Cannot ping my esx Server

Hi all

I hope you can help, this problem has been driving me crazy for some Richard now!

Firstly a bit of history... We have a Compaq ML760 running esx 3.0.1 attached to 2 SCSI disk bays. On weekends, this system was powered down by our partners to outsource in replacement of the ups in the rack. When turning the power on it we lost communication with the inverter boards... a new case, few new readers and reconstruction of the RAID the latter we have an ESX that starts in the log on screen with no obvious errors.

So, the problem is that since we cannot ping or connect to any other way of our ESX Server. Now, before that I have to go any further in my opinion, it is worth noting that I'm not an expert of linux/esx I know enough to login as root and run a few commands.

I have read several discussions around this issue and none seem to apply to my situation. Not only did I not ping my ESX, when I log into the ESX I can't ping any device, even the entry door. I had a quick glance at the configuration (should not have changed during the upgrade of the UPS!) and everything looks ok to me, feel free to correct me, the info is here:! esxcfg-NICS. JPG!

any ideas would be appreciated!

Thanks in advance,

Adam

Adam - I had a very similar problem in my test once environment. Everything was going well, all settings have been properly etc... but no connectivity ntwk. I had to remove my network config and rebuild. You can try just a little at a time to see if it works. Try to create a new vSwitch, move your top Service Console and assign a network adapter with the appropriate vlan information. See if it works then. That should give you an idea if there is a kind of corruption with the current configuration of ntwk.

This site will give you all the commands necessary to accomplish these tasks:

http://B2V.co.UK/b2vguide2vmware3.htm

Tags: VMware

Similar Questions

Cannot add vSphere ESX server in Cluster 4

Good evening everyone
I just finished installing 2 vSphere 4 Essential Edition more servers. Has finished installing vCenter and configured in the data center, I plugged the server vCenter ESX host and create a new cluster with HA features.
When I drag one of the two ESX servers in the cluster, the progress bar stops at 84% and then I got the following error:
Name_esx.domain HA configuration
Can not complete the configuration of the Agent on the host. See the details of the task for more information. Another HA configuration error.
System
vCenter.Domain
2009-10-21 22:13:09
2009-10-21 22:13:09
2009-10-21 22:27:18
Assuming that I have a problem with the license I have everything configured in evaluation mode, but nothing.
I don't understand where it may be the problem.
Thanks in advance

try to restart the management agents and try again. In addition, if you have no virtual machine running on the host computer, add it to the cluster maintenance mode, then press exit maintenance mode once the host is in the cluster.

> service vmware-vpxa restart

... also, what happens if you try "reconfigure for ha?

Problem connecting to the ESX Server in the Windows domain controller workstation

Nice day
I'm trying to set up a lab for the test server ESX 4 on VMware Workstation 7.1.1 running in Ubuntu 10.04 LTS.
Basic configuration is such;
Windows 2008 R2 AD domain controller
IP: 192.168.9.103
SM: 255.255.255.0
DG: 192.168.9.1
ESX1 host
IP: 192.168.9.109
SM: 255.255.255.0
DG: 192.168.9.1
Both are configured with Bridged networking in my computer. I can ping the system Windows 2008 in my Ubuntu system, but cannot ping the ESX 4 server. I can ping the DG of the Windows 2008 system, but cannot ping the DG of ESX4 system. I ping the ESX4 server by IP address and name for itself. I added a DNS entry in Windows 2008 for the server, ESX4. I can't ping the Windows Server 2008 of ESX4 host.
There is an entry in/etc/hosts on the ESX host to IP address and the name of the ESX host. If I look at/etc/sysconfig/network-scripts/ifcfg-vwif0 I see doing a show at the 192.168.9.255, IPADDR 192.168.9.109 in sysconfig there is an entry for the ESX host name thats right, pointing to the front door of 192.168.9.1 using GATEWAYDEV = vswif0, n - route shows 192.168.9.1 as the UG.
All tests seem to indicate a problem with the default gateway that is used to communicate between these 2 VM.
If someone could please provide suggestions as to where I could look, I would appreciate it.
Kind regards
powderskier

AFAIK, you must enable Supreme mode for the virtual ESX using Linux as a host.

See my notes http://sanbarrow.com/vmx/vmx-network-advanced.html

_________________________

VMX-settings- WS FAQ -[MOAcd | http://sanbarrow.com/moa241.html]- VMDK-manual

ESX Server timed out when I try to enter the license server in the CR

Hi all
I have a problem with the addition of two new ESX servers in our virtual Center.
Let me give you a brief overview:
We have 5 servers ESX and virtual Center Server.
All servers are in a single Cluster (Cluster 01)
Now, we want to use Virtual Desktop Infrastructure and for this reason, we bought another 2 servers (blades).
I installed from scratch with ESX 3.5 Update 4.
I did a second Cluster in our VC (Group 02) and add the two.
I configured the network settings and storage, everything went very well, shoot when I want to point to our license server, whenever I get an error message from our VC. Operation timed out and my settings when not accepted. No matter if I get the IP address or FULL domain name. BUT I can ping our server to ESX Server licenses, so I'm not sure if this is some sort of DNS issue or not.
Another note: our first 5 ESX servers where ESX Server Standard license.
Our new ESX servers where an ESX Server VDI license. I used the CD to install ESX normal, because I have not found any VDI install special files.
I see all licenses in the Administration view in our VC, so I think our license file is not corrupted.
Things I've done so far:
Renewal of license, start stop server, esx Server license installed twice from scratch
I have no more ideas, I hope someone could help me with this problem.

