accept customer VPN Cisco 1841 with Cisco 501 site-to-site

Similar Questions

• Customer VPN CISCO C2691 4.9.01.0180 does not work

  Hello

  After reading and find information about the client IPsec and VPN som, I now try to make it work, but:

  The TEST LABORATORY is to follow:

  INTERNET-> (IP 192.168.10.1/24) C1841-> INT0/1 TEST LAB

  C2691 INT0/1 (IP 192.168.10.166/24)-> C2691 INT0/0 (IP 172.18.124.159/24)-> COMPUTER (DIFFICULTY IP 172.18.124.10/24)

  I can PING from the computer:

  192.168.10.1

  172.18.124.159

  But when I run the VPN, I have no communication, the PASSWORD and LOGIN are correct with the scrip.

  Here below what I get when I try to connect:

  Cisco Systems VPN Client Version 4.9.01.0180
  Copyright (C) 1998-2009 Cisco Systems, Inc.. All rights reserved.
  Type of client: Mac OS X
  Running: the Darwin 10.6.0 Darwin kernel Version 10.6.0: Wed Nov 10 18:13:17 PST 2010; root:XNU-1504.9.26~3/RELEASE_I386 i386
  Config files directory: / etc/opt/cisco-vpnclient

  1 20:23:49.072 14/01/2011 Sev = Info/4 CM / 0 x 43100002
  Start the login process

  2 20:23:49.073 14/01/2011 Sev = WARNING/2 CVPND / 0 x 83400011
  Send error - 28 package. ADR DST: 0xAC127CFF, ADR Src: 0xAC127C0A (DRVIFACE:1158).

  3 20:23:49.073 14/01/2011 Sev = WARNING/2 CVPND / 0 x 83400011
  Send error - 28 package. ADR DST: 0x0AD337FF, ADR Src: 0x0AD33702 (DRVIFACE:1158).

  4 20:23:49.073 14/01/2011 Sev = WARNING/2 CVPND / 0 x 83400011
  Send error - 28 package. ADR DST: 0x0A2581FF, ADR Src: 0x0A258102 (DRVIFACE:1158).

  5 20:23:49.080 14/01/2011 Sev = Info/4 CM / 0 x 43100004
  Establish a connection using Ethernet

  6 20:23:49.081 14/01/2011 Sev = Info/4 CM / 0 x 43100024
  Attempt to connect with the server "172.18.124.159".

  7 20:23:49.081 14/01/2011 Sev = Info/6 CM/0x4310002F
  Assigned TCP port local 49164 for the TCP connection.

  8 20:23:49.261 14/01/2011 Sev = Info/4 IPSEC / 0 x 43700008
  IPSec driver started successfully

  9 20:23:49.261 14/01/2011 Sev = Info/4 IPSEC / 0 x 43700014
  Remove all keys

  10 20:23:49.261 14/01/2011 Sev = Info/6 IPSEC / 0 x 43700020
  TCP SYN sent 172.18.124.159, src port 49164, port 10000 DST

  11 20:23:54.261 14/01/2011 Sev = Info/6 IPSEC / 0 x 43700020
  TCP SYN sent 172.18.124.159, src port 49164, port 10000 DST

  12 20:23:59.261 14/01/2011 Sev = Info/6 IPSEC / 0 x 43700020
  TCP SYN sent 172.18.124.159, src port 49164, port 10000 DST

  13 20:24:04.761 14/01/2011 Sev = Info/6 IPSEC / 0 x 43700020
  TCP SYN sent 172.18.124.159, src port 49164, port 10000 DST

  14 20:24:09.261 14/01/2011 Sev = Info/4 CM/0x4310002A
  Unable to establish a TCP connection on port 10000 with server '172.18.124.159 '.

  15 20:24:09.261 14/01/2011 Sev = Info/5 CM / 0 x 43100025
  Initializing CVPNDrv

  16 20:24:09.262 14/01/2011 Sev = Info/4 CM/0x4310002D
  Reset the TCP connection on port 10000

  17 20:24:09.262 14/01/2011 Sev = Info/6 CM / 0 x 43100030
  Removed the TCP port local 49164 for the TCP connection.

  18 20:24:09.262 14/01/2011 Sev = Info/4 CVPND/0x4340001F
  Separation of privileges: restore MTU on the main interface.

  19 20:24:09.262 14/01/2011 Sev = Info/6 IPSEC / 0 x 43700023
  TCP RST sent to 172.18.124.159, src port 49164, port 10000 DST

  20 20:24:09.262 14/01/2011 Sev = Info/4 IPSEC / 0 x 43700014
  Remove all keys

  21 20:24:09.263 14/01/2011 Sev = Info/4 IPSEC / 0 x 43700014
  Remove all keys

  22 20:24:09.263 14/01/2011 Sev = Info/4 IPSEC/0x4370000A
  IPSec driver successfully stopped

  The manuscript in the CISCO 2691 is just suited for my setup, I don't think that I made a few mistakes, but you never know.

  If has a first time, I'm able to establish a VPN connection to my computer and my router, I'll be happy, if I see my home network of the CISCO 1841 (ROUTER MAIN one) this will be perfect, that's also what I would like to check in.

