assign fixed ip vpn?

Similar Questions

• Assign ACLs to VPN clients

  We have a client that VPN in a Pix 515. I inserted the configuration of intra-interface same-security-traffic allowed on the pix so that members of staff who use the VPN would be able to access a specific resource from the public side. What I would do is to continue to use the same-security-traffic intra-interface command permit, but restrict access to other resources to the VPN client. Can I assign an access list to the VPN client allowing 10.10.10.10 everything and refuse all other connections? Where can I insert this in the VPN structure?

  Thank you

  Yes.

  Kind regards

  Arul

  * Please note all useful messages *.

• I use a VPN in AirPort Express. I've updated firmware for 7.7.7 and DNS assigned by my VPN does not work anymore. Upon entry, the icon 'internet' in utility Airpot turns brown, and the internet stops completely. Anyone have any idea?

  Why my internet connection dies? I use a VPN to my internet at home. I put the DNS numbers supplied by the company VPN in my airPort extreme, which, in turn, provides wireless for home. It worked perfectly until I updated to firmware 7.7.7. Suddenly the green light next to the 'internet' in airport Utility icon went Brown, and it is therefore most all internet. I put numbers in DNS to my ISP, and internet provider is displayed again. All the other numbers in DNS, whether it's Google, OpenDNS or VPN to stop the dead from the internet. Anyone has an idea about this?

  Airport base stations, are at best, a VPN-well past that device. It is a server or a VPN client. Upgrade to the latest firmware does not change this fact.

  To create a VPN tunnel using the AirPort Express Terminal, your computer must be running a VPN client that connects to a VPN server somewhere on the Internet. What DNS servers you use should make no difference with VPN.

  If the ISP-supplied DNS servers do not work, I would say that you contact your ISP to find out why they don't allow you to use them.

  What we need to study is more why you lose Internet connectivity when changing the DNS servers of your ISP. Please check with them and to report back, then we can try to help.

• pix 501 vpn problem

  Can connect, I see not all network resources.

  The Vpn Client, worm: 5.0.01, is running on an xp machine.

  It connects to the network is behind a 6.3 (5) pix501-worm.

  When the connection is established the remote client gets an address assigned to the pool 192.168.2.10 vpn - 192.168.2.25:

  The vpn client log shows:

  Line: 45 18:07:27.898 12/08/09 Sev = Info/4 CM / 0 x 63100034

  The virtual card has been activated:

  IP=192.168.2.10/255.255.255.0

  DNS = 0.0.0.0 0.0.0.0

  WINS = 0.0.0.0 0.0.0.0

  Area =

  Split = DNS names

  It is followed by these lines:

  46 18:07:27.968 12/08/09 Sev = WARNING/2 CVPND/0xE3400013

  AddRoute cannot add a route: code 87

  Destination 192.168.1.255

  Subnet mask 255.255.255.255

  Gateway 192.168.2.1

  Interface 192.168.2.10

  47 18:07:27.968 12/08/09 Sev = WARNING/2 CM/0xA3100024

  Failed to add the route. Network: c0a801ff, subnet mask: ffffffff, Interface: c0a8020a Gateway: c0a80201.

  48 18:07:28.178 12/08/09 Sev = Info/4 CM / 0 x 63100038

  Were saved successfully road to file changes.

  49 18:07:28.198 12/08/09 Sev = Info/6 CM / 0 x 63100036

  The routing table has been updated for the virtual card

  50 18:07:29.760 12/08/09 Sev = Info/4 CM/0x6310001A

  A secure connection established

  * ...

  I can ping the remote client, on an inside ip behind the same pix

  When I get the 'route add failure' above, but I cannot ping the computer name.

  I activated traversal of NAT using the PDM, but when I connect with this option, I get the error that the "remote endpoint is NOT behind a NAT device this end is behind a NAT device" and ping fails.

  Behind the pix are a few computers with no central server, so I'm failed a WINS server for remote clients.

  I created the vpn with the wizard.

  The configuration file is attached.

  Any suggestion would be appreciated.

  Kind regards

  Hugh

  Hugh, sure you can classify based on the whole conversation, but you don't have to do but be certainly provide assessments.

  To sum up the shrinking global problems, the main objective was to ensure configuration VPN RA on the PIX501 has been corrected.

