Authenicating of an Cisco 1250 with IAS

Similar Questions

• Cisco Jabber with Cisco multi-party Shared more Licenses

  Hello

  I'm looking for a Solution to video conference for approximately 4000 employees. Currently the customer uses Cisco's Jabber for video calls from point to point. The main requirement is Ad - Hoc videoconferencing by any employee at any time. I looked at both meeting of Cisco and Cisco TelePresence Server server. The two solution requires more or licenses more pluralistic multi-party Personal shared. The customer won't buy a PMP license for each user. Their requirement is multimedia resources shared so that any employee can initiate an ad hoc conference.

  Now the question is: can we use Cisco Jabber with multiparty licensing shared?

  Thank you

  Mockus S

  Yes, it is quite possible.

  The only singularity is with PMP + which applied slightly differently than the head of the Orchestra/vTS. This does not seem to match your use case since you intend to buy only SMP licenses +. From version 2.0 (1) CMS, PMP + licenses - which are less expensive than SMP + - use only if: a) the space belongs to a LDAP user with a PMP + license for which they are responsible; or (b) If a user LDAP with PMP + assigned to them joins the Cisco meeting App space as an authenticated user. In all other scenarios, including ad-hoc escalation with CUCM licensed SMP + is consumed. This is different from that of head of the Orchestra/vTS, which were also able to understand the right to the user for ad-hoc calls.

• Cisco Jabber with VCS

  Hello

  I VCSC and TMS in the network, there are of the endpoints configured with SIP and H323. VCSC are not in the field.

  Now we have to enter Cisco Jabber with the VCSC. What are prerequisites them?

  First it requires license for Cisco Jabber on VCSC?

  We need to join the VCSC domain?

  Our VCSC is version 6.1 and TMS is 13.

  TNX

  Bobby

  Yes, you will still be able to authenticate users JabberVideo locally, 'right', you won't be able to use NTLM.

  Also take a look at the TMS Provisioning Deployment Guide:

  http://www.Cisco.com/en/us/docs/Telepresence/infrastructure/TMS/config_guide/Cisco_TMS_Provisioning_Deployment_Guide_13-0.PDF

  /Jens

• Authentication WLAN with IAS and BSSID

  I have an AP active BSSID and all virtual LAN clients must be authenticated on an IAS server. On the server, VLANs must be mapped to different remote access policies. I wasn't able to find any command for the "group of aaa Server" configuration, which adds an attribute that allows the server select the correct remote access policy.

  Nobody knows answer (without using the addresses of different source for application of aaa)

  How do you have your political configuration in IAS?

  Here are links with examples to configure a remote access policy based on VLAN:

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml

  http://www.TechIMO.com/Forum/blogs/groundzero3/272-Cisco-4404-IAS-2003-dynamic-VLANs.html

  http://www.pskl.us/WP/?p=125

  http://TechNet.Microsoft.com/en-us/library/cc786581 (WS.10) .aspx

• Cisco 1250 and AIR-ANT5959

  Hi all

  Ordering Guide 1250 Cisco indicates that AIR-ANT5959 can be used for 2.4 radio concert.

  1250 AP provides 3 connectors for dipole antennas but AIR-ANT5959 spec indicates that it comes with 2 BNC connectors. Are that we assume a dipole to stick on the rest connector? If this is the case, how can we identify which is the TX and RX, you can connect the AIR-ANT5959 to the respective radio without the performance impact? Any help much appreciated.

  see you soon,

  Andrée

  Hi Jean Miche,.

  The connectors on the side of the 1250 are the connectors of the transmission. Then, left and right. Way is not to ' receive '.

  So if you want to connect a 2 antenna connectors like the 5959, you need to plug it into the connectors on the left and right (the order is not important).

  Be aware that you lose the ability MIMO antenna being diversity and no MIMO.

  So for the IOS ap, you need to configure "antenna diversity of transmission" and "antenna receive diversity". That will prevent your 11n rate but works perfectly.

  WLC APs can be the same configured in the configuration of the AP WLC. You simply specify what a diversity antenan plugged into left/right only.

  Connecting a different antenna on intermediate connector would be a mistake because 3 antennas is used only in the case of MIMO and you cannot reach with a diversity antenna MIMO + another antenna on the middle connector.