According to your image, you have 0 agent licenses virtual centre-left to allocate to new hosts. What might happen, is that the agent is not properly installed on the new servers. Connect to ESX servers. Make sure that you can test the virtual Center by domain name server FULL and hostname, not only by intellectual property. From your RESUME, ping your esx server fqdn and the host name.

Also, check the file/etc/hosts on your esx server and make sure that the entries are tiny.

-KjB

VMware vExpert

Cannot ping virtual machine Windows 7 vm Server 2012 [Server R2 2012]

Hi all
I'm not sure that this is a vmware workstation or server 2012 r2 problem, but I would still ask thought.
I have a 2012 r2 vm server and win 7 vm in a ' host-only: a private network, shared with the host country "network connection.
I can ping the server vm win7, but cannot ping the ""Server the VM win7 ". "
But when I point the win7 dns on the server 2012R2 (that has AD and DNS configured) I can join the virtual machine Windows 7 announcement.
Its totally weird
Whenever I try to win7 from the ping server, it says "Request Timed Out".
Does anyone know how can I fix?
I'm using VMWare Workstation 11
Thank you
Post edited by: Michael Hilburt

Is there a way to get pings without demeaning the whole firewall?

https://TechNet.Microsoft.com/en-us/library/cc972926%28V=WS.10%29.aspx?f=255&MSPPError=-2147217396

After that stright connected to iSCSI (initiator) Host cannot ping the server iSCSI (target), but the target can, why?

After that host on vSHere 4.0 strightly connected to iSCSI (initiator) host cannot ping the server iSCSI (target), but target can. And iSCSI works well. I mean I can create and use the iSCSI disk, why? It makes me confused.
Thank you!

Geoarge,

iSCSI traffic uses a VMkernel port, instead of using the command 'ping', use 'vmkping '.

André

Cannot find device write VMware esx server 3i image support to.

Hello
I'm fairly new Virtualization.
I downloaded: VMware ESX Server 3i Installable U4, Refresh Version 3.5 Update 4 | 153875-30-03-09 on the site and it burned on a disc. at the start of the disk and following the instructions in the installation guide, I get the following error:
The installation operation failed!
The installation operation has encountered a fatal error!
Cannot find device write VMware esx server 3i image support to.
The following system information will help the forum of VMWare support with your problem. Please note the information before proceeding.
Information System
Manufacturing: abandoned
Model: abandoned
Service etiquette: abandoned
BIOS Rev: SGP4510H.06A.0083.2008.0819.1026

OK, I can tell that you are new to this sort of thing, using windows XP, it is the best guide I have found for you should you walk through all the way.

http://www.Symantec.com/connect/articles/how-create-your-own-bootable-ESX-3i-USB-stick

VM management host cannot ping gateway or switch

Hello

We have a server Esx 5.0 with 3 vm on it. When I try to ping the management network of vm for my pc that I do not get an answer too trying to ping from the vmn console I can not ping to the gateway, but I can ping dns. However, I can rdp in vm servers and the ping to the gateway of each server, as well as newspapers in vsphere. We have a system with 2 voip VLAN, the other data and another for voice. Hosts and servers are all on the same cisco switch.
VM management network
IP - 192.168.1.6
Sub - 255.255.255.0
GW - 192.168.1.1
DNS - 192.168.1.10
Cisco switch - 192.168.1.3
Data Vlan - 192.168.1.1
Firewall - 192.168.1.2
PC
-cannot ping 192.168.1.6
-can ping everything else
From the console network management
-cannot ping 192.168.1.1 a.3 or any pc
-can ping 192.168.1.10
It sounds like a switch problem but do not know how to fix it. The switch is a switch of cisco small business pro 8 ports

Make sure that your routing has L3 to a defined network to get traffic to your host (192.168.1.0/24) network to any network it seeks to achieve. You did not show what the subnet for the PCs are so I'm not sure that the network is.

Regarding the gateway ping, make sure that the echo ICMP message is enabled by the firewall so that ping responses can go to the host. If you still cannot ping the gateway with that on, there may be a larger problem with your connectivity.

Cannot ping Lan devices in Vlan

Hello

I looked for a solution to this for the week without success. I came across a Cisco C3560, which is used because of its ability of poe to power some Deskphones Voip. While the works of great poe, machines connected to the switch can only communicate with each other and don't can't ping or otherwise access any device connected directly to the router of the network.

The Cisco switch is configured with a vlan and a default gateway, but nothing comes out by behind the switch. On connected devices can ping by default gateway (192.168.0.1 - a tp-link router), receive a lease dhcp from the router said successfully and can connect to the internet, but on the local network, nothing works. (unable to connect to the printer connetced directly to the router or other computers connected directly to the router.

Any advice? I am new to cisco switches, don't know what I'm doing here. I'm just trying to get devices that are connected directly to the switch to communicate with devices connected directly to the router.

Switch#show runBuilding configuration...

Current configuration : 1528 bytes!version 12.2service configno service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Switch!enable secret 5 {}{}{}{}{}{}{}{}{}{}{}{}!no aaa new-modelclock timezone UTC 2system mtu routing 1500ip subnet-zero!!!!no file verify autospanning-tree mode pvstspanning-tree extend system-id!vlan internal allocation policy ascending!interface FastEthernet0/1!interface FastEthernet0/2!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24 switchport mode access!interface GigabitEthernet0/1!interface GigabitEthernet0/2!interface Vlan1 ip address 192.168.0.26 255.255.255.0 no ip route-cache!ip default-gateway 192.168.0.1ip classlessip default-network 192.168.0.0ip http server!access-list 1 permit any log!control-plane!!line con 0line vty 0 4 password XXXXXXXXX login length 0line vty 5 15 password XXXXXXXX login length 0!end

