basic configuration question IPSec GRE

Similar Questions

• question of LAN IPSec/gre

  Hi guys,.

  I'm trying to connect 2 1841 routers using ipsec/gre.

  the situation is as below:

  router a router - Internet - b

  router config:

  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key cisco address bb.bb.bb.bb

  Crypto ipsec transform-set esp-3des esp-md5-hmac TFMset
  !
  Profile of crypto ipsec ToB
  game of transformation-TFMset

  !

  interface Tunnel0
  Description * to B *.
  IP 100.100.100.1 255.255.255.252
  tunnel source aa.aa.aa.aa
  destination bb.bb.bb.bb tunnel
  ipv4 ipsec tunnel mode
  Profile of tunnel ToB ipsec protection

  interface FastEthernet0/0
  IP address aa.aa.aa.aa 255.255.255.252
  NAT outside IP
  !
  interface FastEthernet0/1
  11.11.11.11 IP address 255.255.255.0
  IP nat inside

  IP route 0.0.0.0 0.0.0.0 FastEthernet0/0

  IP nat inside source map route SHEEP interface FastEthernet0/0 overload

  IPNAT extended IP access list
  deny ip 11.11.11.0 0.0.0.255 22.22.22.0 0.0.0.255
  IP 11.11.11.0 allow 0.0.0.255 any
  !
  SHEEP allowed 10 route map
  corresponds to the IP IPNAT

  Config router B:

  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key cisco address aa.aa.aa.aa

  Crypto ipsec transform-set esp-3des esp-md5-hmac TFMset
  !
  Profile of crypto ipsec ToA
  game of transformation-TFMset

  !

  interface Tunnel0
  Description * to A *.
  IP 100.100.100.1 255.255.255.252
  tunnel source bb.bb.bb.bb
  destination aa.aa.aa.aa tunnel
  ipv4 ipsec tunnel mode
  Profile of tunnel ToA ipsec protection

  interface FastEthernet0/0
  IP address bb.bb.bb.bb 255.255.255.252
  NAT outside IP
  !
  interface FastEthernet0/1
  IP 22.22.22.22 255.255.255.0
  IP nat inside

  IP route 0.0.0.0 0.0.0.0 FastEthernet0/0

  IP nat inside source map route SHEEP interface FastEthernet0/0 overload

  IPNAT extended IP access list

  deny ip 22.22.22.0 0.0.0.255 11.11.11.0 0.0.0.255

  IP 22.22.22.0 allow 0.0.0.255 any

  !

  SHEEP allowed 10 route map

  corresponds to the IP IPNAT

  I managed to see the crypto isakmp and tunnel upward, but I'm not able to ping to the Remote LAN ip...

  have you guys any idea on this?

  Thank you...

  Hello

  Try to create a static route on a router for remote network pointing to the source of the tunnel as its front door.

  Here is a useful link: -.

  https://learningnetwork.Cisco.com/docs/doc-2457

  Thank you

  Shilpa

• GRE tunnels will not come on VPN IPsec/GRE

  Hi all

  We have 400 + remote sites that connect to our central location (and a backup site) using Cisco routers with vpn IPSec/GRE tunnels.  We use a basic model for the creation of tunnels, so there is very little chance of a bad configuration on each router.  Remote sites use Cisco 831 s, central sites use Cisco 2821 s.  There is a site where the tunnels WILL refuse just to come.

  Routers are able to ping their public IP addresses, so it is not a routing problem, but gre endpoints cannot ping.  There is no NATing involved, two routers directly accessing the Internet.  The assorded display orders seem to indicate that the SAs are properly built, but newspapers, it seems that last part just don't is finished, and the GRE tunnels come not only upward.

  The attached log file, it seems that both its IPSEC & ISAKMP are created @ 00:25:14, then QM_PHASE2 end @ 00:25:15.

  00:25:15: ISAKMP: (0:10:HW:2): node error 1891573546 FALSE reason for deletion "(wait) QM.
  00:25:15: ISAKMP: (0:10:HW:2): entrance, node 1891573546 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  00:25:15: ISAKMP: (0:10:HW:2): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
  00:25:15: ISAKMP (0:268435467): received 208.XX packet. Dport 500 sport Global 500 (I) QM_IDLE yy.11
     
  00:25:15: IPSEC (key_engine): had an event of the queue with 1 kei messages
  00:25:15: IPSEC (key_engine_enable_outbound): rec would prevent ISAKMP
  00:25:15: IPSEC (key_engine_enable_outbound): select SA with spinnaker 1572231461/50
  00:25:15: ISAKMP: (0:11:HW:2): error in node-1931380074 FALSE reason for deletion "(wait) QM.
  00:25:15: ISAKMP: (0:11:HW:2): entrance, node-1931380074 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  00:25:15: ISAKMP: (0:11:HW:2): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
  00:25:15: IPSEC (key_engine): had an event of the queue with 1 kei messages
  00:25:15: IPSEC (key_engine_enable_outbound): rec would prevent ISAKMP
  00:25:15: IPSEC (key_engine_enable_outbound): select SA with spinnaker 310818168/50

  I don't have the remote router log file, and is very long, so I joined her.  Before that I captured the log file, I enabled debugging ipsec & isakmp and immediately authorized the SAs.

