 AU

  Can someone help me understand the output.

  Security purpose I changed Ip addresses, so do ' t mistaken for intellectual property.

  PL suggest also any document that clears my VPN concept

  Thanks in advance

  Surya

  Hi Surya,

  Please check out the common link L2L question ex below. It may not solve your problem 100%, but could help to understand the question...

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807e0aca.shtml

  In addition, if you can postyour device and endpoint remote end device config (if possible), it helps.

  THX

  MS

• L2l tunnel question

  Hello...

  I created a tunnel of L2L b & w a Juniper NetScreen VPN 3005... .the tunnel is mounted, but we both are unable to ping the ip allowed... Another thing, I don't see him rx traffic but no traffic tx from... suspecting me keep the alives...

  It's the second tunnel I built on this VPN 3005 box, this first has no problem with what I have now...

  help them on this issue... Thanks in advance

  Hello

  Well, that's your problem. When the 192.168.10.10 pc attempts to send traffic to the PC 172.16.10.10 traffic goes first to the Pix. But because you run v6.x from the pix it is not allowed to send the traffic, he came back on the same interface the and he needs to do this to send traffic to the VPN 3005.

  With pix v7.x, you can do this, but a solution to your problem without having to upgrade would be to add a static route on your 192.168.10.10 PC saying to 172.16.10.10 go to 192.168.10.15.

  HTH

  Jon

• Questions of hub L2L with Checkpoint NGR55 3K 5

  I am trying to create a connection L2L from a 3 K 5 hub to a seller with a NGR55 of control point. Setting up this morning, we have been able to access all applications using a NAT on their side, they were not able to access our own. The message that we've seen on both sides was:

  No routine received Notify message: info ID not valid (18)

  Which indicates the incompatible attributes between the peers. These have been verified on both sides. We have our list of local network specified as all the individual hosts that are translated into static NAT rules. For them, we have static translations and two global PATs... the network list for them specifies all their/24 network, which has been used in the comprehensive PAT. My understanding is that the most specific network will be applied and if not found, the PAT will be used, and I can see what is happening in the case where newspaper.

  Question 1.) This could be a possible problem with why they are unable to connect to what anyone on our side?

  Question 2.) The hub is driven by, even from the menu CLI and I can't find a way to clean up the SA when troubleshooting other than the deactivation and reactivation of the tunnel. I know about the ASA and PIX and I can do for phases 1 and 2 of the CLI. Deactivation of the tunnel on the 3 K 5 has the same result?

  Any other ideas on why this would be appreciated.

  It is very likely that the checkpoint is

  do suppernetting, causing Phase 2

  Quick mode error. I could do this on the

  side of control point:

  1 - Open a session in the check point gateway,

  2. "you vpn" and remove the tunnel between

  point of control and VPNc,

  2 - cd $FWDIR/log,.

  3 - vpn debugging trunc,

  4 - vpn debugging ikeoff,

  5 - vpn debugging ikeon,

  6. now initialize the connection of control point

  side. It will fail,

  7 - get the ike.elg file and export it

  on your desktop via scp or whatever.

  8 - use a tool called IKEView.exe control point

  utility and open the ike.elg file.

  This will tell you EXACTLY why the tunnel failed and why. It is very likely that

  control point is suppernetting its network and

  Send it to VPNc, causing phase II for

  in case of failure.

  To resolve this problem, you will have

  to modify the parameter "IKE_largest_possible_subnet" to "true" to "false" and also change the file user.def as

  Well.

  The other solution is to switch to the NGx so

  you have an option to negotiate 'by '.

  host' and have communication on both sides.

  Sounds easy?

  Now,.

• Question of redundancy VPN l2l using 2811 as endpoint devices

  I have a new implementation of VPN L2L passes using two 2811 s than VPN terminal devices. I'll try to use the HSRP address between the public interfaces of both routers as VPN peer address. The problem that I found during the test is that the tunnel will become active and debugs watch the HSRP address as an invalid address to form the tunnel. Have a work-around, or a better plan for redundancy on peering address using similar devices? Thanks in advance.

