4.0.1W/2000 CLIENT VPN VPN with IOS ping no internal.

Similar Questions

• Client VPN with tunneling IPSEC over TCP transport does not

  Hello world

  Client VPN works well with tunneling IPSEC over UDP transport.

  I test to see if it works when I chose the VPN client with ipsec over tcp.

  Under the group policy, I disabled the IPSEC over UDP and home port 10000

  But the VPN connection has failed.

  What should I do to work VPN using IPSEC over TCP

  Concerning

  MAhesh

  Mahesh,

  You must use "ikev1 crypto ipsec-over-tcp port 10000.

  As crypto isakmp ipsec-over-tcp work on image below 8.3

  HTH

• Client VPN router IOS, and site to site vpn

  Hello

  Im trying to configure a vpn client access to an ios router that already has a vpn site-to site running. I don't see how the two can run on the same router.

  So I guess my question is is it possible? and if anyone has therefore had a config that they can share or a useful link.

  IM using a router 800 series with 12.4 ios

  Thank you very much

  Colin

  ReadersUK wrote:
  Hi
  Im trying to configure access for a vpn client to a ios router that already has a site to site vpn running. I cant see how both can be running on the same router.
  So i guess my question is can this be done? and if so has anyone got a config they can share or a useful link.
  im using a 800 series router with 12.4 ios
  Many thanks
  Colin
  

  Colin

  It can be done. Look at this config example that shows a router configured with a site to site VPN and client vpn - connection

  https://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094685.shtml

  Jon

• Client VPN router IOS does not connect

  Hi all

  I'm having some trouble of Client VPN connection over the internet to our Cisco IOS router. Some help would be very appreciated!

  On the VPN client log I get the following error messages:

  ---------------------------

  ...

  573 16:32:13.164 21/12/05 Sev = WARNING/2 IKE/0xE3000099

  Size invalid SPI (PayloadNotify:116)

  574 16:32:13.164 21/12/05 Sev = Info/4 IKE/0xE30000A4

  Invalid payload: said length of payload, 568, not enough Notification:(PayloadList:149)

  575 16:32:13.164 21/12/05 Sev = WARNING/3 IKE/0xA3000058

  Received incorrect message or negotiation is no longer active (message id: 0x00000000)

  ---------------------------

  We get debugging on the router that I'm trying to connect:

  ---------------------------

  router #debug isakmp crypto

  ...

  21 Dec 16:32:16.089 AEDT: ISAKMP (0:0): received 203.153.196.1 packet dport 500 sport 500 SA NEW Global (N)

  21 Dec 16:32:16.089 AEDT: ISAKMP: created a struct peer 203.153.196.1, peer port 500

  21 Dec 16:32:16.089 AEDT: ISAKMP: new created position = 0x678939E0 peer_handle = 0 x 80000031

  21 Dec 16:32:16.089 AEDT: ISAKMP: lock struct 0x678939E0, refcount IKE peer 1 for crypto_isakmp_process_block

  21 Dec 16:32:16.089 AEDT: ISAKMP: 500 local port, remote port 500

  21 Dec 16:32:16.089 AEDT: insert his with his 67B0AB34 = success

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): treatment ITS payload. Message ID = 0

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): payload ID for treatment. Message ID = 0

  21 Dec 16:32:16.089 AEDT: ISAKMP (0:0): payload ID

  next payload: 13

  type: 11

  ID of the Group: eggs

  Protocol: 17

  Port: 500

  Length: 12

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): peer games * no * profiles

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): supplier code seems the unit/DPD but major incompatibility of 215

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): provider ID is XAUTH

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): provider ID is DPD

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): supplier code seems the unit/DPD but major incompatibility of 194

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): supplier code seems the unit/DPD but major incompatibility of 123

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): provider ID is NAT - T v2

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment

  21 Dec 16:32:16.089 AEDT: ISAKMP: (0:0:N / A:0): provider ID is the unit

  21 Dec 16:32:16.089 AEDT: ISAKMP: analysis of the profiles for xauth...

  .....

  21 Dec 16:32:16.093 AEDT: ISAKMP: (0:0:N / A:0): atts are not acceptable. Next payload is 3

  21 Dec 16:32:16.093 AEDT: ISAKMP: (0:0:N / A:0): audit ISAKMP transform 12 against the policy of priority 3

  21 Dec 16:32:16.093 AEDT: ISAKMP: 3DES-CBC encryption

  21 Dec 16:32:16.093 AEDT: ISAKMP: MD5 hash

  21 Dec 16:32:16.093 AEDT: ISAKMP: group by default 2

  21 Dec 16:32:16.093 AEDT: ISAKMP: pre-shared key auth

  21 Dec 16:32:16.093 AEDT: ISAKMP: type of life in seconds

  21 Dec 16:32:16.093 AEDT: ISAKMP: life (IPV) 0x0 0 x 20 0xC4 0x9B

  21 Dec 16:32:16.093 AEDT: ISAKMP: (0:0:N / A:0): pre-shared authentication offered but does not match policy.

  21 Dec 16:32:16.093 AEDT: ISAKMP: (0:0:N / A:0): atts are not acceptable. Next payload is 3

  ---------------------------

  You can apply the encryption the WAN interface card and check?

• Windows 7 x 64 support for Client VPN with SBL/PLAP

  Is it now or will it be a customer VPN Windows 7 x 64 support prior to logon Access Provider (PLAP) that replaces start them before logon (SBL)?  I understand that connect any client supports it, but the customer needs customer VPN (IPSec) rather than any connection (SSL) because of their current license on the SAA.  They have little license for SSL.