  Here, the manuscript of the CISCO 2691:

  !
  version 12.4
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  router host name
  !
  boot-start-marker
  boot system flash: c2691-adventerprisek9 - mz.124 - 5a .bin
  boot-end-marker
  !
  !
  AAA new-model
  !
  !
  AAA authentication login userauthen local
  AAA authorization groupauthor LAN
  !
  AAA - the id of the joint session
  !
  resources policy
  !
  IP cef
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  Fax fax-mail interface type
  0 username cisco password Cisco
  !
  !
  !
  crypto ISAKMP policy 3
  BA 3des
  preshared authentication
  Group 2
  !
  ISAKMP crypto client configuration group 3000client
  key cisco123
  DNS 8.8.8.8
  domain cisco.com
  pool ippool
  ACL 108
  !
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
  !
  Crypto-map dynamic dynmap 10
  Set transform-set RIGHT
  !
  !
  map clientmap client to authenticate crypto list userauthen
  card crypto clientmap isakmp authorization list groupauthor
  client configuration address map clientmap crypto answer
  10 ipsec-isakmp crypto map clientmap Dynamics dynmap
  !
  !
  !
  !
  interface FastEthernet0/0
  IP 172.18.124.159 255.255.255.0
  automatic speed
  Half duplex
  clientmap card crypto
  !
  interface Serial0/0
  no ip address
  Shutdown
  !
  interface FastEthernet0/1
  IP 192.168.10.166 255.255.255.0
  automatic speed
  Half duplex
  !
  interface Serial1/0
  no ip address
  Shutdown
  series 0 restart delay
  No terminal-dce-enable-calendar
  !
  interface Serial1/1
  no ip address
  Shutdown
  series 0 restart delay
  No terminal-dce-enable-calendar
  !
  interface Serial1/2
  no ip address
  Shutdown
  series 0 restart delay
  No terminal-dce-enable-calendar
  !
  interface Serial1/3
  no ip address
  Shutdown
  series 0 restart delay
  No terminal-dce-enable-calendar
  !
  IP local pool ippool 192.168.10.170 192.168.10.175
  IP route 0.0.0.0 0.0.0.0 192.168.10.1
  !
  !
  IP http server
  no ip http secure server
  !
  access-list 108 permit ip 192.168.10.0 0.0.0.255 host 0.0.0.0
  !
  !
  !
  !
  control plan
  !
  !
  !
  !
  !
  !
  Dial-peer cor custom
  !
  !
  !
  !
  !
  !
  Line con 0
  transportation out all
  Speed 115200
  line to 0
  transportation out all
  line vty 0 4
  transport of entry all
  transportation out all
  !
  !
  end

  Best regards

  Didier

  Hi Didier,.

  Looking at your first series of VPN client logs, it seems that the VPN client is set to use IPSec/TCP on port 10000 while CTCP has not been enabled on the router.

  I suggest you to change the configuration on the client VPN IPSec/UDP rather than TCP. (Go to the tab "Transport" when you change the corresponding connection on the VPN client).

  Let me know if this helps out!

  See you soon,.

  Assia

• False claims RADIUS of customer VPN Cisco ASA 5510

  Hello world

  I use the Cisco VPN client 5.0.7 and Cisco ASA 5510 (7.4 and 8.4.2) VPN RAS solution. Clients are authenticated using certificates and RADIUS AAA (ACS 3.3) and AD.

  Each time, when the client connects, ASA 2 RADIUS requests questions, correct first - which is successfully authenticated by FAC and immediately - second that always fails. I couldn't find information related to this strange behaivor. Function "Double Authentication" (more sympathetic to his name) is only accessible to Anyconnect customers who we do not. When I'm authenicated by using password group, there is only one query RADIUS.

  What is the source of such behavior?

  The negative impact is that my logs are filled with the failed authentication attempts fallacious and users are incrementig attempts failed in the AD meter.

  Debugging of ASA:

  -First application-

  RDS 2011-10-24 16:16:01 0232 14884 request code 172.16.8.1:1645 host = 1 id = 22, length = 145 on port 1025

  RDS 2011-10-24 16:16:01 I 2519 14884 [001] value of username: User1

  RDS 2011-10-24 16:16:01 I 2519 14884 [002] value username-password: 2D A9 B2 D0 15 5F 1E B8 BB DB 3A 38 F5 24 72 B5

  RDS 2011-10-24 16:16:01 I 2538 14884 [005] NAS-Port value:-1072693248

  RDS 2011-10-24 16:16:01 I 2538 14884 [006] Type of Service value: 2

  RDS 2011-10-24 16:16:01 I 2538 14884 [007] value Framed-Protocol: 1

  RDS 2011-10-24 16:16:01 I 2519 14884 [030] value Called-Station-Id: 172.16.8.1

  RDS 2011-10-24 16:16:01 I 2519 14884 [031] value of Calling-Station-Id: 10.4.14.14

  RDS 2011-10-24 16:16:01 I 2538 14884 [061] NAS-Port-Type value: 5

  RDS 2011-10-24 16:16:01 I 2533 14884 [066] Tunnel-Client-Endpoint value: [T1] 10.4.14.14

  RDS 2011-10-24 16:16:01 I 14884 2556 [004] value of NAS-IP-Address: 172.16.8.1

  RDS 2011-10-24 16:16:01 I 2561 14884 [026] Vendor-Specific vsa id: 9

  RDS 2011-10-24 16:16:01 I 2596 14884 [001] cisco-av-pair value: ip:source - ip = 10.4.14.14

  RDS 2011-10-24 16:16:01 I 0282 14884 ExtensionPoint: run the configured scan extension points...

  RDS 2011-10-24 16:16:01 I 0314 14884 ExtensionPoint: advertising [AuthenticationExtension] provider [Cisco EAP generic]

  RDS 2011-10-24 16:16:01 I 0763 14884 ExtensionPoint: Message-[generic EAP] lack of EAP, ignorant...

