ASA5510 VPN L2L cannot reach hosts on the other side
Hello experts,
I have an ASA5510 with 3 VPN L2L and remote VPN access. Two VPN L2L, Marielle and Aeromique no problem, but for VPN ASPCANADA, to a host behind the ASA 192.168.100.xx, I can't reach 57.5.64.250 or 251 and vice versa. But the tunnel is up. Can you help me please, thank you in advance.
Add these two lines to the NAT 0 access list:
inside_outbound_nat0_acl list extended access allowed hosting ASP-NETWORK 255.255.255.0 ip 57.5.64.251
inside_outbound_nat0_acl list extended access allowed hosting ASP-NETWORK 255.255.255.0 ip 57.5.64.250
Also make sure this reflection of these statements are also in the distance of the ASA NAT 0-list of access.
Test and validate results
HTH
Sangaré
Pls rate helpful messages
Tags: Cisco Security
Similar Questions
-
I have a group of the same EPG and VLAN statically mapped ports on my fabric of ACI. One port connects to a port on a stack of 3750 x uplink. Hosts on the fabric, I cannot ping hosts on the 3750 until I have initiated traffic from hosts on the 3750 in the fabric. Once it done on each host of 3750, they can talk to each other. Why is this happening?
Thank you!
When traffic is a failure, the destination will probably not learned as an EP in the fabric. You can check by looking at the operational tab of the EPG.
Once you ping the 3750, we learn the EP and traffic works from the original source. When the BD "Equipment Proxy" mode, the destination must be learned.
If you change the mode of the 'Flood' comic, then inundate us and learn as a normal switch.
Joey
-
Original title: server busy
I get a popup server busy with the message: "this action cannot be completed because the other program is busy. ' Choose ' switch to ' to activate the busy program and correct the problem. There are two buttons"'Switch To' and 'Retry '. Neither fixes the problem and I do not understand what they are talking about.
Hi adarb,
1. when exactly you get this message?
2. what applications do you use when you get this message?
Method 1:
You can restart the computer and check if it helps.
Method 2:
You try to perform a clean boot. A clean boot to check if startup item or services to third-party application is causing this issue.
You can read the following article to put the computer in a clean boot:
http://support.Microsoft.com/kb/310353
If your problem is resolved after the clean boot, and then follow the steps mentioned in the article above to refine the exact source.
After you have used the boot is a way to solve your problem, you can follow the steps to configure Windows XP to start normally.
Hope this information is useful.
Jeremy K
Microsoft Answers Support Engineer
Visit our Microsoft answers feedback Forum and let us know what you think.If this post can help solve your problem, please click the 'Mark as answer' or 'Useful' at the top of this message. Marking a post as answer, or relatively useful, you help others find the answer more quickly.
-
Does my computer have a microphone? my friends on the other side cannot hear me on Skype.
Friends on the other side are unable to hear what I say about Skype. Image is pulled over the two screens and I can hear them clearly, but they can not hear a word of what I am saying. This computer has a built-in microphone? Help, please.
Hello
Unfortunately, we do not know what kind of computer you have.
Except that your best resource on it would be the company that built.
Best regards
Matthew_Ha
-
My doubt is if I press a button, it will redirect you to the other side...
For a single application I need if I press a button, it will redirect you to the other side, how it is possible in LABVIEW
Thank you.
Place your Subvi inside your main diagram of vi. Use a Structure of the event to capture the key event.
more information here:
http://forums.NI.com/T5/LabVIEW/how-to-open-a-subVI-on-a-click-of-a-button/TD-p/1082660
-
I'm develpoing apps using the SAPI, TAPI, however, I'm stuck with a fundamental question... when I dial a number, I can hear the ringtone on the speakers of the laptop... and I can hear the person on the other side as well... but he can't hear me... and as soon as the others left up to the 'Phone dialer' pcks pops up a window with two buttons... 'Talk' and 'Hang up', when I press the talk button, the line is automatically disconnected. Pleas help to solve this problem...
Hi abhi.jeet,
Thank you for visiting the website of Microsoft Windows Vista Community.
The question you have posted is related to application development and would be better suited to the MSDN Community. Please visit the link below to find a community that will provide the support you want.
http://msdn.Microsoft.com/en-us/default.aspx
Hope this information is useful.
Jeremy K
Microsoft Answers Support Engineer
Visit our Microsoft answers feedback Forum and let us know what you think. -
call very low voice on the other side (Z5 MM Compact)
Hello guys,.