  It is possible with AnyConnect, however, there is currently no functionality SBL/PLAP for the traditional IPSec VPN on Windows 7 client. There is an improvement for this feature request, but it has not been applied and so I can't give you an idea on whether she will ever be supported, see CSCse47544.

  -heather

• Save the password on the Client VPN with PIX

  I'm running a PIX 515 6.1 (2) configured for a small number of VPN clients. I want VPN clients to automatically remember the password of login for users do not have to enter it each time (we have an application which periodically autoconnexions).

  While it is a configurable option with concentrators 3000 series, it seems not be configurable with the PIX.

  The only work around, I can find is to make the connection file (.pcf) read-only and set SaveUserPassword = 1. The problem

  which is the password, and then must be stored in clear text in the file and it becomes inconvenient for the user to change their password.

  Does anyone know if the command exists on the PIX from the VPN client to save the connection password?

  Thank you

  Misha

  The command to do this is not currently available on the PIX. He has just been included in the IOS EZVPN server functionality, but have not heard of anything anyone yet as to if it will be included in the PIX.

  If you want this feature, do not hesitate to contact your account manager and have them grow for him, the more customers requesting a new feature faster he gets.

• Configuration of the client VPN IPSEC IOS question

  Hello all, I just can't get my IOS Firewall to accept a client based vpn IPSEC connection. The Cisco client comes to expiration and Im never disputed a username and password. I checked my group and a pre-shared on the client and the router. I put my relevant config below. Any help would be greatly appreciated.

  version 12.4

  boot system flash: uc500-advipservicesk9 - mz.124 - 24.T.bin

  AAA new-model

  !

  !

  AAA authentication login default local

  radius of group AAA authentication login userauthen

  AAA authorization exec default local

  radius of group AAA authorization network groupauthor

  inspect the IP tcp outgoing name

  inspect the IP udp outgoing name

  inspect the name icmp outgoing IP

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  Configuration group customer isakmp crypto SMOVPN

  key xxxxx

  DNS 192.168.10.2

  business.local field

  pool vpnpool

  ACL 108

  Crypto isakmp VPNclient profile

  match of group identity SMOVPN

  client authentication list default

  Default ISAKMP authorization list

  client configuration address respond

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  Define VPNclient isakmp-profile

  market arriere-route

  !

  !

  map clientmap client to authenticate crypto list userauthen

  card crypto clientmap isakmp authorization list groupauthor

  client configuration address map clientmap crypto answer

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  interface FastEthernet0/0

  IP 11.11.11.10 255.255.255.252

  IP access-group outside_in in

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  NAT outside IP

  inspect the outgoing IP outside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  clientmap card crypto

  IP local pool vpnpool 192.168.109.1 192.168.109.254

  IP nat inside source list 1 interface FastEthernet0/0 overload

  outside_in extended IP access list

  permit tcp object-group Yes_SMTP host 11.11.11.10 eq smtp

  allow any host 74.143.215.138 esp

  allow any host 74.143.215.138 eq isakmp udp

  allow any host 74.143.215.138 eq non500-isakmp udp

  allow any host 74.143.215.138 ahp

  allow accord any host 74.143.215.138

  access-list 1 permit 192.168.10.0 0.0.0.255

  access-list 1 permit 10.1.1.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 192.168.10.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.1.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.10.0 0.0.0.255

  Here are a few suggestions:

  change this:

  radius of group AAA authorization network groupauthor

  for this

  AAA authorization groupauthor LAN

  (unless you use the group permission for your radius server you need local)

  Choose either on ISAKMP profiles and if you decide to go with and then get rid of these lines:

  map clientmap client to authenticate crypto list userauthen

  card crypto clientmap isakmp authorization list groupauthor

  client configuration address map clientmap crypto answer

  AND change the following items on your profile isakmp:

  Crypto isakmp VPNclient profile

  ISAKMP authorization list groupauthor

  Also if you'll use a list for user authentication, I advise you to avoid using the default list so go ahead and change it too much under the isakmp profile

  client authentication list userauthen.

  If you do not use isakmp profiles change the following:

  No crypto isakmp VPNclient profile

  Crypto-map dynamic dynmap 10

  No VPNclient set isakmp-profile

• Client VPN cannot access the different internal subnet

  Hi all

  I use pix 7.0 and 4,8 vpn client

  When I connect with the vpn client, I see the subnet behind the pix (10.61.1.0)

  However, there is a router on that subnet that connects to two other sites (10.61.2.0 and 10.72.2.0)

  I can ping from the pix to these subnets command line.

  When I connect using the vpn client I only see the subnet behind the pix and not the other two subnets?

  I have a command-line 10.0.0.0 255.0.0.0 10.61.1.250 (the ip address of the router) on the pix, but this doesn't seem to help?

  The response from the ping is request timed out one or the other subnets.

  Any suggestions on what route, I need to add or is there an ACL to be added?

  Current and ACL routes is:

  0.0.0.0 0.0.0. The ISP router address

  10.0.0.0 255.0.0.0 10.61.1.250

  Outside_access_in list extended access permit icmp any one

  access extensive list ip 10.61.1.0 inside_nat0 allow 255.255.255.0 10.61.1.224 255.255.255.240

  NAT (inside) 0-list of access inside_nat0

  NAT (inside) 10 0.0.0.0 0.0.0.0

  Access-group Outside_access_in in interface outside

  All responses appreciated.

  first of all and above all, the pool of the vpn client should not overlap with the asa inside the subnet, or any connected subnet.

