Changing of PSK auth RADIUS

Similar Questions

• Problem with IKEv2 routes w using PSK and RADIUS

  Hello

  I have a 7 881 + (15.2 (4) M2) connected to a 1001 ASR (03.07.01.S) via the Internet. The goal is to set up DVTI on the ASR, use FlexVPN on the CPE and inject crypto IKEv2 itineraries in the VRF on the EP for subnets protected on the SCE when using pre-shared key for authentication and RADIUS to return the attributes.

  I can get the tunnel works fine, but I can't get the cryptographic routes.

  My configs:

  7 881 + CPE:

  Crypto ikev2 keyring Keychain-CPE

  peer ASR

  address

  pre-shared key abcd

  !

  Profile of crypto ikev2 IKEV2-PROFILE-CPE

  match one address remote identity 255.255.255.255

  identity local fqdn cpe.ipsec.net

  sharing front of remote authentication

  sharing of local meadow of authentication

  Keyring key chain local-CPE

  DPD 30 2 periodic

  !

  Crypto ipsec transform-set esp - TFS-AES256-SHA-HMAC-aes 256 esp-sha-hmac

  tunnel mode

  !

  by default the crypto ipsec profile

  game of transformation-TFS-AES256-SHA-HMAC

  profile ikev2 IKEV2-PROFILE-CPE

  !

  Crypto ikev2 client flexvpn FLEX

  Peer 1

  Customer inside Loopback0

  customer connect Tunnel0

  !

  interface Loopback0

  IP 255.255.255.255

  !

  interface Tunnel0

  the negotiated IP address

  source of tunnel Dialer2

  ipv4 ipsec tunnel mode

  dynamic tunnel destination

  tunnel protection ipsec default profile

  PE OF THE ASR:

  Authorization group to the network IPSEC-AUTHOR of AAA AAA-GROUP-IPSEC-RADIUS

  !

  Crypto ikev2 60 2 dpd periodicals

  !

  Profile of crypto ikev2 IKEV2-PROFILE-ASR

  corresponds to fvrf FVRF

  match identity fqdn remote domain ipsec.net

  sharing front of remote authentication

  sharing of local meadow of authentication

  Keyring aaa IPSEC-AUTHOR

  AAA authorization user psk IPSEC-AUTHOR list

  virtual-model 1

  !

  Crypto ipsec transform-set esp - TFS-AES256-SHA-HMAC-aes 256 esp-sha-hmac

  tunnel mode

  !

  by default the crypto ipsec profile

  game of transformation-TFS-AES256-SHA-HMAC

  the value of RADU ikev2-profile

  answering machine only

  !

  type of interface virtual-Template1 tunnel

  no ip address

  source of tunnel GigabitEthernet0/0/3

  ipv4 ipsec tunnel mode

  tunnel vrf FVRF

  tunnel protection ipsec default profile

  Definition of RADIUS user name:

  CPE. IPSec.net

  Tunnel-Password = abcd,

  Framed-IP-Address = 172.16.0.254,

  Box-IP-Netmask = 255.255.255.254,

  Cisco-avpair = "ip:interface - config = vrf forwarding test",

  Cisco-avpair = "" ip:interface - config = address ip 172.16.0.255 255.255.255.254 ","

  Cisco-avpair = 'ipsec:route - value = interface',

  Cisco-avpair = "ipsec:route - value prefix = 32",

  Cisco-avpair = "ipsec:route - accept = any"

  The tunnel interface is coming on the CPE, the virtual access interface is implemented on the ASR. I could use BGP to Exchange routing between EP and CPE information, but I want to use IKE.

  I think the problem is because I don't know how to call a permission policy IKEv2 on PBS (in which I could set up a list of access for the ). But on the CPE, I have the following limitations:

  I want to use PSK for authentication, but no RADIUS server is available. So, the only other option for PSK authentication is a Keyring set locally, as there is no way to use a user name defined locally (local authentication) with a set of keys.

  So how can I trigger an IKEv2 authorization under the profile of IKEv2 policy?

  CPE (config-ikev2-profile) list of psk #aaa user authorization?

  The WORD AAA list name

  If I set a local aaa authorization list, then all authentication fails:

  AAA authorization network default local

  Profile of crypto ikev2 IKEV2-PROFILE-CPE

  by default the AAA user psk authorization list

  * 15:52:27.042 Dec 20 UTC: IKEV2-3-NEG_ABORT %: negotiation failed due to the ERROR: exchange Auth failed

  And there is no way to trigger that the authorization policy if I do not set the command above, is not it? I tried to modify the authorization policy by default with access list, but it is not taken into account.