  I hoep this helps, s

  Nicolas

  ===

  Please note the answers that will help you

• Need help - Cisco ASA with the power of fire

  Hello

  Currently, we use asa 5510 without function of firepower. Our goal is to publish web servers and microsoft lync with reverse proxy method. control internet traffic, apply extensions individual file not to download, management of bandwidth etc.

  Is it possible if we add firepower on asa 5510... Please guide me... Thank you

  Power of fire must be installed on the new series X of the SAA.  5512 x, x 5515, 5525 x, etc.

  If you have a 5510, you probably want a 5512 x with an SSD.  Cisco has beams of firepower include the ASAx with SSD and the license of firepower.

  Adds that you must also Firesight management software, and there is a license bundle of 2 camera for under $ 500 that you can install on VMWare.

  Firepower is not reverse proxy, it's transparent online packages, analysis and filtering by URL / Application / and threat mitigation.

  If you want a reverse proxy, you should look into Microsoft ISA server or a Proxy Server reverse dedicated Web.  Cisco gave its product Web Director, who has done this function.

  You can host Web sites behind a firewall of ASA without proxy reverse.  And the ASA has an inspection of the request for HTTP traffic, responsible for watching HTTP requests.  The firepower to the ASA system also has specific signatures that monitor traffic to the web servers and prevent specific vulnerabilities that are known on those servers, so if that is what you want the Reverse Proxy for, then the power of fire module would probably cover your needs.

  Don't forget that until the next quarter firepower system has no decryption on the box, and you might want to wait that the feature is released and put in place, so that you know what size firewall you need protect your network with the SSL decryption.  I believe that the ASA5512x is testing at 75 Mbps stream decrypted via the fire power module, which is about half of what was before CX, then you could use the sizing numbers CX and extrapolate until Cisco releases official decryption numbers.

• Cisco ISE with GANYMEDE + and RADIUS both?

  Hello

  I'm wired opening of authentication on a network using Cisco ISE. I studied the conditions for this. I know that I need to enable the RADIUS on the Cisco switches on the network. The switches in the network are already programmed to GANYMEDE +. Anyone know if they can both operate on the same network at the same time?

  Bob

  I suppose that Ganymede is configured (with ACS 4.x or 5.x) for the peripheral administration via telnet/ssh, and now you need the RADIUS (radius) to authenticate 802. 1 x. Yes they can both work on the same network at the same time.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• Œuvres Cisco WLSE with 1130AG

  We will deploy a wireless solution using the Access Point 1130AG (AIR-AP1131AG-A-K9) with Cisco WLSE works (CWWLSE-1030-K9).

  The questions are:

  Are there recommendations for the location of Cisco WLSE to work in this building? Furthermore, the building has five floors and each floor has access switch that supports PoE with empty ports Giga?

  Second, how many access points are recommended on each floor, floor size is 37.5 x 24 m ^ 2. And all floors are identical in the nature of the building (Council Jobson partition) and the number of users?

  Thank you

  HASSAN

  Hassan:

  First of all, the WLSE is like any other server platform, so anywhere with a suitable environment (power/UPS cool, decent, connectivity) should be OK.

  About the recommendations on APs how much and where to put em... Well, which is much more difficult.

  The only sure answer is that depends on the outcome of an investigation on the right site.

  There are so many variables to any given environment, and they are almost always different, that a response may be the result of pure speculation. Which means that is usually guess the right side and overspecifying the solution.

  Even then, there are some unknown factors that you can only get with a poll on the site (such as interference... channels used by your neighbors, prospective multipath, dead & such areas).

  If you do not know how to make a good site survey, he would pay to hire someone who is long term. It is certainly an additional expense from the start, but the final deployment will be more likely to work in your / your customer expectations.

  Once the system is installed, you can make a few tweaks and adjustments according to the measurements reported on the WLSE, but the primary configuration should not be based on a "good guess."

  The number of users per access point is also slightly variable according to the type of application and the expected user traffic.

  I saw thirty users as an absolute maximum, with as little as ten for use of heavy traffic. Generally speaking, somewhere 20 users per AP for common use would be a reasonable number.

  If you have users or systems that will use the 802. 11 b, this number could be lower, since the PA must make accommodations for using 802. 11B and 802.11 g.

  More details would be useful, but without a good site survey, no one can really give you a firm answer.