  1. we have enabled NAT - T on the firewall - even if it wasn't the question, but need it either it should you RA other places - travseral NAT VPN sensitizes the firewall on the other ends NAT devices - here is some good information on NAT - T for reference in the future

  http://www.Microsoft.com/technet/community/columns/cableguy/cg0802.mspx

  2. we fixed the VPN-POOL/28 network as well as the access list and acl to be coherent crypto sheep.

  Here is a link for future reference with many PIX configuration scenarios

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/prod_configuration_examples_list.html

  Finally, your only question remaining, we can say is purely isolated with the customer software vpn and MAC machine.

  You could maybe try a different version of the client in the MAC, or also look at the release notes for the open caveats to avoid cisco cleint managing versions and MAC versions if there are problems.

  http://www.Cisco.com/en/us/products/sw/secursw/ps2308/prod_release_notes_list.html

  Concerning

• IP address connection sets using the VPN Client

  Hello world. I'm using a VPN Client when I establish a VPN Tunnel with a 1600 router, and I have a question.

  Can I assign a fixed IP address in the client, instead the router send to random addresses from customer?

  What I would he do this?

  It would be in the configuration of the VPN client, or in the configuration of the router?

  If so, I'm doing this?

  Do I need another tool, or other software or hardware to do?

  any help is hope...

  Thank you...

  Hello

  I don't think that there is a simple way to do this.

  However, if you create a different groupname for the user who needs a static IP address, I think you should be good to go

  So what you need to do, create a new pool of addresses. Make the start and end ip address be the same (this is the address to which you want to assign to the VPN user)

  Configure another ipsec on the router group and bind the new pool to this group

  Ask your VPN client to connect to this group

  Hope that helps

  Jean Marc

• VPN client can get the gateway?

  I have a question for a long time.

  Cisco vpn client will find a gateway to the remote vpn server address.

  There are many situations in which we need a gateway assigned to the vpn client. If the customer can freely access all private networks.

  PIX of Cisco router has this feature?

  Why the customer would need a bridge tunnel?

  The customer already has a gateway of the ISP.

  Once the tunnel is up, if not to do split tunneling, all customer traffic will be sent on to the CONCENTRATOR's IPSec tunnel. So, indeed, the HUB is the default gateway.

  If you use the split tunneling, then your ACL will say what customer traffic must be encrypted on the tunnel on the hub. All other traffic is sent clear for the ISP. So, indeed, the HUB is the gateway for the LAN within the tunnel.

  There is a featur default on the 3000 gateway Tunnel, but that's for a different purpose

  http://www.ciscotaccc.com/security/showcase?case=K81543933

• Pool of dhcp NAT VPN to the LAN on router 2911

  I need nat the ips assigned by dhcp vpn to my LAN pool. My problem is that I do not know which interface to set my nat statement on since there is no interface that is in the same subnet as my dhcp pool. Any help would be appreciated.

  For remote client ipsec, you must have DVTI according to configuration described here:

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gtIPSctm...

  'use ip nat inside' on the virtual model and 'ip nat outside' on the inside of the interface.

  HTH

  Averroès.

• easy vpn mode configuration

  I am trying to understand...

  I have remote vpn clients to connect to a Pix 515E (outdoors) configure an IPSec tunnel (joining networks inside). This will be my first VPN.

  I've seen many examples of configurations it is possible to declare an ip pool to assign to clients vpn ip addresses not on the subnet of the pix inside the ip address (for example pix inside address is 172.16.0.1 and I can create and reference a vpn group a pool as the 192.168.1.0 - 192.168.1.254).

  My question is: how, guests will find their way to all networks behind the pix without a default gateway? I know Configuration Mode can assign to vpn clients from many settings (DNS/WINS ecc. ecc.) but impossible to assign a default gateway.

  I have a couple of multilayer switch behind pix' inside but how could they transmit packets for vpn clients if they have not any configuration of a default gateway?

  Thanks in advance for your help

  Customers need a default gateway, they simply use the routing on the PIX and other table later instrument that they get routed through to reach their destination.