  If I use a card with an access-list and IKEv2 encryption, I can get directions crypto on the ASR. But I want to use FlexVPN on the CPE.

  Is there a way to do this?

  Also the IOS configuration guides are not too useful

  Thank you

  Radu

  . "09:12:42.299 Dec 21 UTC: IKEv2:IKEv2 local AAA asks author ' 87.84.214.31 '.

  . "09:12:42.299 Dec 21 UTC: IKEv2:IKEv2 local AAA - political ' 87.84.214.31 ' does not exist.

  . 09:12:42.299 Dec 21 UTC: authorization IKEv2:IKEv2 162 error

  Not sure how resembles your config, but here it says that it cannot find

  ikev2 crypto 87.84.214.31 permission policy

  <...>

  If it is configured?

• Failure of Auth RADIUS for PPTP on IOS

  Hello

  We use a Cisco 1721 router to complete Microsoft's PPTP connections. When the local use of the user-data base on the router, everything works.

  However with the RADIUS authentication, Setup fails.

  Even if the router IOS"" get a "Access-accept" the RADIUS, but still he abandoned the client connection.

  This is the track

  +++++++++++++++++++++++++++++++++++++++

  RADIUS: Send to unknown id 10 10.10.1.20:1812, Access-Request, len 138

  1w2d: RADIUS: authenticator 82 C6 16 85 6th 2F C0 - 00 00 00 00 00 00 00 00 D8

  1w2d: RADIUS: username [1] 20 'xxxxxx '.

  1w2d: RADIUS: vendor, Microsoft [26] 16

  1w2d: RADIUS: MSCHAP_Challenge [11] 10

  1w2d: RADIUS: 82 16 85 6th 2F C6 [? / n]

  1w2d: RADIUS: vendor, Microsoft [26] 58

  1w2d: RADIUS: MS-CHAP-response [1] 52 *.

  1w2d: RADIUS: NAS-Port [5] 6 1

  1w2d: RADIUS: NAS-Port-Type [61] 6 virtual [5]

  1w2d: RADIUS: Type of Service [6] 6 box [2]

  1w2d: RADIUS: NAS-IP-Address [4] 6 10.10.1.37

  1w2d: RADIUS: receipt id 10 10.10.1.20:1812, Access-Accept, len 119

  1w2d: RADIUS: authenticator ED 11 24 75 81 89 B4 E6 - 68 63 CC 25 BA E0 0E 13

  1w2d: RADIUS: Framed-Protocol [7] 6 PPP [1]

  1w2d: RADIUS: Type of Service [6] 6 box [2]

  1w2d: RADIUS: [25] in class 32

  1w2d: RADIUS: 3 b 00 05 0E 00 00 01 37 00 01 0 a 0 a 01 14 and 01 C3 [;? 7?]

  1w2d: RADIUS: F3 0C EA 95 B9 06 00 00 00 00 00 00 [?]

  1w2d: RADIUS: vendor, Microsoft [26] 40

  1w2d: RADIUS: MS-CHAP-MPPE-Keys [12] 34 *.

  1w2d: RADIUS: vendor, Microsoft [26] 15

  1w2d: RADIUS: MS-CHAP-DOMAIN [10] 9 "ARKLOW".

  1w2d: RADIUS: response (10) could not decipher

  ++++++++++++++++++++++++++++++++

  Parts are important config like below

  ===========================================

  radius of group AAA of ppp use-RADIUS authentication

  VPDN enable

  !

  VPDN-Group 1

  ! PPTP by default VPDN group

  Description of Tunnels PPTP termination

  accept-dialin

  Pptp Protocol

  virtual-model 1

  renegotiation of LCP always

  adjusting IP mtu

  interface virtual-Template1

  IP unnumbered FastEthernet0

  no ip redirection

  No keepalive

  peer default ip address pool dialin_pool

  PPP mppe 128 encryption

  use-radius of PPP authentication chap, ms-chap pap

  !

  IP local pool dialin_pool 10.10.3.51 10.10.3.100

  ==========================================

  OK, you get it now in your debugging:

  RADIUS: Response (20) could not decipher

  It is an indication that do not match your ray keys. I suggest remove and re-add the key on both devices. When you add it back on the router make sure that you just cut and paste it, cause this can add extra spaces at the end which become part of the key. Enter it manually on both devices and see what you get.