  Good luck

  Scott

• Cisco SPA with problem of DHCP Options 66

  Dear all,

  I have a problem of my phone Cisco SPA for the autodeploiement.

  If I manually enter the page configuration and paste "[- pwd - password user uid] http:///dms/def/spa$PSN.cfg" in the profile rule. Everything works perfectly.

  However, we would like to do in the provision of zero touch, I add the "[- pwd - password user uid] http:///dms/def/spa$PSN.cfg"DHCP Options 66. " The SPA phone seems impossible to get the 66 Options parameter. It shows that "/ spa$ PSN.cfg" in the rule of profiles.

  I'm sure that the DHCP server works perfectly.

  Can anyone help on this?

  Kind regards

  Desmond

  You cannot use the custom during initial deployment (zero touch) password. DHCP can be used to deliver key to the device in this way.

  Ok. What are the options you have?

  You my use of the configuration file, compiled with SPC type -target option. It encrypt the file by using the password from each device Mac so you need no password given to the device - device can calculate the password required their Mac. It provides just basic security level - insensitive user, like me, know the algorithm used for password generation so that it can calculate the password and decrypt the file.

  You can use HTTPS with mutual certificate authentication to deliver XML or SPC configuration form. All phones have the unique client certificate, then you can be sure that the request has been issued by the unit. It offers a high level of security.

  There are also a few other possibilities, but disclosed so that information on the goal you want to hit, so I can't list.

  Just note that DHCP will meet anyone, in addition, the answer may broadcast (therefore handed to anyone, even without prior request). If you deliver critical data via DHCP, you can consider them publicly available. Security resulting is without security.

• Cisco ucs with VMware 5 auto deploy

  Hello

  In our lab, I test with 5 VMware and Cisco UCS. We run UCSM 2.0 (1 m). I am now to test the auto hand deploy. I have auto configuration to deploy in VMware and it works (first of all, I had some problems with DHCP on windows which is solved in version 2.0 of UCSM (q)). vSphere gets deployed to the blade. When the blade (vShpere) wants to connect to vCenter I get an error of vCenter has enough licesing for this action. I loaded a lot of low-income VMware. When I create a virtual machine, it starts perfectly and apears in vCenter.

  I search on the internet for people who have the problem of the simailer, but could not find.

  Some body the same problem our help me?

  Thanks in advance,

  Robin

  Robin,

  This looks more like a VC related question (UCS) platform.  UCS has no effect on the functionality of licenses of the VC.

  If the host does not connect to the CR, how are you VMs to "start perfectly and appear in vCenter?

  Kind regards

  Robert

• Problem Cisco 2811 with L2TP IPsec VPN

  Hello. Sorry for my English. Help me please. I have problem with L2TP over IPsec VPN when I connect with Android phones. Even if I connect with laptop computers. I have Cisco 2811 - Cisco IOS software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4 (2) T2, (fc3) SOFTWARE VERSION. I configured on L2TP over IPsec VPN with Radius Authentication

  My config:

  !
  AAA new-model
  !
  !
  AAA authentication login default local
  Ray of AAA for authentication ppp default local group
  AAA authorization network default authenticated if
  start-stop radius group AAA accounting network L2TP_RADIUS

  !
  dhcp L2tp IP pool
  network 192.168.100.0 255.255.255.0
  default router 192.168.100.1
  domain.local domain name
  192.168.101.12 DNS server
  18c0.a865.c0a8.6401 hexagonal option 121
  18c0.a865.c0a8.6401 hexagonal option 249

  VPDN enable
  !
  VPDN-group sec_groupe
  ! Default L2TP VPDN group
  accept-dialin
  L2tp Protocol
  virtual-model 1
  no authentication of l2tp tunnel

  session of crypto consignment
  !
  crypto ISAKMP policy 5
  BA 3des
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 55
  BA 3des
  md5 hash
  preshared authentication
  Group 2

  ISAKMP crypto key... address 0.0.0.0 0.0.0.0
  invalid-spi-recovery crypto ISAKMP
  ISAKMP crypto keepalive 10 periodicals
  !
  life crypto ipsec security association seconds 28000
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac L2TP
  transport mode
  Crypto ipsec transform-set esp-3des esp-md5-hmac 3DESMD5
  need transport mode
  !