  Take a look at this doc about IOS IPSec HA.

  http://www.Cisco.com/en/us/docs/iOS/security/configuration/guide/sec_vpn_ha_enhance_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1039849

• L2l VPN using Dynamic IP - question

  Dear all,

  I have several sites with dynamic IP address.

  HO, I have a cisco router with dynamic IP, in which internet VPN and terminated on SAA configured port forwarding.

  I have 40 branches will be all dynamic ip. all L2L tunnels are running.

  My problem is that of creates a branch to HO communication is perfect but to HO, I'm not able to access the ants of branch resources.

  could someone help me solve this problem... Config is attached.

  AHA!

  I understand a little better Setup.

  It seems that your routers are destination NAT, so all the tunnels seem to come from the subnet "172.16.40.0/23."

  And indeed your hypothesis is correct problem seems to be related to the lack of correct roads pointing outward. (at least it seems that Yes for now).

  However, reverse route injection should take care of it.

  Speaking of which I noticed your field of tunnels on

  Crypto dynamic-map alfa and not the default system.

  Please add "crypto dynamic-map alfa 1 set reverse" and restart one of the tunnels (do not speak it, simply identify isakmp and ipsec for this session).

  We'll see from there.

  Marcin

• L2l - a non-reachable subnet VPN question

  Hi people,

  I have a strange problem with a new VPN connection and would appreciate any help.

  I have a pair of Cisco asa 5540 s configured as a failover pair (code version 8.2 (5)).

  Recently, I added 2 new VPN L2L - these two VPNS come from the same interface on my ASA (called Internet service provider) and both are to the same customer, but they end the different firewall on the end of cusomter and different client subnets traffic encryption.    There is a basic network diagram attached.

  1 - the VPN is for customer subnet 10.2.1.0/24 traffic.    Devices in this subnet should have access to 2 subnets on my network - DMZ 211 (192.168.211.0./24) and DMZ 144 (192.168.144.0/24).    This VPN working properly.

  2 - the VPN is for the subnet 192.168.1.0/24 customer traffic.    Devices in this subnet should be able to access the same 2 subnets on my network - DMZ 211 (192.168.211.0./24) and DMZ 144 (192.168.144.0/24).    What VPN does not work - the client can access 144 DMZ, but not of DMZ 211.

  There is a SAs isakmp and ipsec for two virtual private networks.    I noticed that the program/decaps packages counter does not increment when the client sends the test traffic to 211 of the DMZ.  This counter will increment when they send traffic test to DMZ144.   I also see the traffic sent to 144 DMZ customer subnet 192.168.1.0/24 in packet capture on the interface DMZ 144 of the ASA.   I don't see similar traffic capture on the interface DMZ211 (although I can see the traffic sent to DMZ211, if it is from 10.2.1.0/24 - IE when using VPN1)

  Exemption of NAT is configured for 192.168.1.0/24 and 10.2.1.0/24.

  There is a road to two client subnets via the same next hop.

  There is nothing in the unknown newspapers 192.168.1.0/24 traffic has been ignored

  I suspect that this may be a problem on the client side, but I would like to be able to prove that.   Specifically, I'd like to really be able to capture traffic destined to 211 DMZ on the interface of the firewall after her Internet service provider has been deciphered - I don't know if this can be done however, and I haven'treally has found a good way to prove or disprove that the 192.168.1.0/24 DMZ211 VPN traffic coming to my ASA Internet service provider interface and show what happens to This traffic, after his arrival.