I have a question which appeared suddenly and wont go away.
My voice is very low, on the other side, people say it's like I want to talk away from the microphone.
There is no problem with voice recording or when using headphones. I already rebooted the phone but question keeps beeing there.
It's as if the z5 lowers my voice through the microphone during a call, maybe it's the malfunkctioning of noise cancellation?
So I had no time for the repair of software, but after upgrading to the new fw X.224 each mentioned last issue is resolved
-
Original tile: need help with tiles of windows 8
I have 2 screens and I was wondering how do windows 8 slabs stand on one single screen while im doing stuff on the other side. He worked like that when I installed it then all of a sudden that it changed whenever I click on something on the other screen that the tiles go to the desktop automatically.
Hi Sean, 12,.
Thanks for posting in the Microsoft Community.
If I understand you must do the windows 8 slabs remain standing on one screen while making changes, you can check if the settings changed to duplicate.
If so, try to change the same scope and check if it helps.
a. open screen resolution by dragging from the edge right of the screen, quilting Search (or if you use a mouse, pointing to the top right of the screen, move the mouse down and then clicking Search), entering display in the search box, type, or by clicking settings, and then type or by clicking display.
b. press or click on multiple monitors and have her take Extended Display.
Check if this can help
For more information, see the articles:
Get the best display on your monitor
If you need further assistance, please answer and we will be happy to help you.
-
So I'm new to Illustrator and have begun to make a logo, one of the first things that I really need to know is how can I duplicate anchors - I know that I can mirror the forms but I don't want to continue to do that every time
I change an anchor on one side... I leave you a screenshot for you show more clearly!Draw half of the shape, and then go to Effects-> deformation and transformation-> Transform...
Check Reflect X and set the anchor point to the left and type 1 in the "copies".
now, when you move any anchor point on the right, that happen on the other side
-
Hi, the technology is a bit beyond me so I need help please.
I have a picture of a written text, but I see that there is also something written on the other side. Is there a way to somehow reverse the picture so I can see what he says on the other side? Someone says something on a reverse and I don't quite know what they are on everything. Thanks in advance, Vince
Can you give more details? How can you see the side 'inverse' of this image? I don't think that you are talking about 3D in Photoshop? If you mean that you see the text "mirrored", you can use, modify, transform and back horizontally.
-
The VPN Clients cannot Ping hosts
I'll include a post my config. I have clients that connect through the VPN tunnel on the 180.0.0.0/24 network, 192.168.1.0/24 is the main network for the office.
I can connect to the VPN, and I received a correct address assignment. I belive tunneling can be configured correctly in the aspect that I can always connect to the internet then on the VPN, but I can't ping all hosts on the 192.168.1.0 network. In the journal of the ASDM debugging, I see pings to the ASA, but no response is received on the client.
6 February 21, 2013 21:54:26 180.0.0.1 53508 192.168.1.1 0 Built of ICMP incoming connections for faddr gaddr laddr 192.168.1.1/0 (christopher) 192.168.1.1/0 180.0.0.1/53508 Any help would be greatly appreciated, I'm currently presuring my CCNP so I would get a deeper understanding of how to resolve these issues.
-Chris
hostname RegencyRE - ASA
domain regencyrealestate.info
activate 2/VA7dRFkv6fjd1X of encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
name 180.0.0.0 Regency
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
link to the description of REGENCYSERVER
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
link to the description of RegencyRE-AP
!
interface Vlan1
nameif inside
security-level 100
192.168.1.120 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP x.x.x.x 255.255.255.248
!