  !
  !
  crypto dynamic-map DYN - map 10
  Set nat demux
  game of transformation-L2TP
  !
  !
  Crypto map 10 L2TP-VPN ipsec-isakmp dynamic DYN-map

  interface Loopback1
  Description * L2TP GateWay *.
  IP 192.168.100.1 address 255.255.255.255

  interface FastEthernet0/0
  Description * Internet *.
  address IP 95.6... 255.255.255.248
  IP access-group allow-in-of-wan in
  IP access-group allows-off-of-wan on
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NAT outside IP
  IP virtual-reassembly
  IP route cache policy
  automatic duplex
  automatic speed
  L2TP-VPN crypto card
  !

  interface virtual-Template1
  Description * PPTP *.
  IP unnumbered Loopback1
  IP access-group L2TP_VPN_IN in
  AutoDetect encapsulation ppp
  default IP address dhcp-pool L2tp peer
  No keepalive
  PPP mtu Adaptive
  PPP encryption mppe auto
  PPP authentication ms-chap-v2 callin
  PPP accounting L2TP_RADIUS

  L2TP_VPN_IN extended IP access list
  permit any any icmp echo
  IP 192.168.100.0 allow 0.0.0.255 192.168.101.0 0.0.0.255
  IP 192.168.100.0 allow 0.0.0.255 192.168.3.0 0.0.0.255
  allow udp any any eq bootps
  allow udp any any eq bootpc
  deny ip any any journal entry

  RADIUS-server host 192.168.101.15 auth-port 1812 acct-port 1813
  RADIUS server retry method reorganize
  RADIUS server retransmit 2
  Server RADIUS 7 key...

  Debugging shows me

  234195: * 3 Feb 18:53:38: ISAKMP (0:0): received 93.73.161.229 packet dport 500 sport 500 SA NEW Global (N)
  234196: * 3 Feb 18:53:38: ISAKMP: created a struct peer 93.73.161.229, peer port 500
  234197: * 3 Feb 18:53:38: ISAKMP: new position created post = 0x47D305BC peer_handle = 0x80007C5F
  234198: * 3 Feb 18:53:38: ISAKMP: lock struct 0x47D305BC, refcount 1 to peer crypto_isakmp_process_block
  234199: * 3 Feb 18:53:38: ISAKMP: 500 local port, remote port 500
  234200: * 3 Feb 18:53:38: insert his with his 480CFF64 = success
  234201: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  234202: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_READY = IKE_R_MM1
  234203: * 3 Feb 18:53:38: ISAKMP: (0): treatment ITS payload. Message ID = 0
  234204: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234205: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  234206: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234207: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 164
  234208: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234209: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
  234210: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is NAT - T v2
  234211: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234212: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 221
  234213: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234214: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
  234215: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234216: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is DPD
  234217: * 3 Feb 18:53:38: ISAKMP: (0): looking for a key corresponding to 93.73.161.229 in default
  234218: * 3 Feb 18:53:38: ISAKMP: (0): success
  234219: * 3 Feb 18:53:38: ISAKMP: (0): pair found pre-shared key matching 93.73.161.229
  234220: * 3 Feb 18:53:38: ISAKMP: (0): pre-shared key local found
  234221: * 3 Feb 18:53:38: ISAKMP: analysis of the profiles for xauth...
  234222: * 3 Feb 18:53:38: ISAKMP: (0): audit ISAKMP transform 1 against policy priority 5
  234223: * 3 Feb 18:53:38: ISAKMP: type of life in seconds
  234224: * 3 Feb 18:53:38: ISAKMP: life (basic) of 28800
  234225: * 3 Feb 18:53:38: ISAKMP: 3DES-CBC encryption
  234226: * 3 Feb 18:53:38: ISAKMP: pre-shared key auth
  234227: * 3 Feb 18:53:38: ISAKMP: SHA hash
  234228: * 3 Feb 18:53:38: ISAKMP: group by default 2
  234229: * 3 Feb 18:53:38: ISAKMP: (0): atts are acceptable. Next payload is 3
  234230: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234231: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  234232: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234233: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 164
  234234: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234235: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
  234236: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is NAT - T v2
  234237: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234238: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 221
  234239: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234240: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
  234241: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
  234242: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is DPD
  234243: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  234244: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM1