  Assorted useful details and matching orders of show results:

  Cisco IOS Software, C831 (C831-K9O3SY6-M), Version 12.4 (25), RELEASE SOFTWARE (fc1)

  There are 2 connections of IPSEC/GRE tunnel:

  Tunnel101: KC (208.YY. ZZ.11) - remote control (74.WW. XX.35)
  Tunnel201: Dallas (208.XX. YY.11) - remote control (74.WW. XX.35)

  Site-382-831 #sho ip int br
  Interface IP-Address OK? Method State Protocol
  FastEthernet1 unassigned YES unset down down
  FastEthernet2 unassigned YES unset upward, upward
  FastEthernet3 unassigned YES unset upward, upward
  FastEthernet4 unassigned YES unset upward, upward
  Ethernet0 10.3.82.10 YES NVRAM up up
  Ethernet1 74.WW. XX.35 YES NVRAM up up
  Ethernet2 172.16.1.10 YES NVRAM up up
  Tunnel101 1.3.82.46 YES NVRAM up toward the bottom<>
  Tunnel201 1.3.82.62 YES NVRAM up toward the bottom<====  ="">
  NVI0 unassigned don't unset upward upwards

  Site-382-831 #.
  Site-382-831 #sho run int tunnel101
  Building configuration...

  Current configuration: 277 bytes
  !
  interface Tunnel101
  Description % connected to the 2nd KC BGP 2821 - PRI - B
  IP 1.3.82.46 255.255.255.252
  IP mtu 1500
  IP virtual-reassembly
  IP tcp adjust-mss 1360
  KeepAlive 3 3
  source of tunnel Ethernet1
  destination of the 208.YY tunnel. ZZ.11
  end

  Site-382-831 #.

  Site-382-831 #show isakmp crypto his
  status of DST CBC State conn-id slot
  208.XX. YY.11 74.WW. XX.35 QM_IDLE ASSETS 0 11
  208.YY. ZZ.11 74.WW. XX.35 QM_IDLE 10 0 ACTIVE
  Site-382-831 #.

  Site-382-831 #.
  Site-382-831 #show detail of the crypto isakmp
  Code: C - IKE configuration mode, D - Dead Peer Detection
  NAT-traversal - KeepAlive, N - K
  X - IKE extended authentication
  PSK - GIPR pre-shared key - RSA signature
  renc - RSA encryption

  C - id Local Remote I have VRF status BA hash Auth DH lifetime limit.
  11 74.WW. XX.35 208.XX. YY.11 ACTIVE 3des sha psk 1 23:56:09
  Connection-id: motor-id = 11:2 (hardware)
  74.WW 10. XX.35 208.YY. ZZ.11 ACTIVE 3des sha psk 1 23:56:09
  Connection-id: motor-id = 10:2 (hardware)
  Site-382-831 #.

  Site-382-831 #.
  Site-382-831 #show crypto ipsec his

  Interface: Ethernet1
  Tag crypto map: IPVPN_MAP, local addr 74.WW. XX.35

  protégé of the vrf: (none)
  ident (addr, mask, prot, port) local: (74.WW. XX.35/255.255.255.255/47/0)
  Remote ident (addr, mask, prot, port): (208.YY. ZZ.11/255.255.255.255/47/0)
  current_peer 208.YY. ZZ.11 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: 2333, #pkts encrypt: 2333, #pkts digest: 2333
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  #send 21, #recv errors 0

  local crypto endpt. : 74.WW. XX.35, remote Start crypto. : 208.YY. ZZ.11
  Path mtu 1500, mtu 1500 ip, ip mtu IDB Ethernet1
  current outbound SPI: 0x45047D1D (1157922077)

  SAS of the esp on arrival:
  SPI: 0x15B97AEA (364477162)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: C83X_MBRD:4, crypto card: IPVPN_MAP
  calendar of his: service life remaining (k/s) key: (4486831/1056)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0x45047D1D (1157922077)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: C83X_MBRD:3, crypto card: IPVPN_MAP
  calendar of his: service life remaining (k/s) key: (4486744/1056)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  protégé of the vrf: (none)
  ident (addr, mask, prot, port) local: (74.WW. XX.35/255.255.255.255/47/0)
  Remote ident (addr, mask, prot, port): (208.XX. YY.11/255.255.255.255/47/0)
  current_peer 208.XX. YY.11 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: 2333, #pkts encrypt: 2333, #pkts digest: 2333
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  #send 21, #recv errors 0

  local crypto endpt. : 74.WW. XX.35, remote Start crypto. : 208.XX. YY.11
  Path mtu 1500, mtu 1500 ip, ip mtu IDB Ethernet1
  current outbound SPI: 0xE82A86BC (3895101116)

  SAS of the esp on arrival:
  SPI: 0x539697CA (1402378186)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2008, flow_id: C83X_MBRD:8, crypto card: IPVPN_MAP
  calendar of his: service life remaining (k/s) key: (4432595/1039)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xE82A86BC (3895101116)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2001, flow_id: C83X_MBRD:1, crypto card: IPVPN_MAP
  calendar of his: service life remaining (k/s) key: (4432508/1039)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:
  Site-382-831 #.

