AC100 - no VPN L2TP/IPSec PSK available

Similar Questions

• Problem setting up vpn l2tp/ipsec

  I tried to configure an ASA5505 with a l2tp/ipsec vpn which I can connect to with Windows Vista vpn client. I had connection problems. When I try to connect, watch windows vpn client tell an error message "error 789: the L2TP connection attempt failed because the security layer detected a processing error during initial negotiations with the remote computer." The newspaper on the SAA is errors saying "Phase 1 failure: incompatibility of the types of attributes of class Group Description: RRs would be: unknown Cfg was: Group 2.

  It seems that the ASA does not like windows vpn client IKE proposal but I do not know if I interpret correctly this error message.

  I was wondering if anyone has seen this problem or have had success with this type of installation. I have the setup of device OK so that I can connect with the Cisco VPN client, but get l2tp/ipsec Setup to work with the windows vpn client turns out to be problematic.

  Can you post the Config of your ASA. Did you check the following link:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807213a7.shtml

• L2TP/IPSec connection failed for Windows 7 Ultimate for Windows Server R2 2012 with error 789.

  For this preface, I use the server in a lab environment and trying to set up my own VPN L2TP/IPSec. I opened the UDP 500 and 1701 TCP ports on my router for the interface of the primary server where is the VPN. It is on a Comcast connection consumer where other applications such as Arma 3 servers dedicated and IIS have worked.
  The RRAS role to run based on this tutorial: http://www.thomasmaurer.ch/2014/01/how-to-install-vpn-on-windows-server-2012-r2/ I have only strayed from it using DHCP forwarding instead of a static pool of IP as my router is running a DHCP server, and if I understand correctly, the router must give IP addresses of the internal IP pool which I use for everything else. I also use the PSK authentication rather than be based certificate. For the authentication of users I have MS-CHAP-V2 and CHAP enabled; I connect from the remote device with an account on that I created on the server for the purpose of this VPN I know RRAS connections are allowed.

  When the connection I get error 789: L2TP connection attempt failed because the security layer detected a processing error during initial negotiations with the remote computer. From what I've seen, this can be fixed by checking that the two ends of the connection are not behind a NAT (not an option), verification of the PSK (already done) and certificates (not applicable). If there is a way to solve this problem that would be great, but my server will always be behind a NAT firewall because the router is one, and the modem becomes one if several devices are connected to him without a router between the two.

  
  This issue is beyond the scope of this site and must be placed on Technet or MSDN

  http://social.technet.Microsoft.com/forums/en-us/home

  http://social.msdn.Microsoft.com/forums/en-us/home

• Windows Error VPNC3005 "unauthorized tunneling protocol" L2TP/IPSec

  I'm trying to implement a vpn L2TP/IPSec to a concentrator 3005. Everything seems to work (phase 1 completed, PHASE2 full, updated tunnel, the session began and the user is authenticated with the RADIUS) but then the tunnel fell with the message "unauthorized tunneling protocol. What causes this message?

  At one point the tunnel remained upward and running, but later I tried again and it failed. I don't remember changing anything in the config right.

  I read somewhere that I should turn on "L2TP over IPSEC" in the group but this disables the IPSEC option and it seems to me that I need IPSec for Cisco vpn clients that need to connect.

  Any suggestions?

  Change the base group to allow l2tp/ipsec; Check if l2tp is enabled at the global level.

• Cisco ASA 5505 VPN L2TP cannot access the internal network

  Hello

  I'm trying to configure Cisco VPN L2TP to my office. After a successful login, I can't access the internal network.

  Can you jhelp me to find the problem?

  I have Cisco ASA:

  within the network - 192.168.1.0

  VPN - 192.168.168.0 network

  I have the router to 192.168.1.2 and I cannot ping or access this router.

  Here is my config:

  ASA Version 8.4 (3)

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 198.X.X.A 255.255.255.248

  !

  passive FTP mode

  permit same-security-traffic intra-interface

  the net-all purpose network

  subnet 0.0.0.0 0.0.0.0

  network vpn_local object

  192.168.168.0 subnet 255.255.255.0

  network inside_nw object

  subnet 192.168.1.0 255.255.255.0

  outside_access_in list extended access permit icmp any any echo response

  outside_access_in list extended access deny ip any any newspaper

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  IP local pool sales_addresses 192.168.168.1 - 192.168.168.254

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  NAT dynamic interface of net-all source (indoor, outdoor)