  234245: * 3 Feb 18:53:38: ISAKMP: (0): built the seller-02 ID NAT - t
  234246: * 3 Feb 18:53:38: ISAKMP: (0): lot of 93.73.161.229 sending my_port 500 peer_port 500 (R) MM_SA_SETUP
  234247: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  234248: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM2

  234249: * 3 Feb 18:53:38: ISAKMP (0:0): received 93.73.161.229 packet 500 Global 500 (R) sport dport MM_SA_SETUP
  234250: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  234251: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_R_MM2 = IKE_R_MM3

  234252: * 3 Feb 18:53:38: ISAKMP: (0): processing KE payload. Message ID = 0
  234253: * 3 Feb 18:53:38: crypto_engine: create DH shared secret
  234254: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_DH_SHARE_SECRET (hw) (ipsec)
  234255: * 3 Feb 18:53:38: ISAKMP: (0): processing NONCE payload. Message ID = 0
  234256: * 3 Feb 18:53:38: ISAKMP: (0): looking for a key corresponding to 93.73.161.229 in default
  234257: * 3 Feb 18:53:38: ISAKMP: (0): success
  234258: * 3 Feb 18:53:38: ISAKMP: (0): pair found pre-shared key matching 93.73.161.229
  234259: * 3 Feb 18:53:38: crypto_engine: create IKE SA
  234260: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_SA_CREATE (hw) (ipsec)
  234261: * 3 Feb 18:53:38: ISAKMP: receives the payload type 20
  234262: * 3 Feb 18:53:38: ISAKMP: receives the payload type 20
  234263: * 3 Feb 18:53:38: ISAKMP (0:5912): NAT found, the node outside NAT
  234264: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  234265: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM3 = IKE_R_MM3

  234266: * 3 Feb 18:53:38: ISAKMP: (5912): lot of 93.73.161.229 sending my_port 500 peer_port 500 (R) MM_KEY_EXCH
  234267: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  234268: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM3 = IKE_R_MM4

  234269: * 3 Feb 18:53:38: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) MM_KEY_EXCH sport
  234270: * 3 Feb 18:53:38: crypto_engine: package to decipher IKE
  234271: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
  234272: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  234273: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM4 = IKE_R_MM5

  234274: * 3 Feb 18:53:38: ISAKMP: (5912): payload ID for treatment. Message ID = 0
  234275: * 3 Feb 18:53:38: ISAKMP (0:5912): payload ID
  next payload: 8
  type: 1
  address: 192.168.1.218
  Protocol: 17
  Port: 500
  Length: 12
  234276: * 3 Feb 18:53:38: ISAKMP: (5912): peer games * no * profiles
  234277: * 3 Feb 18:53:38: ISAKMP: (5912): HASH payload processing. Message ID = 0
  234278: * 3 Feb 18:53:38: crypto_engine: hash generate IKE
  234279: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
  234280: * 3 Feb 18:53:38: ISAKMP: (5912): SA authentication status:
  authenticated
  234281: * 3 Feb 18:53:38: ISAKMP: (5912): SA has been authenticated with 93.73.161.229
  234282: * 3 Feb 18:53:38: ISAKMP: (5912): port detected floating port = 4500
  234283: * 3 Feb 18:53:38: ISAKMP: attempts to insert a peer and inserted 95.6.../93.73.161.229/4500/ 47D305BC successfully.
  234284: * 3 Feb 18:53:38: ISAKMP: (5912): IKE_DPD is enabled, the initialization of timers
  234285: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  234286: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM5 = IKE_R_MM5

  234287: * 3 Feb 18:53:38: ISAKMP: (5912): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
  234288: * 3 Feb 18:53:38: ISAKMP (0:5912): payload ID
  next payload: 8
  type: 1
  address: 95.6...
  Protocol: 17
  Port: 0
  Length: 12
  234289: * 3 Feb 18:53:38: ISAKMP: (5912): the total payload length: 12
  234290: * 3 Feb 18:53:38: crypto_engine: hash generate IKE
  234291: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
  234292: * 3 Feb 18:53:38: crypto_engine: package to encrypt IKE
  routerindc #.
  234293: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT (hw) (ipsec)
  234294: * 3 Feb 18:53:38: ISAKMP: (5912): lot of 93.73.161.229 sending peer_port my_port 4500 4500 (R) MM_KEY_EXCH
  234295: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  234296: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