passive FTP mode
clock timezone PST - 8
clock summer-time recurring PDT
DNS lookup field inside
DNS domain-lookup outside
DNS server-group DefaultDNS
Server name 208.67.220.220
name-server 208.67.222.222
domain regencyrealestate.info
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 Regency 255.255.255.224
RegencyRE_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
outside_access_in list extended access permit icmp any one
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
mask Regency 180.0.0.1 - 180.0.0.20 255.255.255.0 IP local pool
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM 255.255.255.0 inside Regency location
ASDM location 192.168.0.0 255.255.0.0 inside
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 12.186.110.2 1
Route inside 192.0.0.0 255.0.0.0 192.168.1.102 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
LOCAL AAA authentication serial console
http server enable 8443
http 0.0.0.0 0.0.0.0 outdoors
http 0.0.0.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 inside
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 15
SSH version 2
Console timeout 0
dhcprelay Server 192.168.1.102 inside
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 69.25.96.13 prefer external source
NTP server 216.171.124.36 prefer external source
WebVPN
internal RegencyRE group strategy
attributes of Group Policy RegencyRE
value of server DNS 208.67.220.220 208.67.222.222
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list RegencyRE_splitTunnelAcl
username password encrypted adriana privilege 0
christopher encrypted privilege 15 password username
irene encrypted password privilege 0 username
type tunnel-group RegencyRE remote access
attributes global-tunnel-group RegencyRE
Regency address pool
Group Policy - by default-RegencyRE
IPSec-attributes tunnel-group RegencyRE
pre-shared key R3 & eNcY1.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
Review the ip options
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
Cryptochecksum:35bc3a41701f7f8e9dde5fa35532896d
: end
Hello
-be sure that the destination host 192.168.1.x has a route towards 180.0.0.0 by the ASA gateway.
-Configure the following figure:
capture capin interface inside match icmp 192.168.1.x host 180.0.0.x
capture ASP asp type - drop all
then make a continuous ping and get 'show capin cap' and 'asp cap.
-then check the ping, the 'encrypted' counter is increasing in the VPN client statistics
I would like to know about it, hope this helps
----
Mashal
-
Urgent issue: remote vpn users cannot reach server dmz
Hi all
I have an asa5510 firewall in which remote vpn client users can connect but they cannot ping or access the dmz (192.168.3.5) Server
They also can't ping the out interface (192.168.2.10), below is the show run, please help.
SH run
ASA5510 (config) # sh run
: Saved
:
: Serial number: JMX1243L2BE
: Material: ASA5510, 256 MB RAM, Pentium 4 Celeron 1599 MHz processor
:
ASA 5,0000 Version 55
!
Majed hostname
activate the encrypted password of UFWSxxKWdnx8am8f
2KFQnbNIdI.2KYOU encrypted passwd
names of
DNS-guard
!
interface Ethernet0/0
nameif outside
security-level 0
IP 192.168.2.10 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
192.168.1.10 IP address 255.255.255.0
!
interface Ethernet0/2
nameif servers
security-level 90
192.168.3.10 IP address 255.255.255.0
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
Shutdown
No nameif
no level of security
no ip address
!
boot system Disk0: / asa825-55 - k8.bin
passive FTP mode
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
acl_outside to access extended list ip 192.168.5.0 allow 255.255.255.0 192.168.1.0 255.255.255.0
acl_outside list extended access allow icmp 192.168.5.0 255.255.255.0 192.168.1.0 255.255.255.0
acl_outside of access allowed any ip an extended list
acl_outside list extended access permit icmp any one
acl_inside list extended access allowed host ip 192.168.1.150 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host icmp 192.168.1.150 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host ip 192.168.1.200 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host icmp 192.168.1.200 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host ip 192.168.1.13 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host icmp 192.168.1.13 192.168.5.0 255.255.255.0
acl_inside to access ip 192.168.1.0 scope list allow 255.255.255.0 host 192.168.3.5
acl_inside list extended access allow icmp 192.168.1.0 255.255.255.0 host 192.168.3.5
acl_inside list extended access deny ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
acl_inside list extended access deny icmp 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
acl_inside of access allowed any ip an extended list
acl_inside list extended access permit icmp any one
acl_server of access allowed any ip an extended list