  Here is the relevant vpn configuration:

  MY_CRYPTO_MAP 90 crypto card matches the address VPN_2

  card crypto MY_CRYPTO_MAP 90 set peer 217.154.147.221

  crypto 90 MY_CRYPTO_MAP the transform-set 3dessha value card

  card crypto set MY_CRYPTO_MAP security-association life 90 seconds 86400

  crypto MY_CRYPTO_MAP 100 card matches the address VPN_1

  card crypto MY_CRYPTO_MAP 100 set peer 193.108.169.48

  crypto MY_CRYPTO_MAP 100 the transform-set 3dessha value card

  card crypto MY_CRYPTO_MAP 100 set security-association second life 86400

  crypto MY_CRYPTO_MAP isp interface card

  ASA # sh access-list VPN_2

  VPN_2 list of access; 6 elements; hash name: 0xa902d2f4

  permit for access list 1 VPN_2 line extended ip object-group VPN_2_NETS 192.168.1.0 255.255.255.0 0x56c7fb8f

  access-list 1 permit line VPN_2 extended 192.168.144.0 ip 255.255.255.0 192.168.1.0 255.255.255.0 (hitcnt = 45) 0x93b6dc21

  access-list 1 permit line VPN_2 extended ip 192.168.211.0 255.255.255.0 192.168.1.0 255.255.255.0 (hitcnt = 6) 0x0abf7bb9

  access-list 1 permit line VPN_2 extended ip host 192.168.146.29 192.168.1.0 255.255.255.0 (hitcnt = 8) 0xcc48a56e

  ASA # sh VPN_1 access-list

  VPN_1 access list; 3 elements; hash name: 0x30168cce

  access-list line 1 license VPN_1 extended ip 192.168.144.0 255.255.252.0 10.2.1.0 255.255.255.0 (hitcnt = 6) 0 x 61759554

  allowed to Access - list line 2 VPN_1 extended ip 192.168.211.0 255.255.255.0 10.2.1.0 255.255.255.0 (hitcnt = 3) 0xa602c97c

  allowed to Access - list VPN_1 line 3 extended ip host 192.168.146.29 10.2.1.0 255.255.255.0 (hitcnt = 0) 0x7b9f32e3

  nonatdmz144 (dmz144) NAT 0 access list

  nonatdmz211 (dmz211) NAT 0 access list

  ASA # sh access-list nonatdmz144

  nonatdmz144 list of access; 5 elements; hash name: 0xbf28538e

  access-list 1 permit line nonatdmz144 extended 192.168.144.0 ip 255.255.255.0 192.168.0.0 255.255.0.0 (hitcnt = 0) 0 x 20121683

  allowed to Access-list nonatdmz144 line 2 extended 192.168.144.0 ip 255.255.255.0 172.28.2.0 255.255.254.0 (hitcnt = 0) 0xbc8ab4f1

  permit for access list 3 nonatdmz144 line scope ip 192.168.144.0 255.255.255.0 194.97.141.160 255.255.255.224 (hitcnt = 0) 0xce869e1e

  allowed to Access-list nonatdmz144 line 4 extended 192.168.144.0 ip 255.255.255.0 172.30.0.0 255.255.240.0 (hitcnt = 0) 0xd3ec5035

  permit for access list 5 nonatdmz144 line scope ip 192.168.144.0 255.255.255.0 10.2.1.0 255.255.255.0 (hitcnt = 0) 0x4c9cc781

  ASA # sh nonatdmz211 access-list | in 192.168\.1\.

  permit for access list 3 nonatdmz1 line scope ip 192.168.211.0 255.255.255.0 192.168.1.0 255.255.255.0 (hitcnt = 0) 0x2bbfcfdd

  ASA # sh nonatdmz211 access-list | in 10.2.1.

  allowed to Access-list nonatdmz1 line 4 extended ip 192.168.211.0 255.255.255.0 10.2.1.0 255.255.255.0 (hitcnt = 0) 0x8a836d91

  Route ISP 192.168.1.0 255.255.255.0 137.191.234.33 1

  Route ISP 10.2.1.0 255.255.255.0 137.191.234.33 1

  Thanks in advance to anyone who's looking good!