 Switch#show interface

Vlan1 is up, line protocol is up Hardware is EtherSVI, address is 001e.bd27.c4c0 (bia 001e.bd27.c4c0) Internet address is 192.168.0.26/24 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 3 packets/sec 138534 packets input, 9472693 bytes, 0 no buffer Received 0 broadcasts (68 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 30296 packets output, 2248820 bytes, 0 underruns 0 output errors, 1 interface resets 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/2 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c484 (bia 001e.bd27.c484) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:56, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 46000 bits/sec, 37 packets/sec 5 minute output rate 582000 bits/sec, 71 packets/sec 1941044 packets input, 327622438 bytes, 0 no buffer Received 38375 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 30699 multicast, 0 pause input 0 input packets with dribble condition detected 3224783 packets output, 2069682884 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/4 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c486 (bia 001e.bd27.c486) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 129069 packets input, 64947010 bytes, 0 no buffer Received 9953 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9759 multicast, 0 pause input 0 input packets with dribble condition detected 600269 packets output, 45540585 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/6 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c488 (bia 001e.bd27.c488) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:50, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 32693 packets input, 4244428 bytes, 0 no buffer Received 9942 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9759 multicast, 0 pause input 0 input packets with dribble condition detected 588460 packets output, 45003331 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/8 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c48a (bia 001e.bd27.c48a) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:30, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 32694 packets input, 4243413 bytes, 0 no buffer Received 9934 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9757 multicast, 0 pause input 0 input packets with dribble condition detected 588485 packets output, 45009466 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/12 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c48e (bia 001e.bd27.c48e) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:28, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 32742 packets input, 4252075 bytes, 0 no buffer Received 9947 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9763 multicast, 0 pause input 0 input packets with dribble condition detected 588497 packets output, 45019272 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/13 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c48f (bia 001e.bd27.c48f) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:13, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 148160 packets input, 73818106 bytes, 0 no buffer Received 9973 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9760 multicast, 0 pause input 0 input packets with dribble condition detected 599666 packets output, 49045070 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/14 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c490 (bia 001e.bd27.c490) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:05, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 129165 packets input, 68409495 bytes, 0 no buffer Received 9982 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9773 multicast, 0 pause input 0 input packets with dribble condition detected 600283 packets output, 45551497 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/18 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c494 (bia 001e.bd27.c494) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:49, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 21000 bits/sec, 18 packets/sec 5 minute output rate 13000 bits/sec, 16 packets/sec 606386 packets input, 88151136 bytes, 0 no buffer Received 159883 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 55198 multicast, 0 pause input 0 input packets with dribble condition detected 941617 packets output, 308269004 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/20 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c496 (bia 001e.bd27.c496) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:54, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 1000 bits/sec, 1 packets/sec 5 minute output rate 1000 bits/sec, 2 packets/sec 515813 packets input, 87006769 bytes, 0 no buffer Received 21466 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 19952 multicast, 0 pause input 0 input packets with dribble condition detected 1858112 packets output, 1700009146 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/24 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c49a (bia 001e.bd27.c49a) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 546556 packets output, 41182636 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

GigabitEthernet0/1 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is 001e.bd27.c481 (bia 001e.bd27.c481) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not set Full-duplex, 1000Mb/s, link type is auto, media type is 10/100/1000BaseTX SFP input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 556000 bits/sec, 83 packets/sec 5 minute output rate 76000 bits/sec, 63 packets/sec 4457827 packets input, 3961330567 bytes, 0 no buffer Received 15028 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 11213 multicast, 0 pause input 0 input packets with dribble condition detected 3822373 packets output, 728132696 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

Switch#show vlan

VLAN Name     Status         Ports---- -------------------------------- --------- -------------------------------1     default active    Fa0/1, Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16                        Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Gi0/1, Gi0/21002 fddi-default act/unsup1003 token-ring-default act/unsup1004 fddinet-default act/unsup1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------1 enet 100001 1500 - - - - - 0 01002 fddi 101002 1500 - - - - - 0 01003 tr 101003 1500 - - - - - 0 01004 fdnet 101004 1500 - - - ieee - 0 01005 trnet 101005 1500 - - - ibm - 0 0

Remote SPAN VLANs------------------------------------------------------------------------------

Primary Secondary Type Ports------- --------- ----------------- ------------------------------------------

Hello

first thing, please edit your post and remove your remote vty lines access password

never send passwords on a public forum for the just in case production equipment

line vty 0 4
password xxxxxx

***********************

Your question

What is the configuration of the router as a switch which seems to work correctly you're saying and I configured its doing its job, don't forget you said that you cannot route no between the router and the router switch should take care of this, whats the vlan ports on the router are on is - what the same subnet do they get an ip address in the same subnet off dhcp as devices of switching, if they do, and you cannot ping them to the same subnet theres something upward on the side of the router it would treat for layer 3 routing ip traffic

the ping to the router devices connected to the cisco switch and can the device on the router cannot ping devices switches

If you move a device out of the router and attach it to the doe sit switch still work ok, reach the talk of the internet to other devices on the switch?

As there is a layer 2 switch you don't need this command you have your entry door you can remove it.. .IP default-network 192.168.0.0

Cisco ezvpn ASAs cannot ping each other inside interfaces

I have a set ezvpn in place with a 5506 (position B) client-side and a 5520 (location A) server-side. I have successfully connected vpn, and traffic flows. My problem is that I can't SSH in the location b. investigate this more than I can not ping is within the interface of the ASA opposing, or the machines inside each ASA ASA.

I found the following links that describes a scenario similar to mine, but nothing on one of them helped me.
http://www.experts-exchange.com/questions/28388142/cannot-ping-ASA-5505-inside-interface-across-VPN.html
https://www.fir3net.com/firewalls/Cisco/Cisco-ASA-proxy-ARP-gotcha.html
https://supportforums.Cisco.com/discussion/11755586/Cisco-ASA-VPN-established-cant-ping

I joined sanitized versions of these two configs. Any help is appreciated.