  <-->Asa <-->(10.61.1.250) Internet router <-->10.61.2.0 and 10.72.2.0

  allow inside_nat0 to access extended list ip 10.61.1.0 255.255.255.0

  allow inside_nat0 to access extended list ip 10.61.2.0 255.255.255.0

  allow inside_nat0 to access extended list ip 10.72.2.0 255.255.255.0

  Allow Outside_cryptomap_dyn_20 to access extended list ip 10.61.1.0 255.255.255.0

  Allow Outside_cryptomap_dyn_20 to access extended list ip 10.61.2.0 255.255.255.0

  Allow Outside_cryptomap_dyn_20 to access extended list ip 10.72.2.0 255.255.255.0

  In addition, a static route must be configured on the 10.61.1.250 router:

  IP route

• CLIENT VPN connection OK &amp; PING OK but no INTERNET or LAN

  Hello

  After spending too much time to make it work on a router configured and cannot do work and using too much of your time, I decide to test my installation again on a fresh clean router.

  Why I do that before, it took me only 15 minutes to create this script (out of my mind), I know that you will do in 5 minutes or less, but I'm new to this world of CISCO.

  The installation program is to follow:

  TESTLAB:

  NAS (DIFFICULTY IP 192.168.0.100/24)-> C2691, F0 F0/1 (FIX IP (DHCP = IP OF THE ISP) 192.168.0.1/24)/0-> INTERNET-> COMPUTER (MAC BOOK PRO)

  With the bellows of script, when I connect a computer to the side LAN of ROUTER (F0/1), I get an IP address from the DHCP server, I am able to see everything on my LAN, go to the INTERNET, so this does not work well.

  On another network, I am able to do a VPN over the INTERNET connection at my home testlab, but:

  I can PING 192.168.0.1 (ROUTER) and 192.168.0.100 (SIN), but I do not have access to the INTERNET or to the NAS on my LAN TESTLAB.

  I'm sure what I lack only a single line in an ACL or IP ROUTE, but I have no idea.

  Thus, if one of you can give me some advice, you are welcome

  Here below, I give you the script and the JOURNAL when I'm logged in, I do not delete any information, you will be able to see the real IP, it's just a TESTLAB.

  Best regards

  Didier

  Router #sh run

  Building configuration...

  Current configuration: 2297 bytes

  !

  version 12.4

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  router host name

  !

  boot-start-marker

  boot system flash: c2691-adventerprisek9 - mz.124 - 5a .bin

  boot-end-marker

  !

  AAA new-model

  !

  AAA authentication login userauthen local

  AAA authorization groupauthor LAN

  !

  AAA - the id of the joint session

  !

  resources policy

  !

  IP cef

  !

  !

  No dhcp use connected vrf ip

  DHCP excluded-address IP 192.168.0.1

  !

  pool of dhcp IP LAN

  import all

  network 192.168.0.0 255.255.255.0

  !

  Fax fax-mail interface type

  0 username cisco password Cisco

  !

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group 3000client

  key cisco123

  DNS 8.8.8.8

  domain cisco.com

  pool ippool

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  !

  map clientmap client to authenticate crypto list userauthen

  card crypto clientmap isakmp authorization list groupauthor

  client configuration address map clientmap crypto answer

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  !

  interface FastEthernet0/0

  DHCP IP address

  NAT outside IP

  IP virtual-reassembly

  automatic speed

  Half duplex

  clientmap card crypto

  !

  interface Serial0/0

  no ip address

  Shutdown

  !

  interface FastEthernet0/1

  the IP 192.168.0.1 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  automatic speed

  Half duplex

  !

  interface Serial1/0

  no ip address

  Shutdown

  series 0 restart delay

  No terminal-dce-enable-calendar

  !

  interface Serial1/1

  no ip address

  Shutdown

  series 0 restart delay

  No terminal-dce-enable-calendar

  !

  interface Serial1/2

  no ip address

  Shutdown

  series 0 restart delay

  No terminal-dce-enable-calendar

  !

  interface Serial1/3

  no ip address

  Shutdown

  series 0 restart delay

  No terminal-dce-enable-calendar

  !

  IP local pool ippool 14.1.1.100 14.1.1.200

  !

  IP http server

  no ip http secure server

  overload of IP nat inside source list NAT interface FastEthernet0/0

  !

  IP access-list standard NAT

  allow a

  !

  control plan

  !

  Dial-peer cor custom

  !

  Line con 0

  transportation out all

  Speed 115200

  line to 0

  transportation out all

  line vty 0 4

  transport of entry all

  transportation out all

  !

  end

  To CONNECT the VPN CLIENT:

  Cisco Systems VPN Client Version 4.9.01 (0100)

  Copyright (C) 1998-2006 Cisco Systems, Inc. All rights reserved.

  Type of client: Mac OS X

  Running: the Darwin 10.6.0 Darwin kernel Version 10.6.0: Wed Nov 10 18:13:17 PST 2010; root:XNU-1504.9.26~3/RELEASE_I386 i386

  1 08:04:22.991 27/01/2011 Sev = Info/4 CM / 0 x 43100002

  Start the login process

  2 08:04:22.992 27/01/2011 Sev = WARNING/2 CVPND / 0 x 83400011

  Send error - 28 package. ADR DST: 0x0AD337FF, ADR Src: 0x0AD33702 (DRVIFACE:1158).

  3 08:04:22.992 27/01/2011 Sev = WARNING/2 CVPND / 0 x 83400011

  Send error - 28 package. ADR DST: 0x0A2581FF, ADR Src: 0x0A258102 (DRVIFACE:1158).

  4 08:04:22.992 27/01/2011 Sev = Info/4 CM / 0 x 43100004

  Establish a connection using Ethernet

  5 08:04:22.992 27/01/2011 Sev = Info/4 CM / 0 x 43100024

  Attempt to connect with the server "81.83.202.36".