  Think about what happens, using your IP addresses for example. The VPN client sends a packet encrypted for the PIX, this cover has a source address of 192.168.1.1 because this is the address he was allocated pool. The destination of this package is we will tell, 172.16.10.1, a server inside the PIX. The source address is not looked at anywhere, yet it is only the destination IP that we are interested in right now. So the PIX looks up to its routing table to see where the 172.16.10.1, he sends the inside interface to the next hop, based on its routing table. The next hop looks up where 172.16.10.1, sends it on the next hop based on its routing table. This continues until the package arrives to 172.16.10.1.

  Now, the response is returned to 192.168.1.1 (the VPN client), that's where the fun begins. This subnet exists anywhere on your network, it is purely a pool of addresses given by the PIX. This package must be routed to the PIX, then you must add a static on your network route so that whenever the package is, it will find its way to the PIX. It's generally as simple as adding a static route on the router directly connected to the PIX, then redistribute this road in any routing protocol that you are running. When this package for 192.168.1.1 comes to the PIX, the PIX is smart enough to know that it is a VPN client, it encrypts and sends it to the routable address customers everywhere where it is maybe.

  In short, yes you can define an IP subnet as your address on the PIX pool, provided that your internal network has a route to this network that eventually points back to the PIX. Nothing else to do, default gateways on the customer come in it.

• Static NAT with the road map for excluding the VPN

  We have problems of access to certain IPs NATted static via a VPN.  After some research, we have learned that you have to exclude traffic destined for the VPN to the static NAT using a road map. So we did this:

  10.1.1.x is the VPN IP pool.

  access-list 130 refuse ip 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255
  access-list 130 allow ip 192.168.1.0 0.0.0.255 any

  sheep allowed 10 route map
  corresponds to the IP 130

  IP nat inside source static 192.168.1.5 1.1.1.1 sheep map route

  Above worked to fix the VPN but the IP 192.168.1.5 is no longer publicly available via 1.1.1.1.  What seems to happen, is that the static NAT is not really work and this IP address is NATted with the IP of PAT.

  Any ideas on how to get this to work?

  Thank you
  Diego

  Hello

  The following example details exactly your case:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094634.shtml

  Try to replace the 192.168.1.0 subnet by the host address.

  It should work

  HTH

  Laurent.

• Road of default remote access VPN session

  ASA version 8.2.2

  How do you assign remote access VPN sessions a single default route?  Other than the default route assigned to ASA.  For example, my VPN ASA (handles vpn sessions), defaults to the Internet.  I wish that sessions VPN for remote access by default internal network first, then follow the default route to the Internet on another firewall.

  The SAA outside the IP address of the interface is a public.  Inside is a private 10.x.x.x.  VPN clients receive 172.17.x.x.

  Thank you

  After the command 'road' added keyword "tunnel".

  in the tunnel

  Specifies the route as the default gateway of tunnel for the VPN traffic.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/QR.html#wp1767323

• VPN connected but no visible network

  so I have a windows 7 (VPN server) desktop computer and a windows laptop 7 (VPN client) and I have set up the incoming VPN connection on my desktop and a client VPN connection on my laptop. When I go and establish a VPN connection, it says that I'm connected on my laptop and my desktop but I can't access my network resources. Ive been cracking as a result for a few weeks now and have gotten nowhere with it, any help would be greatly appreciated. Thank you!

  I can't access something like \\ServerName\ShareName I can't do a ping them either. address ranges are not the same on the server or client networks. the funny this is that it says I am connected at both ends, the customer declares that ipv4 has no internet access on the vpn which is fine because all I want is access to the network and it shows that I have an ip address assigned on the vpn map. side server but it is said that ipv4 and ipv6 are not connected, but if I do "ipconfig/all" he shows me his ip address on the vpn.

  client side, I've disabled 'Gateway on remote network use default' so that I can still have access to the internet on the im client that is connected to the vpn. on the side server, I tried selecting "Assign addresses automatically using DHCP" as well as "specify IP addresses (with a beach which is on the client and the server ip address range).» I have also "Allow the calling computer to specify its own IP address" selected on the server.

  When I finally fell a VPN server on a Vista box I got the address assigned to the configuration of clients like that.

  http://theillustratednetwork.MVPs.org/Vista/PPTP/VPNSetup06.jpg

  The address range was the same that the server of the LAN address range, in this case, I used 192.168.10.X on the local network.

  http://theillustratednetwork.MVPs.org/Vista/PPTP/ExampleVistaVPNNetwork.PDF

  Customer recevrait.31 ou.32...