• HOWTO to Setup wpa2 + aes + psk with mac-filter WLC 4402 (RADIUS)

  Hello

  I'm trying to Setup wpa2 + aes + psk with mac-filter (RADIUS) on WLC 4402 (6.0.182), with Lap - 1142

  on security, the value L2 security wpa + wpa2 and make sure MAC filtering

  Uncheck the WPA

  check the WPA2, AES, TKIP to unckeck

  Mgmt PSK auth key

  PSK ASCII marker

  L3 no

  Uncheck the political web

  AAA servers

  Select enable accounting radius server server

  It's work fine, when I use WEP with mac-filter (radius)

  but when I select WPA2 is it fail and no newspaper both WLC server and RADIUS

  Is this limitation or bug...

  Thanks in advance for your help

  This sounds like it should work.  Maybe your client likes not wpa2/aes or does not match the PSK.  I would try to associate with this same configuration, but without enabled mac filtering to try to identify the problem.

  -John

• EzVPN and RADIUS

  I configured a router to use Radius (MS IAS) for console connections and telnet. I also want the vpn users who connect to this router to be authenticated with the Radius server. I have configured the router but I am not able to get the vpn client that is connected to the router (ezvpn server)

  The configuration is below the router:

  Router #sh run

  Building configuration...

  Current configuration: 1585 bytes

  !

  version 12.4

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  router host name

  !

  boot-start-marker

  boot-end-marker

  !

  !

  AAA new-model

  !

  !

  RADIUS AAA server AUTH group

  auth-port 1645 172.16.1.243 Server acct-port 1646

  !

  RADIUS authentication AUTH of AAA connection group.

  Group AAA authorization exec default RADIUS

  Group AAA authorization network AUTH RADIUS

  !

  AAA - the id of the joint session

  memory iomem size 5

  !

  !

  IP cef

  !

  !

  dhcp-pool IP address pool

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group AAA

  vpnuser key

  DNS 10.0.1.13 10.0.1.14

  domain cisco.com

  Remote control-pool

  Save-password

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac VPNTRANSFORM

  !

  Crypto dynamic-map Dynamics-plan 10

  game of transformation-VPNTRANSFORM

  market arriere-route

  !

  !

  list map ClientMap client of authentication AUTH crypto

  card crypto ClientMap AUTH isakmp authorization list

  client configuration address map ClientMap crypto answer

  dynamic ClientMap 65535 dynamic-map ipsec-isakmp crypto map

  !

  !

  !

  !

  interface FastEthernet0/0

  IP 172.16.1.241 255.255.255.0

  automatic duplex

  automatic speed

  map ClientMap crypto

  !

  IP pool local Remote-pool 10.0.1.100 10.0.1.150

  IP http server

  no ip http secure server

  !

  !

  !

  radius of the IP source interface FastEthernet0/0

  !

  !

  RADIUS-server host 172.16.1.243 auth-port 1645 acct-port 1646 key xxxxxx

  !

  control plan

  !

  !

  !

  !

  !

  !

  !

  !

  !

  !

  Line con 0

  exec-timeout 0 0

  line to 0

  line vty 0 4

  authentication of connection AUTH

  !

  !

  end

  When I compose using Cisco Easy VPN Client I get a debug error of:

  % CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE 172.16.1.242 package was not encrypted and it should have been.

  I searched on google and thought that the problem would have been the group ID and password

  In my case, the ID of group is AAA and password is vpnuser.

  But still I can't VPN in the router.

  I think it is a problem related to AAA, because in the books, I've read and seen the EzVPN configuration using the local database and here I am their authentication with IAS. But it should work fine because I'm able to telnet to the router using my Active Directory/IAS account i.e. [email protected] / * /

  Help, please

  Change this line:

  Group AAA authorization network AUTH RADIUS

  to be

  local AAA AUTH authorization network

• VPN Site to Site Secret shared and can co-exist RADIUS authenticated VPN?

  Hello

  I have a setup VPN site to site between two offices on 515Es PIX (v.6.2 software) and has recently added a vpngroup/shared secret based VPN remote access to one of the offices. Given that just forced me to add a number of different policies to my existing crypto card, it was a plant direct and easily implemented. For more security, I want to use a RADIUS server to give to each remote user their own connections and profiles rather than a group on all password is configured. To do this, however, it seems that I have to add the following additional commands to my existing crypto card:

  client configuration address map mymap crypto initiate

  client card crypto mymap RADIUS authentication

  These do not correspond to the policy number (my site-to-site is 10, and remote access policy is political 20), so I don't know what the effect would be if I added the. It would cause my connection from site to site for authentication RADIUS request (a very bad thing)? If so, do I need another interface to bind a new encryption card to? The answer to this would be greatly appreciated!

  Also, if anyone knows an example configuration for a similar configuration, I can look at, please let me know! Thank you.

  -A.Hsu

  For the site to site connection, you change line isakmp keys and add the parameters of "No.-xauth No.-config-mode" at the end of this one, which tells the PIX not to do the auth RADIUS or assign an IP address, etc. for the specific site-to-site tunnel.

  Example of config is here:

  http://www.Cisco.com/warp/public/110/37.html

  Note that there is no command options I have just said, I just sent an email to the web guys to fix this. Basically, your config will look with the options "No.-xauth No.-config-mode" on the line «isakmp x.x.x.x key...» "for LAN-to-LAN tunnel.

• VLAN voice N3048P and DHCP issues

  Hello

  I just received several switches for our N3048P and 2 x 4048 access layer - WE for our base layer. Are the N3048P VLT'd between two of 4048. There are 4 x N3048P of one on the other. The 4048 possess all gateways via VRRP.

  I have 802. 1 x works with my Windows client test, and I can get the phone (Cisco 7941) to acquire a DHCP address if I put it on a port "switchport mode access. However, if I change the port to a general port with vlan enabled voice and 802. 1 x, the phone does not have a DHCP address, but the PC attached to the phone Gets a DHCP address in the VLAN correct.

  I see CDP and LLDP messages exchanged via Wireshark, and it seems that the phone and the switch are to exchange the VLAN voice correctly.

  My question is, why the phone can't one address DHCP?

  Here's the relevant config of switch below. I know that some of the config can be duplicated for troubleshooting steps:

  VLAN 75
  the name 'Test '.
  output
  VLAN 76
  name "Test_Phones".
  output

  IP helper-address 1.1.1.3 dhcp
  IP helper-address 1.1.1.4 dhcp

  interface vlan 75
  IP 172.16.75.4 255.255.255.0
  IP helper 1.1.1.3
  IP helper 1.1.1.4
  output
  interface vlan 76
  IP 172.16.76.4 255.255.255.0
  IP helper 1.1.1.3
  IP helper 1.1.1.4

  AAA authentication local connection to "defaultList".
  radius of start-stop AAA accounting dot1x default
  control-dot1x system-auth
  radius AAA dot1x default authentication service
  AAA authorization network default RADIUS

  VLAN, VoIP

  source-ip 172.16.75.4 RADIUS server
  Server RADIUS 'key' key
  RADIUS-server host 1.1.1.1 auth
  primary
  name "rad1.
  use of 802. 1 x
  key 'key '.
  output
  RADIUS-server host 1.1.1.2 auth
  name "rad2.
  use of 802. 1 x
  key 'key '.
  output
  Server RADIUS acct 1.1.1.1 host
  name "rad1.
  output
  host server RADIUS acct 1.1.1.2
  name "rad2.
  output

  Gi2/0/1 interface

  Description '802. 1 x client port.
  spanning tree portfast
  spanning tree guard root
  switchport mode general
  switchport general allowed vlan add 75-76 the tag
  dot1x re-authentication
  dot1x quiet-period 5
  dot1x tx-period 5
  dot1x comments - vlan 20
  dot1x Informati-vlan 20
  LLDP transmit tlv ESCR-sys sys - cap
  LLDP transmit-mgmt
  notification of LLDP
  LLDP-med confignotification
  VLAN voice 76
  disable voice vlan auth
  output

  Thanks for any input you may have. I would like to know if there is any other information, I can provide.

  -Jason

  That ends up being the correct port configuration:

  Gi2/0/1 interface

  Description '802. 1 x client port.

  spanning tree portfast

  switchport mode general

  switchport General pvid 75

  VLAN allowed switchport General add 75

  switchport general allowed vlan add 76 tag

  dot1x port-control on mac

  dot1x re-authentication

  dot1x quiet-period 5

  dot1x timeout supp-timeout 15

  dot1x tx-period 5

  dot1x comments-vlan-deadline 15

  dot1x comments - vlan 20

  dot1x Informati-vlan 20

  VLAN voice 76

  disable voice vlan auth

  The most important line here is «the dot1x port-control on mac» I got 'auto control by port dot1x' configured, but it does not work as expected. In addition, defining the comments-vlan-period and supp-timeout were necessary. If the port was shot, the switch would not necessarily reauth port.

• 3850 switch does not have wlan config.