  Site-382-831 #.
  Site-382-831 #show crypto ipsec his | Pkts Inc. | life
  #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  calendar of his: service life remaining (k/s) key: (4486831/862)
  calendar of his: service life remaining (k/s) key: (4486738/862)
  #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  calendar of his: service life remaining (k/s) key: (4432595/846)
  calendar of his: service life remaining (k/s) key: (4432501/846)
  Site-382-831 #.

  Site-382-831 #.
  Site-382-831 #show crypto isakmp policy

  World IKE policy
  Priority protection Suite 10
  encryption algorithm: three key triple a
  hash algorithm: Secure Hash Standard
  authentication method: pre-shared Key
  Diffie-Hellman group: #1 (768 bits)
  lifetime: 86400 seconds, no volume limit
  Default protection suite
  encryption algorithm: - Data Encryption STANDARD (56-bit keys).
  hash algorithm: Secure Hash Standard
  authentication method: Rivest-Shamir-Adleman Signature
  Diffie-Hellman group: #1 (768 bits)
  lifetime: 86400 seconds, no volume limit
  Site-382-831 #.

  Site-382-831 #show crypto card
  "IPVPN_MAP" 101-isakmp ipsec crypto map
  Description: at the 2nd KC BGP 2821 - PRI - B
  Peer = 208.YY. ZZ.11
  Extend the PRI - B IP access list
  access list PRI - B allowed will host 74.WW. XX.35 the host 208.YY. ZZ.11
  Current counterpart: 208.YY. ZZ.11
  Life safety association: 4608000 Kbytes / 3600 seconds
  PFS (Y/N): N
  Transform sets = {}
  IPVPN,
  }

  "IPVPN_MAP" 201-isakmp ipsec crypto map
  Description: 2nd Dallas BGP 2821 - s-B
  Peer = 208.XX. YY.11
  Expand the list of IP SEC-B access
  s - B allowed will host 74.WW access list. XX.35 the host 208.XX. YY.11
  Current counterpart: 208.XX. YY.11
  Life safety association: 4608000 Kbytes / 3600 seconds
  PFS (Y/N): N
  Transform sets = {}
  IPVPN,
  }
  Interfaces using crypto card IPVPN_MAP:
  Ethernet1
  Site-382-831 #.

  Tunnel between KC & the remote site configuration is:

  Distance c831 - KC

  crypto ISAKMP policy 10
  BA 3des
  preshared authentication
  !
  PRI-B-382 address 208.YY isakmp encryption key. ZZ.11
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac IPVPN
  transport mode
  !
  IPVPN_MAP 101 ipsec-isakmp crypto map
  Description of 2nd KC BGP 2821 - PRI - B
  set of peer 208.YY. ZZ.11
  game of transformation-IPVPN
  match address PRI - B
  !
  interface Tunnel101
  Description % connected to the 2nd KC BGP 2821 - PRI - B
  IP 1.3.82.46 255.255.255.252
  IP mtu 1500
  KeepAlive 3 3
  IP virtual-reassembly
  IP tcp adjust-mss 1360
  source of tunnel Ethernet1
  destination of the 208.YY tunnel. ZZ.11
  !
  interface Ethernet0
  private network Description
  IP 10.3.82.10 255.255.255.0
  IP mtu 1500
  no downtime
  !
  interface Ethernet1
  IP 74.WW. XX.35 255.255.255.248
  IP mtu 1500
  automatic duplex
  IP virtual-reassembly
  card crypto IPVPN_MAP
  no downtime
  !
  PRI - B extended IP access list
  allow accord 74.WW the host. XX.35 the host 208.YY. ZZ.11
  !

  KC-2821 *.

  PRI-B-382 address 74.WW isakmp encryption key. XX.35
  !
  PRI-B-382 extended IP access list
  allow accord 208.YY the host. ZZ.11 the host 74.WW. XX.35
  !
  IPVPN_MAP 382 ipsec-isakmp crypto map
  Description % connected to the 2nd KC BGP 2821
  set of peer 74.WW. XX.35
  game of transformation-IPVPN
  match address PRI-B-382
  !
  interface Tunnel382
  Description %.
  IP 1.3.82.45 255.255.255.252
  KeepAlive 3 3
  IP virtual-reassembly
  IP tcp adjust-mss 1360
  IP 1400 MTU
  delay of 40000
  tunnel of 208.YY origin. ZZ.11
  destination of the 74.WW tunnel. XX.35
  !
  end

  Any help would be much appreciated!

