CANNOT ACCESS THE LAN WITH THE EASY VPN CONFIGURATION

Hello

I configured easy vpn server in cisco 1905 SRI using ccp. The router is already configured with zone based firewall. With the help of vpn client I can reach only up to the internal interface of the router, but cannot access the LAN from my company. I need to change any configuration of ZBF since it is configured as "deny everything" from outside to inside? If so that all protocols should I match?   Also is there any exemption of NAT for VPN clients? Please help me! Thanks in advance.

Please see my full configuration:

Router #sh run
Building configuration...

Current configuration: 8150 bytes
!
! Last modification of the configuration at 05:40:32 UTC Wednesday, July 4, 2012 by
! NVRAM config updated 06:04 UTC Tuesday, July 3, 2012 by
! NVRAM config updated 06:04 UTC Tuesday, July 3, 2012 by
version 15.1
horodateurs service debug datetime msec
Log service timestamps datetime msec
no password encryption service
!
router host name
!
boot-start-marker
boot-end-marker
!
!
Passwords security min-length 6
no set record in buffered memory
enable secret 5 xxxxxxxxxxx
!
AAA new-model
!
!
AAA authentication login default local
AAA authentication login ciscocp_vpn_xauth_ml_1 local
AAA authorization exec default local
AAA authorization ciscocp_vpn_group_ml_1 LAN
!
!
!
!
!
AAA - the id of the joint session
!
!
No ipv6 cef
IP source-route
no ip free-arps
IP cef
!
Xxxxxxxxx name server IP
IP server name yyyyyyyyy
!
Authenticated MultiLink bundle-name Panel
!

parameter-map local urlfpolicy TSQ-URL-FILTER type
offshore alert
block-page message "Blocked according to policy"
parameter-card type urlf-glob FACEBOOK
model facebook.com
model *. Facebook.com

parameter-card type urlf-glob YOUTUBE
mires of youtube.com
model *. YouTube.com

parameter-card type urlf-glob CRICKET
model espncricinfo.com
model *. espncricinfo.com

parameter-card type urlf-glob CRICKET1
webcric.com model
model *. webcric.com

parameter-card type urlf-glob YAHOO
model *. Yahoo.com
model yapo

parameter-card type urlf-glob PERMITTEDSITES
model *.

parameter-card type urlf-glob HOTMAIL
model hotmail.com
model *. Hotmail.com

Crypto pki token removal timeout default 0
!
Crypto pki trustpoint TP-self-signed-2049533683
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 2049533683
revocation checking no
rsakeypair TP-self-signed-2049533683
!
Crypto pki trustpoint tti
crl revocation checking
!
Crypto pki trustpoint test_trustpoint_config_created_for_sdm
name of the object [email protected] / * /
crl revocation checking
!
!
TP-self-signed-4966226213 crypto pki certificate chain
certificate self-signed 01
3082022B 30820194 02111101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43647274 31312F30
69666963 32303439 35323236 6174652D 3833301E 170 3132 30363232 30363332