  Darragh

  The counters of compensation was a good idea. If the counter is not incremented and ping the remote side is not cause future VPN it certainly confirms that something is not working properly.

  It might be interesting to wait the SAs time out and go idle and test it again with the ping to the remote subnet that does not work. Turn on debugging for ISAKMP and see if there is an attempt of negotiation. Especially if you don't get any attempt to open ISAKMP then so it would be a way of showing that there is a problem on the remote site.

  Certainly, the ASA has the ability to capture packets. I've used this feature and it can be very useful. I have not tried to make a catch on the external interface for incoming VPN traffic and so not sure if you would be available to capture the encrypted packet or the off encrypted packet. You can configure an access list to identify traffic capture and I guess you could write an access list that included the two addresses as source and destination peer to capture encrypted traffic and the Scriptures that were unencrypted source and destination subnets to capture traffic after encryption.

  HTH

  Rick

• L2l IPsec question: 0 packages decrypted!

  Hello

  We have implemented a solution for IPSec-l2l between HQ and remote sites. The last being a ship, we opted for the dynamic Ipsec l2l solution to static using two ASAs. However, the solution fails to certain ports. In fact, the tunnel is established and the packets are encrypted on the ASA remote. However, no packet is decrypted. HQ sees not all encrypted packets. It looks like something between the two does not prevent IPSec packets to reach the HQ...

  How could ensure us that the solution works always regardless of any ACL or NAT between the two?

  Excerpts of the "sh crypto ipsec his" cmd for a positive and result negative as well as the configuration of the remote control - ASA IPsec.

  Distance - ASA # sh crypto isakmp his

  Interface: outside
  Tag crypto map: CMAP, seq num: 10, local addr: 172.16.1.215

  extended vpn ip 10.240.192.0 access list allow 255.255.255.0 10.0.0.0 255.0.0.0
  local ident (addr, mask, prot, port): (10.240.192.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.0.0.0/255.0.0.0/0/0)
  current_peer: 146.40.75.33

  #pkts program: 28, encrypt #pkts: 28, #pkts digest: 28
  decaps #pkts: 15, #pkts decrypt: 15, #pkts check: 15
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 28, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 172.16.1.215, remote Start crypto. : 146.40.75.33

  Distance - ASA # sh crypto isakmp his

  Interface: outside
  Tag crypto map: CMAP, seq num: 10, local addr: 168.240.6.11

  extended vpn ip 10.240.192.0 access list allow 255.255.255.0 10.0.0.0 255.0.0.0
  local ident (addr, mask, prot, port): (10.240.192.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.0.0.0/255.0.0.0/0/0)
  current_peer: 146.40.75.33

  #pkts program: 45, #pkts encrypt: 45, #pkts digest: 45
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 28, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 168.240.6.11, remote Start crypto. : 146.40.75.33

  Remote control - ASA config

  extended vpn ip 10.240.192.0 access list allow 255.255.255.0 10.0.0.0 255.0.0.0

  10.240.192.0 IP Access-list extended sheep 255.255.255.0 allow 10.0.0.0 255.0.0.0

  Global 1 interface (outside)
  NAT (inside) 0 access-list sheep
  NAT (inside) 1 0.0.0.0 0.0.0.0

  Crypto ipsec transform-set esp-sha-3des esp-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto CMAP 10 corresponds to the vpn address
  card crypto CMAP 10 set pfs Group1
  card crypto CMAP 10 set peer 146.40.75.33

  card crypto CMAP 10 value transform-set esp-3des-sha
  card crypto CMAP 10 set phase 1-mode aggressive Group1
  card crypto CMAP 10 set reverse-road
  CMAP outside crypto map interface
  ISAKMP crypto identity hostname
  crypto ISAKMP allow outside
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 1
  life 86400
  No encryption isakmp nat-traversal

  tunnel-group 146.40.75.33 type ipsec-l2l
  IPSec-attributes tunnel-group 146.40.75.33
  pre-shared key *.