  Hello

  I have a switch (running 03.03.05SE) 3850 functioning as WLC but it doesn´t take any configuration associated with an SSID.

  After a power failure she set the SSID on the default configuration and I can´t reconfigure (web or CLI).

  I tried to create a new wlan but it didn t work too.

  fail_to_set_config.jpg

  

  Thank you.

  Hey Mate,

  2 weeks ago, I hit this bug on my stack of 3850 running the 3.6.3 version.

  Below you will find the answer of the TAC engineer:

  This is a known issue and the following bug filed:

  CSCus85866    

  Invalid configuration Wlan error trying to change to PSK AKM

  Symptom:

  Error when you attempt to replace AKM PSK in the wlan configuration.

  %-configuration 2:wcm:Invalid WLAN switch. Dot1x or psk
  

  the authentication must be configured in wpa

   

  Workaround solution:

  Reset the unit to default settings or configure the key to passwd obscure

  Seems that the bug details are not public available and this is why does not have necessary permissions.

  Concerning

  Christos

• Cisco NAC Profiler

  Hello

  I have some doubts if any1 can clearly it will be great. I have the deployment of gateway NAS OOB real ip in my network.

  Assuming that all ports are Nac_controlled. So as soon as the client caches they are in the local network virtual auth.

  now I have a cisco nac Profiler in my network which I will configure IP phones and printers.

  by example, if the port of the ip phone is connected to it will be also under auth vlan.

  so as soon as as ip phone gets plugged, Profiler cisco will see the profile and change the vlan auth to its vlan respective by mapping the profile and the profile of the NAC that we have mapped in the Profiler and given of the vlan in the user profile of the NAC for the ip phone.

  Please correct me if I'm wrong, for the understanding of the operation. I need profile of ip phones. I am not able to connect.

  It would be very useful if you can help me.

  Thanks in advance.

  Nitesh salvation,

  the NAC has no control over the voice VLAN, then this would be defined locally on each switch ports.

  For example, you assign it not the point endpoint IP Phone profiled in any role, because the input is 'ignored' and the phone works on the configured locally voice VLAN without going through the NAC.

  The IP phone case is different from that of printers and ATM... as in this case, these devices are looking at VIRTUAL local network access (which is commissioned by the NAC), and you do not expect to see all other devices (MAC addresses) on the same port of a printer, ATM or other endpoints without an agent. That being said, you can assign profiles different points of endpoints to different roles in this case.

  I hope that answers your questions.

  Kind regards

  Federico

• VPN site to site UP, but no traffic

  Dear friends,

  I did a VPN site to site using ASA 5555 02 in each site running the Version of the software 9.2 (4).

  The VPN is UP, as shown below:

  ASA-SSP-Pri (config) # sh isak his

  There are no SAs IKEv1

  IKEv2 SAs:

  Session-id: 1, State: UP-ACTIVE, IKE County: 1, number of CHILDREN: 1

  Tunnel-id Local remote status role
  201.23.100.130/500 268373031 200.174.36.19/500 LOAN MACHINE
  BA: AES - CBC, keysize: 256, Hash: SHA96, Grp:5 DH, Auth sign: PSK, Auth check: PSK
  Duration of life/active: 86400/272 sec
  His child: selector local 10.69.0.0/0 - 10.69.0.255/65535
  selector of distance 10.12.20.0/0 - 10.12.20.255/65535
  SPI ESP/output: 0xf89430e6/0x86a5cd8f

  But when I try to ping from one site to another, is not possible, the result of the ping command is '?

  I did some research on this problem and a lot of people say that Miss crypto isakmp nat-traversal 20 command, but this command is already enabled.

  Exempt from NAT is enabled and I did tests of deactivation as well.

  Hello

  The last thing I think is that there is a SPINNAKER twice on the table of the asp and that is why the traffic is not encrypted everything seems correct, run the following command on the ASA:

  clear crypto ipsec its inactive

  test again

• SG300-28 - Firmware 1.2.7.76 with the MAC: how to use the VLAN? (Bugs00131469)

  Hallo,

  can you please explain to me this problem more in detail, please:

  ##################################################################

  Problem: When a port Transceiver allowed tent of to re-authenticate and RADIUS

  attributes no longer target attributes VLAN, re-authentication breaks down and the

  port must become unauthorized. This is not the case, and the port is not.

  (Bugs00131469)

  Solution: Do not delete attributes of VLANS on a RADIUS server or unplug

  network cable and plug it in again to force the failure.