acl_server list extended access permit icmp any one
Local_LAN_Access list standard access allowed 10.0.0.0 255.0.0.0
Local_LAN_Access list standard access allowed 172.16.0.0 255.240.0.0
Local_LAN_Access list standard access allowed 192.168.0.0 255.255.0.0
access-list nat0 extended ip 192.168.0.0 allow 255.255.0.0 192.168.0.0 255.255.0.0
allow acl_servers to access extensive ip list a whole
acl_servers list extended access allow icmp a whole
pager lines 24
Outside 1500 MTU
Within 1500 MTU
MTU 1500 servers
IP local pool 192.168.5.1 - 192.168.5.100 mask 255.255.255.0 vpnpool
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
interface of global (servers) 1
NAT (inside) 0 access-list nat0
NAT (inside) 1 192.168.1.4 255.255.255.255
NAT (inside) 1 192.168.1.9 255.255.255.255
NAT (inside) 1 192.168.1.27 255.255.255.255
NAT (inside) 1 192.168.1.56 255.255.255.255
NAT (inside) 1 192.168.1.150 255.255.255.255
NAT (inside) 1 192.168.1.200 255.255.255.255
NAT (inside) 1 192.168.2.5 255.255.255.255
NAT (inside) 1 192.168.1.0 255.255.255.0
NAT (inside) 1 192.168.1.96 192.168.1.96
NAT (servers) - access list 0 nat0
NAT (servers) 1 192.168.3.5 255.255.255.255
static (inside, servers) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
static (servers, inside) 192.168.3.5 192.168.3.5 netmask 255.255.255.255
Access-group acl_outside in interface outside
Access-group acl_servers in the servers of the interface
Route outside 0.0.0.0 0.0.0.0 192.168.2.15 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.1.0 255.255.255.0 inside
http 192.168.3.5 255.255.255.255 servers
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic outside_dyn_map 10 the value transform-set ESP-3DES-SHA
Crypto-map dynamic outside_dyn_map 10 set security-association life seconds288000
Crypto-map dynamic outside_dyn_map 10 kilobytes of life together - the association of safety 4608000
Crypto-map dynamic outside_dyn_map 10 the value reverse-road
map Outside_map 10-isakmp ipsec crypto dynamic outside_dyn_map
Outside_map interface card crypto outside
ISAKMP crypto identity hostname
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 192.168.2.0 255.255.255.0 outside
Telnet 192.168.1.0 255.255.255.0 inside
Telnet 192.168.3.0 255.255.255.0 servers
Telnet 192.168.38.0 255.255.255.0 servers
Telnet timeout 5
SSH timeout 5
Console timeout 0
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal vpn group policy
attributes of vpn group policy
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list Local_LAN_Access
allow to NEM
password encrypted qaedah Ipsf4W9G6cGueuSu user name
password encrypted moneef FLlCyoJakDnWMxSQ user name
chayma X7ESmrqNBIo5eQO9 username encrypted password
sanaa2 zHa8FdVVTkIgfomY encrypted password username
sanaa x5fVXsDxboIhq68A encrypted password username
sanaa1 x5fVXsDxboIhq68A encrypted password username
bajel encrypted DygNLmMkXoZQ3.DX privilege 15 password username
daris BgGTY7d1Rfi8P2zH username encrypted password
taiz Ip3HNgc.pYhYGaQT username encrypted password
damt gz1OUfAq9Ro2NJoR encrypted privilege 15 password username
aden MDmCEhcRe64OxrQv username encrypted password
username hodaidah encrypted password of IYcjP/rqPitKHgyc
username yareem encrypted password ctC9wXl2EwdhH2XY
AMMD ZwYsE3.Hs2/vAChB username encrypted password
haja Q25wF61GjmyJRkjS username encrypted password
cisco 3USUcOPFUiMCO4Jk encrypted password username
ibbmr CNnADp0CvQzcjBY5 username encrypted password
IBBR oJNIDNCT0fBV3OSi encrypted password username
ibbr 2Mx3uA4acAbE8UOp encrypted password username
ibbr1 wiq4lRSHUb3geBaN encrypted password username
password username: TORBA C0eUqr.qWxsD5WNj encrypted
username, password shibam xJaTjWRZyXM34ou. encrypted
ibbreef 2Mx3uA4acAbE8UOp encrypted password username
username torbah encrypted password r3IGnotSy1cddNer
thamar 1JatoqUxf3q9ivcu encrypted password username
dhamar pJdo55.oSunKSvIO encrypted password username
main jsQQRH/5GU772TkF encrypted password username
main1 ef7y88xzPo6o9m1E encrypted password username
password username Moussa encrypted OYXnAYHuV80bB0TH
majed 7I3uhzgJNvIwi2qS encrypted password username
lahj qOAZDON5RwD6GbnI encrypted password username
vpn tunnel-group type remote access
VPN tunnel-group general attributes
address vpnpool pool
Group Policy - by default-vpn
Tunnel vpn ipsec-attributes group
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!Hello brother Mohammed.
"my asa5510 to work easy as Server & client vpn at the same time.?
Yes, it can work as a client and a server at the same time.
I have never seen anyone do it but many years of my understanding, I have no reason to think why it may be because the two configurations (client/server) are independent of each other.
Your ASA function as server uses the "DefaultL2LGroup" or it uses standard group policy and tunnel-group are mapped to the remote clients ASA?