  NAT (inside, outside) source inside_nw destination inside_nw static static vpn_local vpn_local

  NAT (exterior, Interior) source vpn_local destination vpn_local static static inside_nw inside_nw-route search

  !

  network vpn_local object

  dynamic NAT interface (outdoors, outdoor)

  network inside_nw object

  NAT dynamic interface (indoor, outdoor)

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 198.X.X.B 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  AAA authentication enable LOCAL console

  the ssh LOCAL console AAA authentication

  AAA authentication http LOCAL console

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  IKEv1 crypto ipsec transform-set my-transform-set-ikev1 esp-3des esp-sha-hmac

  transport in transform-set my-transform-set-ikev1 ikev1 crypto ipsec mode

  Crypto-map Dynamics dyno 10 set transform-set my-transformation-set-ikev1 ikev1

  card crypto 20-isakmp ipsec vpn Dynamics dyno

  vpn outside crypto map interface

  Crypto isakmp nat-traversal 3600

  Crypto ikev1 allow outside

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.0 inside

  SSH timeout 30

  Console timeout 0

  management-access inside

  dhcpd address 192.168.1.5 - 192.168.1.132 inside

  dhcpd dns 75.75.75.75 76.76.76.76 interface inside

  dhcpd allow inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal sales_policy group policy

  attributes of the strategy of group sales_policy

  Server DNS 75.75.75.75 value 76.76.76.76

  Protocol-tunnel-VPN l2tp ipsec

  user name-

  user name-

  attributes global-tunnel-group DefaultRAGroup

  address sales_addresses pool

  Group Policy - by default-sales_policy

  IPSec-attributes tunnel-group DefaultRAGroup

  IKEv1 pre-shared-key *.

  tunnel-group DefaultRAGroup ppp-attributes

  ms-chap-v2 authentication

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  Cryptochecksum:5d1fc9409c87ecdc1e06f06980de6c13

  : end

  Thanks for your help.

  You must test with 'real' traffic on 192.168.1.2 and if you use ping, you must add icmp-inspection:

  Policy-map global_policy

  class inspection_default

  inspect the icmp

  --

  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• default DNS does not not in l2tp/ipsec

  Hi all

  We have Setup l2tp on asa, everything works except the default domain that is not defined. This is necessary because all the links does not provide full dns:

  It's cisco config:

  IP mask 255.255.255.224 local pool ClientVPNAddressPool 172.16.31.1 - 172.16.31.32

  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set TRANS_ESP_3DES_SHA TRANS-ESP-3DES-MD5 ikev1

  card crypto PublicTESA_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  PublicTESA_map PublicTESA crypto map interface

  internal DefaultRAGroup group strategy

  attributes of Group Policy DefaultRAGroup

  value of server DNS X.X.X.X Y.Y.Y.Y

  Protocol-tunnel-VPN l2tp ipsec

  value by default-field AAA. BBBBBBB

  the address value ClientVPNAddressPool pools

  It's windows ipconfig/all:

  Useful PPP VPN from Cisco ASA :--> name of the connection

  Sufijo DNS specific para the conexion. . :--> suffix DNS specific connections (in WHITE)

  Descripción...: Cisco ASA VPN--> description

  Dirección física... :--> physiqueet address

  DHCP enable...: don't--> active dhcp

  Automatica habilitada... config: if--> active auto config

  172.16.31.1 (Preferido) IPv4 address... :--> IP address

  Subred... mascara:--> netmask 255.255.255.255

  Puerta of enlace... by default: 0.0.0.0--> default GW

  Servidores DNS...: X.X.X.X--> dns servers

  Y.Y.Y.Y

  Sober NetBIOS TCP/IP...: enable--> net bios on tcp active

  Thank you!

  Hi Jose,

  L2TP over IPsec will not be able to receive the DNS suffix.

  This is a limitation of the PPP. More information:

  http://cdetsweb-PRD.Cisco.com/apps/dumpcr?identifier=CSCse74376&parentprogram=QDDTS

  Marcin

• Microsoft l2tp IPSec VPN site to site ASA on top

  I have a specialized applications casino that requires end-to-end encryption. I'm under the stack of Microsoft IPSec l2tp between my XP machine and my Windows 2003 server on the LAN. Can I use the same type of protocol stack Microsoft l2tp IPSec between my XP machine and the Windows Server 2003 a branch on the SAA to site to site ASA VPN tunnel? The VPN site-to site ASA is a type of key Preshare IPSec VPN tunnelle traffic between our head office and a branch in distance.

  In other words, the ASA site-to-site IPSec VPN will allow Microsoft l2tp through IPSec encrypted traffic? My ACL tunnel would allow full IP access between site. Something like:

  name 192.168.100.0 TexasSubnet

  name 192.168.200.0 RenoSubnet

  IP TexasSubnet 255.255.255.0 RenoSubnet 255.255.255.0 allow Access-list extended nat_zero

  Hello

  Yes, the L2TP can be encapsulated in IPSEC as all other traffic.

  However, make sure that no NAT is performed on each end. L2TP is a default header protection which will see NAT as a falsification of package and reject it.

  See you soon,.

  Daniel

• Support for L2TP/IpSec VPN on 1921

  Hello

  I am not able to find an answer on something very simple... Fact of 1921 Cisco router supports L2TP/IpSec VPN connections? (from Windows 7 clients)

  If she could please point me to the right location/document where I can read more about it.

  I already tried with the configuration below, but command ppp under a virtual-Template1 don't output interface.

  Thank you very much for your answers.

  Kind regards

  Herman

  # VPN configuration I've tried, but it did not work.

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  life 4000

  ISAKMP crypto key xxxxxxx address X.X.X.X (ip strongvpn)

  !

  !

  Crypto ipsec transform-set ESP-AES256-SHA1 esp - aes 256 esp-sha-hmac

  transport mode

  !

  Map 10 IPSEC L2TP ipsec-isakmp crypto

  defined peer X.X.X.X

  game of transformation-ESP-AES256-SHA1

  match address 101

  !

  !

  !

  Pseudowire-class pwclass1

  encapsulation l2tpv2

  local IP interface FastEthernet0/0

  PMTU IP

  !

  !

  !

  !

  interface FastEthernet0/0

  DHCP IP address

  automatic duplex

  automatic speed

  card crypto IPSEC L2TP

  !

  interface FastEthernet0/1

  IP 10.20.20.1 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  !

  interface Serial0/0/0

  no ip address

  Shutdown

  !

  interface Serial0/1/0

  no ip address

  Shutdown

  2000000 clock frequency

  !

  virtual-PPP1 interface

  the negotiated IP address

  IP mtu 1399

  NAT outside IP

  IP virtual-reassembly max-pumping 64

  No cdp enable

  PPP authentication ms-chap-v2 callin

  PPP chap hostname vpnxxx

  PPP chap password 0 xxxxxxxxxx

  Pseudowire pw-class 1, pwclass1 X.X.X.X

  ##################################################################################################################

  Cisco-gw #show version

  Cisco IOS software, software C1900 (C1900-UNIVERSALK9-M), Version 15.2 (4) M2, VERSION of the SOFTWARE (fc2)

  Technical support: http://www.cisco.com/techsupport

  Copyright (c) 1986-2012 by Cisco Systems, Inc.

  Updated Thursday, November 7, 12 and 12:45 by prod_rel_team

  ROM: System Bootstrap, Version 15.0 M16 (1r), RELEASE SOFTWARE (fc1)

  Cisco-gw uptime is 2 days, 4 hours, 22 minutes

  System to regain the power ROM

  System restart to 09:11:07 PCTime Tuesday, April 2, 2013

  System image file is "usbflash0:c1900 - universalk9-mz.» Spa. 152 - 4.M2.bin.

  Last reload type: normal charging

  Reload last reason: power

  This product contains cryptographic features and is under the United States

  States and local laws governing the import, export, transfer and

  use. Delivery of Cisco cryptographic products does not imply

  third party approval to import, export, distribute or use encryption.

  Importers, exporters, distributors and users are responsible for

  compliance with U.S. laws and local countries. By using this product you

  agree to comply with the regulations and laws in force. If you are unable

  to satisfy the United States and local laws, return the product.

  A summary of U.S. laws governing Cisco cryptographic products to:

  http://www.Cisco.com/WWL/export/crypto/tool/stqrg.html

  If you need assistance please contact us by mail at

  [email protected] / * /.

  Cisco CISCO1921/K9 (revision 1.0) with 491520K / 32768K bytes of memory.

  Card processor ID FCZ170793UH

  2 gigabit Ethernet interfaces

  1 line of terminal

  1 module of virtual private network (VPN)

  Configuration of DRAM is 64 bits wide with disabled parity.

  255K bytes of non-volatile configuration memory.

  249840K bytes of Flash usbflash0 (read/write)

  License info:

  License IDU:

  -------------------------------------------------

  Device SN # PID

  -------------------------------------------------

  * 0 CISCO1921/K9

  Technology for the Module package license information: "c1900".

  -----------------------------------------------------------------

  Technology-technology-package technology

  Course Type next reboot

  ------------------------------------------------------------------

  IPBase ipbasek9 ipbasek9 Permanent

  Security securityk9 Permanent securityk9

  given none none none

  Configuration register is 0 x 2102

  Yes, it is supported.

  http://www.Cisco.com/en/us/Tech/tk827/tk369/technologies_configuration_example09186a0080094501.shtml#iosforl2tp

  It is necessary to configure the encapsulation under virtual-model.

  Note: you will have much better results by using the IPSec VPN or SSL VPN client AnyConnect client.

• VPN L2TP does not / / Android 4.4.3

  My vpn connection does not work.

  The installer is: L2TP/IPSec with PSK in my network private.

  Given that my old phone (Xperia S), located on android 4.3.X, still works
  I see no problem of configuration, but I guess that it is a problem with android 4.4.X

  The same problem occurs on my sony tablet z since the update to 4.4.X

  Is there any fix from sony?

  I read on a google fix, that should be in place on the 4.4.4, version but updated for 4.4.4 on the
  Tablet does not solve this problem.

  We got a test account of another user with this issue and have found the cause of this. It will be fixed in a future software update.

• Windows 7 64 bit ultimate - VPN L2TP does not

  Hello

  On a brand new with windows 7 64 bit ultimate laptop, I set up a VPN L2TP connection but it still fails with error 789.

  On the same network, I have an XP machine that connects to the remote gateway even.

  After a long search, here's what I did:

  1. Add a Dword AssumeUDPEncapsulationContextOnSendRuleregistry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgentand set it to 2 as shown in the MS KB - http://support.microsoft.com/kb/926179

  2. set correctly the two political generation of IPSEC Agent & key services

  3 reboot several times the PC

  4. to pass the local gateway connecting directly to the ISP

  Nothing works.

  On the XP machine, it runs immediately without problem: same gateway, local gateway, remote and local network, access, etc...

  Any help will be greatly welcome!

  Thank you.

  Have you tried to delete / create the VPN connection again?

• L2TP/ipsec passthrough firewall of cisco router

  Hello! I have the following problem.

  External network users wish to connect internal Windows to network and share resources 2012 (start the software, files, etc)

  So it's time to deploy a vpn server and as I did not have a free license to run on my windows 2012, I decided to use my qnap for it (because it has this built-in feature) so I chose l2tp/ipsec and tested on the laboratory at home with simple tplink router with upnp function and it worked like a charm.

  However, in the real production environment, I need to use the cisco router, and this is how the story begins ;)

  Thus, clients with their machines say (7, 8.1, 10) must pass router cisco (with nat) firewall and access a vpn server and the internal network on qnap.

  I googled for sample configuration, but most of them related to the configuration of the router as a vpn server, and I want to achieve is to make my pass router vpn traffic. Once I found the same sample of pptp config, I have modified it a bit, but do not know if it works because I have not yet tested.

  In any case, could you check my config and see if it's ok? I'm doing a static nat for vpn 192.168.5.253 server to external address?

  Also, here is a short pattern

  vpn client VPN server (win 7,8,10)---routeur cisco 1921 - qnap)

  xxx.194 cloud 5,254 5.253 (internal network)

  test #show runn
  Building configuration...

  Current configuration: 3611 bytes
  !
  ! Last modified at 19:31:01 UTC Wednesday, may 4, 2016 configuration by
  !
  version 15.4
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  hostname test
  !
  boot-start-marker
  boot-end-marker
  !
  !
  enable secret $5
  !
  No aaa new-model
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  DHCP excluded-address IP 192.168.5.200 192.168.5.254
  DHCP excluded-address IP 192.168.5.1 192.168.5.189
  !
  pool dhcp IP network
  network 192.168.5.0 255.255.255.0
  router by default - 192.168.5.254
  network domain name
  xxx.x.xxx.244 DNS server
  !
  !
  !
  IP domain name temp
  IP cef
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  CTS verbose logging
  !
  !
  license udi pid CISCO1921/K9 sn xxxxxx
  licence start-up module c1900 technology-package securityk9
  !
  !
  username secret abc 5
  username privilege 15 7 cisco password
  !
  redundancy
  !
  !
  !
  !
  !
  property intellectual ssh version 2
  !
  type of class-card inspect entire game cm_helpdek_protocols
  http protocol game
  https protocol game
  ssh protocol game
  type of class-card inspect entire game cm_gre_protocols
  Access-group name WILL
  type of class-card inspect entire game cm_icmp
  group-access icmp name game
  type of class-card inspect the correspondence cm_helpdesk
  match the name of group-access helpdesk
  type of class-card inspect entire game inside_to_outside
  h323 Protocol game
  match Protocol pptp
  ftp protocol game
  tcp protocol match
  udp Protocol game
  match icmp Protocol
  !
  type of policy-card inspect pm_outside_to_inside
  class type inspect cm_gre_protocols
  Pass
  class type inspect cm_icmp
  inspect
  class type inspect cm_helpdesk
  inspect
  class class by default
  Drop newspaper
  type of policy-card inspect pm_inside_to_outside
  class type inspect inside_to_outside
  inspect
  class type inspect cm_gre_protocols
  Pass
  class class by default
  Drop newspaper
  !
  area inside security
  Description inside the zone of confidence
  security of the outside area
  Outside the untrusted area description
  source of zonep_insiede_to_outside security pair area inside the destination outside
  type of service-strategy inspect pm_inside_to_outside
  source of zonep_outside_to_inside security zone-pair outside the destination inside
  type of service-strategy inspect pm_outside_to_inside
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  the Embedded-Service-Engine0/0 interface
  no ip address
  Shutdown
  !
  interface GigabitEthernet0/0
  Description 'LAN '.
  IP 192.168.5.254 255.255.255.0
  IP nat inside
  IP virtual-reassembly in
  security of the inside members area
  automatic duplex
  automatic speed
  !
  interface GigabitEthernet0/1
  Description "WAN CID: xxxxx".
  IP address xxx.xxx.xxx.194 255.255.255.252
  NAT outside IP
  IP virtual-reassembly in
  security of the outside Member area
  automatic duplex
  automatic speed
  !
  IP forward-Protocol ND
  !
  IP http server
  local IP http authentication
  no ip http secure server
  !
  IP nat pool network xxx.xxx.xxx.201 xxx.xxx.xxx.201 netmask 255.255.255.248
  IP nat inside source list 1 pool overload the network
  IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.193
  !
  GRE extended IP access list
  Note ACL to allow ACCORD of PPTP OUTBOUND
  allow a gre
  permit any any eq udp 1701
  allow udp any any eq isakmp
  permit any any eq non500-isakmp udp
  helpdesk extended IP access list
  IP enable any host 192.168.5.253
  icmp extended IP access list
  allow icmp any host 192.168.5.253
  !
  !
  !
  access-list 1 permit 192.168.5.0 0.0.0.255
  !
  control plan
  !
  !
  !
  Line con 0
  local connection
  line to 0
  line 2
  no activation-character
  No exec
  preferred no transport
  transport output pad telnet, rlogin xxxxx
  StopBits 1
  line vty 0 4
  local connection
  transport input telnet ssh
  !
  Scheduler allocate 20000 1000
  !
  end

  Kind regards

  Andrew

  Once the client has been connected to the VPN, you want traffic back to flow to the client. Which can be easily received with "inspect".

  And from the point of view of the firewall, you do not have ESP-traffic (which would be the IP/50). You have only UDP traffic (initially UDP/500 which goes into UDP/4500)

  And you are right with your last ACE. That of a lot to permissive and not necessary for this function.

• Cisco VPN Client and Windows XP VPN Client IPSec to ASA

  I configured ASA for IPSec VPN via Cisco VPN Client and XP VPN client communications. I can connect successfully with Cisco VPN Client, but I get an error when connecting with the XP client. Debugging said "misconfigured groups and transport/tunneling mode" I know, they use different methods of transport and tunneling, and I think that I have configured both. Take a look at the config.

  PS a funny thing - when I connect with client VPN in Windows Server 2003, I have no error. The only difference is that client XP is behind an ADSL router and client server is directly connected to the Internet on one of its public IP of interfaces. NAT in the case of XP can cause problems?