Hi Adam

The site of B I'm not able to see "management of access to inside. Please try to set up the same. He could solve the problem.

Also on the instruction of the ASA takes place nat can you please try to add keywords 'search non-proxy-arp route'.

something like:
```
nat (inside,outside) source static (Location A)_Networks (Location A)_Networks destination static (location B)-remote_network (location B)-remote_network no-proxy-arp route-lookup
```
as I have noted problems with inside access to interface via the VPN when those keywords are not applied. If I remember correctly 8.6.x ASA version had a bug regarding the same. Cordially Véronique

cannot ping between remote vpn site?

vpn l2l site A, site B is extension vpn network, connect to the same vpn device 5510 to the central office and work well. I can ping from central office for two remote sites, but I cannot ping between these two vpn sites? Tried to debug icmp, I can see the icmp side did reach central office but then disappeared! do not send B next? Help, please...

permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
!
object-group network SITE-a.
object-network 192.168.42.0 255.255.255.0
!
object-group network SITE-B
object-network 192.168.46.0 255.255.255.0
!
extended OUTSIDE allowed a whole icmp access list
HOLT-VPN-ACL extended access-list allow ip object-CBO-NET object group SITE-a.
!
destination SITE-a NAT (outside, outside) static source SITE - a static SITE to SITE-B-B
!
address for correspondence card crypto VPN-card 50 HOLT-VPN-ACL
card crypto VPN-card 50 peers set *. *.56.250
card crypto VPN-card 50 set transform-set AES-256-SHA ikev1
VPN-card interface card crypto outside
!
internal strategy group to DISTANCE-NETEXTENSION
Remote CONTROL-NETEXTENSION group policy attributes
value of DNS server *. *. *. *
VPN-idle-timeout no
Ikev1 VPN-tunnel-Protocol
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value REMOTE-NET2
value by default-field *.org
allow to NEM
!
remote access of type tunnel-group to DISTANCE-NETEXTENSION
Global DISTANCE-NETEXTENSION-attributes tunnel-group
authentication-server-group (inside) LOCAL
Group Policy - by default-remote CONTROL-NETEXTENSION
IPSec-attributes tunnel-group to DISTANCE-NETEXTENSION
IKEv1 pre-shared-key *.
tunnel-group *. *.56.250 type ipsec-l2l
tunnel-group *. *.56.250 ipsec-attributes
IKEv1 pre-shared-key *.
!

!

ASA - 5510 # display route. include the 192.168.42
S 192.168.42.0 255.255.255.0 [1/0] via *. *. 80.1, outside
ASA - 5510 # display route. include the 192.168.46
S 192.168.46.0 255.255.255.0 [1/0] via *. *. 80.1, outside
ASA-5510.

!
Username: Laporte-don't Index: 10
Assigned IP: 192.168.46.0 public IP address: *. *.65.201
Protocol: IKEv1 IPsecOverNatT
License: Another VPN
Encryption: 3DES hash: SHA1
TX Bytes: bytes 11667685 Rx: 1604235
Group Policy: Group remote CONTROL-NETEXTENSION Tunnel: remote CONTROL-NETEXTENSION
Opening time: 08:19:12 IS Thursday, February 12, 2015
Duration: 6 h: 53 m: 29 s
Inactivity: 0 h: 00 m: 00s
Result of the NAC: unknown
Map VLANS: VLAN n/a: no
!
ASA - 5510 # display l2l vpn-sessiondb

Session type: LAN-to-LAN

Connection: *. *.56.250
Index: 6 IP Addr: *. *.56.250
Protocol: IPsec IKEv1
Encryption: AES256 3DES hash: SHA1
TX Bytes: bytes 2931026707 Rx: 256715895
Connect time: 02:00:41 GMT Thursday, February 12, 2015
Duration: 13: 00: 10:00

Hi Rico,

You need dynamic nat (for available IP addresses) for the two side to every subset of remote access to the other side remote subnet and so they can access every other subnet as if both from the traffic from your central location.

example:

Say, this IP (10.10.10.254) is unused IP to the central office, allowed to access remote tunnel 'A' and 'B' of the site.

object-group network SITE-a.
object-network 192.168.42.0 255.255.255.0
!
object-group network SITE-B
object-network 192.168.46.0 255.255.255.0

dynamic source destination SITE-a. 10.10.10.254 NAT (outdoors, outdoor)
public static SITE SITE-B-B

destination NAT (outdoors, outdoor) SITE-B 10.10.10.254 dynamic source
SITE static-SITE a

Hope this helps

Thank you

Rizwan James

Customer remote VPN cannot ping certain IP

My Cisco VPN client can establish the tunnel with my successful ASA5505 Office vpn but cannot ping some IP such as an internal server (10.100.194.6).

FIREWALL-1 # ping 10.100.194.6
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 10.100.194.6, wait time is 2 seconds:
!!!!!
Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/1 ms

Why I can't ping certain IP?

Help, please.

Thank you.

Hey Kevin,

Check out the capture, it is obvious that there is a problem of internal routing as we can see packets from the VPN client requests, but there is no response from the server package.

Please ensure that the server has pointing on the Firewall VPN subnet route.
HTH.

Kind regards

Dinesh Moudgil

PS: Please check the useful messages.

Peer AnyConnect VPN cannot ping, RDP each other

I have an ASA5505 running ASA 8.3 (1) and ASDM 7.1 (1). I have a remote access VPN set up and remote access users are able to connect and access to network resources. I can ping the VPN peers between the Remote LAN. My problem counterparts VPN cannot ping (RDP, CDR) between them. Ping a VPN peer of reveals another the following error in the log of the SAA.