Thank you
-
Cannot ping hosts on the same vlan on the 2 switches.
Hey guys so I create my own network in Packet Tracer 6.3. While the hosts can ping others on the same switch 2960 and VLAN, they are unable to ping a host on another switch in the same VLAN. For example. Josh PC on S1 (192.168.10.10) cannot ping PC Doge on S2 (192.168.10.13). I'm sure that they are on the same subnet, so I thing it is a problem of junction...
S1:
S1 #show ip int br
Interface IP-Address OK? Method State Protocol
FastEthernet0/1 unassigned YES manual up up
FastEthernet0/2 unassigned YES manual up up
FastEthernet0/3 unassigned YES manual up up
FastEthernet0/4 unassigned YES manual up up
FastEthernet0/5 unassigned YES manual administratively down down
FastEthernet0/6 unassigned YES manual administratively down down
FastEthernet0/7 unassigned YES manual administratively down down
FastEthernet0/8 unassigned YES manual administratively down down
FastEthernet0/9 unassigned YES manual administratively down down
FastEthernet0/10 unassigned YES manual administratively down down
FastEthernet0/11 unassigned YES manual administratively down down
FastEthernet0/12 unassigned YES manual administratively down down
FastEthernet0/13 unassigned YES manual administratively down down
FastEthernet0/14 unassigned YES manual administratively down down
FastEthernet0/15 unassigned YES manual administratively down down
FastEthernet0/16 unassigned YES manual administratively down down
FastEthernet0/17 unassigned YES manual administratively down down
FastEthernet0/18 unassigned YES manual administratively down down
FastEthernet0/19 unassigned YES manual administratively down down
FastEthernet0/20 unassigned YES manual administratively down down
FastEthernet0/21 unassigned YES manual administratively down down
FastEthernet0/22 unassigned YES manual administratively down down
FastEthernet0/23 unassigned YES manual administratively down down
FastEthernet0/24 unassigned YES manual administratively down down
GigabitEthernet0/1 unassigned YES manual down down
GigabitEthernet0/2 unassigned YES manual down down
Vlan1 unassigned YES manual administratively down down
Vlan2 unassigned YES manual downwards upwards
Vlan10 unassigned YES manual up up
S1 #show interface f0/1 switchport
Name: Fa0/1
Switchport: enabled
Administrative mode: trunk
Operational mode: trunk
Encapsulation of administrative circuits: dot1q
Operational Trunking encapsulation: dot1q
Trunking negotiation: Off
The VIRTUAL LAN access mode: (default) 1
Native mode VLAN Trunking: 2 (native)
The voice of VLAN: no
Private-vlan host association Directors: no
Mapping of private - vlan management: no
Private-vlan trunk administration VLAN native: no
Private - vlan administration trunk encapsulation: dot1q
Private-vlan trunk administration VLAN normal: no
Private-vlan trunk administration private VLAN: no
Private-vlan operational: no
VLAN Trunking enabled: ALL
Pruning VLANS enabled: 2-1001
Capture Mode disabled
Capture VLAN allowed: ALL
Protected: false
The unit trust: no
S1 #show vlan br
Ports of status for the name of VLAN
---- -------------------------------- --------- -------------------------------
1 by default active Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
FA0/13, Fa0/14, Fa0/15, Fa0/16
FA0/17, Fa0/18, Fa0/19, Fa0/20
FA0/21, Fa0/22, Fa0/23 and Fa0/24
Gig0/1, Gig0/2
2 active native
5 active
10 active VLAN0010 Fa0/2, Fa0/3, Fa0/4
active by default fddi 1002
assets of token-ring-default 1003
1004 fddinet - default active
1005 trnet - default active
Trunk interface #show S1
VLAN Mode Encapsulation native port State
FA0/1 on 802. 1 trunking q 2
Port VLAN allowed on trunk
5,10,20 FA0/1
Port VLAN authorized and active in the field of management
FA0/1 5,10
VLAN port extending on transmission State and no tree pruned
FA0/1 5,10
S1 #show mac-address-table
Mac address table
-------------------------------------------
VLAN Mac Address Type Ports
---- ----------- -------- -----
5 00d0.d37a.ed01 DYNAMICS Fa0/1
S2:
S2 #show ip int br
Interface IP-Address OK? Method State Protocol
FastEthernet0/1 unassigned YES manual up up
FastEthernet0/2 unassigned YES manual up up