quit smoking
encryption pki certificate chain tti
for the crypto pki certificate chain test_trustpoint_config_created_for_sdm
license udi pid CISCO1905/K9 sn xxxxxx
licence start-up module c1900 technology-package datak9
username privilege 15 password 0 xxxxx xxxxxxx
!
redundancy
!
!
!
!
!
type of class-card inspect entire tsq-inspection-traffic game
dns protocol game
ftp protocol game
https protocol game
match icmp Protocol
match the imap Protocol
pop3 Protocol game
netshow Protocol game
Protocol shell game
match Protocol realmedia
match rtsp Protocol
smtp Protocol game
sql-net Protocol game
streamworks Protocol game
tftp Protocol game
vdolive Protocol game
tcp protocol match
udp Protocol game
match Protocol l2tp
class-card type match - all BLOCKEDSITES urlfilter
Server-domain urlf-glob FACEBOOK game
Server-domain urlf-glob YOUTUBE game
CRICKET urlf-glob-domain of the server match
game server-domain urlf-glob CRICKET1
game server-domain urlf-glob HOTMAIL
class-map type urlfilter match - all PERMITTEDSITES
Server-domain urlf-glob PERMITTEDSITES match
inspect the class-map match tsq-insp-traffic type
corresponds to the class-map tsq-inspection-traffic
type of class-card inspect correspondence tsq-http
http protocol game
type of class-card inspect all match tsq-icmp
match icmp Protocol
tcp protocol match
udp Protocol game
type of class-card inspect correspondence tsq-invalid-src
game group-access 100
type of class-card inspect correspondence tsq-icmp-access
corresponds to the class-map tsq-icmp
!
!
type of policy-card inspect urlfilter TSQBLOCKEDSITES
class type urlfilter BLOCKEDSITES
Journal
reset
class type urlfilter PERMITTEDSITES
allow
Journal
type of policy-card inspect SELF - AUX-OUT-policy
class type inspect tsq-icmp-access
inspect
class class by default
Pass
policy-card type check IN and OUT - POLICIES
class type inspect tsq-invalid-src
Drop newspaper
class type inspect tsq-http
inspect
service-policy urlfilter TSQBLOCKEDSITES
class type inspect tsq-insp-traffic
inspect
class class by default
drop
policy-card type check OUT IN-POLICY
class class by default
drop
!
area inside security
security of the OUTSIDE area
source of security OUT-OF-IN zone-pair outside the destination inside
type of service-strategy check OUT IN-POLICY
zone-pair IN-to-OUT DOMESTIC destination outside source security
type of service-strategy inspect IN and OUT - POLICIES
security of the FREE-to-OUT source destination free outdoors pair box
type of service-strategy inspect SELF - AUX-OUT-policy
!
Crypto ctcp port 10000
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
crypto ISAKMP policy 2
Group 2
!
ISAKMP crypto client configuration group vpntunnel
XXXXXXX key
pool SDM_POOL_1
include-local-lan
10 Max-users
ISAKMP crypto ciscocp-ike-profile-1 profile
vpntunnel group identity match
client authentication list ciscocp_vpn_xauth_ml_1
ISAKMP authorization list ciscocp_vpn_group_ml_1
client configuration address respond
virtual-model 1
!
!
Crypto ipsec transform-set TSQ-TRANSFORMATION des-esp esp-md5-hmac
!
Profile of crypto ipsec CiscoCP_Profile1
game of transformation-TRANSFORMATION TSQ
set of isakmp - profile ciscocp-ike-profile-1
!
!
!
!
!
!
the Embedded-Service-Engine0/0 interface
no ip address
response to IP mask
IP directed broadcast to the
Shutdown
!
interface GigabitEthernet0/0
Description LAN INTERFACE-FW-INSIDE
IP 172.17.0.71 255.255.0.0
IP nat inside
IP virtual-reassembly in
security of the inside members area
automatic duplex
automatic speed
!
interface GigabitEthernet0/1
Description WAN-INTERNET-INTERNET-FW-OUTSIDE
IP address xxxxxx yyyyyyy
NAT outside IP
IP virtual-reassembly in
security of the OUTSIDE member area
automatic duplex
automatic speed
!
interface Serial0/0/0
no ip address
response to IP mask
IP directed broadcast to the
Shutdown
no fair queue
2000000 clock frequency
!
type of interface virtual-Template1 tunnel
IP unnumbered GigabitEthernet0/0
ipv4 ipsec tunnel mode
Tunnel CiscoCP_Profile1 ipsec protection profile
!
local IP SDM_POOL_1 172.17.0.11 pool 172.17.0.20
IP forward-Protocol ND
!
no ip address of the http server
local IP http authentication
IP http secure server
!
IP nat inside source list 1 interface GigabitEthernet0/1 overload
IP route 0.0.0.0 0.0.0.0 yyyyyyyyy
IP route 192.168.1.0 255.255.255.0 172.17.0.6
IP route 192.168.4.0 255.255.255.0 172.17.0.6
!
access-list 1 permit 172.17.0.0 0.0.255.255
access-list 100 permit ip 255.255.255.255 host everything
access-list 100 permit ip 127.0.0.0 0.255.255.255 everything
access-list 100 permit ip yyyyyy yyyyyy everything
!
!
!
!
!
!
!
!
control plan
!
!
!
Line con 0
line to 0
line 2
no activation-character
No exec
preferred no transport
transport of entry all
output transport lat pad rlogin lapb - your MOP v120 udptn ssh telnet
StopBits 1
line vty 0 4
transport input ssh rlogin
!
Scheduler allocate 20000 1000
end

A few things to change:

(1) pool of IP must be a single subnet, it is not the same subnet as your subnet internal.