  Thanks for your help!

  Franc

  Hello

  The first output shows two packets encrypted/decrypted on the ASA remote.

  At this point, the VPN worked very well? What was different?

  The second output shows encrypted packets on the ASA remote but no decrypted.

  You mentioned that the HQ site does not show decrypted packets either.

  It seems that the ASA remote sends the traffic in the tunnel, but they never reached the HQ site.

  This can happen when there is a problem of route, NAT problem or some sort of VPN filter.

  To understand this better explain what the difference was between the first and the second scenario.

  Federico.

• Design of VPN L2L ASA question

  We expect to have more than 10,000 remote VPN L2L clients.

  I see that each crypto card needs a statement of 'same game' and the IP address is the address of the remote peer VPN L2L.

  :

  EX:

  card encryption UNI-POP 3 set peer 172.23.0.3

  : . . .

  card crypto UNI-POP 10000 set peer 172.26.0.250

  :

  I already feel that this will be a VERY long config, maybe too big to save/read/from memory.

  :

  Anyone would be a better approach?

  Thank you

  Frank

  Frank,

  If the remote end will run only from time to time, you should not have set peer statements and normally it would suffice to have a dynamic encryption card.

  If the remote ends do not support certificates, it is possible to land on defaultl2l tunnel-group.

  bsns-asa5505-19# sh run all tunnel-group
  tunnel-group DefaultL2LGroup type ipsec-l2l
  tunnel-group DefaultL2LGroup general-attributes
  (...)
  

  You need to test yourself to see if it will work.

  I also agree in terms of more than one firewall. With devices for two in the load balancing or if possible 2pairs of devices in the failover cluster could be great way to have a decent charge by machine and equipment redundancy (ideal circumstances]);. I suggest you ping your system engineer for sure any deployment involving 5585, guys can usually give good advice (and discounts;]).

  Marcin

• L2l using routers Cisco VPN question

  I can successfully configure an L2L IPSec VPN between two ASAs but using a similar configuration on Cisco routers, I can't establish a tunnel ping to the local LAN interface on the other, but two, NY and Burlington, routers can ping each and other WAN interface. Here is the configuration of routers and a version of the show; I have attached the config files complete and the screenshot of the topology.
  I appreciate all help.
  The f

  F0/0 - ISP - F0/0 Burlington NY

  See the version

  Cisco IOS Software, software 3600 (C3640-IK9S-M), Version 12.4 (25), RELEASE SOFTWARE (fc1)
  Technical support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2010 by Cisco Systems, Inc.
  Updated Thursday, August 18, 10 06:59 by prod_rel_team

  ROM: ROMMON emulation Microcode
  ROM: 3600 Software (C3640-IK9S-M), Version 12.4 (25), RELEASE SOFTWARE (fc1)

  The availability of NY is 0 minutes
  System returned to ROM by unknown charge cause - suspect boot_data [BOOT_COUNT] 0 x 0, BOOT_COUNT 0, BOOTDATA 19
  System image file is "tftp://255.255.255.255/unknown".

  Cisco 3640 (R4700) Prozesseur (revision 0xFF) 124928K / 6144K bytes of memory.
  Card processor ID FF1045C5
  R4700 CPU at 100 MHz, 33, Rev 1.2 implementation
  2 FastEthernet interfaces
  Configuration of DRAM is wide with parity 64-bit capable.
  125K bytes of NVRAM memory.
  8192 K bytes of processor onboard flash system (read/write)

  Configuration register is 0 x 2102

  NY router

  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  address of ThisIsAWeekKey key crypto isakmp 172.16.2.2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac L2L
  !
  Burlington 1-isakmp ipsec crypto map
  defined peer 172.16.2.2
  game of transformation-L2L
  match address Burlington-NW
  !
  !
  interface FastEthernet0/0
  address 172.16.1.2 IP 255.255.255.252
  automatic duplex
  automatic speed
  card crypto Burlington
  !
  interface FastEthernet1/0
  IP 10.0.1.1 255.255.255.0
  automatic duplex
  automatic speed
  !
  no ip address of the http server
  no ip http secure server
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 172.16.1.1
  !
  !
  Burlington-NW extended IP access list
  ip licensing 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255