  234297: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
  234298: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  234299: * 3 Feb 18:53:38: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) QM_IDLE sport
  234300: * 3 Feb 18:53:38: ISAKMP: node set-893966165 to QM_IDLE
  234301: * 3 Feb 18:53:38: crypto_engine: package to decipher IKE
  234302: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
  234303: * 3 Feb 18:53:38: crypto_engine: hash generate IKE
  234304: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
  234305: * 3 Feb 18:53:38: ISAKMP: (5912): HASH payload processing. Message ID =-893966165
  234306: * 3 Feb 18:53:38: ISAKMP: (5912): treatment protocol NOTIFIER INITIAL_CONTACT 1
  SPI 0, message ID =-893966165, his 480CFF64 =
  234307: * 3 Feb 18:53:38: ISAKMP: (5912): SA authentication status:
  authenticated
  234308: * 3 Feb 18:53:38: ISAKMP: (5912): process of first contact.
  dropping existing phase 1 and 2 with 95.6 local... 93.73.161.229 remote remote port 4500
  234309: * 3 Feb 18:53:38: ISAKMP: (5912): node-893966165 error suppression FALSE reason 'informational (en) State 1.
  234310: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
  234311: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  234312: * 3 Feb 18:53:38: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
  234313: * 3 Feb 18:53:39: % s-6-IPACCESSLOGRL: registration of limited or missed rates 150 packages of access list
  234314: * 3 Feb 18:53:39: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) QM_IDLE sport
  234315: * 3 Feb 18:53:39: ISAKMP: node set-1224389198 to QM_IDLE
  234316: * 3 Feb 18:53:39: crypto_engine: package to decipher IKE
  234317: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
  234318: * 3 Feb 18:53:39: crypto_engine: hash generate IKE
  234319: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
  234320: * 3 Feb 18:53:39: ISAKMP: (5912): HASH payload processing. Message ID =-1224389198
  234321: * 3 Feb 18:53:39: ISAKMP: (5912): treatment ITS payload. Message ID =-1224389198
  234322: * 3 Feb 18:53:39: ISAKMP: (5912): proposal of IPSec checking 1
  234323: * 3 Feb 18:53:39: ISAKMP: turn 1, ESP_3DES
  234324: * 3 Feb 18:53:39: ISAKMP: attributes of transformation:
  234325: * 3 Feb 18:53:39: ISAKMP: type of life in seconds
  234326: * 3 Feb 18:53:39: ISAKMP: life of HIS (basic) of 28800
  234327: * 3 Feb 18:53:39: ISAKMP: program is 61444 (Transport-UDP)
  234328: * 3 Feb 18:53:39: ISAKMP: authenticator is HMAC-SHA
  234329: * 3 Feb 18:53:39: CryptoEngine0: validate the proposal
  234330: * 3 Feb 18:53:39: ISAKMP: (5912): atts are acceptable.
  234331: * 3 Feb 18:53:39: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 95.6..., distance = 93.73.161.229,.
  local_proxy = 95.6.../255.255.255.255/17/1701 (type = 1),
  remote_proxy = 93.73.161.229/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = esp-3des esp-sha-hmac (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
  234332: * 3 Feb 18:53:39: map_db_find_best found no corresponding card
  234333: * 3 Feb 18:53:39: ISAKMP: (5912): processing NONCE payload. Message ID =-1224389198
  234334: * 3 Feb 18:53:39: ISAKMP: (5912): payload ID for treatment. Message ID =-1224389198
  234335: * 3 Feb 18:53:39: ISAKMP: (5912): payload ID for treatment. Message ID =-1224389198
  234336: * 3 Feb 18:53:39: ISAKMP: (5912): ask 1 spis of ipsec
  234337: * 3 Feb 18:53:39: ISAKMP: (5912): entrance, node-1224389198 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  234338: * 3 Feb 18:53:39: ISAKMP: (5912): former State = new State IKE_QM_READY = IKE_QM_SPI_STARVE
  234339: * 3 Feb 18:53:39: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
  234340: * 3 Feb 18:53:39: IPSEC (spi_response): spi getting 834762579 for SA
  of 95.6... to 93.73.161.229 for prot 3
  234341: * 3 Feb 18:53:39: crypto_engine: hash generate IKE
  234342: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
  234343: * 3 Feb 18:53:39: crypto_engine: create Security Association IPSec (by QM)
  routerindc #.
  234344: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IPSEC_KEY_CREATE (hw) (ipsec)
  234345: * 3 Feb 18:53:39: crypto_engine: create Security Association IPSec (by QM)
  234346: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IPSEC_KEY_CREATE (hw) (ipsec)
  234347: * 3 Feb 18:53:39: ISAKMP: (5912): establishing IPSec security associations
  234348: * 3 Feb 18:53:39: from 93.73.161.229 to 95.6 SA... (f / i) 0 / 0
  (93.73.161.229 to 95.6 proxy...)
  234349: * 3 Feb 18:53:39: spi 0x31C17753 and id_conn a 0
  234350: * 3 Feb 18:53:39: life of 28800 seconds
  234351: * 3 Feb 18:53:39: ITS 95.6 outgoing... to 93.73.161.229 (f / i) 0/0
  (proxy 95.6... to 93.73.161.229)
  234352: * 3 Feb 18:53:39: spi 0x495A4BD and id_conn a 0
  234353: * 3 Feb 18:53:39: life of 28800 seconds
  234354: * 3 Feb 18:53:39: crypto_engine: package to encrypt IKE
  234355: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT (hw) (ipsec)
  234356: * 3 Feb 18:53:39: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
  234357: * 3 Feb 18:53:39: map_db_find_best found no corresponding card
  234358: * 3 Feb 18:53:39: IPSec: rate allocated for brother 80000273 Flow_switching
  234359: * 3 Feb 18:53:39: IPSEC (policy_db_add_ident): 95.6..., src dest 93.73.161.229, dest_port 4500