(2) your NAT ACL 1 must be changed to ACL extended for you can configure NAT exemption, so if your pool is reconfigured to be 10.10.10.0/24:

access-list 120 deny ip 172.17.0.0 0.0.255.255 10.10.10.0 0.0.0.255

access-list 120 allow ip 172.17.0.0 0.0.255.255 everything

overload of IP nat inside source list 120 interface GigabitEthernet0/1

No inside source list 1 interface GigabitEthernet0/1 ip nat overload

(3) OUT POLICY need to include VPN traffic:

access-list 121 allow ip 10.10.10.0 0.0.0.255 172.17.0.0 0.0.255.255

type of class-card inspect correspondence vpn-access

game group-access 121

policy-card type check OUT IN-POLICY

vpn-access class

inspect

Tags: Cisco Security

Similar Questions

  • Cannot access the file

    We have implemented a cluster and our hosts, added vmkernel and have the right licenses. The migration option is available, but then we get the error message "cannot access the virtual machine configuration: cannot access the file [storage]" I thought about is because they do not work on a shared storage...

    I had to think about iSCSI, but have not tried it before, and now I ask you, is the most optimal solution? We will cable from the server to the top with a SAS cable,

    The servers are located in different parts of the building, I could put the other to the first server and their cable it but to avoid this, is there another solution? I can't use the data storage "migrate" since I don't have essential vmware more...

    you need external shared storage and follow the right cable FC, iSCSI, or SAS. You can not just a two-server cable upward with a SAS cable and expect it to work like the discs are still local only. the other option is to search for virtual storage in which transform your disks local shared iSCSI volume

  • Cannot access the file filename.vmx [Datastore]

    When I try to power on my machine, I get "cannot access the virtual machine configuration: cannot access files [Datastore] filename.vmx."

    I chose to delete all the snapshots in snapshot Manager, and after it was finished, I had this message. Is - this recoverable?

    Oscar

    This virtual machine may be any locked file. Check out http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=10051

    try restarting your vsphere services too.

  • Unable to access the remote VPN LAN

    My VPN ends very well, but cannot access the local network. The warning is the LAN is a public good 24 subnet.  I'm not sure how to NAT the LAN to access the VPN subnet and not to disturb any other functionality.  I have attached the configuration.

    Thank you in advance.

    ciscoasa # sh run
    : Saved
    :
    ASA Version 8.2 (2)
    !
    ciscoasa hostname
    activate the encrypted Anuj/1RTcTy/SmZO password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP address .149.200 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address *.165.37.131 255.255.255.248
    !
    interface Vlan5
    No nameif
    security-level 50
    IP 10.10.10.1 255.255.255.0
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    switchport access vlan 5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passive FTP mode
    clock timezone GMT 0
    standard permit access list MASTERPWRTRANS_splitTunnelAcl *. . 149.0 255.255.255.0
    allow inside_nat0_outbound to access extensive ip list *. . 149.0 255.255.255.0 172.30.110.0 255.255.255.224
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    local pool POOL1 172.30.110.1 - 172.30.110.30 IP 255.255.255.224 mask
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    Global (outside) 2 *.165.37.132
    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 2 *. .149.199 255.255.255.255
    NAT (inside) 1 0.0.0.0 0.0.0.0
    static (exterior, Interior) *. .149.199 *.165.37.132 netmask 255.255.255.255
    Route outside 0.0.0.0 0.0.0.0 * 1.165.37.134
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    RADIUS protocol Server AAA MPT
    AAA server MPT (inside) host .149.210
    Timeout 5
    key *.
    AAA authentication enable LOCAL console
    the ssh LOCAL console AAA authentication
    Enable http server
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outdoors
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    md5 hash
    Group 2
    life 86400
    Telnet *. . 149.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 5
    Console timeout 0
    management-access inside

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    internal MASTERPWRTRANS group policy
    MASTERPWRTRANS group policy attributes
    value of DNS server *. . 149.10 *. . 149.11
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list MASTERPWRTRANS_splitTunnelAcl
    MCI.local value by default-field
    ptiadmin encrypted BtOLil2gR0VaUjfX privilege 15 password username
    mptadmin U2T.1fmOIe772zE username password / encrypted
    type tunnel-group MASTERPWRTRANS remote access
    attributes global-tunnel-group MASTERPWRTRANS
    POOL1 address pool
    TPM authentication server group
    Group Policy - by default-MASTERPWRTRANS
    IPSec-attributes tunnel-group MASTERPWRTRANS
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    Cryptochecksum:820529ed70de923a8375694004b2544c
    : end
    ciscoasa #.

    The 2821 should have a route pointing to the ASA for the VPN address pool (because the ASA is not the default gateway for the LAN).

    That should do it.

    Federico.

  • one of the VM cannot access network LAN

    Hello

    I configured 3 VM on an ESXi 4.1 (see attached jpg file). one of the virtual machine (GSPPBPCDBVM), it cannot access the network LAN, even cannot ping Bridge but can ping GSPPBPCVM after I walk today, previously, it was ok. The other 2 VM can access LAN network. What could be the problem?

    GSPPBPCVM (128.1.8.x)

    GSPPBPCDBVM (128.1.8.x)

    AEPAD (10.8.1.x)

    vmnic1 (to connect to the local network virtual 128.1.8.x)

    vmnic0 (to connect to the local network virtual 10.8.1.x)

    Thank you and best regards,

    Kelvin

    With the configuration you have posted, you have a 50/50 chance that none of your VM will have access to the network, since you have 2 NICs connected to two different VLANS and virtual machines are assigned to these network cards based on the virtual switch port (assuming you use the default settings).

    To properly set up the network, you have two options:

    1.) VLAN tagging on the physical switch ports (what you have)

    In this case, you will need to create a second vSwitch and attach the second NETWORK card to this switch. Then connect virtual machines to the vSwitch and port group that is connected to the switch port VLAN corresponding physics.

    2.) VLAN tagging on the virtual port group (this is what I recommend)

    Configure the ports on your physical switch as the trunk (or ports 'labelled' If you use Procurve switches), create another port VM on vSwitch0 group and set up VLAN tags on the gropus (VMKernel, VM Network1, VM Network2) port

    Take a look at http://www.vmware.com/files/pdf/virtual_networking_concepts.pdf for more information.

    André

  • Just upgraded to El Capitan and cannot access the calendar. It opens with a "Shift schedules to the server" message Can only Force Quit

    Just upgraded to El Capitan and cannot access the calendar. It opens with a message 'Moving calendars to the server.

    I cannot access all features and can be closed only by using force quit.

    Please stop calendar and also the application of reminders, runs. Force quit if necessary.

    Back up all data.

    If you synchronize some of your calendars, or reminders with iCloud, then in the iCloud preferences window, uncheck that marked calendars and reminders. You will be prompted to confirm that you want to remove your iCloud calendars and reminders of the computer. They will always be in iCloud. Re-check the boxes.

    If you synchronize agendas or reminders with another network such as Google service, please open the preferences panel Internet accounts. Make a note of the settings for calendar accounts, then delete and recreate.

    Launch schedule and see if there is an improvement.

  • System 32 error (0x00000020): "the process cannot access the file because it is being used by another process.". The operation to open the file will fail with error - 1032 (0xfffffbf8(JET_errFileAccessDenied))"

    Original title: svchost (1020)

    Event type: error
    Event source: ESENT
    Event category: general
    Event ID: 490
    Date: 2010-10-19
    Time: 14:51:34
    User: n/a
    Computer: ROB
    Description:
    Svchost (1020) an attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with the error System 32 (0x00000020): "the process cannot access the file because it is being used by another process.".  The operation to open the file will fail with error - 1032 (0xfffffbf8(JET_errFileAccessDenied)).

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Hi Robrw,

    1. when exactly you receive this error?

    2. don't you make changes to the computer before this problem?

    You can try to rename the catroot2 folder and check if it helps.

    Step 1:

    a. Click Start and in run type C:\windows\system32 and click ok

    b. find the Catroot2 folder. Right-click on Catroot2 and rename it to Catroot2.old

    If you are not able to do the normal mode, try to start in safe mode and rename

    Check out the link for more information on starting your computer in SafeMode below:

    http://support.Microsoft.com/kb/315222

    Step 2:

    If you are unable to access the catroot2 folder, and then try to change the permissions on the files and check if it helps.

    See the following article:

    How to capture a file or a folder in Windows XP

    http://support.Microsoft.com/kb/308421

    Step 3:

    You can also try to temporarily disable third-party security software and firewalls and check what is happening.

    Note: Activate the security software after the resolution of the problem.

    Hope this information is useful.

    Jeremy K
    Microsoft Answers Support Engineer
    Visit our Microsoft answers feedback Forum and let us know what you think.

    If this post can help solve your problem, please click the 'Mark as answer' or 'Useful' at the top of this message. Marking a post as answer, or relatively useful, you help others find the answer more quickly.

  • When I receive e-mails with an attachment can not open, it says: Windows media player cannot access the file, Please HELP

    WHEN I RECEIVE AN EMAIL WITH AN ATTACHMENT I CAN'T OPEN IT. IT SAYS WINDOWS MEDIA PLAYER CANNOT ACCESS THE FILE.