  6 08:04:22.992 27/01/2011 Sev = Info/4 CVPND / 0 x 43400019

  Separation of privileges: binding to the port: (500).

  7 08:04:22.992 27/01/2011 Sev = Info/4 CVPND / 0 x 43400019

  Separation of privileges: binding to the port: (4500).

  8 08:04:22.993 27/01/2011 Sev = Info/6 IKE/0x4300003B

  Attempts to establish a connection with 81.83.202.36.

  9 08:04:23.072 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) at 81.83.202.36

  10 08:04:23.203 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  11 08:04:23.204 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" ag="" (sa,="" vid(unity),="" vid(dpd),="" vid(?),="" vid(xauth),="" vid(nat-t),="" ke,="" id,="" non,="" hash,="" nat-d,="" nat-d)="" from="">

  12 08:04:23.204 27/01/2011 Sev = Info/5 IKE / 0 x 43000001

  Peer is a compatible peer Cisco-Unity

  13 08:04:23.204 27/01/2011 Sev = Info/5 IKE / 0 x 43000001

  Peer supports the DPD

  14 08:04:23.204 27/01/2011 Sev = Info/5 IKE / 0 x 43000001

  Peer supports DWR and text DWR

  15 08:04:23.204 27/01/2011 Sev = Info/5 IKE / 0 x 43000001

  Peer supports XAUTH

  16 08:04:23.204 27/01/2011 Sev = Info/5 IKE / 0 x 43000001

  Peer supports NAT - T

  17 08:04:23.282 27/01/2011 Sev = Info/6 IKE / 0 x 43000001

  IOS Vendor ID successful construction

  18 08:04:23.282 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) at 81.83.202.36

  19 08:04:23.282 27/01/2011 Sev = Info/4 IKE / 0 x 43000083

  IKE port in use - Local Port = 0x01F4, Remote Port = 0x01F4

  20 08:04:23.282 27/01/2011 Sev = Info/5 IKE / 0 x 43000072

  Automatic NAT detection status:

  Remote endpoint is NOT behind a NAT device

  This effect is NOT behind a NAT device

  21 08:04:23.282 27/01/2011 Sev = Info/4 CM/0x4310000E

  ITS established Phase 1.  1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

  22 08:04:23.290 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  23 08:04:23.290 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

  24 08:04:23.290 27/01/2011 Sev = Info/5 IKE / 0 x 43000045

  Answering MACHINE-LIFE notify has value of 86400 seconds

  25 08:04:23.290 27/01/2011 Sev = Info/5 IKE / 0 x 43000047

  This SA was already alive for 1 second, expiration of adjustment to 86399 seconds now

  26 08:04:23.294 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  27 08:04:23.294 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" info="" *(hash,="" del)="" from="">

  28 08:04:23.296 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  29 08:04:23.296 27/01/2011 Sev = WARNING/2 IKE / 0 x 83000062

  Attempt to inbound connection from 81.83.202.36. Incoming connections are not allowed.

  30 08:04:23.298 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  31 08:04:23.298 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

  32 08:04:23.298 27/01/2011 Sev = Info/4 CM / 0 x 43100015

  Launch application xAuth

  33 08:04:23.416 27/01/2011 Sev = Info/4 IPSEC / 0 x 43700008

  IPSec driver started successfully

  34 08:04:23.416 27/01/2011 Sev = Info/4 IPSEC / 0 x 43700014

  Remove all keys

  35 08:04:23.416 27/01/2011 Sev = Info/6 IPSEC/0x4370002C

  Sent 29 packages, 0 were fragmented.

  36 08:04:27.320 27/01/2011 Sev = Info/4 CM / 0 x 43100017

  xAuth application returned

  37 08:04:27.320 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to 81.83.202.36

  38 08:04:27.333 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  39 08:04:27.333 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

  40 08:04:27.333 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to 81.83.202.36

  41 08:04:27.333 27/01/2011 Sev = Info/4 CM/0x4310000E

  ITS established Phase 1.  1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

  42 08:04:27.334 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to 81.83.202.36

  43 08:04:27.351 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  44 08:04:27.351 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

  45 08:04:27.351 27/01/2011 Sev = Info/5 IKE / 0 x 43000010

  MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 14.1.1.101

  46 08:04:27.351 27/01/2011 Sev = Info/5 IKE / 0 x 43000010

  MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 8.8.8.8

  47 08:04:27.351 27/01/2011 Sev = Info/5 IKE / 0 x 83000017

  MODE_CFG_REPLY: The attribute (INTERNAL_ADDRESS_EXPIRY) and the (134744072) value received is not supported

  48 08:04:27.351 27/01/2011 Sev = Info/5 IKE/0x4300000D

  MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000000

  49 08:04:27.351 27/01/2011 Sev = Info/5 IKE/0x4300000E

  MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = cisco.com

  50 08:04:27.351 27/01/2011 Sev = Info/5 IKE / 0 x 83000015

  MODE_CFG_REPLY: Attribute received no data MODECFG_UNITY_SPLITDNS_NAME

  51 08:04:27.351 27/01/2011 Sev = Info/4 CVPND / 0 x 43400018

  Separation of privileges: opening file: (/ etc/opt/cisco-vpnclient/Profiles/DRI.pcf).

  52 08:04:27.352 27/01/2011 Sev = Info/5 IKE/0x4300000E

  MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = software Cisco IOS, software 2600 (C2691-ADVENTERPRISEK9-M), Version 12.4(5a), VERSION of the SOFTWARE (fc3)

  Technical support: http://www.cisco.com/techsupport

  Copyright (c) 1986-2006 by Cisco Systems, Inc.