  Mark

  Hello

  logs on Site-382-831, only see the crypt but none decrypts, could you check a corresponding entry on the peer and see if has any questions send return traffic?

  Site-382-831 #show crypto ipsec his | Pkts Inc. | life
  #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  calendar of his: service life remaining (k/s) key: (4486831/862)
  calendar of his: service life remaining (k/s) key: (4486738/862)
  #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  calendar of his: service life remaining (k/s) key: (4432595/846)
  calendar of his: service life remaining (k/s) key: (4432501/846)
  Site-382-831 #.

  Kind regards

  Averroès.

• Cisco VTI and configuration of IPSec (IKE Phase2) ITS proposal.

  Hello

  I have a question about the functionality of the virtual Tunnel Interface (VTI) configuration option. I have a Cisco IOS router, ending individual customers with the tunnel interfaces. The question I have now is that how can I specify the traffic 'interesting' on the security association proposal ITS IPsec (IKE Phase2). The configuration of the router is made by cryptographic profiles like this:

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  !

  Crypto isakmp ISAKMP_PHASE1_PARAMETERS profile

  key ring PRESHARED_KEYS

  function identity address 1.2.3.4 255.255.255.255

  !

  door-key crypto PRESHARED_KEYS

  pre-shared key address 1.2.3.4 key xyz

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac VPN-TRANSFORMSET

  !

  Profile of crypto ipsec ISAKMP_PHASE2_TUNNEL

  game of transformation-VPN-TRANSFORMSET

  PFS group2 Set

  ISAKMP_PHASE1_PARAMETERS Set isakmp-profile

  !

  Tunnel1 interface

  IP 10.10.10.1 255.255.255.252

  IP mtu 1450

  source of tunnel Loopback1

  tunnel destination 1.2.3.4

  ipv4 ipsec tunnel mode

  Tunnel ISAKMP_PHASE2_TUNNEL ipsec protection profile

  !

  Now when I look at the output of the command 'See the crypto ipsec his tu1 int' I get the following:

  ....

  Interface: Tunnel1

  Tag crypto map: x.x.x.x addr Tunnel1-head-0, local

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (0.0.0.0/0.0.0.0/0/0)

  Remote ident (addr, mask, prot, port): (0.0.0.0/0.0.0.0/0/0)

  current_peer 1.2.3.4 port 500

  LICENCE, flags is {origin_is_acl},

  ....

  However, the peer on the other side do not accept the proposal, as it would like to have specific IP subnets on the IPSec security association proposal parameters. He would accept the policy if the identity local remote proxies, for example, would be 192.168.10.0/255.255.255.0/0/0 (local) and

  192.168.200.0/255.255.255.0/0/0 (remotely).

  Y at - it 'interesting' no IOS configuration for traffic configuration option on the profile of crypto? With the crypto map - basic configuration you can specify interesting traffic with an ACL under the crypto map configuration section.

  I'm in IOS version 15.1 (4) M with Advanced IP Services have together.

  Hello

  ASIT will always want to negotiate a whole as traffic selectors.

  What you MIGHT find is multi-SA DVTI configuration, in what remote end could say what proxy identity he would like to encrypt. (Supported from 15.2 M / T)

  Unfortunately, the ceveat of this configuration is this remote end needs to open the negotiation.

  M.

• DMVPN/IPSEC, GRE and IPSEC Multi Point

  Hi all

  I have a project of construction of 50 locations connectivity to my data center 2. Each location has Internet with router 877 with image dry.

  my DC has 1900 router. Now I want what tunnel I go with. DMVPN IPSEC or IPSEC GRE.

  The data will come from DC locations only. No inter connections location. I want to know the pros and cons as well as any change of required equipment.

  Kind regards

  Satya.M

  Given your criteria, I would say THAT DMVPN would be best suited

  Cisco - Configuration dynamic Multipoint Virtual Private Networks DMVPN

  Implementation in DMVPN GDOI

  Pete

• Basic configuration of TFS 2012 fails on the data layer.

  Hello

  I have a new installation of sql server 2014 and has the last update 7 on it.

  Installed TFS 2012 update 4 and I tried the basic configuration to help start Wizard.

  I am getting...

  "TF255146: Team foundation server requires SQL server 2008 Rs (10.50.1600) or higher." The SQL server instance xxxxxxx you provided is the version 12.0.2495.0.

  I couldn't find much online research help. Any ideas how to solve this problem?

  Thank you

  Vinciane

  
  This issue is beyond the scope of this site and must be placed on Technet or MSDN
  http://social.technet.Microsoft.com/forums/en-us/home

  http://social.msdn.Microsoft.com/forums/en-us/home

• Aironet 1600 I have the Basic Configuration

  Hello, someone to share the basic configuration to a SSID and security with WPA with the phrase password not numers

  Because I have a problem, I can only see the SSID if I put on the guest mode.

  Excellent.  You can disable the 2.4 Ghz on the AP all together.

  If you think that I helped it would be great if you could evaluate and score the answer.

• Need help configuration IOS IPsec to enable communication between the VPN client

  Hi, I need help with the configuration of IPsec VPN router 2811. I want to allow communication between VPN clients, is that possible? I know that ASA, you can do this by using the command "permit same-security-traffic intra-interface".

  The fact is that each Client IP communicator installed, but when they tried to call each other, he failed. I guess that's because the connectivity between them is not permitted because of the VPN connection.

  Thanks in advance...

  Hello

  Try this: -.

  local pool IP 192.168.1.1 ippool 192.168.1.5

  access-list 1 permit host 192.168.1.2< vpn="" ip="" addr="" of="" client="">

  access-list 1 permit host 192.168.1.3< vpn="" ip="" addr="" of="" client="">

  access-list 1 permit 10.10.10.0 0.0.0.255

  < lan="" behind="" the="">

  ISAKMP crypto client configuration group vpnclient

  key cisco123

  ACL 1< binding="" the="" acl="">

  !

  --------Done-------------

  If you do NAT on the router then you might want to exempt your VPN traffic to be NAt had

  Assuming that the NAT of your router is

  overload of IP nat inside source list 111 interface FastEthernet1/0

  !

  ! - The access list is used to specify which traffic

  ! - must be translated to the outside Internet.

  access-list 111 deny ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 111 deny ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255

  Above two statements are exempt from nat traffic.

  access-list 111 allow ip 10.10.10.0 0.0.0.255 any<, permits="">

  I would like to know if it worked for you.

  Concerning

  M

• Configuration of IPSec in VMWare ESXi can be applied to virtual machines running?

  Hello

  I have an operating system running inside VMWare ESXi 5.1.  Let's call is "MyLinux".  It is a modified version of Linux which does not support IPSec.  So I try to get VMWare to manipulate IPSec for MyLinux.

  I used esxcli orders to successfully create configurations for IPSec between VMWare itself and other systems.

  However, I wonder if I can use the same esxcli commands to configure IPSec between MyLinux and other systems?  In my tests, VMWare does not perform tunneling IPSec data between the running machines and other virtual systems.

  It is an illustration of the configuration I created for MyLinux in VMWare.  I also have a security policy that is not visible.

  Name Source address Destination address State SPI Mode Encryption Algorithm, integrity algorithm to life

  --------                              -------------------------------------      -------------------------------------  ------      -----     ---------     --------------------               -------------------           --------

  MyLinuxToExternalSA MyLINUX.IPv6.ADDRESS EXTERNAL. Mature IPv6.ADDRESS infinity 0 x 300 transport 3des-cbc hmac-sha2-256

  ExternalToMyLinuxSA EXTERNAL. IPv6.ADDRESS infinite mature MyLINUX.IPv6.ADDRESS of hmac-sha2-256 0 x 256 transport 3des-cbc

  When I captured a trace TCP ping between MyLinux and the external system, MyLinux never sent the IPSec packets. Everything was sent in the clear.  This suggests that VMWare does not apply the rule for MyLinux, but I would like to confirm.  Thank you.

  Kwabena

  When you configure IPSec on ESXi, you sécuriserez the VMkernel traffic, not the virtual machine... If you want to protect the traffic of the virtual machine, you will need to enable IPSec on guest operating system.

  Here is more information on IPSec on ESXi: VMware KB: IPv6 and IPsec configuration on vSphere ESX and ESXi 4.1, 5.x ESXi

• the basic sql question

  Hi all I have a basic sql question
  Watch below two querries
  

  1.  select 1 from dual where 1 in (select 1 from dual union all select null from dual) 
  
  It gives output  as 1
  
  but below one 
  
  2.   select 1 from dual where 1 not in  (select 2 from dual union all select null from dual)
  
  It gives output as no data found 

  I think as operator will not compare with all the values, but not the outcome it will compare with all values... When comparing with the value null, the result is automatically null
  
  I'm wrong
  Please help me on this
  
  and why performance wise in operator is more better than no of?
  
  Thanks to all in advance

  Thanks for posting your explain plan command

  Execution Plan
  ----------------------------------------------------------
  Plan hash value: 3249215828
  
  -----------------------------------------------------------------------------
  | Id  | Operation        | Name     | Rows  | Bytes | Cost (%CPU)| Time     |
  -----------------------------------------------------------------------------
  |   0 | SELECT STATEMENT |          |     2 |     6 |     4   (0)| 00:00:01 |
  |   1 |  NESTED LOOPS    |          |     2 |     6 |     4   (0)| 00:00:01 |
  |   2 |   FAST DUAL      |          |     1 |       |     2   (0)| 00:00:01 |
  |   3 |   VIEW           | VW_NSO_1 |     2 |     6 |     2   (0)| 00:00:01 |
  |   4 |    SORT UNIQUE   |          |     2 |       |     2   (0)| 00:00:01 |
  |   5 |     UNION-ALL    |          |       |       |            |          |
  |   6 |      FAST DUAL   |          |     1 |       |     2   (0)| 00:00:01 |
  |*  7 |      FILTER      |          |       |       |            |          |
  |   8 |       FAST DUAL  |          |     1 |       |     2   (0)| 00:00:01 |
  -----------------------------------------------------------------------------
  
  Predicate Information (identified by operation id):
  ---------------------------------------------------
  
     7 - filter(NULL IS NOT NULL)
  
  02:12:54 SQL> select 1 from dual where 1 not in  (select 2 from dual union all select null from dual);
  Elapsed: 00:00:00.01
  
  Execution Plan
  ----------------------------------------------------------
  Plan hash value: 3291682568
  
  -----------------------------------------------------------------
  | Id  | Operation        | Name | Rows  | Cost (%CPU)| Time     |
  -----------------------------------------------------------------
  |   0 | SELECT STATEMENT |      |     1 |     4   (0)| 00:00:01 |
  |*  1 |  FILTER          |      |       |            |          |
  |   2 |   FAST DUAL      |      |     1 |     2   (0)| 00:00:01 |
  |   3 |   UNION-ALL      |      |       |            |          |
  |*  4 |    FILTER        |      |       |            |          |
  |   5 |     FAST DUAL    |      |     1 |     2   (0)| 00:00:01 |
  |   6 |    FAST DUAL     |      |     1 |     2   (0)| 00:00:01 |
  -----------------------------------------------------------------
  

• What are the basic element of basic configuration of an oracle database?

  What are the basic element of basic configuration of an oracle database?

  It consists of
  one or more data files.
  one or more files of control.
  two or more redo log files.
  The database contains
  multiple users/schemas
  one or more rollback segments
  one or more storage space
  Data dictionary tables
  User objects (table, index, views etc.,)
  The server who access the database consists of
  SGA (dictionary database Cache buffers, a Redo buffers of the newspaper, shared pool SQL buffer)
  SMON (System MONito)
  PMON (Process MONitor)
  LGWR (LoG Write)
  DBWR (data writing)
  ARCH (archive)
  CKPT (Check Point)
  RECO
  Dispatcher
  Associate the user with PGS process

• How to circumvent the "Assistant" secpol.msc and configure State IPsec (esp, spi, enc, auth-trunc) and political (src, dst, in, on, fwd) directly as in the ip-xfrm Linux command?

  Right off the bat, the wizard tells me that I can't use a multicast address, when it is the only destination I am interested in security.  Here is exactly what I want to do - no more, no less (although I can use the mode of transport instead of tunnel at some point):

  #! / bin/bash

  Echo 2 >/proc/sys/net/ipv4/conf/eth0/force_igmp_version

  # NOTE: To avoid the possibility of breaking IGMPv2 snooping, src should ONLY be defined for SHIPPERS, NOT for RECEIVERS!  Otherwise, joins will be compromised by the IPsec encryption and the switch will not detect them.

  IP xfrm State flush; IP political xfrm hunting

  State of xfrm IP add src 10.0.2.15 dst 239.192.1.1 proto esp spi 0x54c1859e tunnel mode reqid 0x67cea4aa auth-trunc hmac\ (sha256\) 128 0xc8a8bf5ce6330699c3500bd8d2637bc1fa26929bab747d5ff2a1c4dddc7ce7ff enc cbc\ (aes\) 0xfdce8eaf81e3da02fa67e07df975c0111ecfa906561e762e5f3e78dfe106498e # aead rfc4106\ (gcm\ (aes\) \) 0x123456789abcdef0baddeed0deadbeeffeedface900df00d0fedcba987654321 128 #Error: duplicate 'ALGO-TYPE': 'aead' is the second value.

  xfrm IP strategy add 10.0.2.15 src 239.192.1.1 dst dir output stat CBC 10.0.2.15 dst 239.192.1.1 proto reqid 0x67cea4aa tunnel mode esp

  xfrm IP policy add 10.0.2.15 src 239.192.1.1 dst dir in src 10.0.2.15 stat dst 239.192.1.1 proto reqid 0x67cea4aa tunnel mode esp

  xfrm IP strategy add 10.0.2.15 src dst 239.192.1.1 dir fwd stat 10.0.2.15 src dst 239.192.1.1 proto reqid 0x67cea4aa esp tunnel mode

  A graphical interface which requires me to work in step by step mode (in particular to implement a relatively simple configuration of the shared key) with no idea of what irrelevant or confusing questions await us doing me no favor.  And while this computer uses Windows 7, the eventual target can use something older or newer.  I want to do is create the portable equivalent of a preferred scenario, no instructions to repeat the time-consuming and confusing.  This approach exist?  (I already checked cygwin and there seems to be no support for the ip packet, and even if there were, it seems not support sudo is.)

  Hello

  Thank you for visiting Microsoft Community and we provide a detailed description of the issue.

  I suggest you to send your request in the TechNet forums to get the problem resolved.

  Please visit the link below to send your query in the TechNet forums:

  https://social.technet.Microsoft.com/forums/en-us/home?category=WindowsServer

  Hope this information is useful. Please come back to write to us if you need more help, we will be happy to help you.

• Problem with IPSec GRE tunnel

  Hello, I have a radio link with a branch, but the link to the provider is not approved to set up a Tunnel GRE + IPSec, but I get that this log in my router.

  % CRYPTO-4-PKT_REPLAY_ERR: decrypt: re-read the verification failed

  The topology is:

  Router 1 C3825 IOS 12.4 (25f) Fa0/2/2 - link radio - router 2 C3825 IOS 15.1 (4) M4 Gi0/1

  I get the logs into the Router 1 only.

  Configurations are:

  Router 1:

  crypto ISAKMP policy 1

  BA aes

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key Andina12 address 172.20.127.114

  invalid-spi-recovery crypto ISAKMP

  !

  !

  Crypto ipsec transform-set TS aes - esp esp-md5-hmac

  !

  Profile of crypto ipsec protected-gre

  86400 seconds, life of security association set

  game of transformation-TS

  interface Tunnel0

  Description IPSec Tunnel of GRE a Víbora

  bandwidth 2000

  IP 172.20.127.117 255.255.255.252

  IP 1400 MTU

  IP tcp adjust-mss 1360

  tunnel source 172.20.127.113

  tunnel destination 172.20.127.114

  protection ipsec profile protected-gre tunnel

  interface FastEthernet0/2/2

  Description RadioEnlace a Víbora

  switchport access vlan 74

  bandwidth 2000

  No cdp enable

  interface Vlan74

  bandwidth 2000

  IP 172.20.127.113 255.255.255.252

  Router eigrp 1

  network 172.20.127.116 0.0.0.3

  Router 2:

  crypto ISAKMP policy 1

  BA aes

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key Andina12 address 172.20.127.113

  !

  !

  Crypto ipsec transform-set TS aes - esp esp-md5-hmac

  !

  Profile of crypto ipsec protected-gre

  86400 seconds, life of security association set

  game of transformation-TS

  interface Tunnel0

  Description IPSec Tunnel of GRE a CSZ

  bandwidth 2000

  IP 172.20.127.118 255.255.255.252

  IP 1400 MTU

  IP tcp adjust-mss 1360

  tunnel source 172.20.127.114

  tunnel destination 172.20.127.113

  protection ipsec profile protected-gre tunnel

  interface GigabitEthernet0/1

  Description Radio Enlace a CSZ

  bandwidth 2000

  IP 172.20.127.114 255.255.255.252

  automatic duplex

  automatic speed

  media type rj45

  No cdp enable

  Router eigrp 1

  network 172.20.127.116 0.0.0.3

  Thanks for the help.

  Yes, you can have just as configured:

  Crypto ipsec transform-set esp - aes TS

  transport mode

  Be sure to change it on both routers.

• DMVPN questions - IPsec packets

  Hi all

  Currently, I am configuring DMVPN for the first time. I followed the guide to configuring cisco and Googling a bit other strands however seems to have hit a brick wall.

  The Setup is in a lab environment, so I can post as much information as required, but here's the important bits:

  I have 3 routers Cisco 2821 running IOS 12.4 (15) with a layer 3 switch in the Middle connecting ports 'wan' together. the routing works fine, I can ping to each of the other router router.

  Excerpts from the hub router config:

  crypto ipsec transform-set DMVPN_SET esp-3des esp-md5-hmac
  !
  crypto ipsec profile DMVPN_PRJ
  set transform-set DMVPN_SET
  !
  interface Tunnel0
  bandwidth 10000
  ip address 172.17.100.1 255.255.255.0
  no ip redirects
  ip mtu 1500
  ip nhrp authentication secretid
  ip nhrp map multicast dynamic
  ip nhrp network-id 101
  ip nhrp holdtime 450
  ip tcp adjust-mss 1460
  tunnel source GigabitEthernet0/0
  tunnel mode gre multipoint
  tunnel key 10101
  tunnel protection ipsec profile DMVPN_PRJ
  !
  interface GigabitEthernet0/0
  description HQ WAN
  ip address 1.1.1.1 255.255.255.248
  ip nat outside
  ip virtual-reassembly
  duplex auto
  speed auto
  !
  

  and here's the config on the first router spoke:

  crypto ipsec transform-set DMVPN_SET esp-3des esp-md5-hmac
  !
  crypto ipsec profile DMVPN_PRJ
  set transform-set DMVPN_SET
  !
  interface Tunnel0
  bandwidth 3000
  ip address 172.17.100.10 255.255.255.0
  no ip redirects
  ip mtu 1500
  ip nhrp authentication secretid
  ip nhrp map 172.17.100.1 1.1.1.1
  ip nhrp map multicast 1.1.1.1
  ip nhrp network-id 101
  ip nhrp holdtime 450
  ip nhrp nhs 172.17.100.1
  ip tcp adjust-mss 1460
  tunnel source GigabitEthernet0/0
  tunnel mode gre multipoint
  tunnel key 10101
  tunnel protection ipsec profile DMVPN_PRJ
  !
  interface GigabitEthernet0/0
  description Site 1 WAN
  ip address 11.11.11.1 255.255.255.248
  ip nat outside
  ip virtual-reassembly
  duplex auto
  speed auto
  !
  

