3015 VPN concentrator

Whenever I try to add a new local network connection to local area network, a vpn 3015 concentrator, I get the following error:

"Unable to parse the source IP address."

My options are again or go to the home page.

Does anyone know what is the problem?

Thank you

Pat

You get this when there is an error in the fields in the L2L configuration section. Check the LAN section, you must either specify a list of network (and make sure that this list has something in it), or specify a subnet and subnet mask in the two fields below.

It's basically tell you you have not filled in the fields correctly, so check everything and it should disappear.

Tags: Cisco Security

Similar Questions

  • 3015 VPN concentrator Version help

    The 3015 comes not only as no redundant hw together? If not, how do I know which version I have?

    I don't have the CD of VPN client supplied with the appliance, can it be downloaded or bought?

    Thanks for any help.

    Jeff

    The 3015 comes with no card encryption HW (SEPs). This is the same chassis as the 3030, 3060 and 3080, the only difference between the models is the memoy in the box and how many MS and feeds they included. The 3015 allows you to upgrade to a more powerful area by simple addition of MS, but as is, it's basically empty.

    The client code and the VPN concentrator here are downloadable from EAC:

    http://www.Cisco.com/Kobayashi/SW-Center/SW-VPN.shtml

    You will need a CCO login that has access to this page.

  • 837 routers not reconnected to VPN concentrator

    When our grave 3015 VPN concentrator fails and restarts all non-837 routers connect again in a minute or 2, but the 837 hours or need a manual reset (clear isakmp). There are a number of different versions of IOS, and I presume some sort timeout setting must be configured. Despite scouring the forum, I can not know where I am going wrong. Any help appreciated.

    There is nothing in the specification IKE/ISAKMP who treats each detectig peer the other peer has declined, because of this, you can get data to enter a black hole when one side always considers that the tunnel is up and the other side has crashed/restarted and is attempting to build a new tunnel.

    To work around this problem we came with ISAKMP KeepAlive, or dead-Peer Detection (DPD). This sends a packet keepalive above the tunnel of PHase 1 every x seconds (configurable). If one end dies then the other end knows consolidated it fairly quickly and will lower its tunnels also.

    On the side of the router configuration is the following:

    ISAKMP crypto keepalive

    Make sure that you have configured in your 837. There was also some problems in the code very early with these KeepAlive, so if you do not have this command, but all your 837 seem to be code running earlier than the other routers, I would say that their transition to the last code that will insert itself into their memory/flash, which should solve your problem.

  • VPN concentrator + PIX on LAN-> customers can not reach local servers

    Hello

    I have a problem wrt. remote access clients coming via a VPN3000 concentrator and trying to access local servers.

    For the topology:

    The internal network is 10.0.1.0/24. It connects with the outside world, as well as via a PIX DMZ; the PIX has 10.0.1.1 in the internal network.

    On the same LAN (internal), I have the VPN concentrator for the inside address 10.0.1.5. It assigns addresses in the 10.0.100.0/24 range to the

    VPN client-PCs.

    I can sucessfully connect using the VPN client SW to the hub, i.e. remote access clients out addresses

    the 10.0.100.0/24 range.

    The problem: access from VPN clients to internal network is * not * possible; for example, a customer with 10.0.100.1 cannot connect to

    internal to the 10.0.1.28 server.

    To my knowledge, this is a routing problem because the server (10.0.1.28) has no idea on how to reach customers in

    10.0.100.0/24. The only thing that the server is a default static route pointing to the PIX, i.e. 10.0.1.1.

    So I set up a static route on the PIX for 10.0.100.0 pointing to the hub-VPN, that is

    Mylan route 10.0.100.0 255.255.255.0 10.0.1.5 1

    This does not solve my problem though.

    In the PIX logs, I see the entries as follows:

    % 3 PIX-106011: deny entering (no xlate) tcp src trainee: 10.0.1.28 (atlas) / 445 intern dst: 10.0.100.1 (pending) 1064

    The PIX seems to abandon return packages, i.e. traffic from the server back to the client

    To my knowledge, the problem seems to be:

    Short traffic VPN - client-> Concentrator VPN-> Server-> PIX - where it gets moved.