  Last updated Sunday, January 14, 06 05:00 by alnguyen

  53 08:04:27.352 27/01/2011 Sev = Info/4 CM / 0 x 43100019

  Data in mode Config received

  54 08:04:27.353 27/01/2011 Sev = Info/4 IKE / 0 x 43000056

  Received a request from key driver: local IP = 81.83.203.94, GW IP = 81.83.202.36, Remote IP = 0.0.0.0

  55 08:04:27.353 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to 81.83.202.36

  56 08:04:27.359 27/01/2011 Sev = Info/4 IPSEC / 0 x 43700014

  Remove all keys

  57 08:04:27.371 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  58 08:04:27.371 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" qm="" *(hash,="" sa,="" non,="" id,="" id,="" notify:status_resp_lifetime)="" from="">

  59 08:04:27.371 27/01/2011 Sev = Info/5 IKE / 0 x 43000045

  Answering MACHINE-LIFE notify has value of 3600 seconds

  60 08:04:27.371 27/01/2011 Sev = Info/5 IKE / 0 x 43000046

  Answering MACHINE-LIFE notification has the value 4608000 kb

  61 08:04:27.371 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK QM * (HASH) at 81.83.202.36

  62 08:04:27.371 27/01/2011 Sev = Info/5 IKE / 0 x 43000059

  IPsec Security Association of loading (MsgID = SPI OUTBOUND SPI INCOMING = 0x289044F5 0xA3A7DAF8 = 1DBA3942)

  63 08:04:27.372 27/01/2011 Sev = Info/5 IKE / 0 x 43000025

  OUTGOING ESP SPI support: 0xA3A7DAF8

  64 08:04:27.372 27/01/2011 Sev = Info/5 IKE / 0 x 43000026

  Charges INBOUND ESP SPI: 0x289044F5

  65 08:04:27.372 27/01/2011 Sev = Info/4 CM/0x4310001A

  A secure connection established

  66 08:04:27.372 27/01/2011 Sev = Info/4 CVPND/0x4340001E

  Separation of privileges: reduce the MTU on the main interface.

  67 08:04:27.373 27/01/2011 Sev = Info/4 CVPND/0x4340001B

  Separation of privileges: /etc/resolv.conf file backup.

  68 08:04:27.373 27/01/2011 Sev = Info/4 CVPND/0x4340001D

  Separation of privileges: chown (/ var/run/resolv.conf.vpnbackup, uid = 0 gid = 1).

  69 08:04:27.373 27/01/2011 Sev = Info/4 CVPND / 0 x 43400018

  Separation of privileges: opening file: (/ var/run/resolv.conf).

  70 08:04:27.377 27/01/2011 Sev = Info/4 CM/0x4310003B

  Look at address added to 81.83.203.94.  Current host name: d5153cb5e.access.telenet.be, current address (s): 81.83.203.94, 10.211.55.2, 10.37.129.2.

  71 08:04:27.860 27/01/2011 Sev = Info/4 IPSEC / 0 x 43700010

  Creates a new key structure

  72 08:04:27.860 27/01/2011 Sev = Info/4 IPSEC/0x4370000F

  Adding key with SPI = 0xf8daa7a3 in the list of keys

  73 08:04:27.860 27/01/2011 Sev = Info/4 IPSEC / 0 x 43700010

  Creates a new key structure

  74 08:04:27.860 27/01/2011 Sev = Info/4 IPSEC/0x4370000F

  Adding key with SPI = 0xf5449028 in the list of keys

  75 08:04:37.360 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to 81.83.202.36

  76 08:04:37.360 27/01/2011 Sev = Info/6 IKE/0x4300003D

  Sending DPD request to 81.83.202.36, our seq # = 2293347010

  77 08:04:37.382 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  78 08:04:37.382 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

  79 08:04:37.382 27/01/2011 Sev = Info/5 IKE / 0 x 43000040

  DPD ACK from 81.83.202.36, seq # receipt = 2293347010, seq # expected = 2293347010

  80 08:04:47.859 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to 81.83.202.36

  81 08:04:47.860 27/01/2011 Sev = Info/6 IKE/0x4300003D

  Sending DPD request to 81.83.202.36, our seq # = 2293347011

  82 08:04:47.867 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  83 08:04:47.867 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

  84 08:04:47.867 27/01/2011 Sev = Info/5 IKE / 0 x 43000040

  DPD ACK from 81.83.202.36, seq # receipt = 2293347011, seq # expected = 2293347011

  85 08:05:03.865 27/01/2011 Sev = Info/4 IKE / 0 x 43000013

  SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to 81.83.202.36

  86 08:05:03.865 27/01/2011 Sev = Info/6 IKE/0x4300003D

  Sending DPD request to 81.83.202.36, our seq # = 2293347012

  87 08:05:03.872 27/01/2011 Sev = Info/5 IKE/0x4300002F

  Received packet of ISAKMP: peer = 81.83.202.36

  88 08:05:03.872 27/01/2011 Sev = Info/4 IKE / 0 x 43000014

  RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

  89 08:05:03.872 27/01/2011 Sev = Info/5 IKE / 0 x 43000040

  DPD ACK from 81.83.202.36, seq # receipt = 2293347012, seq # expected = 2293347012

  You must configure split tunnel as well as the NAT ACL must refuse/free of traffic between the local network to IP Pool as follows:

  (1) create split tunnel ACL:

  access-list 150 permit ip 192.168.0.0 0.0.0.255 14.1.1.0 0.0.0.255

  ISAKMP crypto client configuration group 3000client

  ACL 150

  (2) you must configure an ACL extended for NAT:

  access-list 170 deny ip 192.168.0.0 0.0.0.255 14.1.1.0 0.0.0.255

  access-list 170 allow ip 192.168.0.0 0.0.0.255 any

  overload of IP nat inside source list 170 interface FastEthernet0/0

  no nat ip inside the source list NAT interface FastEthernet0/0 overload

  clear the ip nat trans *.

  Hope that solves this problem.

• Connection with the client VPN for RV110W problem

  Hi guys: I just installed a RV110W router to my small business and I try to connect via VPN from home client.  I was unable to do so, no matter what I try.  Relevant information:

  1. I can connect to the router via remote very well management, so I know that the router is accessible from the Net.

  2. internal address of the router: 10.81.208.1

  3. active PPTP.  PPTP server IP address: 10.0.0.1

  4 IP addresses for PPTP clients: 10.0.0.10 - 14

  5. two VPN clients added - one with PPTP, with the QuickVPN Protocol Protocol.  Both are enabled (and Yes, I triple checked passwords)

  6 encryption MPPE and Netbios active.

  7 IPSec, PPTP and L2TP all active gateways.

  8 VPN client: 1.4.1.2

  9. computer: laptop running Windows 7 family (64-bit), with the firewall Windows is activated.

  10 home network: 192.168.2.196

  It is causing to tear my hair out.  What Miss me?

  Shannon

  Hi Shannon,

  I am pleased to see that you're progress.

  Shannon Rotz wrote:
  I changed the RM port to 443.  Unfortunately, now I can't connect to the router via browser, either by remote management or from the local network - I get the usual "page cannot be displayed".  How do I get back into the router configuration GUI?
  

  You should be able to reach the GUI by typing https://192.168.1.1(assuming that you have not changed the default IP address) normally once you replace http (port 80) with https (port 443) the internal router web server automatically will redirect you to the https page if you type http. Open your command prompt and try to do a ping of the IP address of the router to ensure that it still meets this address

  With regards to the VPN client:   Up until I changed the port, the same error message kept coming up, i.e. "Unable to establish connection" (or something like that), with a list of possible reasons why it couldn't connect. Now the message has changed - I'm getting "Server's certificate doesn't exist on your local computer".  If I continue trying to connect, then it says "Activating Policy", followed by "Verifying Network", then "The remote gateway is not responding.  Do you want to wait?"  This is definitely progress, since I never got this far before.

  You are a quarter inch offline. If you look at the log.txt in C:\Program Cisco Small Business\QuickVPN Client, in my view, you will see "Failed to ping router remote VPN! This means that your PC is blocking the ping to the router response. Usually, if you look at this point the status of Client VPN in the router (first of all need to remote management) you will see that your user status is "connected." If the router thinks that the connection is established, but the PC does not work. You might want to try another PC at this stage to verify that it is indeed a problem with your PC. This problem is usually caused by the 3rd party software antivirus/firewall blocking the ping response. Microsoft Security Essentials can do this as well, so if you turn it off. If you do not have another PC to test from, call Cisco Small Business Support and ask a technician, try to connect to the lab. You can find the number to call here

  On an impulse, I tried setting up a Windows VPN connection, i.e. created a new VPN connection in Network and Sharing Center, using a PPTP client ID that I had created.  That connection actually worked, except for one problem:  I can't see the remote network.  If I could solve that problem, I'll just tell the other clients to use a Windows connection rather than QuickVPN.
  

  Good thought. If you do not see the remote devices, make sure that they do not block VPN connections. (Windows or third-party firewall, antivirus, antispyware) With a connection, PPTP or QuickVPN, you should be able to go to run, type the IP address of the device that you want to connect to (i.e. \\192.168.1.101 ) and see the list of shared folders. After the PPTP connection is established, try to ping the address LAN IP of the router. If it is successful, try to ping a LAN device such as a network printer or a PC. Again, PCs may block ping requests if they have a firewall running watch so for this.

  Answer please if you have any questions.

• IOS: Dynamic VPN with l2tp/CVPN Client

  It is possible to configure a router (12.3.9a) to accept dynamic vpn through MS l2tp (XP sp1) and Cisco VPN client (4.0.5 for XP) at the same time?

  without the line 'crypto map vpn client client authentication list userauthen' 2 vpn clients work but cisco vpn client does not request a user name and password.

  with this line, the l2tp MS client fails.

  Here is my config:

  AAA authentication login userauthen local

  AAA authorization groupauthor LAN

  !

  VPDN enable

  !

  VPDN-group pino

  ! Default L2TP VPDN group

  accept-dialin

  L2tp Protocol

  virtual-model 1

  Force-local-chap

  no authentication of l2tp tunnel

  !

  crypto ISAKMP policy 100

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 5000

  BA 3des

  preshared authentication

  Group 2

  isakmp encryption key * address 0.0.0.0 0.0.0.0

  !

  ISAKMP crypto client configuration group pino

  key *.

  domain test.test

  pool pool_cvpn

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac set_3des

  Crypto ipsec transform-set esp-3des esp-md5-hmac set_l2tp

  transport mode

  !

  dynamic-map crypto CVPN 20

  Set transform-set set_l2tp

  match the address l2tp_acl

  !

  crypto dynamic-map CVPNN 10

  Set transform-set set_3des

  !

  crypto map vpn client client authentication list userauthen

  crypto map client-vpn isakmp authorization list groupauthor

  address of card crypto configuration vpn-client client answer

  Crypto map 10-client vpn ipsec-isakmp dynamic CVPN

  Crypto map 20-customer vpn ipsec-isakmp dynamic CVPNN

  Thank you

  Davide

  Hi David

  Although it is a L2TP/dynamic IPSEC, you must have authentication configured for dynamic clients.

  hope this link can clear things...

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00801dddbb.shtml

  regds

  Prem

• multi-site VPN with just the cisco vpn client

  Hello everyone

  Please I need your help.

  We have a headquarters office and up to 60 is BranchOffice, we want to create VPN network between its. so let's deploy 2 router cisco esy vpn server with HA (HSRP) at the Headquarters Office and all branches have Connection ADSL and they will use just the cisco vpn client to connect to the Headquarters Office.

  My question is: is it possible to do it just with the client vpn cisco without purchased for any exercise bracnh a cisco router to create an ipsec tunnel because it is so expensive?

  It depends on if the routers to offices can handle NAT with several internal VPN clients to 1 IP address. Most of the new material should be fine. Keep in mind the maximum limit of the VPN client, with 60 agencies and 5 people each of whom you are above the limit.

  Michael

  Please note all useful posts

• SSL vpn client port light with impatience

  I configured a vpn ssl with client application think, with the port below before ordering.

  port-forward "port forwarding".

  description of the 23 local-port remote port 5000 remote control-server "10.18.20.9" 'switch '.

  We should connect this device via the command in this way, telnet 127.0.0.1 prompt 5000

  He managed the switch to Telnet, but is it possible to connect via ip to the real device?

  or we should as a vpn client config all connect (tunnel mode) in order to telnet as the hardware directly?

  There are different ways to solve this. But it depends on the device and the version you are using. As you show an IOS-config, you are quite limited in features. The SAA is mouch more powerful with VPN without client.

  The choices you have are:

  1. Keep this behavior
  2. Use DNS names for the connection. Here the local 'hosting' - the table is changed, so administrator rights are needed.
  3. use a VPN client AnyConnect or EzVPN-based
  4. use the Smart Tunnels:

  http://www.Cisco.com/en/us/docs/iOS-XML/iOS/sec_conn_sslvpn/configuration/15-Mt/sec-Conn-sslvpn-smart-tunnels-support.html

  If you don't want to use a full-tunnel-client, you must first review in Smart-Tunnels.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• With the help of Client VPN dial-up networking on L2l

  I m tring to configure ASA 5505 with Cleint of VPN to access a remote network on a L2L with an another ASA 5505, but without success. There is a special function for this work?

  Follow the topology

  TKS

  

  Hello

  You must ensure that you have configured following

  • permit same-security-traffic intra-interface
    • This will allow VPN Client traffic to enter the ASA and leave the same interface
  • If you use Split Tunnel ACL with the VPN Client, make sure that the ACL has included Remote Site network
    • If you use complete Tunnel this wont be a problem
  • Make sure that the ACL of VPN L2L that defines "interesting traffic" includes the pool of Client VPN on both sides of the VPN L2L
  • Configure a NAT0 on the ASA of Client VPN 'outside' interface that makes NAT0 for pool of Client VPN Remote Site network

  If you have a real-world setting to share I can try to help with those. Otherwise I can only give general things like the above to check.

  -Jouni

• -VPN - PROBLEM IOS CLIENT!

  -Start ciscomoderator note - the following message has been changed to remove potentially sensitive information. Please refrain from publishing confidential information about the site to reduce the risk to the security of your network. -end of the note ciscomoderator-

  Hello

  I have IOS Cisco 2650XM running IPSEC. I configured for authentication local customer vpn. I create ipsec tunnel more Don t ping from router to my client vpn (windows 2 k with vpn client 4.0). If anyone can help me, my express recognition.

  Better compliance

  Joao Medeiros

  SH RUN

  Current configuration: 8092 bytes

  !

  ! Last configuration change at 09:09:04 GMT Tuesday, March 2, 1993 by lordz

  !

  version 12.2

  horodateurs service debug uptime

  Log service timestamps uptime

  encryption password service

  !

  hostname router_vpn_fns

  !

  start the system flash c2600-ik9o3s - mz.122 - 11.T.bin

  AAA new-model

  !

  !

  AAA authentication login default local

  AAA authorization network default local

  AAA - the id of the joint session

  !

  clock timezone GMT - 3

  voice-card 0

  dspfarm

  !

  IP subnet zero

  no ip source route

  IP cef

  !

  !

  no ip domain search

  agm IP domain name - tele.com

  name-server IP 192.168.10.1

  !

  no ip bootp Server

  audit of IP notify Journal

  Max-events of po verification IP 100

  property intellectual ssh time 60

  IP port ssh 2000 rotary 1

  !

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 110

  preshared authentication

  lifetime 10000

  !

  crypto ISAKMP policy 130

  preshared authentication

  lifetime 10000

  ISAKMP crypto key xxx address xxx.xxx.76.22

  ISAKMP crypto key xxx address yyy.yyy.149.190

  !

  ISAKMP crypto client configuration group xlordz

  key cisco123

  DNS 192.168.10.1

  area agm - tele.com

  LDz-pool

  ACL 108

  !

  86400 seconds, duration of life crypto ipsec security association

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac agmipsec_gyn

  Crypto ipsec transform-set esp-3des esp-sha-hmac agmipsec_poa

  Crypto ipsec transform-set esp-3des esp-sha-hmac ldz-series

  !

  Crypto-map dynamic ldz_dynmap 10

  ldz - Set transform-set

  !