  ##################################################################

  I use an assignment VLAN dynamic for my known hosts of the network (authentication MAC) based only. But there are people from other companies who use their own computer and this computer does not know on my RADIUS server. These people should use the VLAN comments. In general they disconnect the LAN cable from a host that is known on my SHELF and put the LAN cable into their laptop (which is not known by the RADIUS server).

  Does this mean that this port will remain in the VLAN old or the switch will change the port the the guest VLAN?

  And what happens if I reconnect the computer to know about this port?

  This feature is very important to me, but I need the functionality of the new firmware RADIUS accounting. So please give me some advice!

  Thank you very much!

  Alexander Wilke

  Hello, Alexander.

  When connecting to an unknown host to the switch, it should go to a VLAN authenticated or if you use the VLAN comments, it must be created statically a VLAN on the switch. With the comments-VLAN-Enable, the switch automatically assigns a port as a member not marked. When the port is allowed, the switch will have to move the port to VLAN comments when the first applicant authorizes.

  Basically, this bug listed above says not to make changes to your information RADIUS server of VLAN and if you do, unplug the network and reconnect it.

  -Tom

• FlexVPN and OSPF question

  I have a problem with rountig OSPF on the routers configured in the hub-and-spoke topology.

  One question is on a course that OSPF don't advertise hub to rays.

  Created on a hub, router subnets are not seen on the rays, but new added subnet on talk appears in the table of routing hub.

  The addition of broadcast command network ip ospf on a virtual-template interface hub causes OSPF adjacency downstairs.

  Also, EIGRP works very well.

  A that someone has experienced this problem with OSPF.

  Please, look at a few config below;

  -----------------------HUB-------------------------------

  IKEv2 crypto by default authorization policy

  Road enabled interface

  !

  Crypto ikev2 proposal ikev2_prop

  encryption aes-cbc-256

  integrity sha512

  Group 16

  !

  IKEv2 crypto policy ikev2_policy

  proposal ikev2_prop

  !

  Crypto ikev2 keyring Flex_key

  Rays peer

  address 192.168.50.197

  pre-shared key local 12345

  pre-shared key remote 12345

  !

  peer RTB

  address 192.168.50.199

  pre-shared key local 12345

  pre-shared key remote 12345

  !

  Profile of ikev2 crypto Flex_IKEv2

  match one address remote identity 192.168.50.197 255.255.255.255

  match one address remote identity 192.168.50.199 255.255.255.255

  sharing front of remote authentication

  sharing of local meadow of authentication

  local Flex_key keychain

  virtual-model 1

  !

  no default isakmp crypto policy

  !

  Crypto ipsec transform-set esp - aes 256 esp-sha512-hmac ipsec_trans

  tunnel mode

  !

  by default the crypto ipsec profile

  Set transform-set ipsec_trans

  Flex_IKEv2 Set ikev2-profile

  !

  interface Loopback1

  address 172.16.10.1 IP 255.255.255.0

  IP ospf 10 area 0

  !

  interface Loopback10

  10.1.1.1 IP address 255.255.255.0

  IP ospf 10 area 0

  !

  interface Loopback50

  IP 50.1.1.1 255.255.255.0

  IP 10 50 ospf area

  !

  the Embedded-Service-Engine0/0 interface

  no ip address

  !

  interface GigabitEthernet0/1

  bandwidth 100000

  IP 192.168.50.198 255.255.255.0

  automatic duplex

  automatic speed

  !

  type of interface virtual-Template1 tunnel

  IP unnumbered Loopback1

  IP 1400 MTU

  IP tcp adjust-mss 1360

  source of tunnel GigabitEthernet0/1

  ipv4 ipsec tunnel mode

  tunnel path-mtu-discovery

  tunnel protection ipsec default profile

  !

  router ospf 10

  redistribute connected subnets

  Network 10.1.1.0 0.0.0.255 area 0

  SH cryp ike his

  IPv4 Crypto IKEv2 SA

  Tunnel-id Local Remote fvrf/ivrf status

  1 192.168.50.198/500 192.168.50.197/500 no/no LOAN

  BA: AES - CBC, keysize: 256, Hash: SHA512, DH Grp:16, Auth sign: PSK, Auth check: PSK

  Duration of life/active: 86400/77565 sec

  Tunnel-id Local Remote fvrf/ivrf status

  2 192.168.50.198/500 192.168.50.199/500 no/no LOAN

  BA: AES - CBC, keysize: 256, Hash: SHA512, DH Grp:16, Auth sign: PSK, Auth check: PSK