Asymmetrical NAT rules matched for flows forward and backward; Connection for icmp outside CBC: 10.10.10.8 outside dst: 10.10.10.9 (type 8, code 0) rejected due to the failure of reverse NAT.

Here's my ASA running-config:

ASA Version 8.3 (1)

!

ciscoasa hostname

domain dental.local

activate 9ddwXcOYB3k84G8Q encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address dhcp setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone CST - 6

clock to summer time recurring CDT

DNS lookup field inside

DNS server-group DefaultDNS

192.168.1.128 server name

domain dental.local

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

network obj_any object

subnet 0.0.0.0 0.0.0.0

network of the RAVPN object

10.10.10.0 subnet 255.255.255.0

network of the NETWORK_OBJ_10.10.10.0_28 object

subnet 10.10.10.0 255.255.255.240

network of the NETWORK_OBJ_192.168.1.0_24 object

subnet 192.168.1.0 255.255.255.0

access-list Local_LAN_Access note VPN Customer local LAN access

Local_LAN_Access list standard access allowed host 0.0.0.0

DefaultRAGroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0

Note VpnPeers access list allow peer vpn ping on the other

permit access list extended ip object NETWORK_OBJ_10.10.10.0_28 object NETWORK_OBJ_10.10.10.0_28 VpnPeers

pager lines 24

Enable logging

asdm of logging of information

logging of information letter

address record [email protected] / * /

exploitation forest-address recipient [email protected] / * / level of information

record level of 1 600 6 rate-limit

Outside 1500 MTU

Within 1500 MTU

mask 10.10.10.5 - 10.10.10.10 255.255.255.0 IP local pool VPNPool

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 711.bin

don't allow no asdm history

ARP timeout 14400

NAT (inside, all) static source all electricity static destination RAVPN RAVPN

NAT (inside, outside) static static source NETWORK_OBJ_10.10.10.0_28 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_10.10.10.0_28

NAT (inside, outside) static source all all NETWORK_OBJ_10.10.10.0_28 of NETWORK_OBJ_10.10.10.0_28 static destination

!

network obj_any object

NAT dynamic interface (indoor, outdoor)

network of the RAVPN object

dynamic NAT (all, outside) interface

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Community SNMP-server

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-DES-SHA-TRANS esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transit

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP ESP-AES-128-SHA ESP - AES - 192 - SHA ESP - AES - 256 - SHA ESP - 3DES - SHA - OF - SHA ESP - AES - 128 - SHA - TRANS ESP - AES - 192 - SHA - TRANS ESP - AES - 256 - SHA - ESP ESP - 3DES - SHA - TRANS TRANS-DES - SHA - TRANS

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

trustpoint crypto ca-CA-SERVER ROOM

LOCAL-CA-SERVER key pair

Configure CRL

Crypto ca trustpoint ASDM_TrustPoint0

registration auto

name of the object CN = ciscoasa

billvpnkey key pair

Proxy-loc-transmitter

Configure CRL

crypto ca server

CDP - url http://ciscoasa/+CSCOCA+/asa_ca.crl

name of the issuer CN = ciscoasa

SMTP address [email protected] / * /

crypto certificate chain ca-CA-SERVER ROOM

certificate ca 01

* hidden *.

quit smoking

string encryption ca ASDM_TrustPoint0 certificates

certificate 10bdec50

* hidden *.

quit smoking

crypto ISAKMP allow outside

crypto ISAKMP policy 10

authentication crack

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 20

authentication rsa - sig

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 40

authentication crack

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 50

authentication rsa - sig

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 60

preshared authentication

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 70

authentication crack

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 80

authentication rsa - sig

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 90

preshared authentication

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 100

authentication crack

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 110

authentication rsa - sig

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 120

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 130

authentication crack

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 140

authentication rsa - sig

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 150

preshared authentication

the Encryption

sha hash

Group 2

life 86400

enable client-implementation to date

Telnet 192.168.1.1 255.255.255.255 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

management-access inside

dhcpd outside auto_config

!

dhcpd address 192.168.1.50 - 192.168.1.99 inside

dhcpd allow inside

!

a basic threat threat detection

threat detection statistics

a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

SSL-trust outside ASDM_TrustPoint0 point

WebVPN

allow outside

SVC disk0:/anyconnect-win-3.1.04072-k9.pkg 1 image

SVC profiles DellStudioClientProfile disk0: / dellstudioclientprofile.xml

enable SVC

tunnel-group-list activate

internal-password enable

chip-tunnel list SmartTunnelList RDP mstsc.exe windows platform

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

Server DNS 192.168.1.128 value

Protocol-tunnel-VPN l2tp ipsec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl

Dental.local value by default-field

WebVPN

SVC value vpngina modules

internal DefaultRAGroup_1 group strategy

attributes of Group Policy DefaultRAGroup_1

Server DNS 192.168.1.128 value

Protocol-tunnel-VPN l2tp ipsec

Dental.local value by default-field

attributes of Group Policy DfltGrpPolicy

Server DNS 192.168.1.128 value

VPN - 4 concurrent connections

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

value of group-lock RAVPN

value of Split-tunnel-network-list Local_LAN_Access

Dental.local value by default-field

WebVPN

the value of the URL - list DentalMarks

SVC value vpngina modules

SVC value dellstudio type user profiles

SVC request to enable default webvpn

chip-tunnel enable SmartTunnelList

wketchel1 5c5OoeNtCiX6lGih encrypted password username

username wketchel1 attributes

VPN-group-policy DfltGrpPolicy

WebVPN

SVC value DellStudioClientProfile type user profiles

username privilege 15 encrypted password 5c5OoeNtCiX6lGih wketchel

username wketchel attributes

VPN-group-policy DfltGrpPolicy

WebVPN

modules of SVC no

SVC value DellStudioClientProfile type user profiles

jenniferk 5.TcqIFN/4yw0Vq1 of encrypted password privilege 0 username

jenniferk username attributes

VPN-group-policy DfltGrpPolicy

WebVPN

SVC value DellStudioClientProfile type user profiles

attributes global-tunnel-group DefaultRAGroup

address pool VPNPool

LOCAL authority-server-group

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared key *.