  Config is:

  !

  interface GigabitEthernet0/2.30

  Description remote access

  VLAN 30

  nameif remote access

  security-level 0

  IP 85.*. *. 1 255.255.255.0

  !

  access-list 110 scope ip allow a whole

  NAT list extended access permit tcp any host 10.254.17.10 eq ssh

  NAT list extended access permit tcp any host 10.254.17.26 eq ssh

  access-list extended ip allowed any one sheep

  access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh

  sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0

  tunnel of splitting allowed access list standard 192.168.121.0 255.255.255.0

  flow-export destination inside-Bct 192.168.1.27 9996

  IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0

  ARP timeout 14400

  global (outside-Baku) 1 interface

  global (outside-Ganja) interface 2

  NAT (inside-Bct) 0 access-list sheep-vpn

  NAT (inside-Bct) 1 access list nat

  NAT (inside-Bct) 2-nat-ganja access list

  Access-group rdp on interface outside-Ganja

  !

  Access remote 0.0.0.0 0.0.0.0 85.*. *. 1 2

  Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1

  Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1

  Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1

  Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1

  Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1

  Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1

  Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1

  Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1

  dynamic-access-policy-registration DfltAccessPolicy

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  Crypto ipsec transform-set newset aes - esp esp-md5-hmac

  Crypto ipsec transform-set esp-3des esp-md5-hmac vpnclienttrans

  Crypto ipsec transform-set vpnclienttrans transport mode

  Crypto ipsec transform-set esp-3des esp-md5-hmac raccess

  life crypto ipsec security association seconds 214748364

  Crypto ipsec kilobytes of life security-association 214748364

  raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

  vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1

  card crypto interface for remote access vpnclientmap

  crypto isakmp identity address

  ISAKMP crypto enable vpntest

  ISAKMP crypto enable outside-Baku

  ISAKMP crypto enable outside-Ganja

  crypto ISAKMP enable remote access

  ISAKMP crypto enable Interior-Bct

  crypto ISAKMP policy 30

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  No encryption isakmp nat-traversal

  No vpn-addr-assign aaa

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.192 outside Baku

  SSH 10.254.17.26 255.255.255.255 outside Baku

  SSH 10.254.17.18 255.255.255.255 outside Baku

  SSH 10.254.17.10 255.255.255.255 outside Baku

  SSH 10.254.17.26 255.255.255.255 outside-Ganja

  SSH 10.254.17.18 255.255.255.255 outside-Ganja

  SSH 10.254.17.10 255.255.255.255 outside-Ganja

  SSH 192.168.1.0 255.255.255.192 Interior-Bct

  internal vpn group policy

  attributes of vpn group policy

  value of DNS-server 192.168.1.3

  Protocol-tunnel-VPN IPSec l2tp ipsec

  Split-tunnel-policy tunnelspecified

  Split-tunnel-network-list value split tunnel

  BCT.AZ value by default-field

  attributes global-tunnel-group DefaultRAGroup

  raccess address pool

  Group-RADIUS authentication server

  Group Policy - by default-vpn

  IPSec-attributes tunnel-group DefaultRAGroup

  pre-shared-key *.

  Hello

  For the Cisco VPN client, you would need a tunnel-group name configured on the ASA with a pre-shared key.

  Please see configuration below:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  or

  http://tinyurl.com/5t67hd

  Please see the section of tunnel-group config of the SAA.

  There is a tunnel-group called "rtptacvpn" and a pre-shared key associated with it. This group name is used by the VPN Client Group name.

  So, you would need a specific tunnel-group name configured with a pre-shared key and use it on the Cisco VPN Client.

  Secondly, because you are behind a router ADSL, I'm sure that's configured for NAT. can you please activate NAT - T on your ASA.

  "crypto isakmp nat-traversal.

  Thirdly, change the transformation of the value

  raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

  Let me know the result.

  Thank you

  Gilbert

• Chrombook L2TP/IPSec for ASA 5510

  Hello

  I have trouble getting a chromebook to establish a remote access connection VPN using L2TP/IPsec for a Cisco ASA 5510 12 7.2 (5) running.

  Run a debug crypto isakmp 5 I see the following logs (ip changed...)

  Jan 06 09:58:06 [IKEv1 DEBUG]: IP = 1.1.1.1, Oakley proposal is acceptable

  Jan 06 09:58:06 [IKEv1 DEBUG]: IP = 1.1.1.1, IKE SA proposal # 1, turn # 1 entry overall IKE acceptable matches # 4

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, connection landed on tunnel_group DefaultRAGroup

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, status of automatic NAT detection: remote endpoint IS behind a NAT device this end is NOT behind a NAT device

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, connection landed on tunnel_group DefaultRAGroup

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, previously allocated memory of liberation for permission-dn-attributes

  06 jan 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, PHASE 1 COMPLETED

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, Keep-alive type for this connection: DPD

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, timer to generate a new key to start P1: 8100 seconds.