    Help, please

    How this is related to Windows Update, John?

  • VPN IS CONNECTED BUT CANNOT ACCESS THE INTERNAL NETWORK

    I tried to set up a simple customer vpn using this document

    http://www.Cisco.com/en/us/products/sw/secursw/ps2308/products_configuration_example09186a00801e71c0.shtml

    VPN IS CONNECTED BUT CANNOT ACCESS THE INTERNAL NETWORK BEHIND "RA"...

    6.3 (5) PIX version

    interface ethernet0 car

    Auto interface ethernet1

    ethernet0 nameif outside security0

    nameif ethernet1 inside the security100

    activate the encrypted password of VmHKIhnF4Gs5AWk3

    VmHKIhnF4Gs5AWk3 encrypted passwd

    hostname VOIPLABPIX

    domain voicelab.com

    fixup protocol dns-length maximum 512

    fixup protocol ftp 21

    fixup protocol h323 h225 1720

    fixup protocol h323 ras 1718-1719

    fixup protocol http 80

    fixup protocol they 389

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol sip 5060

    fixup protocol sip udp 5060

    fixup protocol 2000 skinny

    fixup protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol tftp 69

    names of

    access-list 101 permit ip 172.10.2.0 255.255.255.0 172.10.3.0 255.255.255.0

    access-list 101 permit ip 172.10.1.0 255.255.255.0 172.10.3.0 255.255.255.0

    access-list 102 permit ip 172.10.2.0 255.255.255.0 172.10.3.0 255.255.255.0

    access-list 102 permit ip 172.10.1.0 255.255.255.0 172.10.3.0 255.255.255.0

    pager lines 24

    Outside 1500 MTU

    Within 1500 MTU

    IP address outside 208.x.x.11 255.255.255.0

    IP address inside 172.10.2.2 255.255.255.0

    alarm action IP verification of information

    alarm action attack IP audit

    IP local pool voicelabpool 172.10.3.100 - 172.10.3.254

    history of PDM activate

    ARP timeout 14400

    NAT (inside) - 0 102 access list

    Route outside 0.0.0.0 0.0.0.0 208.x.x.11 1

    Route inside 172.10.1.0 255.255.255.0 172.10.2.1 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

    H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

    Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    AAA-server GANYMEDE + 3 max-failed-attempts

    AAA-server GANYMEDE + deadtime 10

    RADIUS Protocol RADIUS AAA server

    AAA-server RADIUS 3 max-failed-attempts

    AAA-RADIUS deadtime 10 Server

    AAA-server local LOCAL Protocol

    Enable http server

    http 172.0.0.0 255.0.0.0 inside

    http 0.0.0.0 0.0.0.0 inside

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    No trap to activate snmp Server

    enable floodguard

    Permitted connection ipsec sysopt

    Crypto ipsec transform-set esp-aes-256 trmset1, esp-sha-hmac

    Crypto-map dynamic map2 10 set transform-set trmset1

    map map1 10 ipsec-isakmp crypto dynamic map2

    client authentication card crypto LOCAL map1

    map1 outside crypto map interface

    ISAKMP allows outside

    ISAKMP identity address

    part of pre authentication ISAKMP policy 10

    ISAKMP policy 10 encryption aes-256

    ISAKMP policy 10 sha hash

    10 2 ISAKMP policy group

    ISAKMP life duration strategy 10 86400

    vpngroup address voicelabpool pool cuclab

    vpngroup dns 204.x.x.10 Server cuclab

    vpngroup cuclab by default-field voicelab.com

    vpngroup split tunnel 101 cuclab

    vpngroup idle 1800 cuclab-time

    vpngroup password cuclab *.

    Telnet timeout 5

    SSH 208.x.x.11 255.255.255.255 outside

    SSH 0.0.0.0 0.0.0.0 outdoors

    SSH 172.10.1.2 255.255.255.255 inside

    SSH timeout 60

    Console timeout 0

    username labadmin jNEF0yoDIDCsaoVQ encrypted password privilege 2

    Terminal width 80

    Cryptochecksum:b03a349e1ac9e6022432523bbb54504b

    : end

    Try to turn on NAT - T

    PIX (config) #isakmp nat-traversal 20

    http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807e0aca.shtml#Solution1

    HTH

  • Cannot access a file with a padlock in the icon.

    Cannot access a file with a padlock in the icon.

    I created a file using an application called TV Expert (download the file of my Cam handy Sony Hi-8 on PC). I can access the file by using the software, but cannot access the file using Windows Explorer. The location of the file is c:\Program Files\TVExpert\Movie.