tunnel-group DefaultRAGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

eap-proxy authentication

type tunnel-group RAVPN remote access

attributes global-tunnel-group RAVPN

address pool VPNPool

LOCAL authority-server-group

tunnel-group RAVPN webvpn-attributes

enable RAVPN group-alias

IPSec-attributes tunnel-group RAVPN

pre-shared key *.

tunnel-group RAVPN ppp-attributes

PAP Authentication

ms-chap-v2 authentication

eap-proxy authentication

type tunnel-group WebSSLVPN remote access

tunnel-group WebSSLVPN webvpn-attributes

enable WebSSLVPN group-alias

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

173.194.64.108 SMTP server

context of prompt hostname

HPM topN enable

Cryptochecksum:3304bf6dcf6af5804a21e9024da3a6f8

: end

Hello

Seems to me that you can clean the current NAT configuration a bit and make it a little clearer.

I suggest the following changes

network of the VPN-POOL object

10.10.10.0 subnet 255.255.255.0

the object of the LAN network

subnet 192.168.1.0 255.255.255.0

PAT-SOURCE network object-group

object-network 192.168.1.0 255.255.255.0

object-network 10.10.10.0 255.255.255.0

NAT static destination LAN LAN (indoor, outdoor) static source VPN-VPN-POOL

destination VPN VPN-POOL POOL static NAT (outside, outside) 1 static source VPN-VPN-POOL

NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

The above should allow
- Dynamic PAT for LAN and VPN users
- NAT0 for traffic between the VPN and LAN
- NAT0 for traffic between the VPN users
You can then delete the previous NAT configurations. Naturally, please save the configuration before you make the change, if you want to revert to the original configuration.

no static source nat (inside, everything) all electricity static destination RAVPN RAVPN

No source (indoor, outdoor) nat static static NETWORK_OBJ_10.10.10.0_28 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_10.10.10.0_28

No source (indoor, outdoor) nat static everything all NETWORK_OBJ_10.10.10.0_28 of NETWORK_OBJ_10.10.10.0_28 static destination

No network obj_any object

No network object RAVPN

In case you do not want to change the settings a lot you might be right by adding this

network of the VPN-POOL object

10.10.10.0 subnet 255.255.255.0

destination VPN VPN-POOL POOL static NAT (outside, outside) 1 static source VPN-VPN-POOL

But the other above configurations changes would make NAT configurations currently simpler and clearer to see every goal of "nat" configurations.

-Jouni

established - VPN connection, but cannot connect to the server?

vpn connection AnyConnect is implemented - but cannot connect to the server? The server IP is 192.168.0.4

Thank you

ASA Version 8.2 (1)

!

hostname ciscoasa5505

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.0.3 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP 208.0.0.162 255.255.255.248

!

interface Vlan5

Shutdown

prior to interface Vlan1

nameif dmz

security-level 50

IP address dhcp setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone PST - 8

clock summer-time recurring PDT

DNS lookup field inside

DNS server-group DefaultDNS

192.168.0.4 server name

Server name 208.0.0.11

permit same-security-traffic intra-interface

object-group Protocol TCPUDP

object-protocol udp

object-tcp protocol

object-group service TS-780-tcp - udp

port-object eq 780

object-group service Graphon tcp - udp

port-object eq 491

Allworx-2088 udp service object-group

port-object eq 2088

object-group service allworx-15000 udp

15000 15511 object-port Beach

object-group service udp allworx-2088

port-object eq 2088

object-group service allworx-5060 udp

port-object eq sip

object-group service allworx-8081 tcp

EQ port 8081 object

object-group service web-allworx tcp

EQ object of port 8080

allworx udp service object-group

16001 16010 object-port Beach

object-group service allworx-udp

object-port range 16384-16393

object-group service remote tcp - udp

port-object eq 779

object-group service billing1 tcp - udp

EQ object of port 8080

object-group service billing-1521 tcp - udp

port-object eq 1521

object-group service billing-6233 tcp - udp

6233 6234 object-port Beach

object-group service billing2-3389 tcp - udp

EQ port 3389 object

object-group service olivia-3389 tcp - udp

EQ port 3389 object

object-group service olivia-777-tcp - udp

port-object eq 777

netgroup group of objects

network-object host 192.168.0.15

network-object host 192.168.0.4

object-group service allworx1 tcp - udp

8080 description

EQ object of port 8080

allworx_15000 udp service object-group

15000 15511 object-port Beach

allworx_16384 udp service object-group

object-port range 16384-16393

DM_INLINE_UDP_1 udp service object-group

purpose of group allworx_16384

object-port range 16384 16403

object-group service allworx-5061 udp

range of object-port 5061 5062

object-group service ananit tcp - udp

port-object eq 880

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.164 object-group billing-6233

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.164 object-group billing-1521