  234360: * 3 Feb 18:53:39: IPSEC (create_sa): its created.
  (his) sa_dest = 95.6..., sa_proto = 50.
  sa_spi = 0x31C17753 (834762579).
  sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 1165
  234361: * 3 Feb 18:53:39: IPSEC (create_sa): its created.
  (his) sa_dest = 93.73.161.229, sa_proto = 50,.
  sa_spi = 0x495A4BD (76915901).
  sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 1166
  234362: * 3 Feb 18:53:39: ISAKMP: (5912): lot of 93.73.161.229 sending peer_port my_port 4500 4500 (R) QM_IDLE
  234363: * 3 Feb 18:53:39: ISAKMP: (5912): entrance, node-1224389198 = IKE_MESG_FROM_IPSEC, IKE_SPI_REPLY
  234364: * 3 Feb 18:53:39: ISAKMP: (5912): former State = new State IKE_QM_SPI_STARVE = IKE_QM_R_QM2
  234365: * 3 Feb 18:53:39: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) QM_IDLE sport
  234366: * 3 Feb 18:53:39: crypto_engine: package to decipher IKE
  234367: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
  234368: * 3 Feb 18:53:39: crypto_engine: hash generate IKE
  234369: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
  routerindc #.
  234370: * 3 Feb 18:53:39: ISAKMP: (5912): node-1224389198 error suppression FALSE reason 'QM (wait).
  234371: * 3 Feb 18:53:39: ISAKMP: (5912): entrance, node-1224389198 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  234372: * 3 Feb 18:53:39: ISAKMP: (5912): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
  234373: * 3 Feb 18:53:39: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
  234374: * 3 Feb 18:53:39: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP
  234375: * 3 Feb 18:53:39: IPSEC (key_engine_enable_outbound): select SA with spinnaker 76915901/50
  234376: * 3 Feb 18:53:40: IPSEC (epa_des_crypt): decrypted packet has no control of her identity
  routerindc #.
  234377: * 3 Feb 18:53:42: IPSEC (epa_des_crypt): decrypted packet has no control of her identity
  routerindc #.
  234378: * 3 Feb 18:53:44: IPSEC (epa_des_crypt): decrypted packet has no control of her identity

  Also when I connect with the phone, I see HIS Active and IPsec tunnel is mounted, but the wire of time tunnel is down and phone connects.

  I hope that you will help me. Thank you.

  Hi dvecherkin1,

  Who IOS you're running, you could hit the next default.

  https://Tools.Cisco.com/bugsearch/bug/CSCsg34166/?reffering_site=dumpcr

  It may be useful

  -Randy-

  Evaluate the ticket to help others find the answer quickly.