  !

  by default the card crypto client ldz_map of authentication list

  default value of card crypto ldz_map isakmp authorization list

  client configuration address card crypto ldz_map answer

  ldz_map 10 card crypto ipsec-isakmp dynamic ldz_dynmap

  !

  agmmap_gyn crypto-address on Serial0/0

  agmmap_gyn 1 ipsec-isakmp crypto map

  the value of xxx.xxx.76.22 peer

  Set transform-set agmipsec_gyn

  PFS group2 Set

  match address 120

  QoS before filing

  agmmap_gyn 2 ipsec-isakmp crypto map

  the value of yyy.yyy.149.190 peer

  Set transform-set agmipsec_poa

  PFS group2 Set

  match address 130

  !

  !

  !

  call active voice carrier's ability

  !

  voice class codec 1

  codec preference 1 60 g729r8 bytes

  g711alaw preferably 2 codec

  !

  !

  Fax fax-mail interface type

  MTA receive maximum-recipients 0

  !

  controller E1 0/1

  case mode

  No.-CRC4 framing

  termination 75 Ohm

  time intervals DS0-Group 1-15, 17 0 type digital r2 r2-compelled ani

  Digital-r2 r2-compelled ani type 1 time intervals DS0-group 18-31

  0 cases-custom

  country Brazil

  counting

  signal response Group-b 1

  case-personal 1

  country Brazil

  counting

  signal response Group-b 1

  !

  !

  !

  !

  interface FastEthernet0/0

  192.168.15.1 IP address 255.255.255.0 secondary

  192.168.7.1 IP address 255.255.255.0 secondary

  IP 192.168.10.10 255.255.255.0

  NBAR IP protocol discovery

  load-interval 30

  automatic speed

  full-duplex

  priority-group 1

  No cdp enable

  !

  interface Serial0/0

  bandwidth of 512

  IP 200.193.103.154 255.255.255.252

  NBAR IP protocol discovery

  frame relay IETF encapsulation

  load-interval 30

  priority-group 1

  dlci 507 frame relay interface

  frame-relay lmi-type ansi

  ldz_map card crypto

  !

  interface FastEthernet0/1

  no ip address

  NBAR IP protocol discovery

  load-interval 30

  Shutdown

  automatic duplex

  automatic speed

  No cdp enable

  !

  LDz-pool IP local pool 192.168.10.3 192.168.10.5

  IP classless

  IP route 0.0.0.0 0.0.0.0 200.193.103.153

  IP route 192.168.20.0 255.255.255.0 xxx.xxx.76.22

  IP route 192.168.25.0 255.255.255.0 xxx.xxx.76.22

  IP route 192.168.30.0 255.255.255.0 yyy.yyy.149.190

  IP route 192.168.35.0 255.255.255.0 yyy.yyy.149.190

  IP route vvv.vvv.17.152 255.255.255.248 192.168.10.1

  IP http server

  enable IP pim Bennett

  !

  !

  dns-servers extended IP access list

  extended IP access to key exchange list

  !

  Journal of access list 1 permit 192.168.10.44

  Journal of access list 1 permit 192.168.10.2

  Journal of access list 1 permit 192.168.10.1

  access-list 1 permit vvv.vvv.17.154 Journal

  IP access-list 108 allow any 192.168.10.0 0.0.0.255 connect

  access-list 108 permit ip any any newspaper

  IP access-list 120 allow any 192.168.20.0 0.0.0.255 connect

  IP access-list 120 allow any 192.168.25.0 0.0.0.255 connect

  access-list allow 120 ip host xxx.xxx.76.22 any log

  access-list 120 deny ip any any newspaper

  IP access-list 130 allow any 192.168.30.0 0.0.0.255 connect

  IP access-list 130 allow any 192.168.35.0 0.0.0.255 connect

  access-list allow 130 ip host yyy.yyy.149.190 any log

  access-list 130 deny ip any any newspaper

  access-list 140 deny udp 192.168.20.0 0.0.0.255 any netbios-ns range

  NetBIOS-ss log

  access-list 140 deny udp 192.168.25.0 0.0.0.255 any netbios-ns range

  NetBIOS-ss log

  access-list 140 deny udp 192.168.30.0 0.0.0.255 any netbios-ns range

  NetBIOS-ss log

  access-list 140 deny udp 192.168.35.0 0.0.0.255 any netbios-ns range

  NetBIOS-ss log

  access-list 140 refuse tcp 192.168.20.0 0.0.0.255 any beach 137 139 connect

  access-list 140 refuse tcp 192.168.25.0 0.0.0.255 any beach 137 139 connect

  access-list 140 refuse tcp 192.168.30.0 0.0.0.255 any beach 137 139 connect

  access-list 140 deny tcp 192.168.35.0 0.0.0.255 any beach 137 139 connect

  access-list 140 refuse tcp 192.168.20.0 0.0.0.255 any eq connect 5900

  access-list 140 refuse tcp 192.168.25.0 0.0.0.255 any eq connect 5900

  access-list 140 refuse tcp 192.168.30.0 0.0.0.255 any eq connect 5900

  access-list 140 deny tcp 192.168.35.0 0.0.0.255 any eq connect 5900

  access-list 140 permit ip any any newspaper

  Dialer-list 1 ip protocol allow

  not run cdp

  !

  Server SNMP community xxxxxxxxxx

  Enable SNMP-Server intercepts ATS

  call the rsvp-sync

  !

  voice-port 0/1:0

  !

  voice-port 0/1:1

  !

  No mgcp timer receive-rtcp

  !

  profile MGCP default

  !

  Dial-peer cor custom

  !

  !

  !

  !

  Line con 0

  exec-timeout 2 0

  Synchronous recording

  length 50

  line to 0

  exec-timeout 0 10

  No exec

  line vty 0 4

  access-class 1

  transport input telnet ssh

  !

  Master of NTP

  !

  end

  Hello

  If you are not disturbing the production network much, just try to reload 2650.

  This works sometimes!

  Kind regards

  Walked.