    My reasoning: the PIX only sees the package back, i.e. the package back from the server to the client - and therefore decreasing the

    package because he has not seen the package from the client to the server.

    So here are my questions:

    (o) how do I configure the PIX that I be connectivity between my remote VPN clients (10.0.100.0/24) and

    computers servers on the local network (10.0.1.0/24)?

    (o) someone else you have something like this going?

    PS: Please note that the first obvious idea, installation of static routes on all machines on the local network is not an option here.

    Thank you very much in advance for your help,.

    -ewald

    Hello, PIX the because can not route traffic on the same interface (prior to version 7.0 anyway), I suggest you two places your hub to the outside with the inside of the legs on a zone demilitarized or (if you can not do a makeover of the network) you remove your pool with 10.0.100.0 - addresses and create a pool with 10.0.1.0 - addresses which is a part of the address space. No, NOT all. A little book that it is not used inside.

    Best regards

    Robert Maras

  • aid required for the image backup vpn concentrator

    Hi, I am unable to download the vpn concentrator ios image to the tftp server. is someone can pls tell me what is the procedure for that. I can't find good documentation on it. pls help someone.

    concerning

    Assane

    Assane,

    You try to save the image of the hub to the VPN concentrator. Like the 4.7.2.D or the version E or F of the code. If this is the case, it is not possible to copy the image file from the hub to the tftp server.

    You must download the CEC file.

    He had an answer to your question earlier, but it pointed you on how to make a backup of your CONFIGURATION file.

    If this answers your question, feel free to write it down.

  • Configuration file for the VPN concentrator

    Hello

    I have a text-based VPN concentrator configuration file, and I want to know if there is a configuration guide of Concentrator VPN that I can use to refer to this file. The configuration on cisco.com guide is currently for the GUI based configuration.

    Furthermore, if there is a tool/utility that will read the configuration file in the format GUI without physical access to the device, which will also help.

    Thanks in advance for any assistance.

    There is a "XML export screen" in the management section of the files on the VPN concentrator. You can export the current configuration of the concentrator in a XML format, which provides the labels and values for the fields in the configuration file.

    http://www.Cisco.com/en/us/docs/security/vpn3000/vpn3000_47/Administration/Guide/Fileman.html#wpxref53361

  • Cisco VPN Client behind PIX 515E,-> VPN concentrator

    I'm trying to configure a client as follows:

    The user is running Cisco VPN Client 4.0. They are behind a 6.1 PIX 515E (4), and I need to connect to a VPN concentrator located outside of our network. We use PAT for address translation. As far as I know, to allow ipsec through Firewall 1 tunnel, I need to upgrade the pix to 6.3 and activate "fixup protocol esp-ike.

    Is there another way to do this? I am also curious to know how much more easy/better this will work if we were dealing with pptp.

    You don't necessarily need to fixup protocol esp-ike active. The remote Hub there encapsulation NAT - T enabled so that clients behind the NAT can run?

  • problem of traffic flow with tunnel created the network with a tunnel to a VPN concentrator

    Hi, I worked with Cisco and the seller for 2 weeks on this.II am hoping that what we are witnessing will ring a Bell with someone.

    Some basic information:

    I work at a seller who needs from one site to the other tunnel.  There are currently 1 site to another with the seller using a Juniper SSG, which works without incident in my system.  I'm transitioning to routers Cisco 2811 and put in place a new tunnel with the seller for the 2800 uses a different public ip address in my address range.  So my network has 2 tunnels with the provider that uses a Cisco VPN concentrator.  The hosts behind the tunnel use 20x.x.x.x public IP addresses.

    My Cisco router will create a tunnel, but I can't not to hosts on the network of the provider through the Cisco 2811, but I can't get through the tunnel of Juniper.  The seller sees my packages and provider host meets them and sends them to the tunnel.  They never reach the external interface on my Cisco router.