• CISCO RV215W with modem usb HUAWEI E398

  Hello

  I am trying to set up a Huawei E398 de Swiscom (operator Switzerland) and does not detect it my CISCO RV215W.

  The RV215W is compatible with the Huawei E398 USB LTE Modem?

  If this isn't the case, it will be compatible in the near future?

  Thank you

  Hi Jorge, here is the list of compatibility

  https://supportforums.Cisco.com/docs/doc-29162

  I can't see there (unless I missed it).

  If you want to extend the scope of supported USB dongle for the router, the best thing to do is open a ticket with small business support center and ask to make a feature request to include the dongle you wish.

  Here are the numbers of support by country

  http://www.Cisco.com/en/us/support/tsd_cisco_small_business_support_center_contacts.html

  -Tom
  Please mark replied messages useful

• Problems with the management of the CSC/Cisco (associated with SSO) site

  Dear friends,

  I came across a problem with single sign - on (SSO) used in the Cisco's Web site and CSC which begins to be more and more awkward:

  1. I visit the CSC and connect you to reply to a thread. Then I start to reply to a message.
  2. In response, I need to consult the technical documentation, guides, configuration or other documents on Cisco's Web site. In another tab in my browser, I visit the Cisco's Web site and do my search/navigation.
  3. At some point, Cisco's Web site acknowledges that I am already connected to the CSC and begins to produce URLs with the /partner/ inside component (for example in the search results). By clicking on this URL causes me be redirected to the page of connection again. This is the first question - why do I have to log in again because I am already connected and SSO is supposed to take care of this?
  4. Well, I re-enter my credentials, get connected, access the necessary document, then I go back to my post on the CSC, finish it and submit it. KABOOM - CCS quickly informs me that I am without permission to perform this action, lose my answer in the process! Logging on to the Web site (as described in step 3) Cisco obviously invalid my current session on CSC! I need to connect again to the SCC (until I do that, she considers me as a guest once again, but when I click on the login link, I suddenly make me connected without enter my credentials) and, well, write again my answer. Sometimes, a part is recoverable, but usually, it is only a small fragment.

  Would it not be possible to correct this behavior? I lost a lot of time my lost rewrite responses.

  Best regards

  Peter

  Hi Peter,.

  I wanted to give you a quick update on the two issues.

  First question:

  We are currently working on a long term and short fix for this problem. Unfortunately the long-term solution will be a drawn out effort as we begin our new data of all content in our heritage Center. The team is currently testing the short-term solution, will keep you posted on the progress that I get more details.

  Second question:

  We currently do analysis of the root causes of this problem and give you updated each week on this issue that deploy us the patch.

  Thanks a lot again for you continued support and patience.

  Sainaba.

• Cisco ASA with Microsoft CA but arrive CRL

  Hi all

  I'm going through the old VPN IPsec of Cisco AnyConnect VPN.  We want to keep two-factor authentication, so I install a Microsoft stand-alone certification authority (cannot use local ASA CA as we have two units of the SAA in failover).  MS it works very well, I delivered the of CA root certificate to the ASA and not issued certificates of the certification authority for client computers that connect using AnyConnect no problem.

  My problem is that everything I try I can not get the ASA to retrieve the Revocation list.  Many guides, I followed the State that you just add the CRL to the certificate root, then the SAA should pick this up by using the option "use CRL Distribution Point certificate."  I tried also manually add LDAP url and try recovery like that (although I don't know about the url I used) and I always get just "cannot retrieve or check the Revocation list.  Does anyone have any experience with this or know what I'm doing wrong?

  Thank you

  Rob

  You have the right URL in the certificate? I have seen so many times that the CDP has been incorrectly configured with only a host name instead of a FULL domain name that does not able to solve the modem-router VPN.

• Cisco ASA with Microsoft LDAP integration

  Hello

  I need to integrate a Cisco ASA 5510 version 8.3 with Microsoft LDAP to authenticate IPSEC VPN.

  Following the procedures described in the documents below:

  http://www.Cisco.com/en/us/customer/docs/security/ASA/asa83/configuration/guide/access_aaa.html

  http://www.Cisco.com/en/us/customer/docs/security/ASA/asa83/asdm63/configuration_guide/access_aaa.html

  Does not. Turn on debugging ldap 255.

  The result was that debugging is attached.

  Try to connect using the softerra ldap browser and see if it works or not.

  Kind regards

  ~ JG