    The file size is about 3.6 GB , when I check the size of the Explorer folder it sows 0 bytes .

    When I open the file using the TV Expert software I see a Pad lock symbol in the icon of the file

    I want to copy the file to another location so that I can edit the file.

    Try this: right click on the file > do you see in unlock general tab button? If so, click it.

    ...

    If it does not help...

    What happens when you try to copy this file to another location? Do you take information that it can be done by the administrator? If Yes, there should be a continue button, so click it.

    You can also try this: right click on the file > Properties > Security tab. Who is listed under group or user names ? Is your user name? If not, you can click on change... > Add... > enter your username > OK

  • Cannot connect to the easy VPN server

    Hi *.

    I have a stupid problem with my easy VPN server. I took the following configuration to configure the VPN: click on

    Successfully, I can ping 192.168.99.1 but when I start AnyConnect (enter this IP address as serveraddress) on my IPhone, it first says that the server certificate is not valid (I ignore because it is self-signed..) and when I press continue it says that no link could be established.

    What can be the problem?

    It is very likely that you have a configured PAT-pool and simply use the Word key "overload" when from your external interface. In this command, you reference an ACL (or an ACL in a road map) where we need to ensure that your VPN-pool in included in the traffic using a NAT.

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • a computer laptop, internet is accessible only if proxyserver offline, my office internet is accessible with the proxy server. without him we cannot access the internet.

    I am faced with a kind of strange and unusual error. in my office, the internet is accessible with the proxy server. without him we cannot access the internet. However, there is a laptop computer on which some time the internet is accessible only when I leave the proxyserver only on that machine... any idea?

    Hello

    Work on a domain environment?

    Changing the proxy settings is something that you usually only have to do if you connect to the Internet via a corporate network. By default, Internet Explorer automatically detects proxy settings. However, you may need to manually set a proxy with information supplied by your network administrator.

    If you are on a domain environment then please post the question on the link mentioned below using:
    http://social.technet.Microsoft.com/forums/en/w7itpronetworking/threads

  • Problem with Windows Search 'Windows cannot access the specified device, file, or path. May not be the appropriate permissions for access you to computing.

    I have a very annoying problem:


    OT: Problem with Windows Search
    When I try to use Windows Search in the menu start I get the message "Windows cannot access the specified device, file, or path. May not permissions to access you the item. I get this message no matter what I type in. Therefore, I can't find something on my computer and continually to achieve this result.
    Could someone please help me solve this problem?
    I tried what answers I could find other peoples messages online, nothing helps. I'd appreciate any help.
    Thank you very much.

    Hello

    You did changes to the computer before the show?

    I suggest you try the steps from the following link:

    Error "Windows cannot access the specified device, path or file" when you try to install, update or launch a program or file
    http://support.Microsoft.com/kb/2669244

  • I tried to download PES 13 and everything I had, it was a folder called 'Package' which I still cannot access the post-secondary education program. I have a Compaq laptop with Windows 7. Help, please.

    I tried to download PES 13 and everything I had, it was a folder called 'Package' which I still cannot access the post-secondary education program. I have a Compaq laptop with Windows 7. Help, please.

    Make sure you download the windows files.

    You must download a 7z and an exe file.  put them both in the same directory and double-click on the exe file.

    Available downloadable Setup files:

    Download and installation help links Adobe

    Help download and installation to Prodesigntools links can be found on the most linked pages.  They are essential; especially steps 1, 2 and 3.  If you click on a link that does not have these listed steps, open a second window by using the link to Lightroom 3 to see these "important Instructions".

    window using the Lightroom 3 link to see these "important Instructions".

  • Cannot access the internet with bridged network - Windows 7 64 bit host, XPSP3 comments

    I use VMPlayer v3.0.1 build-227600 on a PC under Windows 7 64-bit. My guest operating system is Windows XP Professional w/SP3.

    I read all the messages on the use of NAT for the guest operating system can access the internet. But when I do that my guest is unable to access my Oracle server on my network. If I use Bridged my guest can access my Oracle server, but it cannot access the internet! How can I fix it? Shouldn't VMPlayer allow the guest OS to access the network and the internet? I need these two features.

    Any help would be appreciated.

    the simplest solution would be to add a second NIC to your comments, so that you can have bridged and NAT at the same time

    ___________________________________

    VMX-settings- Workstation FAQ -[MOA-liveCD | http://sanbarrow.com/moa241.html]- VM-infirmary

Maybe you are looking for