  Of course assumed that the customer was or would not be on a LAN 192.168.10.X to start. If it was so I could have problems connecting to shares on my LAN Server.

  MS - MVP Windows Desktop Experience
  "When all else fails try what the captain suggested before you started...". »

• help with 2 concurrent internal users trying to VPN (Cisco s/w) at extern

  Hi all

  We are a small office running Small Business Server 2003 - which means that we miss the ISA 2004 firewall.

  An external company provided us with the Cisco VPN (ver403a) software to access their site web network / secure.

  One user could connect to the network of the company for some time. It was working fine until two users tried to connect at the same time - using the same VPN user ID. We have learned by the company that it should work, but it just isn't so we asked a second VPN user ID to test with.

  Now what happens is that the user has to connect with success and user B can connect successfully at the same time however even if user B is connected, and you see even an IP assigned to the VPN adapter, the user can not ping the company website and then of course can not access it. Very strange indeed!

  I went back to the company and told her about our dilemma and we were told that there is nothing at their end, but a problem of Routing/NAT at our end. So here, I'm now looking for help I hope that some experts from Cisco. :-)

  Appropriate, the ports were opened in ISA and once again the two users will connect to the VPN very well, it's just that the second user can? t go further.

  It was suggested to me that is maybe not a routing problem, but that Cisco VPN server/box the company rejects the second connection because it comes from the same IP address - that would be the IP address of our ISA Server external network card.

  If anyone has any suggestions on how to solve this problem, I would be so grateful!

  Thank you very much.

  Tammy

  VPN configuration multiple tunnels for the same device (same public IP address) is not possible because it is not possible to have several (SA) IPsec Security Association for the same position. However, it is possible to configure multiple VPN tunnels to multiple devices. In your case, if your client PC using public IP addresses, they both can simultaneously connect to the remote vpn server. However if you are using a single public IP address so it is not possible to have mutiple vpn connections. If you have only a single ip address of your ISP then it would have to do PAT and you will be not able to have the two vpn clients to connect to even

  time.

• Routing of traffic for a specific user through vpn Ipsec

  I want to route traffic to a specific host on the internet through our external interface (for example, 7.7.7.0/27) instead of the internet connection of the client (for example 9.9.9.9).

  I have already added 9.9.9.9 in the split dns acl so that the road is inserted on the client workstation and a default route on the external interface is defined as follows:

  CISCOASA # run HS | I have the route outside

  Route outside 0.0.0.0 0.0.0.0 7.7.7.30 1

  Nat config

  object obj-InsideNetworks network

  NAT 7.7.7.3 Dynamics (indoor, outdoor)

  No nat

  NAT (inside, all) source static obj-InsideNetworks obj-InsideNetworks destination DEST-Interior-SHEEP inside-DEST-SHEEP no-proxy-arp static

  object obj-InsideNetworks network

  range 10.0.1.0 10.0.255.255

  object-group network inside-DEST-SHEEP

  network-object 10.0.3.0 255.255.255.0

  object-network 10.0.2.0 255.255.255.0

  object-network 10.10.10.0 255.255.255.0

  object-network 10.0.4.0 255.255.255.128

  The static IP assigned to the vpn client is 10.0.4.150 if it is not the scope of the Interior-DEST-SHEEP.  If again I traceroute

  9.9.9.9 when connected, I get the first bond 7.7.7.1 and it stops there.

  Would appreciate any help on this.

  Hello

  If you try to NAT the VPN user traffic when it connects to the Internet through the ASA NAT configuration so that the user should then be

  network of the VPN-CLIENT-PAT object

  subnet 10.0.4.128 255.255.255.128

  dynamics of NAT (outdoors, outdoor)

  Insert the dynamic PAT public IP in the above configuration. You can either use "interface" parameter to use the public IP address of ASAs or insert a detached public IP address that can be used. I guess the Pool of VPN uses the 10.0.4.128/25 subnet.

  You must also make sure you have the following configuration enabled

  permit same-security-traffic intra-interface

  You can check with

  See the race same-security-traffic

  Note that there is another similar parameter that ends in "inter-interface" who used to work for this situation.