  RDS 2011-10-24 16:16:01 I 0319 14884 ExtensionPoint: [GenericEAP.dll-> AuthenticationExtension] returned [1 - ignored]

  RDS 2011-10-24 16:16:01 I 0314 14884 ExtensionPoint: asking provider [Download Cisco ACL] [AuthenticationExtension]

  RDS 2011-10-24 16:16:01 I 0763 14884 ExtensionPoint: [DnldACLs] asking not a download of ACL, ignorant...

  RDS 2011-10-24 16:16:01 I 0319 14884 ExtensionPoint: [DnldACLs.dll-> AuthenticationExtension] returned [1 - ignored]

  RDS 2011-10-24 16:16:02 I 14884 0475 AuthorExtensionPoint: run the configured scan extension points...

  RDS 2011-10-24 16:16:02 I 14884 0507 AuthorExtensionPoint: requesting provider [Download Cisco ACL] [AuthorisationExtension]

  RDS 2011-10-24 16:16:02 I 0763 14884 ExtensionPoint: looking for ACL from [DnldACLs] to [user1]

  RDS 2011-10-24 16:16:02 I 0512 14884 AuthorExtensionPoint: [DnldACLs.dll-> AuthorisationExtension] returned [1 - ignored]

  RDS 2011-10-24 16:16:02 3360 14884 sent response code 2, id 22 to 172.16.8.1 on port 1025

  RDS 2011-10-24 16:16:02 I 2561 14884 [026] Vendor-Specific vsa id: 9

  RDS 2011-10-24 16:16:02 I 2596 14884 [001] cisco-av-pair value: ip:addr - pool = vpnpool

  RDS 2011-10-24 16:16:02 I 2561 14884 [026] Vendor-Specific vsa id: 9

  RDS 2011-10-24 16:16:02 I 2596 14884 [001] cisco-av-pair value: ip:wins - servers = 10.2.9.12 10.3.9.10 10.4.2.202

  RDS 2011-10-24 16:16:02 I 2561 14884 [026] Vendor-Specific vsa id: 9

  RDS 2011-10-24 16:16:02 I 2596 14884 [001] cisco-av-pair value: IP: DNS-servers = 10.2.9.12 10.3.9.10 10.4.2.202

  RDS 2011-10-24 16:16:02 I 2538 14884 [006] Type of Service value: 2

  RDS 2011-10-24 16:16:02 I 2538 14884 [007] value Framed-Protocol: 1

  RDS 2011-10-24 16:16:02 I 2538 14884 [013] box-Compression value: 1

  RDS 2011-10-24 16:16:02 I 14884 2556 [008] value box-IP-Address: 255.255.255.254

  RDS 2011-10-24 16:16:02 I 2519 14884 [025] value class: CISCOACS:002cb2a9/ac100801/3222274048

  -The second request-

  RDS 2011-10-24 16:16:02 0232 14884 request code 172.16.8.1:1645 host = 1 id = 23, length = 145 on port 1025

  RDS 2011-10-24 16:16:02 I 2519 14884 [001] value of username: User1

  RDS 2011-10-24 16:16:02 I 2519 14884 [002] value username-password: 06 EA 08 AB C7 8F 75 D0 A5 E5 AE B7 A8 1 48 96 b

  RDS 2011-10-24 16:16:02 I 2538 14884 [005] NAS-Port value:-1072693248

  RDS 2011-10-24 16:16:02 I 2538 14884 [006] Type of Service value: 2

  RDS 2011-10-24 16:16:02 I 2538 14884 [007] value Framed-Protocol: 1

  RDS 2011-10-24 16:16:02 I 2519 14884 [030] value Called-Station-Id: 172.16.8.1

  RDS 2011-10-24 16:16:02 I 2519 14884 [031] value of Calling-Station-Id: 10.4.14.14

  RDS 2011-10-24 16:16:02 I 2538 14884 [061] NAS-Port-Type value: 5

  RDS 2011-10-24 16:16:02 I 2533 14884 [066] Tunnel-Client-Endpoint value: [T1] 10.4.14.14

  RDS 2011-10-24 16:16:02 I 14884 2556 [004] value of NAS-IP-Address: 172.16.8.1

  RDS 2011-10-24 16:16:02 I 2561 14884 [026] Vendor-Specific vsa id: 9

  RDS 2011-10-24 16:16:02 I 2596 14884 [001] cisco-av-pair value: ip:source - ip = 10.4.14.14

  RDS 2011-10-24 16:16:02 I 0282 14884 ExtensionPoint: run the configured scan extension points...

  RDS 2011-10-24 16:16:02 I 0314 14884 ExtensionPoint: advertising [AuthenticationExtension] provider [Cisco EAP generic]

  RDS 2011-10-24 16:16:02 I 0763 14884 ExtensionPoint: Message-[generic EAP] lack of EAP, ignorant...

  RDS 2011-10-24 16:16:02 I 0319 14884 ExtensionPoint: [GenericEAP.dll-> AuthenticationExtension] returned [1 - ignored]

  RDS 2011-10-24 16:16:02 I 0314 14884 ExtensionPoint: asking provider [Download Cisco ACL] [AuthenticationExtension]

  RDS 2011-10-24 16:16:02 I 0763 14884 ExtensionPoint: [DnldACLs] asking not a download of ACL, ignorant...

  RDS 2011-10-24 16:16:02 I 0319 14884 ExtensionPoint: [DnldACLs.dll-> AuthenticationExtension] returned [1 - ignored]

  RDS 2011-10-24 16:16:02 P 2237 14884 user: User1 - Windows user unknown or invalid password

  RDS 2011-10-24 16:16:02 3360 14884 sent response code 3, id 23 to 172.16.8.1 on port 1025

  RDS 2011-10-24 16:16:02 I 2519 14884 [018] value Reply-Message: rejected...