  Duration of life/active: 86400/77542 sec

  IPv6 Crypto IKEv2 SA

  SH ip rou

  S * 0.0.0.0/0 [1/0] via 192.168.50.1

  10.0.0.0/8 is variably divided into subnets, 2 subnets, 2 masks

  C 10.1.1.0/24 is directly connected, Loopback10

  L 10.1.1.1/32 is directly connected, Loopback10

  50.0.0.0/8 is variably divided into subnets, 2 subnets, 2 masks

  C 50.1.1.0/24 is directly connected, Loopback50

  L 50.1.1.1/32 is directly connected, Loopback50

  100.0.0.0/32 is divided into subnets, subnets 1

  AI 100.1.1.1 [110/2] via 172.16.10.254, 21:32:58, Virtual Network1

  172.16.0.0/16 is variably divided into subnets, 2 subnets, 2 masks

  172.16.10.0/24 C is directly connected, Loopback1

  L 172.16.10.1/32 is directly connected, Loopback1

  192.168.50.0/24 is variably divided into subnets, 2 subnets, 2 masks

  C 192.168.50.0/24 is directly connected, GigabitEthernet0/1

  The 192.168.50.198/32 is directly connected, GigabitEthernet0/1

  200.1.1.0/32 is divided into subnets, subnets 1

  AI 200.1.1.1 [110/2] via 172.16.10.253, 21:32:38, Access2-virtual

  201.1.1.0/32 is divided into subnets, subnets 1

  AI 201.1.1.1 [110/2] via 172.16.10.253, 21:32:38, Access2-virtual

  220.1.1.0/32 is divided into subnets, subnets 1

  AI 220.1.1.1 [110/2] via 172.16.10.253, 00:06:11, Access2-virtual

  ---------------------------SPOKE---------------------------------------------

  Crypto ikev2 proposal ikev2_prop

  encryption aes-cbc-256

  integrity sha512

  Group 16

  !

  IKEv2 crypto policy ikev2_policy

  proposal ikev2_prop

  !

  Crypto ikev2 keyring Flex_key

  Rays peer

  address 192.168.50.198

  pre-shared key local 12345

  pre-shared key remote 12345

  !

  Profile of ikev2 crypto Flex_IKEv2

  match one address remote identity 192.168.50.198 255.255.255.0

  sharing front of remote authentication

  sharing of local meadow of authentication

  local Flex_key keychain

  virtual-model 1

  !

  no default isakmp crypto policy

  !

  !

  Crypto ipsec transform-set esp - aes 256 esp-sha512-hmac ipsec_trans

  tunnel mode

  !

  by default the crypto ipsec profile

  Set transform-set ipsec_trans

  Flex_IKEv2 Set ikev2-profile

  !

  interface Loopback200

  200.1.1.1 IP address 255.255.255.0

  IP ospf 10 200 area

  !

  interface Loopback201

  IP 201.1.1.1 255.255.255.0

  IP ospf 10 201 area

  !

  interface Loopback220

  IP 220.1.1.1 255.255.255.0

  IP ospf 10 220 area

  !

  Tunnel1 interface

  IP 172.16.10.253 255.255.255.0

  IP 1400 MTU

  IP tcp adjust-mss 1360

  source of tunnel GigabitEthernet0/1

  ipv4 ipsec tunnel mode

  tunnel destination 192.168.50.198

  tunnel path-mtu-discovery

  tunnel protection ipsec shared default profile

  !

  interface GigabitEthernet0/1

  IP 192.168.50.199 255.255.255.0

  automatic duplex

  automatic speed

  !

  router ospf 10

  network 172.16.10.0 0.0.0.255 area 0

  SH cryp ike his

  IPv4 Crypto IKEv2 SA

  Tunnel-id Local Remote fvrf/ivrf status

  1 192.168.50.199/500 192.168.50.198/500 no/no LOAN

  BA: AES - CBC, keysize: 256, Hash: SHA512, DH Grp:16, Auth sign: PSK, Auth check: PSK