  Burlington router

  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  address of ThisIsAWeekKey key crypto isakmp 172.16.1.2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac L2L
  !
  NY 1 ipsec-isakmp crypto map
  defined peer 172.16.1.2
  game of transformation-L2L
  match address NY - NW
  !
  !
  interface FastEthernet0/0
  IP 172.16.2.2 255.255.255.252
  automatic duplex
  automatic speed
  card crypto NY
  !
  interface FastEthernet1/0
  IP 10.0.2.1 255.255.255.0
  automatic duplex
  automatic speed
  !
  no ip address of the http server
  no ip http secure server
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 172.16.2.1
  !
  !
  NY - NW extended IP access list
  IP 10.0.2.0 allow 0.0.0.255 10.0.1.0 0.0.0.255

  No problem, we learn every day

  Please kindly marks the message as answered while others can also learn from your post. Thank you.

• L2L IOS VPN question

  Hello

  I created a vpn between two routers in two different sites. The VPN works well, but I noticed something that I can ping from peer1 at peer2 however the tunnel although the ACL of the interesting traffic allows no icmp between two counterparts, it is configured as follows:

  access-list 120 allow ip 10.10.10.0 255.255.255.0 192.168.2.0 255.255.255.0

  access-list 120 allow ip 1.1.1.1 host 2.2.2.2

  No icmp is allowed, but the icmp traffic is encapsulated, encrypted, and through the tunnel, why?

  Hello moahmed1981,

  When you configure access-list for IPs, so it includes ICMP, TCP, and UDP, therefore, it is expected that you will be able to ping across the tunnel.

  If you want to change this, please configure the VPN filter to prevent the ping to the vpn tunnel.
  Here's a doc for your reference:-
  https://popravak.WordPress.com/2011/11/07/Cisco-IOS-VPN-filter/

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• VPN issues - 3005 to ASA5510

  We are moving from a concentrator 3005 to an ASA5510 and I have a few questions.

  In the 3005, you can disable and enable easy VPN tunnels. You go into politics and check or uncheck the box for enable. What is the method to temporarily disable a tunnel on the SAA? Through the ASDM of preference, for ease of management.

  Also, I want my remote access sessions to timeout after 8 hours. It shows in the tunnel policy in the ASDM its value for 8 (28800) hours, but I don't see this value in the config at all. I can't quite see a value of 86400 for the isakmp policy. If it is set in the ASDM like 8 hours, why doesn't it appear in the config? Has priority on the time-out, the policy of tunnel or isakmp policy?

  Thank you!

  Ryan,

  For your remote access to the vpn session users max connection time can be specified in attributes of tunnel group policy. Go to your group of tunnel in ASDM > general develop several obtions and uncheck maximum connect time here, you can specify minutes the vpn session will end when it reaches the time in minutes.

  example to specify 90 minutes you can also do this through cli, note it's not a time out that this will decrease the session in 90 minutes for all members of the Group of tunnel.

  group-policy attributes

  vpn-session-timeout 90

  You can disable it as:

  group-policy attributes

  no vpn-session-timeout

  as I don't know how to disable vpn L2L sessions support there is no option to turn on/off as in the vpn concentrators, this is a nice feature in the hub, but I haven't seen yet a feature of ASA like that or not aware of an Im.

  HTH

  Rgds

  Jorge

• 3005 pro MT coprocessor driver for Win7 - 64 bit

  Kinda says it all. I have a desktop HP Pro 3005 MT with an AMD X processor 2 245, that I've upgraded to Windows 7 ultimate (64 bit). Everything works well except that the co-processor driver is not installed, and I can't seem to find anywhere (nothing online, pilots,). Apparently, the motherboard has a Nvidia Chipset, and the coprocessor driver should install with that. However, the page Pro 3005 MT drivers don't offer not a Nvidia Chipset driver down load for Windows 7 or any other OS no more. Any suggestions would be greatly appreciated.