  06 jan 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, PHASE 1 COMPLETED

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, Keep-alive type for this connection: DPD

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, timer to generate a new key to start P1: 8100 seconds.

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, data received in payload ID remote Proxy Host: address 3.3.3.3, 17 of the Protocol, Port 1701

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, data received in payload ID local Proxy Host: address 2.2.2.2, 17 of the Protocol, Port 1701

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, detected L2TP/IPSec session.

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, QM IsRekeyed its not found old addr

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, static checking Card Crypto, check card = outside_map, seq = 1...

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, static checking Card Crypto Card = outside_map, seq = 1, ACL does not proxy IDs src:1.1.1.1 dst: 2.2.2.2

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, only Tunnel UDP-encapsulated and UDP-encapsulated-Transport mode NAT-Traversal-defined selection

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, remote peer IKE configured crypto card: outside_dyn_map0

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, ITS processing IPSec payload

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, proposals of any IPSec security association has deemed unacceptable.

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, error QM WSF (P2 struct & 0x3d48800, mess id 0xce12c3dc).

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, history of mistake IKE responder QM WSF (struct & 0x3d48800) , : QM_DONE EV_ERROR--> QM_BLD_MSG2 EV_NEGO_SA--> QM_BLD_MSG2, EV_IS_REKEY--> QM_BLD_MSG2, EV_CONFIRM_SA--> QM_BLD_MSG2, EV_PROC_MSG--> QM_BLD_MSG2, EV_HASH_OK--> QM_BLD_MSG2, NullEvent--> QM_BLD_MSG2, EV_COMP_HASH

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, removing counterpart table correlator failed, no match!

  1.1.1.1 = address remote chromebook NAT

  2.2.2.2 = ASA 5510 acting as distance termintaion access point

  3.3.3.3 = Chromebook private address

  I noticed that the Chromebook is appearing as the ID of the remote proxy but later, he seeks the applied to the Chromebook NAT address.  Not sure if this is the cause or how to solve this problem, if it is.

  Can someone advise please

  Thank you

  Ryan

  7.2 is old code.  You can re - test with 9.0.x or 9.1.x.

  https://support.Google.com/Chromebook/answer/1282338?hl=en

• Windows L2TP/IPSec to ASA

  Hello

  I configured on ASA windows L2TP/Ipsec connections. Phase 1 and 2 are successful, the tunnel is created but immediately after this deletet. Tested from windows XP and windows 7. I use DefaultRAGroup for that (can not use any group which is by default not - limitation of windows). Here is my config:

  attributes of Group Policy DfltGrpPolicy
  value of 10.1.1.1 WINS server
  value of server DNS 10.1.1.1
  VPN-idle-timeout 300
  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
  the authentication of the user activation
  allow to NEM
  NAC-parameters DfltGrpPolicy-NAC-framework-create value
  WebVPN
  SVC keepalive no
  client of dpd-interval SVC no
  dpd-interval SVC bridge no
  value of customization DfltCustomization

  attributes global-tunnel-group DefaultRAGroup
  asa-admins address pool
  authentication-server-group CSACS
  IPSec-attributes tunnel-group DefaultRAGroup
  pre-shared-key *.
  Disable ISAKMP keepalive
  tunnel-group DefaultRAGroup ppp-attributes
  PAP Authentication
  ms-chap-v2 authentication
  eap-proxy authentication

  Crypto-map dynamic outside_dyn_map 10 the value transform-set TRANS_ESP_AES_SHA TRANS_ESP_DES_SHA ESP-AES-256-SHA ESP-AES-256-MD5 ESP-AES-128-SHA ESP-AES-128-MD5 MD5-ESP-3DES ESP-3DES-SHA ESP-DES-MD5 ESP-DES-SHA
  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
  outside_map interface card crypto outside

  And here are some logs:

  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-7-715027: Group = DefaultRAGroup, IP = 193.193.193.193, IPSec SA proposal # 1, turn # 1 entry overall SA IPSec acceptable matches # 10