  Hope this helps

  Let me know if make you it work

  -Jouni

• l2l ASA vpn issues

  Hi all

  I have two firewalls that I'm trying to implement VPNs l2l between them. Once of them is an old wall of sonic and the other 5505.

  I put in all and ends the phase 1/2 and the tunnel rises however no traffic passes through

  Here is my configuration

  ASA (outside, 192.168.30.1) asa internal 192.168.10.0/25

  (Outside 192.168.30.2) SonicWALL sonicwall 192.168.20.0/24

  I have an accesslist that is configured on the asa and applied to the cypto card using card crypto XXXX 1, atch address YYY

  However when I watch the news ebugging on the console it says: "cannot locate the output for UDP of XXXX interface: 192.168.10.10/1 to 192.178.20.1/0.

  any ideas why this is?

  I just need a static route to say all traffic on asa with 192 source... 10.0 should go through 192.168.30.2?

  I guess it's the work of crypto card

  Am I wrong?

  Hello

  Begins to seems to me you have a filter ACL configured for your L2L VPN VPN and also the ACL filter of VPN and Crypto ACLs are the same things, which means you use a simple both ACL.

  Why I think it's like this is the fact that you say that your VPN L2L cross trading in the "packet-tracer" VPN Phase means Crypto VPN L2L ACL was correct. At the same time say you that the connection was stopped to the Phase of the VPN USER. He points to a VPN filter ACL being configured.

  In view of the foregoing, I also know that the ACL of filter for the L2L VPN behave with a logic different than typical ACL interface. In VPN L2L the ACL filter ALWAYS mention the remote network as the source ALWAYS and your Local network as the destination.

  If add you an ACL rule with order switched networks appears this fixes the VPN filter ACL problems and finally allowed traffic. Naturally I can only guess that I saw actual configurations at this point (which, usually with release "packet - trace", help to solve a problem faster just guessing)

  If you indeed filter VPN, you may be able to track him down with the following commands

  See the tunnel-group race

  Check if a "group policy" is defined then the command

  See establishing group policy enforcement

  This output should list the name of the ACL filter VPN if its game

  Regarding the installantion auto road. The default setting for ASA, is that it will create NO static routes automatically depending on the VPN configurations. This must be enabled manually in "crypto map" configurations, or you can configure static routes manually.

  ASA tracking to default TCP and UDP connections. ICMP is inspected only if his permit. By default, it is NOT inspected.

  Hope this helps

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary.

  -Jouni

• Remote access VPN with ASA 5510 by using the DHCP server

  Hello

  Can someone please share your knowledge to help me find out why I'm not able to receive an IP address on the remote access VPN connection so that I can get an IP local pool DHCP?

  I'm trying to set up remote access VPN with ASA 5510. It works with dhcp local pool but does not seem to work when I tried to use an existing DHCP server. It is tested in an internal network as follows:

  !

  ASA Version 8.2 (5)

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  IP 10.6.0.12 255.255.254.0

  !

  IP local pool testpool 10.6.240.150 - 10.6.240.159 a mask of 255.255.248.0. (worked with it)

  !

  Route inside 0.0.0.0 0.0.0.0 10.6.0.1 1

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto-map dynamic dyn1 1jeu transform-set FirstSet

  dynamic mymap 1 dyn1 ipsec-isakmp crypto map

  mymap map crypto inside interface

  crypto ISAKMP allow inside

  crypto ISAKMP policy 1

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 43200

  !

  VPN-addr-assign aaa

  VPN-addr-assign dhcp

  !

  internal group testgroup strategy

  testgroup group policy attributes

  DHCP-network-scope 10.6.192.1

  enable IPSec-udp

  IPSec-udp-port 10000

  !

  username testlay password * encrypted

  !

  tunnel-group testgroup type remote access

  tunnel-group testgroup General attributes

  strategy-group-by default testgroup

  DHCP-server 10.6.20.3

  testgroup group tunnel ipsec-attributes

  pre-shared key *.

  !