  RDS 2011-10-24 16:16:03 0232 14884 request code 10.2.47.200:1812 host = 1 id = 254, length = 227 on port 32769

  RDS 2011-10-24 16:16:03 2788 14884 (VSA unknown Vendor ID 14179)

  GBA debug:

  -First application-

  AUTH 24/10/2011 16:16:01 I 0365 13060 external DB [NTAuthenDLL.dll]: from [user01] user authentication
  AUTH 24/10/2011 16:16:01 I 0365 13060 external DB [NTAuthenDLL.dll]: Windows authentication attempt for the user1 user

  AUTH 24/10/2011 16:16:02 I 0365 13060 external DB [NTAuthenDLL.dll]: authentication Windows successfully (by DCCORPMSK04)
  AUTH 24/10/2011 16:16:02 I 0365 13060 external DB [NTAuthenDLL.dll]: information get RAS to the user user1 DCCORPMSK04

  -The second request-
  AUTH 24/10/2011 16:16:02 I 0365 13060 external DB [NTAuthenDLL.dll]: from [user1] user authentication
  AUTH 24/10/2011 16:16:02 I 0365 13060 external DB [NTAuthenDLL.dll]: Windows authentication attempt for the user1 user
  AUTH 24/10/2011 16:16:02 0365 13060 external DB [NTAuthenDLL.dll]: Windows authentication FAILED (Error 1326 L)
  AUTH 24/10/2011 16:16:02 I 0365 13060 external DB [NTAuthenDLL.dll]: retry authentication to the CORP domain
  AUTH 24/10/2011 16:16:02 I 0365 13060 external DB [NTAuthenDLL.dll]: Windows authentication attempt for the user1 user
  AUTH 24/10/2011 16:16:02 0365 13060 external DB [NTAuthenDLL.dll]: Windows authentication FAILED (Error 1326 L)

  The ASA config:

  Crypto ikev1 allow outside
  Crypto ikev1 allow inside
  IKEv1 crypto ipsec-over-tcp port 10000
  life 86400
  IKEv1 crypto policy 65535
  authentication rsa - sig
  3des encryption
  md5 hash
  Group 2
  life 86400

  !

  internal Cert_auth group strategy
  attributes of Group Policy Cert_auth
  client ssl-VPN-tunnel-Protocol ikev1 l2tp ipsec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list aclVPN2
  the address value vpnpool pools
  rule of access-client-none

  !

  attributes global-tunnel-group DefaultRAGroup
  address (inside) vpnpool pool
  address vpnpool pool
  authentication-server-group RADIUS01
  authorization-server-group RADIUS01
  authorization-server-group (inside) RADIUS01
  Group Policy - by default-Cert_auth

  !

  RADIUS protocol AAA-server RADIUS01
  AAA-server host 10.2.9.224 RADIUS01 (inside)
  key *.
  RADIUS-common-pw *.
  AAA-server host 10.4.2.223 RADIUS01 (inside)
  key *.

  Hello

  It is a 'classic' error and has nothing to do with dual authentication, but rather with the fact that you do both radius and authorization of RADIUS authentication.

  If you remove this line:

  authorization-server-group RADIUS01

  you will see that it starts to work properly

  In short: when ASA no authorization of RADIUS, it sends a request to access radius with the username as a password, that's why you see the second application fails all the time.

  This is because the RADIUS authorization is intended to be used when authentication happens using certificates (only) so there is no password.

  Also note that within the RADIUS protocol, authentication and authorization are not separate things, both occur in a single step. So if the ASA makes the radius authentication, he already gets the user attributes in the authentication step and it makes no sense to also make a separate authorization stage (except in a few very rare scenario where you have 2 radius servers, one for authentication and another for permission).

  HTH

  Herbert

• How to configure a Cisco No. 2851 to access customer VPN Cisco router?

  It is my current configuration below, can someone help me see problems with it:

  AAA new-model
  !
  !
  AAA authentication local connection user
  AAA authorization network group local
  AAA accounting update newinfo

  crypto ISAKMP policy 10
  BA 3des
  preshared authentication
  !
  crypto ISAKMP policy 11
  BA 3des
  preshared authentication
  Group 2
  !
  12 crypto isakmp policy
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 15
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 20
  md5 hash
  preshared authentication

  !
  ISAKMP crypto client configuration group vpngroup
  key cisco123
  pool VPN_POOL

  Crypto ipsec transform-set esp-3des esp-sha-hmac vpnc1
  !
  Crypto-map dynamic dynmap 15
  Set transform-set vpnc1
  !
  !

  local IP 10.1.1.1 VPN_POOL pool 10.1.1.20

  list user card crypto Test client authentication
  card crypto isakmp authorization list Group Test
  Crypto map Test address client configuration address
  Discover 15 Test card crypto ipsec-isakmp dynamic dynmap
  !
  !
  !
  !
  interface GigabitEthernet0/0
  Description *.
  IP address
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  No cdp enable
  card crypto Test

  Hi Ralema,

  Please see this link:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00800949ba.shtml

  It will be useful.

  Federico.

• The customer VPN Cisco PIX501

  Hello

  I ran through the Wizzard VPN on Pix Device Manager but I would like to know how to check my connections are given of sailors and passage.

  Jason

  Jason,

  You can use the sh command his isa crypto and crypto ips HS her.

  SH crypto isa his will tell you who threw a connection and what state it is.