  Added info! The motherboard uses NVIDIA GeForce 9100 chipset

  Thank you - RagnCagn

  PROBLEM SOLVED!

  Well, for what it's worth, I have finally found the right driver and solved this problem. Apparently, this link goes to a page of drivers HP for the MT 3005 Pro, but this is not the site takes you to when you type the number systen.  Anyway, the question of coprocessor is resolved. Here is a link to the page:

  http://www.driverscape.com/manufacturers/HP/laptops-desktops/HP-Pro-3005-microtower-PC/10307

  What you need to do is select the 'Coprocessor' driver in the list of drivers, click it, and then on the next screen scroll version: 5.1.26000208 (327.42 K) and downloaded to your desktop. Once downloaded, unzip it to a known location (I extracted on my desk). Now, on your desktop, go to the cutton to start, right click and go to "Device Manager" option in the upper left corner. Open it and click twice on the icon "coprocessor warning." Select the option "update driver" and guide them to the folder that you extracted the driver. Select the driver and leaves the system to update. Problem solved. Hope this helps someone.

• HP Pavilion dm4-3005 serious bug BIOS/drivers - ACPI.sys blocks constantly DPC to 3 milliseconds

  Some of our users reported problems with the HP Pavilion dm4, Intel i5, portable audio beats, so we bought such a system for the test, a HP Pavilion dm4-3005. The OS is Windows 7 Home Premium 64-bit.

  The questions were dropouts sound while using the software and USB audio interfaces that we do.

  Now, we have confirmed the questions and analyzed the cause behind it.

  The computer suffers from a DPC latency bottleneck, that fires continually in the OS ACPI.sys driver.

  ("CPD" is a regular work of pilots (Deferred Procedure Call).)

  Each DPC planned by each driver must always end quickly (less than 100 microseconds), or it causes a bug which acts as a bottleneck. When a long DPC runs in a driver, all other drivers are often necessarily suspended, for example, on a machine that behaves in the way reported, Windows can not reliable service all the drivers that need to run more often than once every 3-4 milliseconds.

  Low latency is necessary for all reception record, DAW, music app, software synth, as well as pro audio interface hardware drivers.

  Because of the congestion, they all suffer from heavy sound artifacts more use cases / underallocations for the pilot of the audio interface. This includes our products but also in any other software low latency and USB audio interfaces.

  HP Pavilion dm4-3005 has in this way from the factory, and no matter what drivers are disabled or set to date.
  I ran all the critical updates for installation of Windows 7 Home Premium 64-bit.

  I downloaded and installed all the updates driver from HP support.

  Finally, I also downloaded the BIOS update that available to HP support.

  I also followed several guides to address these issues, including advice prevailing to disable the driver "ACPI Compliant control method battery" in Device Manager (Edit: filled in the name of the pilot.)

  Does not the initial problem.

  I guess it's a bug in the BIOS - which has yet to be resolved by HP or their partner of BIOS for this product.

  I have the computer factory reset and ready for testing your solution, when it will be available.

  As it is now, we must warn our users of these systems because of their unusable latency.

  HP is aware of this problem?

  Thank you very much

  John Engstrom

  Developer

  Propellerhead Software

  Hello world

  I have good news for you, dm4-30xx users!

  The new BIOS is completed and will be published shortly by HP (need to package configuration file and write the documentation now...). The update of the BIOS version will be the F.0B.

  However, I have access to the "raw" version of this new BIOS. I can send it to you if you ask me, but in this case, you will assume any bad use of this file. In this case, please send me your mail by MP.

  The official release will not take much time, so I think it's best that you wait.

  Best regards!