    I'm from the external interface so that my endpoint and the peers are the same IP address.  (note, I tried to do a static NAT and have an address of tunnel and my different host to the same result.)  Cisco has confirmed that I do have 2 addresses different and this configuration was a success with the creation of another successful tunnels toa different network.)

    I tested this configuration on a network of transit area before moving the router to the production network and my Cisco 2811 has managed to create the tunnel and ping the inside host.  Once we moved the router at camp, we can no longer ping on the host behind the seller tunnel.   The seller assured me that the tunnel setting is exactly the same, and he sees his host to send traffic to the tunnel.  The seller seems well versed with the VPN concentrator and manages connections for many customers successfully.

    The seller has a second VPN concentrator on a separate network and I can connect to this VPN concentrator with success of the Cisco 2811 who is having problems with the hub, which has also a tunnel with Gin.

    Here is what we have done so far:

    (1) confirm the config with the help of Cisco 2811.  The tunnel is up.  SH cyrpto ipa wristwatch tunnel upward.
    (2) turn on Nat - T side of the tunnel VPN landscapers
    (3) confirm that the traffic flows properly a tunnel on another network (which would indicate that the Cisco config is ok)
    (4) successfully, tunnel and reach a different configuration hosting
    (5) to confirm all the settings of tunnel with the seller
    (6) the seller confirmed that his side host has no way and that it points to the default gateway
    (7) to rebuild the tunnel from scratch
    8) confirm with our ISP that no way divert traffic elsewhere.  My gateway lSP sees my directly connected external address.
    (9) confirm that the ACL matches with the seller
    (10) I can't get the Juniper because he is in production and in constant use

    Is there a known issue with the help of a VPN concentrator to connect to 2 tunnels on the same 28 network range?

    Options or ideas are welcome.  I had countless sessions with Cisco webex, but do not have access to the hub of the seller.  I can forward suggestions.

    Here's a code

    crypto ISAKMP policy 1
    BA 3des
    md5 hash
    preshared authentication
    Group 2
    !
    crypto ISAKMP policy 2
    BA 3des
    preshared authentication
    Group 2

    Crypto ipsec transform-set mytrans aes - esp esp-sha-hmac

    Crypto-map dynamic dynmap 30
    Set transform-set RIGHT

    ISAKMP crypto key address No.-xauth

    interface FastEthernet0/0
    Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE $ 0/0
    IP 255.255.255.240
    IP access-group 107 to
    IP access-group out 106
    NAT outside IP
    IP virtual-reassembly
    route IP cache flow
    automatic duplex
    automatic speed
    crypto mymap map

    logging of access lists (applied outside to get an idea of what will happen.  No esp traffic happens, he has never hits)

    allowed access list 106 esp host host newspaper
    106 ip access list allow a whole
    allowed access list 107 esp host host Journal
    access-list 107 permit ip host host Journal

    access-list 107 permit ip host host Journal
    107 ip access list allow a whole

    Crypto isa HS her
    IPv4 Crypto ISAKMP Security Association
    status of DST CBC State conn-id slot
      QM_IDLE ASSETS 0 1010

    "Mymap" ipsec-isakmp crypto map 1
    Peer =.
    Extend the 116 IP access list
    access - list 116 permit ip host host (which is a public IP address))
    Current counterpart:
    Life safety association: 4608000 kilobytes / 2800 seconds
    PFS (Y/N): N
    Transform sets = {}
    myTrans,
    }

    OK - so I have messed around the lab for 20 minutes and came up with the below (ip are IP test:-)

    (4) ip nat pool crypto-nat 10.1.1.1 10.1.1.1 prefix length 30 <> it comes to the new address of NAT

    !
    (1) ip nat inside source list 102 interface FastEthernet0/0 overload <> it comes to the interface by default NAT

    !
    IP nat inside source map route overload of crypto-nat of crypto-nat pool <> it is the policy of the NAT function

    !

    (6) access-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 <> defines the IP source and destination traffic

    !

    (2) access-list 102 deny ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 <> does not NAT the normal communication

    (3) access-list 102 deny ip 10.1.1.1 host 172.16.2.0 0.0.0.255 <> does not re - NAT NAT

    (1) access-list 102 permit ip 172.16.1.0 0.0.0.255 any <> allows everyone else to use the IP Address of the interface for NAT

    !

    (5) crypto-nat route-map permit 5 <> condition for the specific required NAT
    corresponds to the IP 101 <> game of traffic source and destination IP must be NAT'td

    (7) access list 103 permit ip 10.1.1.1 host 172.16.2.0 0.0.0.255 <> crypto acl

    Then, how the works above, when a package with the what IP 172.16.1.0/24 source wants to leave the router to connect to google, say the source will change to IP interface (1).  When 172.16.1.0/24 wants to talk to172.16.2.0/24, it does not get translated (2).  When the remote end traffic equaled the following clause of NAT - the already NAT'td IP will not be affected again (3) when a host 172.16.1.0/24 wants to communicate with 172.16.2.20/24 we need a NAT NAT specific pool is required (4).  We must define a method of specific traffic to apply the NAT with a roadmap (5) which applies only when the specific traffic (6), then simply define the interesting traffic to the VPN to initiate and enable comms (7) corresponding

  • BW policy on VPN concentrator

    I've got a 3030 VPN concentrator with 4.0.1 B. I OS release have implemented a policy of BW for the VPN site - to many. Is it possible to check/see if the policy is applied (for example, deleted if traffic over the limit)?

    Thank you, Meg

    Monitoring - statistics - bandwidth Mgmt should give you some details.

  • Download the firmware from the 3030 VPN concentrator?

    Hello

    I would like to download a newer firmware our vpn concentrator but wish to download a copy of the old firmware. Is this possible and how can I do? It seems that the only option is to download, as well as a fall on a document that indicate how to go back but still doesn't explain not how can I get a copy of the old firmware. Thank you

    I think that Cisco pulls some of the older minor revisions out of the web for major versions when the image becomes a bit old. 3.5 (3), you should be fine with 3.6 (which is available for download). You cannot copy the picture from the hub as far as I know.

  • Ports open VPN concentrator

    I'm running the port scan (Angry IP Scanner) against VPN concentrator. Sometimes it shows the port as open 21. I have disabled ftp under "Management protocols" sometimes it shows the port 389 & 1002 as open. What wrong with my VPN concentrator?

    I activated only IPSEC protocol Tunneling.

    When I run the scan of port which ports are should be included amongst them open?

    Thank you

    Hello avilt,

    VCA means Cluster Virtual Agent. This is used mainly when the VPN 3000 pair is configured for load balancing,... when doing so cells communicate with each other on VCA and we must normally allow this on the filters...

    My question is, u have allowed this filter on the public interface? you see the ports via the VPN concentrator or you make a sweep WILL and see these ports (such as FTP) to be opened on the VPN concentrator?

    REDA

  • Cisco VPN concentrator 3005

    FW 4.1.7r

    I can't the https management work on the device.  The event logs tell something, of not being able to add the ssl certificate to the private interface.  I tried to turn on/off box https without success.  I also restarted the device.

    Anything else I can try?

    You can check if the self-signed certificate VPN concentrator has expired.

    It will be under the Administration--> Management of certificates

  • Redundancy of VPN concentrator

    Hello

    I have some doubts on the VRRP process in VPN concentrators.

    (1) the shared address group (private and public) is the same as addresses real Ip of the master, correct?

    For example, if I have it set up like this:

    Master: public (10.10.10.1); private (20.20.20.1)

    Backup: public (10.10.10.2); private (20.20.20.2)

    Shared group address must be: public (10.10.10.1) and private (20.20.20.1), correct?

    (2) if I already have a configured VPN concentrator and I would like to had another one for redundancy, and I maintain the same IP address as before for the master, I don't need to change anything to the neighbors of the VPN concentrator, right?

    (3) if the master goes down, the backup will take over VPN connections, users will always use the same IP address that before to connect by VPN. However if I want to access the administration of backup should I always access the correct 20.20.20.2?

    Thank you.

    Best regards

    Norberto

    Yes, you are absolutely right with your 3 statements.