FastEthernet0/3 unassigned YES manual up up
FastEthernet0/4 unassigned YES manual up up
FastEthernet0/5 unassigned YES manual administratively down down
FastEthernet0/6 unassigned YES manual administratively down down
FastEthernet0/7 unassigned YES manual administratively down down
FastEthernet0/8 unassigned YES manual administratively down down
FastEthernet0/9 unassigned YES manual administratively down down
FastEthernet0/10 unassigned YES manual administratively down down
FastEthernet0/11 unassigned YES manual administratively down down
FastEthernet0/12 unassigned YES manual administratively down down
FastEthernet0/13 unassigned YES manual administratively down down
FastEthernet0/14 unassigned YES manual administratively down down
FastEthernet0/15 unassigned YES manual administratively down down
FastEthernet0/16 unassigned YES manual administratively down down
FastEthernet0/17 unassigned YES manual administratively down down
FastEthernet0/18 unassigned YES manual administratively down down
FastEthernet0/19 unassigned YES manual administratively down down
FastEthernet0/20 unassigned YES manual administratively down down
FastEthernet0/21 unassigned YES manual administratively down down
FastEthernet0/22 unassigned YES manual administratively down down
FastEthernet0/23 unassigned YES manual administratively down down
FastEthernet0/24 unassigned YES manual administratively down down
GigabitEthernet0/1 unassigned YES manual down down
GigabitEthernet0/2 unassigned YES manual down down
Vlan1 unassigned YES manual administratively down down
Vlan2 unassigned YES manual downwards upwards
Vlan5 unassigned YES manual up up
Vlan10 unassigned YES manual up up
Vlan20 unassigned YES manual up up
Vlan99 unassigned YES manual administratively down down
S2 #show interface f0/1 switchport
Name: Fa0/1
Switchport: enabled
Administrative mode: trunk
Operational mode: trunk
Encapsulation of administrative circuits: dot1q
Operational Trunking encapsulation: dot1q
Trunking negotiation: on
The VIRTUAL LAN access mode: (default) 1
Native mode VLAN Trunking: 2 (native)
The voice of VLAN: no
Private-vlan host association Directors: no
Mapping of private - vlan management: no
Private-vlan trunk administration VLAN native: no
Private - vlan administration trunk encapsulation: dot1q
Private-vlan trunk administration VLAN normal: no
Private-vlan trunk administration private VLAN: no
Private-vlan operational: no
VLAN Trunking enabled: ALL
Pruning VLANS enabled: 2-1001
Capture Mode disabled
Capture VLAN allowed: ALL
Protected: false
The unit trust: no
S2 #show vlan br
Ports of status for the name of VLAN
---- -------------------------------- --------- -------------------------------
1 by default active Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
FA0/13, Fa0/14, Fa0/15, Fa0/16
FA0/17, Fa0/18, Fa0/19, Fa0/20
FA0/21, Fa0/22, Fa0/23 and Fa0/24
Gig0/1, Gig0/2
2 active native
5 active
10 VLAN0010 active Fa0/4
20 VLAN0020 active Fa0/2, Fa0/3
active by default fddi 1002
assets of token-ring-default 1003
1004 fddinet - default active
1005 trnet - default active
S2 #show mac-address-table
Mac address table
-------------------------------------------
VLAN Mac Address Type Ports
---- ----------- -------- -----
2 0030.f2c1.94e5 STATIC Fa0/1
2 0060.5c83.3401 STATIC Fa0/1
10 0002.4ae9.6964 STATIC Fa0/4
10 0060.5c83.3401 STATIC Fa0/1
20 0009.7c9a.a134 STATIC Fa0/2
----------------------------------------------------------------------------------
Let me know what I missed here. All connections are made with a straight through cable.
See you soon
Josh
Try to remove the S2 switchport port-security:
interface FastEthernet0/1 no switchport port-security
-
Easy VPN with IPSec VPN L2L (Site - to - Site) in the same ASA 5505
Hi Experts,
We have an ASA 5505 in our environment, and currently two IPSec VPN L2L tunnels are established. But we intend to connect with VPN (Network Extension Mode) easy to another site as a customer. Is it possible to configure easy VPN configurations by keeping the currently active IPSec L2L VPN(Site-to-Site) tunnels? If not possible is there any work around?
Here's the warning we get then tried to configure the easy VPN Client.