  Duration of life/active: 77852/86400 sec

  IPv6 Crypto IKEv2 SA

  SH ip route

  S * 0.0.0.0/0 [1/0] via 192.168.50.1

  172.16.0.0/16 is variably divided into subnets, 2 subnets, 2 masks

  172.16.10.0/24 C is directly connected, Tunnel1

  L 172.16.10.253/32 is directly connected, Tunnel1

  192.168.50.0/24 is variably divided into subnets, 2 subnets, 2 masks

  C 192.168.50.0/24 is directly connected, GigabitEthernet0/1

  The 192.168.50.199/32 is directly connected, GigabitEthernet0/1

  200.1.1.0/24 is variably divided into subnets, 2 subnets, 2 masks

  C 200.1.1.0/24 is directly connected, Loopback200

  L 200.1.1.1/32 is directly connected, Loopback200

  201.1.1.0/24 is variably divided into subnets, 2 subnets, 2 masks

  C 201.1.1.0/24 is directly connected, Loopback201

  L 201.1.1.1/32 is directly connected, Loopback201

  220.1.1.0/24 is variably divided into subnets, 2 subnets, 2 masks

  C 220.1.1.0/24 is directly connected, Loopback220

  L 220.1.1.1/32 is directly connected, Loopback220

  SH ip ospf database ro 172.16.10.1

  Router OSPF with ID (200.1.1.1) (the process ID of 10)

  Router link States (zone 0)

  ADV router is accessible via is not in the Base with MTID topology 0

  LS age: 336

  Options: (no TOS-capability, DC)

  LS type: Router links

  Link state ID: 172.16.10.1

  Advertising router: 172.16.10.1

  LS number of Seq: 80000065

  Checksum: 0x4B6E

  Length: 60

  Area border router

  ROUTER limits

  Number of links: 3

  Link to: a Stub network

  (Link ID) Network/subnet number: 10.1.1.1

  (Data link) Network mask: 255.255.255.255

  Number of parameters MTID: 0

  TOS 0 metric: 1

  Link to: another router (point to point)

  (Link ID) Neighbors router ID: 100.1.1.1

  (Data link) Address of the router Interface: 0.0.0.18

  Number of parameters MTID: 0

  TOS 0 metric: 1

  Link to: another router (point to point)

  (Link ID) The router ID neighbors: 200.1.1.1

  (Data link) Address of the router Interface: 0.0.0.17

  Number of parameters MTID: 0

  TOS 0 metric: 1

  Kamil,

  A tunnel in this deployment (and VT / going also) is an interface point to point, there is really no good reason to keep anything other than 32 (I might not be aware of some subtleties in more complex deployment).

  'Set interface route' is your greatest friend ;-)

  M.

• How to edit several groups in Secure ACS?

  I have 20 or if groups of users with GBA and I want to edit a field in each of them (say I want to change the primary [3076\005] DNS domain in each of them having the same). Is there a way to do this only once (either through download a txt using csutils?), or I have to edit this group at the same time?

  There is a Code of Action (163 - ADD_RADIUS_ ATTR) RDBMS, but it would change only the IETF RADIUS attributes.

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/A_RDBMS.html#wp78074

  I do not believe there is no option to accomplish what you are trying to do...

  You must enter one by one each group and make the necessary changes.

• Aironet 1142 standalone, no clients can connect to this topic.

  Hello

  I have a strange behavior on my standalone 1142, it's been 2 days now. No clients can connect to this topic.

  The config has been reset 5 times already, even tried with 3 different versions of IOS and still nothing.

  I put this up ever since a few years back now and it worked perfectly.

  3 days ago, I changed the PSK, it worked fine for one day and then it happened.

  I get the authentication failure of all devices that tried to connect to this topic, I even changed the configuration with no authentication, radio stations are open, the two SSID with no guarantee whatsoever, and even with no encryption I can't connect on it.

  Really strange, I was setting up Cisco AP for many years and now I have a black out... I don't know I'm missing something, I can't understand what it is...

  Any help about it please?

  Thank you

  Kyriakos

  you have a WLSM?

  If not, you should remove the

   mobility network-id 3

  and the

   mobility network-id 1

  statements that they are for communication with the WLSM

  HTH,
  Steve

• UCS LDAP and Native authentication

  Hello

  We put the Native authentication for LDAP and UCS Manager connection to LDAP as well. We are able to connect to GUI & SSH using the LDAP account. But can not connect on the GUI using the local account (admin).

  If I change the Native authentication at the local level, we can connect to GUI via local account (admin), but can not connect to SSH via LDAP account.

  Missing something?

  Please let me know.

  / Rags

  Hello

  When you have changed the native auth to LDAP and use local account, are you prefixing the local username with the local domain auth?

  * From Linux / MAC machine

  SSH ucs -------@.

  SSH-l ucs -.

  SSH -l ucs -.

  * From client PuTTY

  Connect as: ucs -.

  NOTE the domain name is case-sensitive and must match the name field set up in UCSM.

  Try connecting with the name in domainsername and let us know the result.

  Padma