    With your second question, if you want to add another VPN hub for redundancy, you can actually use the other VPN concentrator configuration and simply change the ip address that you assign to the public and private interfaces is unique. Everything must be the same it is the shared group addresses, as well as the role as a slave instead of master.

    Here is more information about VRRP for your reference:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2284/products_tech_note09186a0080094490.shtml

    Hope that helps.

  • VPN concentrator 3005 - problem of IP attribution

    I have a strange problem with the VPN concentrator 3005. I have the private interface configured with 192.168.3.3/24 as the ip address. For all the users I assign an ip address from the same network (for example) 192.168.3.105/24 or use an IP address pool (192.168.3.100 - 192.168.3.150) the connection fails and the hub will specify that it cannot assign an ip address to the client.

    However, if I configure the user address pool or a client on a subnet different it works and the user GET connected. For example, 192.168.2.105/24. I hit him a back-end switch and do not really want to have to add a router to talk between subnets.

    Am I missing something?

    Any help is appreciated!

    Alan,

    It is recommended to assign another pool of IP addresses for VPN clients to internal network.

    Although it is not recommended, you should be able to assign a Pool of IP addresses that is part of the same internal network and it should work. The only thing that you must be aware of, is that this range of IP addresses assigned to customers should not be used on the internal network

    You can post the VPN3000 logs when its not able to assign an IP address to the VPN Client.

    Let me know if it helps.

    Kind regards

    Arul

    * Please note all useful messages *.

  • What has replaced the vpn concentrator?

    Greenhorn here, I was not to sit in this place.  We have three remote sites, sister of institutions, we share an app with.  Host us the app.  A site has a configuration of vpn concentrator, the other two use a leased from point to point line. They each have a router that connects to a single router.  They want to replace the lines leased by using a vpn.  Do the digging, I see that the hubs are EOL.

    So, what is used to replace the hub today?  What is a solution today from leased lines? They are all poor profit. My guess is that they will say look on Ebay for a hub if the solution is too expensive.

    Thanks Jim

    Jim

    The package of security (CISCO2901-SEC/K9 or CISCO2921-SEC/K9) is the convenient way to get the combination of the router, the software and licenses you will need. I don't think that you need something more elaborate than one of these security packages.

    I think one of these would be a good choice for you. It's been a while since I looked at the details of these routers. My recollection is that the 2921 offers more power, more interfaces and a few other benefits and would be attractive to many of us. But I think I understand your needs, I believe that the 2901 router cheaper and quite adequate for you.

    HTH

    Rick

Maybe you are looking for

  • MacBook Pro mid-2009 vs MacBook late 2009 - macOS Sierra

    Hi all Can anyone please explain to me, why we can't install macOS Sierra on MacBook Pro mid-2009 models and can install it on the MacBook models end 2009? I checked the specifications of these two laptops and they are quite similar, where MBP is fas

  • Firefox windows lack of profile 7

    Hello. I can't open mozilla cos is to show an error message "unable to load your Firefox profile. It may be missing or inaccessible.I saw the older sons, and when I create a new profile that works. Then when I close an reopen it I have the same error

  • Question on the display resolution of Vista on Satellite Pro P100 (PSPA4E)

    There was my laptop today for the Vista upgrade patterns. Found the drivers ok, but the Nvidia drivers from Toshiba for the 7600 light only support the max resolution of 1024 x 768 on a screen 17 "wide. I looked on Nvidia and there is none for Vista

  • NVIDEA GeForce GT530 connector problem.

    I have a NVIDEA GeForce GT530 graphics with 1 DVI and 1 USB connector.  There are two DVI monitors.  Are there adapters that will allow a USB DVI-connection, or do I need another card to run 2 monitors?  It was my understanding that the card would be

  • I can't get the audio to be synchronized with the video editing multicamera?

    Multicamera editing, audio will not be synchronized with the video. I have two clips, 1 Plus 6 iPhone and the other an iPad Mini 2. While the audio wave forms are aligned, they will not match the video... the lips are out of sync. How can I handle th