  If I closed/no farm tunnel0 on RADIUS 1 interface, I get the following error on the hub router:

  Mar 30 13:41:17.075: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
  (ip) vrf/dest_addr= /1.1.1.1, src_addr= 11.11.11.1, prot= 47
  

  so I feel im lack some config on the side talking to encrypt the traffic, but I'm not sure what.

  Here's the output router spoke:

  RTR_SITE1#sh dmvpn detail
  Legend: Attrb --> S - Static, D - Dynamic, I - Incompletea
  N - NATed, L - Local, X - No Socket
  # Ent --> Number of NHRP entries with same NBMA peer
  -------------- Interface Tunnel0 info: --------------
  Intf. is up, Line Protocol is up, Addr. is 172.17.100.10
  Source addr: 11.11.11.1, Dest addr: MGRE
  Protocol/Transport: "multi-GRE/IP", Protect "DMVPN_PRJ",
  Tunnel VRF "", ip vrf forwarding ""
  NHRP Details: NHS:       172.17.100.1  E
  Type:Spoke, NBMA Peers:1
  # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb    Target Network
  ----- --------------- --------------- ----- -------- ----- -----------------
  1         1.1.1.1    172.17.100.1   IKE    never S       172.17.100.1/32
  Interface: Tunnel0
  Session: [0x48E31B98]
  Crypto Session Status: DOWN
  fvrf: (none),   IPSEC FLOW: permit 47 host 11.11.11.1 host 1.1.1.1
  Active SAs: 0, origin: crypto map
  Outbound SPI : 0x       0, transform :
  Socket State: Closed
  Pending DMVPN Sessions:
  

  
  RTR_SITE1#sh ip nhrp detail
  172.17.100.1/32 via 172.17.100.1, Tunnel0 created 00:33:44, never expire
  Type: static, Flags: used
  NBMA address: 1.1.1.1
  

  
  RTR_SITE1#sh crypto ipsec sa
  interface: Tunnel0
  Crypto map tag: Tunnel0-head-0, local addr 11.11.11.1
  protected vrf: (none)
  local  ident (addr/mask/prot/port): (11.11.11.1/255.255.255.255/47/0)
  remote ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/47/0)
  current_peer 1.1.1.1 port 500
  PERMIT, flags={origin_is_acl,}
  #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
  #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
  #pkts compressed: 0, #pkts decompressed: 0
  #pkts not compressed: 0, #pkts compr. failed: 0
  #pkts not decompressed: 0, #pkts decompress failed: 0
  #send errors 46, #recv errors 0
  local crypto endpt.: 11.11.11.1, remote crypto endpt.: 1.1.1.1
  path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
  current outbound spi: 0x0(0)
  inbound esp sas:
  inbound ah sas:
  inbound pcp sas:
  outbound esp sas:
  outbound ah sas:
  outbound pcp sas:
  

  All these commands appear as empty when I throw them on the hub router.

  Any help appreciated.

  Thank you

  No negotiate is because you do not have an Ike key implemented. You need

  Crypto ISAKMP policy 1

  BA (whatever)

  AUTH pre-shared

  Group (whatever)

  ISAKMP crypto key 0 some secret address 0.0.0.0 0.0.0.0

  Hun and talks must match.

  Your IPSec transform-set should also have "transport mode".

  Sent by Cisco Support technique iPad App

• Basic VMWare question

  Hello, people:

  Please forgive my very basic questions, but I'm totally new to VMWare.

  Yes, as a R & S Cisco engineer, I worked with server

  specialists to get their online environments, but my focus was on the

  network component, from the access layer.

  Anyway, when you create a virtual machine and associate a request,

  This virtual machine has an IP address assigned to its own vNIC?  So, if it

  5 virtual machines run on a physical server, the number of addresses IP are you going

  have? How the allocation of an IP address of the physical NETWORK adapter is bound to the

  others?

  Once again, thank you for your help in advance.

  Take a look at the document I linked in the previous post.

  The virtual network is based on vSwitch which are "dummy" brigde.

  So has each VM's own MAC address (which is virtual and the part of the seller is dedicated to VMware).

  A physical NETWORK card is simply an uplink to the physical switch and the physical MAC address is generally not used and not visible in your network traffic or your ARP table (think a unmaged switch, it can have a MAC address, but you don't see it on your network).

  When you have several (more than one bear on a vSwitch) uplink you can have different types of team policy.

  (For you is probably the simplest to understand) is like the etherchannel on Cisco switches (and it takes a good configuration of the physical switch).

  André