  SH ips crypto her will allow you to see packets encrypted and unencrypted packets and the amount of data has been transmitted through your vpn tunnel.

  Patrick

• Client VPN Cisco router Cisco, MSW CA + certificates

  Dear Sirs,
  Let me approach you on the following problem.

  I wanted to use a secure between the Cisco VPN client connection
  (Windows XP) and Cisco 2821 with certificate-based authentication.
  I used the Microsoft certification authority (Windows 2003 server).
  Cisco VPN client used eTokenPRO Aladdin as a certificate store.

  Certificate of MSW CA registration and implementation in eToken ran OK
  Customer VPN Cisco doesn't have a problem with the cooperation of eToken.
  Certificate of registration of Cisco2821 MSW ca ran okay too.

  Cisco 2821 configuration is standard. IOS version 12.4 (6).

  Attempt to connect to the client VPN Cisco on Cisco 2821 was
  last update of the error messages:

  ISAKMP: (1020): cannot get router cert or routerdoes do not have a cert: had to find DN!
  ISAKMP: (1020): ITS been RSA signature authentication more XAUTH using id ID_FQDN type
  ISAKMP (1020): payload ID
  next payload: 6
  type: 2
  FULL domain name: cisco - ca.firm.com
  Protocol: 17
  Port: 500
  Length: 25
  ISAKMP: (1020): the total payload length: 25
  ISAKMP (1020): no cert string to send to peers
  ISAKMP (1020): peer not specified not issuing and none found appropriate profile
  ISAKMP (1020): Action of WSF returned the error: 2
  ISAKMP: (1020): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  ISAKMP: (1020): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

  Is there some refence where is possible to find some information on
  This problem? There is someone who knows how to understand these mistakes?
  Thank you very much for your help.

  Best regards
  P.Sonenberk

  PS Some useful information for people who are interested in the above problem.

  Address IP of Cisco 2821 10.1.1.220, client VPN IP address is 10.1.1.133.
  MSW's IP 10.1.1.50.
  Important parts of the Cisco 2821 configuration:

  !
  cisco-ca hostname
  !
  ................
  AAA new-model
  !
  AAA authentication login default local
  AAA authentication login sdm_vpn_xauth_ml_1 local
  AAA authorization exec default local
  AAA authorization sdm_vpn_group_ml_1 LAN
  !
  ...............
  IP domain name firm.com
  host IP company-cu 10.1.1.50
  host to IP cisco-vpn1 10.1.1.133
  name of the IP-server 10.1.1.33
  !
  Authenticated MultiLink bundle-name Panel
  !
  Crypto pki trustpoint TP-self-signed-4097309259
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 4097309259
  revocation checking no
  rsakeypair TP-self-signed-4097309259
  !
  Crypto pki trustpoint company-cu
  registration mode ra
  Enrollment url http://10.1.1.50:80/certsrv/mscep/mscep.dll
  use of ike
  Serial number no
  IP address no
  password 7 005C31272503535729701A1B5E40523647
  revocation checking no
  !
  TP-self-signed-4097309259 crypto pki certificate chain
  certificate self-signed 01
  30820249 308201B 2 A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030
  .............
  FEDDCCEA 8FD14836 24CDD736 34
  quit smoking
  company-cu pki encryption certificate chain
  certificate 1150A66F000100000013
  30820509 308203F1 A0030201 02020 HAS 11 092A 8648 01000000 13300 06 50A66F00
  ...............
  9E417C44 2062BFD5 F4FB9C0B AA
  quit smoking
  certificate ca 51BAC7C822D1F6A3469D1ADC32D0EB8C
  30820489 30820371 A0030201 BAC7C822 02021051 D1F6A346 9D1ADC32 D0EB8C30
  ...............
  C379F382 36E0A54E 0A6278A7 46
  quit smoking
  !
  ...................
  crypto ISAKMP policy 30
  BA 3des
  md5 hash
  authentication rsa-BA
  Group 2
  ISAKMP crypto identity hostname
  !
  Configuration group customer isakmp crypto Group159
  key Key159Key
  pool SDM_POOL_1
  ACL 100
  !
  the crypto isakmp client configuration group them
  domain firm.com
  pool SDM_POOL_1
  ACL 100
  !
  Crypto ipsec transform-set esp-3des esp-md5-hmac 3DES-MD5
  !
  crypto dynamic-map SDM_DYNMAP_1 1
  the transform-set 3DES-MD5 value
  market arriere-route
  !
  card crypto SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
  map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto
  client configuration address map SDM_CMAP_1 crypto answer
  map SDM_CMAP_1 65535-isakmp dynamic SDM_DYNMAP_1 ipsec crypto
  !
  ................
  !
  end

  status company-cu of Cisco-ca #show cryptographic pki trustpoints
  Trustpoint company-cu:
  Issuing CA certificate configured:
  Name of the object:
  CN = firm-cu, dc = company, dc = local
  Fingerprint MD5: 5026582F 8CF455F8 56151047 2FFAC0D6
  Fingerprint SHA1: 47B 74974 7C85EA48 760516DE AAC84C5D 4427E829
  Universal router configured certificate:
  Name of the object:
  host name = cisco - ca.firm.com
  Fingerprint MD5: E78702ED 47D5D36F B732CC4C BA97A4ED
  Fingerprint SHA1: 78DEAE7E ACC12F15 1DFB4EB8 7FC DC6F3B7E 00138
  State:
  Generated keys... Yes (general purpose, not exportable)
  Authenticated issuing certification authority... Yes
  Request certificate (s)... Yes

  Cisco-ca #sh crypto pubkey-door-key rsa
  Code: M - configured manually, C - excerpt from certificate

  Name of code use IP-address/VRF Keyring
  C Signature name of X.500 DN default:
  CN = firm-cu
  DC = company
  DC = local

  C signature by default cisco-vpn1

  IMPORTANT: I don't have a Cisco IOS Software: 12.4 (5), 12.3 (11) T08, 12.4 (4.7) PI03c,.
  12.4 (4.7) T - there is error in the cryptographic module.

  Hey guys, it's weird that the router is not find cert after IKE is the cert and validates, it is certainly not reason, but I would go ahead and set up the mapping of certificate on this router to force the client to associate with Group of IKE, for that matter, that you need to change your config a bit for use iskamp profiles :

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t8/feature/guide/gt_isakp.html

• client vpn Cisco pix 501

  I wonder and wonder, is it possible for a branch (2 vpn clients) to connect to the central location (cisco 501 pix) at the same time via the vpn client with a public address on each side. If this is not the case, what will be the way to make it work without additional equipment (another pix of cisco).

  Yes you can, you should check your os 6.3 a pix and you enable nat-transapency: -.

  ISAKMP nat-traversal 20

• help with 2 concurrent internal users trying to VPN (Cisco s/w) at extern

  Hi all

  We are a small office running Small Business Server 2003 - which means that we miss the ISA 2004 firewall.

  An external company provided us with the Cisco VPN (ver403a) software to access their site web network / secure.

  One user could connect to the network of the company for some time. It was working fine until two users tried to connect at the same time - using the same VPN user ID. We have learned by the company that it should work, but it just isn't so we asked a second VPN user ID to test with.

  Now what happens is that the user has to connect with success and user B can connect successfully at the same time however even if user B is connected, and you see even an IP assigned to the VPN adapter, the user can not ping the company website and then of course can not access it. Very strange indeed!

  I went back to the company and told her about our dilemma and we were told that there is nothing at their end, but a problem of Routing/NAT at our end. So here, I'm now looking for help I hope that some experts from Cisco. :-)

  Appropriate, the ports were opened in ISA and once again the two users will connect to the VPN very well, it's just that the second user can? t go further.

  It was suggested to me that is maybe not a routing problem, but that Cisco VPN server/box the company rejects the second connection because it comes from the same IP address - that would be the IP address of our ISA Server external network card.

  If anyone has any suggestions on how to solve this problem, I would be so grateful!

  Thank you very much.

  Tammy

  VPN configuration multiple tunnels for the same device (same public IP address) is not possible because it is not possible to have several (SA) IPsec Security Association for the same position. However, it is possible to configure multiple VPN tunnels to multiple devices. In your case, if your client PC using public IP addresses, they both can simultaneously connect to the remote vpn server. However if you are using a single public IP address so it is not possible to have mutiple vpn connections. If you have only a single ip address of your ISP then it would have to do PAT and you will be not able to have the two vpn clients to connect to even

  time.

• Customer Cisco IPSec vpn cisco ios router <>==

  Hello

  I need to implement ipsec vpn for all users of 10-15. They all use the vpn cisco 5.x client and we have a router for cisco ios at the office. We already have a situation of work for these users. However, it has become a necessity which known only devices (laptops company) are allowed to install a virtual private network.

  I think that the only way to achieve this is to use certificates. But we don't won't to buy certificates if there is a free way to implement. So my question is

  (1) what are the options I have to configure vpn ipsec, where only known devices can properly configure a vpn and all unknown devices are blocked?

  (2) if the certificate is the only way. Can I somehow produce these certificates myself using cisco router ios?

  (3) someone at - it an example of a similar installation/configuration?

  Thanks in advance.

  Kind regards

  M.

  Unfortunately if you connect to the router IOS, there is no other way except using the certificate. If you connect to a Cisco ASA firewall, then you can identify the laptop company using DAP (Dynamic Access Policy).

• PROJECT VPN - CISCO ASA

  Hi all

  We have a large ongoing project in which we implement a Firewall / VPN service to the customers to provide VPN connections back to a single VPN server. We have about 1,000 users but only run about 200-250 concurrent sessions at any time and the IP Sec and SSL will be fine. As part of our evaluation and the construction phase we need to firstly consider hardware and Cisco is an obviuos because we have the expertise in house. However, I consider that for this client, it would be preferable to provide a solution that will scale that their subscribers grow and therefore my opinion is the ASA 5510 would be a good starting point and we can improve if their subscriber base grows. There are also run active failover / standby. However, the licenceing issues are a little confussing to say the least and so would like a second opinion from someone on this forum which has some recent experience of a similar build and install. Hardware and software specifications for this build are important, so any suggestions in this regard would be also welcome. We considered all connect premium, but this can be expensive looking at 250 concurrent sessions. These are fundamental questions.

  1. what would be the best material to offer to this customer to get them started?

  2. with Anyconnect is the example from the sessions simultaneous or registered user accounts or in other words we would have 1,000 accounts of users with 250 concurrent connections?

  3. is there a better way to configure the VPN simultaneous 250 with about 1000 users?

  Any help would be as always greatly appreciated.

  Kind regards

  >> 1. What would be the best material to offer to this customer to get them started?

  The 5510 is a legacy that should not be bought and more like the first firewall. And the concurrent users are also too low. You should look into the 5525-X. This model supports VPN connections simultaneous 750. The next smallest model, the 5515-X only supports 250 simultaneous sessions.

  >> 2. With Anyconnect is the example from the sessions simultaneous or registered user accounts, or in other words we would have 1,000 accounts of users with 250 concurrent connections?