NOCMEFW1 (config) # vpnclient enable
* Delete "nat (inside) 0 S2S - VPN"
* Detach crypto card attached to the outside interface
* Remove the tunnel groups defined by the user
* Remove the manual configuration of ISA policies
CONFLICT of CONFIG: Configuration that would prevent the Cisco Easy VPN Remo success
you
operation was detected and listed above. Please solve the
above a configuration and re - activate.
Thanks and greetings
ANUP sisi
"Dynamic crypto map must be installed on the server device.
Yes, dynamic crypto is configured on the EasyVPN server.
Thank you
-
PIX501 VPN PPTP: I have to browse the internet side remote via my VPN server
Hello
IM using PPTP for remote access to my server VPN, its power remotely connect to LAN, but I did not have Internet access on the remote side is that I need...
IM using windows PPTP client and he has to select the "use default gateway on remote network": but still does not.
Could you help me, thanks in advance
Rolando
6.3 (5) PIX version
interface ethernet0 car
interface ethernet1 100full
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
fixup protocol dns-length maximum 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
!
inside_access_in ip access list allow a whole
Note outside_access_in list of outdoor access
access-list outside_access_in allow icmp a whole
inside_outbound_nat0_acl ip access list allow any 192.168.1.200 255.255.255.248
pager lines 24
the history of logging alerts
ICMP allow all outside
Outside 1500 MTU
Within 1500 MTU
IP address outside of *. *. *. * 255.255.255.248
IP address inside 192.168.1.1 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
IP pool local remote_users 192.168.1.200 - 192.168.1.205
!
PDM logging 100 information
history of PDM activate
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_outbound_nat0_acl
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
Access-group outside_access_in in interface outside
inside_access_in access to the interface inside group
Route outside 0.0.0.0 0.0.0.0 *. *. *. *
Timeout xlate 0:05:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
AAA-server GANYMEDE + 3 max-failed-attempts
AAA-server GANYMEDE + deadtime 10
RADIUS Protocol RADIUS AAA server
AAA-server RADIUS 3 max-failed-attempts
AAA-RADIUS deadtime 10 Server
AAA-server local LOCAL Protocol
Enable http server
enable floodguard
Sysopt connection permit-pptp
Telnet timeout 5
SSH timeout 5
Console timeout 0
VPDN PPTP-VPDN-group accept dialin pptp
VPDN group PPTP-VPDN-GROUP ppp mschap authentication
VPDN group PPTP-VPDN-GROUP ppp encryption mppe auto
VPDN group configuration client PPTP-VPDN-GROUP address local remote_users
VPDN group VPDN GROUP-PPTP client configuration dns 200.57.2.108 200.57.7.61
VPDN group VPDN GROUP-PPTP pptp echo 60
VPDN group VPDN GROUP-PPTP client for local authentication
VPDN username * password *.
VPDN allow outside
VPDN allow inside
dhcpd address 192.168.1.100 - 192.168.1.199 inside
dhcpd dns 200.57.2.108 200.57.7.61
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd outside auto_config
dhcpd allow insideThe PIX cannot re - route traffic to the Internet because it's a feature supported on version 7.x and higher. You cannot execute code on PIX501 7.x.
You can send all traffic through the tunnel (for the PIX) and have the PIX route this traffic to a router internal (on the head), then rewritten the PIX to the Internet.
Federico.
Maybe you are looking for
-
How do I know the date purchased in the macbook pro?
How do I know the date purchased in the macbook pro?
-
Satellite S70 - B - graphic driver blocks using photoshop
Hello I bought my toshiba satellite s70 - b less than a month ago, but it's happened a few times, while using photoshop graphic processor, stops working and one of the people pop up at the bottom of the screen of messages indicates that the graphics
-
SATELLINE Pro A200: When headphones are plugged in sound comes through the speakers + headphones
I have problems when I plug my headphones in the headphone, sound comes through the headphones and speakers. He has not always done that, only for a few months and I have tried know how to solve this problem for a long time. Any help would be greatly
-
Publish with music is played over and over again.
I have windows 7, no matter what I do the music keeps playing the same play over and over again how to stop it I tried everything. its always on. It is the advertising and music. Where it is stored in the computer so I can remove it. Thank you
-
BlackBerry Smartphones IT policies to my Blackberry.
How long it will take to enable the IT policy on my blackberry. I noticed that every time a policy created/amended then on behalf of the company must be enabled manually.