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.164 object-group billing2-3389

outside_access_in list extended access permit tcp any host 208.0.0.164 eq https

outside_access_in list extended access permit tcp any host 208.0.0.164 eq www

outside_access_in list extended access permit tcp any host 208.0.0.164 eq ftp

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.164 object-group billing1

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.162 EQ field

outside_access_in list extended access permit tcp any host 208.0.0.162 eq www

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.162 remote object-group

outside_access_in list extended access permit tcp any host 208.0.0.162 eq smtp

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.162 object-group olivia-777

outside_access_in list extended access permit udp any host 208.0.0.162 - group Allworx-2088 idle object

outside_access_in list extended access permit udp any host 208.0.0.162 object-group inactive allworx-5060

outside_access_in list extended access permit tcp any host 208.0.0.162 object-group web-allworx inactive

outside_access_in list extended access permit tcp any host 208.0.0.162 object-group inactive allworx-8081

outside_access_in list extended access permit udp any host 208.0.0.162 object-group inactive allworx-15000

outside_access_in list extended access permit udp any host 208.0.0.162 DM_INLINE_UDP_1 idle object-group

outside_access_in list extended access permit udp any host 208.0.0.162 object-group inactive allworx-5061

outside_access_in list extended access allowed object-group TCPUDP any host 208.0.0.162 inactive ananit object-group

outside_access_in list extended access deny ip host 151.1.68.194 208.0.0.164

permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 172.16.0.0 255.255.0.0

permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 192.168.1.0 255.255.255.0

permit access ip 192.168.0.0 scope list outside_20_cryptomap 255.255.255.0 172.16.0.0 255.255.0.0

Ping list extended access permit icmp any any echo response

inside_access_in of access allowed any ip an extended list

permit access ip 192.168.0.0 scope list outside_cryptomap 255.255.255.0 192.168.1.0 255.255.255.0

access-list 1 standard allow 192.168.0.0 255.255.255.0

pager lines 24

Enable logging

logging buffered stored notifications

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

MTU 1500 dmz

IP local pool 192.168.100.30 - 192.168.100.60 mask 255.255.255.0 remote_pool

192.168.0.20 mask - distance local pool 255.255.255.0 IP 192.168.0.50

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (outside) 1 192.168.0.0 255.255.255.0

alias (inside) 192.168.0.4 99.63.129.65 255.255.255.255

public static tcp (indoor, outdoor) interface 192.168.0.4 smtp smtp netmask 255.255.255.255

public static tcp (indoor, outdoor) interface field 192.168.0.4 netmask 255.255.255.255 area

public static tcp (indoor, outdoor) interface 192.168.0.4 www www netmask 255.255.255.255

public static tcp (indoor, outdoor) interface 777 192.168.0.15 777 netmask 255.255.255.255

public static tcp (indoor, outdoor) interface 779 192.168.0.4 779 netmask 255.255.255.255

public static (inside, outside) udp interface field 192.168.0.4 netmask 255.255.255.255 area

public static tcp (indoor, outdoor) interface 880 192.168.0.16 880 netmask 255.255.255.255

static (inside, outside) 208.0.0.164 tcp 3389 192.168.0.185 3389 netmask 255.255.255.255

inside_access_in access to the interface inside group

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 208.0.0.161 1

Route inside 192.168.50.0 255.255.255.0 192.168.0.1 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.0.0 255.255.255.0 inside

http 192.168.0.3 255.255.255.255 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Sysopt noproxyarp inside

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

card crypto outside_map 1 match address outside_cryptomap

card crypto outside_map 1 set pfs

peer set card crypto outside_map 1 108.0.0.97

card crypto outside_map 1 set of transformation-ESP-3DES-SHA

card crypto outside_map 20 match address outside_20_cryptomap

card crypto outside_map 20 set pfs

peer set card crypto outside_map 20 69.0.0.54

outside_map crypto 20 card value transform-set ESP-3DES-SHA

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

life no

crypto ISAKMP policy 30

preshared authentication

3des encryption

sha hash

Group 1

life no

Telnet timeout 5

SSH timeout 5

Console timeout 0

identifying client DHCP-client interface dmz

dhcpd outside auto_config

!

dhcpd address 192.168.0.20 - 192.168.0.50 inside

dhcpd dns 192.168.0.4 208.0.0.11 interface inside

dhcpd allow inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

allow outside

SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image

enable SVC

tunnel-group-list activate

attributes of Group Policy DfltGrpPolicy

internal group anyconnect strategy

attributes of the strategy group anyconnect

VPN-tunnel-Protocol svc webvpn

WebVPN

list of URLS no

SVC request enable

encrypted olivia Zta1M8bCsJst9NAs password username

username of graciela CdnZ0hm9o72q6Ddj encrypted password

tunnel-group 69.0.0.54 type ipsec-l2l

IPSec-attributes tunnel-group 69.0.0.54

pre-shared-key *.

tunnel-group 108.0.0.97 type ipsec-l2l

IPSec-attributes tunnel-group 108.0.0.97

pre-shared-key *.

tunnel-group anyconnect type remote access

tunnel-group anyconnect General attributes

remote address pool

strategy-group-by default anyconnect

tunnel-group anyconnect webvpn-attributes

Group-alias anyconnect enable

!

Global class-card class

match default-inspection-traffic

!

!

World-Policy policy-map

Global category

inspect the icmp

!

service-policy-international policy global

: end

ASDM location 208.0.0.164 255.255.255.255 inside

ASDM location 192.168.0.15 255.255.255.255 inside

ASDM location 192.168.50.0 255.255.255.0 inside

ASDM location 192.168.1.0 255.255.255.0 inside

don't allow no asdm history

Right now your nat 0 (NAT exemption) follows the access list:

permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 172.16.0.0 255.255.0.0

permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 192.168.1.0 255.255.255.0

Traffic back from your server to 192.168.0.4 in the pool of VPN (192.168.0.20 - 50) not correspond to this access list and thus be NATted. The TCP connection will not develop due to the failure of the Reverse Path Forwarding (RPF) - traffic is asymmetric NATted.