  Yes, concurrent sessions are what count.

  >> 3. Is there a better way to configure the VPN simultaneous 250 with about 1000 users?

  You must decide if you really need VPN without client. If your users could all use a complete tunnel (AnyConnect) client, then just buy the AnyConnect Essentials license which is pretty cheap.

  Sent by Cisco Support technique iPad App

• VPN Cisco ASA 5540 L2L - one-way traffic only for the pair to a network

  Hello

  I'm a little confused as to which is the problem. This is the premise for the problem I have face.

  One of our big clients has a Cisco ASA5540 (8.2 (2)) failover (active / standby). Early last year, we have configured a VPN from Lan to Lan to a 3rd party site (a device of control point on their end). He worked until early this week when suddenly the connection problems.

  Only 1 of the 3 networks the / guests can access a remote network on the other side. 2 others have suddenly stopped working. We do not know of any change on our side and the remote end also insists that their end configurations are correct (and what information they sent me it seems to be correct)

  So essentially the encryption field is configured as follows:

  access-list line 1 permit extended ip 10.238.57.21 host 10.82.0.202 (hitcnt = 2)
  access-list line 2 extended permit ip 10.207.0.0 255.255.0.0 10.82.0.200 255.255.255.252 (hitcnt = 198)
  access-list line 3 extended permit ip 10.231.191.0 255.255.255.0 10.82.0.200 255.255.255.252 (hitcnt = 173)

  Free NAT has been configured as follows (names modified interfaces):

  NAT (interface1) 0-list of access to the INTERIOR-VPN-SHEEP

  the INTERIOR-VPN-SHEEP line 1 permit access list extended ip 10.231.191.0 255.255.255.0 10.82.0.200 255.255.255.252
  permit for Access-list SHEEP-VPN-INSIDE line lengthened 2 ip host 10.238.57.21 10.82.0.202

  NAT (interface2) 0-list of access VPN-SHEEP

  VPN-SHEEP line 1 permit access list extended ip 10.207.0.0 255.255.0.0 10.82.0.200 255.255.255.252

  After the problem started only 10.207.0.0/16 network connections worked for the site remote 10.82.0.200/30. All other connections do not work.

  There has been no change made on our side and on the side remote also insists there has been no change. I also checked how long the ASAs have been upward and how long the same device has been active in the failover. Both have been at the same time (about a year)

  The main problem is that users of the 10.231.191.0/24 cant access remote network network. However, the remote user can initiate and implement the VPN on their side but usually get any return traffic. Ive also checked that the routes are configured correctly in the routers in core for the return of their connections traffic should go back to the firewall.

  Also used of "packet - trace" event raising the VPN tunnel (even if it passes the phases VPN). For my understanding "packet - trace" alone with the IP source and destination addresses must activate the VPN connection (even if it generates no traffic to the current tunnel).

  This is printing to the following command: "packet - trace entry interface1 tcp 10.231.191.100 1025 10.82.0.203 80.

  Phase: 1
  Type: ACCESS-LIST
  Subtype:
  Result: ALLOW
  Config:
  Implicit rule
  Additional information:
  MAC access list

  Phase: 2
  Type: FLOW-SEARCH
  Subtype:
  Result: ALLOW
  Config:
  Additional information:
  Not found no corresponding stream, creating a new stream

  Phase: 3
  Type:-ROUTE SEARCH
  Subtype: entry
  Result: ALLOW
  Config:
  Additional information:
  in 10.82.0.200 255.255.255.252 outside

  Phase: 4
  Type: ACCESS-LIST
  Subtype: Journal
  Result: ALLOW
  Config:
  Access-group interface interface1
  access-list extended allow ip 10.231.191.0 255.255.255.0 10.82.0.200 255.255.255.252
  Additional information:

  Phase: 5
  Type: IP-OPTIONS
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 6
  Type: INSPECT
  Subtype: np - inspect
  Result: ALLOW
  Config:
  class-map inspection_default
  match default-inspection-traffic
  Policy-map global_policy
  class inspection_default
  inspect the http
  global service-policy global_policy
  Additional information:

  Phase: 7
  Type: FOVER
  Subtype: Eve-updated
  Result: ALLOW
  Config:
  Additional information:

  Phase: 8
  Type: NAT-FREE
  Subtype:
  Result: ALLOW
  Config:
  NAT-control
  is the intellectual property inside 10.231.191.0 255.255.255.0 outside 10.82.0.200 255.255.255.252
  Exempt from NAT
  translate_hits = 32, untranslate_hits = 35251
  Additional information:

  -Phase 9 is a static nat of the problem to another network interface. Don't know why his watch to print.

  Phase: 9
  Type: NAT
  Subtype: host-limits
  Result: ALLOW
  Config:
  static (interface1, interface3) 10.231.0.0 10.231.0.0 255.255.0.0 subnet mask
  NAT-control
  is the intellectual property inside 10.231.0.0 255.255.0.0 interface3 all
  static translation at 10.231.0.0
  translate_hits = 153954, untranslate_hits = 88
  Additional information:

  -Phase 10 seems to be the default NAT for the local network configuration when traffic is to the Internet

  Phase: 10
  Type: NAT
  Subtype:
  Result: ALLOW
  Config:
  NAT (interface1) 5 10.231.191.0 255.255.255.0
  NAT-control
  is the intellectual property inside 10.231.191.0 255.255.255.0 outside of any
  dynamic translation of hen 5 (y.y.y.y)
  translate_hits = 3048900, untranslate_hits = 77195
  Additional information:

  Phase: 11
  Type: VPN
  Subtype: encrypt
  Result: ALLOW
  Config:
  Additional information:

  Phase: 12
  Type: VPN
  Subtype: ipsec-tunnel-flow
  Result: ALLOW
  Config:
  Additional information:

  Phase: 13
  Type: IP-OPTIONS
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 14
  Type: CREATING STREAMS
  Subtype:
  Result: ALLOW
  Config:
  Additional information:
  New workflow created with the 1047981896 id, package sent to the next module

  Result:
  input interface: interface1
  entry status: to the top
  entry-line-status: to the top
  output interface: outside
  the status of the output: to the top
  output-line-status: to the top
  Action: allow

  So, basically, the connection should properly go to connect VPN L2L but yet is not. I tried to generate customer traffic of base (with the source IP address of the client network and I see the connection on the firewall, but yet there is absolutely no encapsulated packets when I check "crypto ipsec to show his" regarding this connection VPN L2L.) Its almost as if the firewall only transfers the packets on the external interface instead of encapsulating for VPN?

  And as I said, at the same time the remote end can activate the connection between these 2 networks very well, but just won't get any traffic back to their echo ICMP messages.

  access-list extended allow ip 10.231.191.0 255.255.255.0 10.82.0.200 255.255.255.252
  local ident (addr, mask, prot, port): (10.231.191.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.82.0.200/255.255.255.252/0/0)
  current_peer: y.y.y.y

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 131, #pkts decrypt: 131, #pkts check: 131
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  If it was just a routing problem it would be a simple thing to fix, but it is not because I can see the connection I have to confirm it by the router base on the firewall, but they don't just get passed on to the VPN connection.

  Could this happen due to a bug in the Software ASA? Would this be something with Checkpoint VPN device? (I have absolutely no experience with devices of control point)

  If there is any essential information that I can give, please ask.

  -Jouni

  Jouni,

  8.2.4.1 is the minimum - 8.2.4 had some issues (including TCP proxy).

  If this does not resolve the problem - I suggest open TAC box to get to the bottom of this ;-)

  Marcin

• What clients VPN Cisco 2811 supports?

  Is the solution of VPN Cisco 2811 locked customers cisco or that market with other brands too?

  Best regards Tommy Svensson

  Hello

  With the correct IOS feature set, it will support IPsec VPN clients. This includes not only the Cisco VPN client but almost any standard IPsec client.

  In addition, if on the 2811 can accept any browser SSL VPN connections, or even use the AnyConnect SSL client.

  It will be useful.

  Federico.

• Check the ISE for the VPN Cisco posture

  Hello community,

  first of all thank you for taking the time to read my post. I have a deployment in which requires the characteristic posture of controls for machines of VPN Cisco ISE. I know that logically once a machine on the LAN, Cisco ISE can detect and apply controls posture on clients with the Anyconnect agent but what about VPN machines? The VPN will end via a VPN concentrator, which then connects to an ASA5555X that is deployed as an IPS only. Are there clues to this?

  Thank you!

  The Cisco ASA Version 9.2.1 supports the change in RADIUS authorization (CoA) (RFC 5176). This allows for the gesticulations of users against the ISE Cisco VPN without the need of an IPN. Once a VPN user connects, the ASA redirects web traffic to the LSE, where the user is configured with a Network Admission Control (NAC) or Web Agent. The agent performs specific controls on the user's computer to determine its conformity against one together configured posture rules, such as the rules of operating system (OS) patches, AntiVirus, registry, Application, or Service.

  The posture validation results are then sent to the ISE. If the machine is considered the complaint, then the ISE can send a RADIUS CoA to the ASA with the new set of authorization policies. After validation of the successful posture and CoA, the user is allowed to access internal resources.

  http://www.Cisco.com/c/en/us/support/docs/security/Adaptive-Security-Appliance-ASA-software/117693-configure-ASA-00.html

• Configuration of VPN Cisco RV220W wireless

  Hello expert support.

  We have a RV220 Wireless Network Security Cisco Firewall.  It is currently configured to provide access only to select users.  Asked me to configure it to provide access to users of hotspots or home networks.  Thought which is on the road, or at home that they would use their home network or a location of hot point to the VPN to the RV220 to access the documents they needed.

  My hypothesis was set up VPN with the users who access the QuickVPN client.  I followed the setup steps, but VPN access failed.

  Anyone who has tried or succeeded in a configuration like that?  I have read a number of posts with users having problems, just configure the VPN and access with QuickVPN.

  Any help would be greatly appreciated.

  Best regards

  Michael

  Try this first.

  http://www.Cisco.com/en/us/docs/routers/CSBR/app_notes/QuickVPN_an_OL-25680.PDF

  If the problem persists, please call the support help center.

  http://www.Cisco.com/en/us/support/tsd_cisco_small_business_support_center_contacts.html

• What VPN Cisco IOS VPN and RADIUS client?

  Hello community,

  My company are trying to set up the remote user VPN for all of our external collaborators to the help of our existing Cisco router and a RADIUS server in Active Directory.

  I did all the AAA config on the router and set up the RADIUS, but I do not know what customer buy Cisco Remote and how to set up.

  Anyone who knows this set upwards or it uses can be me help please we don't lose our money (and my boss time!)?

  Thanks in advance.

  Paul

  Paul,

  AnyConnect lets connect you using IKEv2/IPsec and SSLVPN for IOS network head.

  There are countless examples of configuration.

  Alternatively, some clients of IKEv1/IPsec 3rd party exists and are able to connect, however is those who are not TAC (Cisco) supported. You can check the feature called ezvpn

  M.