  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-7-710005: UDP request and eliminated from 193.193.193.193/4204 outside: outside-interface/4500
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-6-602303: IPSEC: outgoing remote access to ITS (SPI = 0xAEA59455) between the outside of the interface and 193.193.193.193 (user = DefaultRAGroup) was created.
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-7-715007: Group = DefaultRAGroup, IP = 193.193.193.193, IKE got a msg KEY_ADD for SA: SPI = 0xaea59455
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-6-602303: IPSEC: incoming remote access to ITS (SPI = 0x9D3B8BDE) between the outside of the interface and 193.193.193.193 (user = DefaultRAGroup) was created.
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-7-715077: Group = DefaultRAGroup, IP = 193.193.193.193, pitcher: received KEY_UPDATE, spi 0x9d3b8bde
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-7-715080: Group = DefaultRAGroup, IP = 193.193.193.193, timer to generate a new key to start P2: 3060 seconds.
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % 713120-5-ASA: Group = DefaultRAGroup, IP = 193.193.193.193, PHASE 2 COMPLETED (msgid = 00000001)
  17 February 13:27:07 vpnasa1 February 17, 2010 13:27:07 vpnasa1: % ASA-7-713906: IKEQM_Active() Add L2TP classification rules: ip <193.193.193.193>mask <0xFFFFFFFF>port<4204>
  17 February 13:27:08 vpnasa1 February 17, 2010 13:27:08 vpnasa1: % ASA-7-710005: UDP request and eliminated from 193.193.193.193/4204 outside: outside-interface/1701
  17 February 13:27:08 vpnasa1 February 17, 2010 13:27:08 vpnasa1: % ASA-6-302016: connection UDP disassembly 56281479 for outside:193.193.193.193/4204 of identity: outside-interface/1701 duration 0:01:07 431 bytes
  17 February 13:27:10 vpnasa1 February 17, 2010 13:27:10 vpnasa1: % ASA-6-302015: built connection UDP incoming 56282536 for outside:193.193.193.193/4204 (193.193.193.193/4204) to the identity: outside-interface/1701 (outside-interface/1701)
  17 February 13:27:10 vpnasa1 February 17, 2010 13:27:10 vpnasa1: % ASA-6-603106: L2TP Tunnel created, tunnel_id 50, remote_peer_ip is 193.193.193.193 ppp_virtual_interface_id 1, client_dynamic_ip is 0.0.0.0 username is user1
  17 February 13:27:10 vpnasa1 February 17, 2010 13:27:10 vpnasa1: % ASA-6-603107: L2TP Tunnel deleted, tunnel_id = 50 remote_peer_ip = 193.193.193.193

  17 February 13:27:10 vpnasa1 February 17, 2010 13:27:10 vpnasa1: % ASA-4-113019: Group = DefaultRAGroup, username =, IP = 193.193.193.193, disconnected Session. Session type: IPsecOverNatT, duration: 0 h: 00 m: 03 s, xmt bytes: 795 bytes RRs: 1204, reason: L2TP initiated

  What's wrong?

  Thanx

  Please go ahead and activate the following command:

  ISAKMP nat-traversal crypto

  Try again.

• RVS4000 L2TP IPSec

  Trying to establish a L2TP IPSec VPN tunnels between remote Windows XP and Windows 2003 RRAS server customer.

  XP remote client and the RRAS W2003 server are behind routers RVS4000.

  Have established that the RRAS W2003 server will accept connections L2TP IPSec clients behind the router Cisco RVS4000 [LAN clients].

  Could not establish remote through the RVS4000 router L2TP IPSec connections. Have established that PPTP VPN RVS4000 router. Both routers are running the version 1.3.0.5

  Both routers 4000 RVs are configured for PPTP, IPSec, and L2TP VPN passthrough with the port UDP 1701 transferred to the RRAS server by the

  RVS router 4000. VPN PPTP connections have no problems.

  Error code is 792

  The problem seems to be with IPSec passthrough.  The port UDP 1701 is sent to the RRAS server. Unable to create port rules for IKE 500 or IP protocol 50/4500 on the RVS4000 because these policies collide with transmission UDP1701.

  No indication about why the IPSec fails with the RVS4000 for remote access clients, but IPSec has managed to connect to the RRAS server using LAN clients.

  1. never transfer the port UDP 1701. The port UDP 1701 is used for L2TP. However, L2TP is supposed to be in the tunnel within an IPSec tunnel. Exposing a L2TP server directly to the internet can be a security risk. Don't, don't.

  2. what you must have to pass, this is port UDP 500 for IKE (establishing the IPSec connection) and possibly port TCP/UDP 4500 for NAT traversal for IPSec. There should be no conflict. If there is, I guess it's because the RVS4000 has its own implementation of IPSec.

  3 LAN works because there's NAT involved and therefore there is no need of NAT traversal, port forwarding or something similar.