Then try to add an entry to the list of access as:

permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 192.168.0.0 255.255.255.0

It's a bit paradoxical but necessary that your VPN pool is cut out in your interior space network. You could also do like André offers below and use a separate network, but you would still have to add an access list entry to exempt outgoing NAT traffic.

VPN - cannot ping the next hop

Then some advice... I have configured a server VPN - pptp on my router, create a vpn for the customer at the site. For the moment, the client computer can connect and a connection to the router. I can ping from client to the router (192.168.5.1) but cannot ping 192.168.5.2 (switch) or 192.168.10.X (workstations)

What I try to achieve is to access the internal network (192.168.10.X), which is the end of the layer 3 switch. Any help/extra eyes would be good.

Here is my design of the network and the config below:

Client computer---> Internet---> (1.1.1.1) Cisco router (192.168.5.1) 881---> switch Dell Powerconnect 6248 (192.168.5.2)--> Workstation (192.168.10.x)

Router Cisco 881

AAA new-model

!

AAA of authentication ppp default local

!

VPDN enable

!

!

VPDN-group VPDN PPTP

!

accept-dialin

Pptp Protocol

virtual-model 1

!

interface FastEthernet0

Description link to switch

switchport access vlan 5

!

interface FastEthernet1

no ip address

!

interface FastEthernet2

no ip address

!

interface FastEthernet3

switchport access vlan 70

no ip address

!

interface FastEthernet4

Description INTERNET WAN PORT

IP [IP EXTERNAL address]

NAT outside IP

IP virtual-reassembly in

full duplex

Speed 100

card crypto VPN1

!

interface Vlan1

no ip address

!

interface Vlan5

Description $ES_LAN$

IP 192.168.5.1 255.255.255.248

no ip redirection

no ip unreachable

IP nat inside

IP virtual-reassembly in

!

interface Vlan70

IP [IP EXTERNAL address]

IP virtual-reassembly in

IP tcp adjust-mss 1452

!

!

!

interface virtual-Template1

IP unnumbered FastEthernet4

encapsulation ppp

peer default ip address pool defaultpool

Ms-chap PPP chap authentication protocol

!

IP local pool defaultpool 192.168.10.200 192.168.10.210

IP forward-Protocol ND

IP http server

23 class IP http access

local IP http authentication

IP http secure server

IP http timeout policy inactive 600 life 86400 request 10000

!

overload of IP nat inside source list no. - NAT interface FastEthernet4

IP route 0.0.0.0 0.0.0.0 [address IP EXTERNAL]

Route IP 192.168.0.0 255.255.0.0 192.168.5.2

!

No. - NAT extended IP access list

deny ip 192.168.0.0 0.0.255.255 10.1.0.0 0.0.255.255

IP 192.168.0.0 allow 0.0.255.255 everything

VLAN70 extended IP access list

ip [IP EXTERNAL] 0.0.0.15 permit 192.168.10.0 0.0.1.255

permit tcp [IP EXTERNAL] 0.0.0.15 any eq smtp

permit tcp [IP EXTERNAL] 0.0.0.15 any eq www

permit any eq 443 tcp [IP EXTERNAL] 0.0.0.15

permit tcp [IP EXTERNAL] 0.0.0.15 any eq field

permits any udp [IP EXTERNAL] 0.0.0.15 eq field

list of IP - VPN access scope

IP 192.168.10.0 allow 0.0.1.255 10.1.0.0 0.0.1.255

Licensing ip [IP EXTERNAL] 0.0.0.15 10.1.0.0 0.0.1.255

WAN extended IP access list

!

Layer 3 switch - Dell Powerconnect 6224

!

IP routing

IP route 0.0.0.0 0.0.0.0 192.168.5.1

interface vlan 5

name "to connect to the Cisco router.

Routing

IP 192.168.5.2 255.255.255.248

output

!

interface vlan 10

"internal network" name

Routing

IP 192.168.10.1 255.255.255.0

output

!

interface ethernet 1/g12

switchport mode acesss vlan 5

output

!

interface ethernet 1/g29

switchport mode access vlan 10

output

!

Hi Samuel,.

I went through your configuration and picked up a few problematic lines...

First of all, you can't have your vpn-pool to be in the range of 192.168.10.x/24, because you already have this subnet used behind the switch (this would be possible if you had 192.168.10.x range connected directly to the router). In addition, you may not link your virtual model to the WAN ip address, it must be bound to an interface with a subnet that includes your IP vpn-pool range.

The cleaner for this is,

Create a new interface of back of loop with a new subnet

!

loopback interface 0

192.168.99.1 IP address 255.255.255.0

!

New vpn set up, pool

!

IP local pool defaultpool 192.168.99.200 192.168.99.210

!

Change your template to point the new loopback interface,

!

interface virtual-Template1

IP unnumbered loopback0

encapsulation ppp

peer default ip address pool defaultpool

Ms-chap PPP chap authentication protocol

!

All vpn clients will get an IP address of 192.168.99.200 192.168.99.210 range. And they will be able to get the router and up to the desired range 192.168.10.x/24 behind the router. Packages get the switch, then to the host. Host will respond through the gateway (switch)-> router-> Client.

PS: Sooner, even if your packages arrive at the host, the host will never try to send the response back through the gateway (switch) packets because STI (hosts) point of view, the package came from the same local network, so the host will simply try to "arp" for shippers MAC and eventually will expire)

I hope this helps.

Please don't forget to rate/brand of useful messages

Shamal

Cannot ping my esx Server

Similar Questions

Maybe you are looking for