  I got following output when I test connect to the ASA with Cisco VPN client 5.0

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: (4) SA (1) + KE + NUNCIO (10) + ID (5), HDR + VENDO

  4024 bytesR copied in 3,41 0 seconds (1341 by(tes/sec) 13) of the SELLER (13) seller (13) + the SELLER (13), as well as the SELLER (13) ++ (0) NONE total length: 853

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, SA payload processing

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ISA_KE

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, nonce payload processing

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received xauth V6 VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, DPD received VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received Fragmentation VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received NAT-Traversal worm 02 VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, the customer has received Cisco Unity VID

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, connection landed on tunnel_group testgroup

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA payload processing

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA proposal # 1, turn # 9 entry overall IKE acceptable matches # 1

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build the payloads of ISAKMP security

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building ke payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building nonce payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for answering machine...

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of payload ID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of Cisco Unity VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing payload V6 VID xauth

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building dpd vid payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing the payload of the NAT-Traversal VID ver 02

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of Fragmentation VID + load useful functionality

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, send Altiga/Cisco VPN3000/Cisco ASA GW VID

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR SA (1) KE (4) NUNCIO (10) + ID (5) + HASH (8) + SELLER (13) + the SELLER (13) + the SELLER (13) + the SELLER (13) NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) total length: 440

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + HASH (8) + NOTIFY (11) + NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) overall length: 168

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, useful treatment IOS/PIX Vendor ID (version: 1.0.0 capabilities: 00000408)

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, the customer has received Cisco Unity VID

  Jan 16 15:39:21 [IKEv1]: Group = testgroup, I

  [OK]

  KenS-mgmt-012 # P = 10.15.200.108, status of automatic NAT detection: remote end is NOT behind a NAT device this end is NOT behind a NAT device

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, empty building hash payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash qm

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 72

  Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 87

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): enter!

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, transformation MODE_CFG response attributes.

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = authorized

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = authorized

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized primary WINS

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized secondary WINS

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Compression IP = disabled

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling political = disabled

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: setting Proxy browser = no - modify

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: browser Local Proxy bypass = disable

  Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, (testlay) the authenticated user.

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

  Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 64

  Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + NONE (0) overall length: 60

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cfg ACK processing attributes

  Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 49ae1bb8) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 182

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, treatment cfg request attributes

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 address!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 network mask!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for DNS server address.

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the address of the WINS server.

  Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, transaction mode attribute unhandled received: 5

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the banner!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting save PW!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: receipt of request for default domain name!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for Split-Tunnel list!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for split DNS!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for PFS setting!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Proxy Client browser setting!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the list of backup peer ip - sec!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting disconnect from the Client Smartcard Removal!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Version of the Application.

  Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Type of Client: Windows NT Client Application Version: 5.0.07.0440

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for FWTYPE!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: request received for the DHCP for DDNS hostname is: DEC20128!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the UDP Port!

  Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

  Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = b04e830f) with payloads: HDR + HASH (8) + NOTIFY (11) + (0) NONE total length: 84

  Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload

  Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload

  Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE has received the response from type [] at the request of the utility of IP address

  Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cannot get an IP address for the remote peer

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE TM V6 WSF (struct & 0xd8030048) , : TM_DONE, EV_ERROR--> TM_BLD_REPLY, EV_IP_FAIL--> TM_BLD_REPLY NullEvent--> TM_BLD_REPLY, EV_GET_IP--> TM_BLD_REPLY, EV_NEED_IP--> TM_WAIT_REQ, EV_PROC_MSG--> TM_WAIT_REQ, EV_HASH_OK--> TM_WAIT_REQ, NullEvent

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE AM Responder WSF (struct & 0xd82b6740) , : AM_DONE, EV_ERROR--> AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL--> AM_TM_INIT_MODECFG_V6H NullEvent--> AM_TM_INIT_MODECFG, EV_WAIT--> AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG--> AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK--> AM_TM_INIT_XAUTH_V6H NullEvent--> AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b ending: 0x0945c001, refcnt flags 0, tuncnt 0

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending clear/delete with the message of reason

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing the payload to delete IKE

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

  Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 9de30522) with payloads: HDR HASH (8) + DELETE (12) + (0) NONE total length: 80

  Kind regards

  Lay

  For the RADIUS, you need a definition of server-aaa:

  Protocol AAA - NPS RADIUS server RADIUS

  AAA-server RADIUS NPS (inside) host 10.10.18.12

  key *.

  authentication port 1812

  accounting-port 1813

  and tell your tunnel-group for this server:

  General-attributes of VPN Tunnel-group

  Group-NPS LOCAL RADIUS authentication server

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni