Cisco 881 - Access Gateway VPN session

Similar Questions

• Cisco IOS - access remote VPN - route unwanted problem

  Hello

  I recently ran into a problematic scenario: I am trying to connect to a remote LAN (using a Cisco VPN client on my windows xp machine) my office LAN and access a server there. The problem is that I need a remote local network access at the same time.

  Remote LAN: 172.16.0.0/16

  LAN office: 172.16.45.0/24

  Topology:

  (ME: 172.16.10.138/25) - (several subnets form 172.16.0.0/16) - (Internet cloud) - (VPN-Gateway) - (172.16.45.0/24) - (TARGET: 172.16.45.100)

  To provide access, I configured a VPN to access simple distance on a 1700 series router. It's the relevant part:

  (...)

  crypto ISAKMP client config group group-remote access

  my-key group

  VPN-address-pool

  ACL 100

  IP local pool pool of addresses-vpn - 172.16.55.1 172.16.55.30

  access-list 100 permit ip 172.16.45.100 host 172.16.55.0 0.0.0.31

  (...)

  The configuration works fine, I can access the 172.16.45.100 server every time I need to. However, the problem is that when the VPN connection is connected, Windows wants to somehow rout the packets intended for 172.16.0.0/16 through the VPN tunnel. This is apparently due to a static route that added by the Cisco VPN Client and all other specific VPN routes.

  I suspect that the culprit is the IP LOCAL POOL, since when the VPN is connected, debugging of Client VPN log shows something like "adapter connected, address 172.16.55.1/16. Focus on the part "/ 16". I checked the VPN status page and the only road indicated there was "172.16.45.100 255.255.255.255" under remote routes. Local routes was empty.

  Is this a known problem I missed the obvious solution for? Is there no workaround apart from the pool local vpn penetrating high-end 10.x.x.x or 192.168.x.x? Thank you in advance for advice or tips!

  Hello

  The best way is to avoid any overlap between the local network and VPN pool.

  Try 172.17.0.0/16, is also private IP address space:

  http://en.Wikipedia.org/wiki/Private_network

  Please rate if this helped.

  Kind regards

  Daniel

• Support VPN Cisco 881

  Hi all

  I am not cisco trained or worked with cisco, im a complete beginner in Cisco platforms. We are an IT support MPH and we have recently taken on a client that has an office abroad using a Cisco 881 device with a Draytek router to the United Kingdom. Site to site connectivity is necessary. I watched and watched videos of youtube on how to configure the VPN and think I have it in place by using the config on the cisco below:

  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  lifetime 28800
  isakmp encryption key * address *.
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac sha3des
  !
  crypto map 1 VPN ipsec-isakmp
  set peer *.
  Set transform-set sha3des
  PFS group2 Set
  match address UK

  !

  interface FastEthernet4
  IP address
  IP access-group netbios in
  IP access-group netbios on
  no ip proxy-arp
  NAT outside IP
  IP virtual-reassembly in
  no ip-cache cef route
  no ip route cache
  automatic duplex
  automatic speed
  No cdp enable
  VPN crypto card

  !
  interface Vlan1
  secondary IP address
  IP 255.255.255.0
  IP access-group netbios in
  IP access-group netbios on
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly in
  no ip-cache cef route
  no ip route cache
  !

  UK extended IP access list
  allow IP 0.0.0.255 0.0.0.255
  allow IP 0.0.0.255 0.0.0.255

  It shows the VPN and active but there is no movement between the two and I do not know why...

  Current state of the session crypto

  Interface: FastEthernet4
  The session state: UP-ACTIVE
  Peer: port of 500
  IKEv1 SA: local remote 500 500 Active
  FLOW IPSEC: ip allow /255.255.255.0 /255.255.255.0
  Active sAs: 0, origin: card crypto
  FLOW IPSEC: ip allow /255.255.255.0 /255.255.255.0
  Active sAs: 2, origin: card crypto

  So it all seems perfect, however, if I try and ping the remote remote sites over ip LAN router I get the following:

  Type to abort escape sequence.
  Send 5, 100 bytes to ICMP echoes, waiting time is 2 seconds:
  .....
  Success rate is 0% (0/5)

  I also can't ping the remote site in the Cisco lan.

  I think that it is towards the end of cisco, the Draytek is a basic router and no routing is able to be configured. It does it automatically. The VPN is so no traffic...

  Please can someone point me in the right directoin?

  Thank you

  The additional ip route does not harm even if it is not needed. I love these additional routes that they can serve as a sort of "online documentation" when it is used with a keyword "name" extra at the end.

  Your NAT - ACL does not have the traffic. Just add the following:

   ip access-list ext 102 1 deny ip  0.0.0.255  0.0.0.255 

• Site to site VPN works only on Cisco 881

  I have 2 problems with a cisco 881. The first problem is that Vlan2 (192.168.5.xx) cannot access the internet on the outside. But I know that the router has internet, because I can ping the external ip address. The 2nd problem is that I have a set of site to another upward, but when I test the Site to site I get this error:

  destination of traffic of the tunnel must be channelled through the crypto map interface. The destination following (s) doesn't have a routing entry in the routing table
  192.168.2.0

  I copied the config form this router from another cisco 881 work, where everything works. The only difference is that this router needs a site to site vpn connection.

  My question is how I can get internet on vlan2 and who can I solve the connection to site to site.

  Here's the running configuration:

  Building configuration...

  Current configuration: 12698 bytes
  !
  version 15.3
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname Cisco_881
  !
  boot-start-marker
  boot-end-marker
  !
  AQM-registry-fnf
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authorization exec default local
  AAA authorization network default local
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  !
  Crypto pki trustpoint TP-self-signed-1151531093
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1151531093
  revocation checking no
  rsakeypair TP-self-signed-1151531093
  !
  Crypto pki trustpoint TP-self-signed-2011286623
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2011286623
  revocation checking no
  rsakeypair TP-self-signed-2011286623
  !
  !
  TP-self-signed-1151531093 crypto pki certificate chain
  certificate self-signed 01
  3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
  69666963 31313531 35333130 6174652D 3933301E 170 3135 30343031 31363230
  34315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
  4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 31353135 65642D
  33313039 3330819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
  8100AC6E E7FA8AFD 9D4E206C 2B23DFC1 990AFDB3 98CD84A7 37697253 A7EF2520
  0C45190E 298B6E9F E2711580 80DCFBFB 05A6A0BA 347B960B D9DA17FC B1543B9D
  FBC048F3 063EBBC5 02391432 F0232A73 EAC7278E 8CB83005 D13A1D47 BEF18198
  A 547469, 2 F65ED0E6 249BF517 1E74117D C94BE542 46EE487D A3843F12 364639B 4
  0B 090203 010001 HAS 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355
  551 2304 18301680 147996F4 3E6D0EE2 2D9065BB D726137C 2DF42ABE 01301D 06
  03551D0E 04160414 7996F43E 6D0EE22D 9065BBD7 26137C2D F42ABE01 300 D 0609
  2A 864886 F70D0101 8181002A 05050003 677B9BE6 CB60D188 73227C4B 2DC33101
  BD448017 EDEF0296 FF7438A3 4C46519B 144C775F 1429CF06 7DB29F2D EB16EE75
  22100B 63 0D75511A 98DC57DC EF87BED2 1C1635C8 B5352706 3963037A 4E9B739A
  3A1EC9BE 8431BD70 116D3B31 E4A2AC4C 0F934B3F 196AF829 AD537005 6935B 451
  EB31DB3F A9BA6D70 65B70D19 D00158
  quit smoking
  TP-self-signed-2011286623 crypto pki certificate chain
  no ip source route
  !
  !
  !
  !

  !
  DHCP excluded-address IP 10.10.10.1
  DHCP excluded-address IP 192.168.5.1 192.168.5.49
  DHCP excluded-address IP 192.168.5.150 192.168.5.254
  !
  DHCP IP CCP-pool
  import all
  Network 10.10.10.0 255.255.255.248
  default router 10.10.10.1
  Rental 2 0
  !
  IP dhcp Internet pool
  network 192.168.5.0 255.255.255.0
  router by default - 192.168.5.254
  DNS-Server 64.59.135.133 64.59.128.120
  lease 6 0
  !
  !
  !
  no ip domain search
  "yourdomain.com" of the IP domain name
  name of the IP-Server 64.59.135.133
  name of the IP-Server 64.59.128.120
  IP cef
  No ipv6 cef
  !
  !
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  !
  !
  !
  !
  udi pid C881-K9 sn FTX18438503 standard license
  !
  !
  Archives
  The config log
  hidekeys
  username * privilege 15 secret 5 $1$IBY.$X5/iqYy47a5vAWWuG4/Oa/
  username * secret 5 $1$ 17 ST$ QzJMvQnZ9Q.1y7u0rYXFa0
  username * secret 5 $1$ L4W9$ zBKpawZ3i5nXxwyS9H6Lf1
  !
  !
  !
  !
  !
  no passive ftp ip
  !
  !
  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 208.98.212.xx
  !
  Configuration group crypto isakmp MPE client
  key *.
  pool VPN_IP_POOL
  ACL 100
  include-local-lan
  10 Max-users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is reserved for administrators of control systems.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.              ^ C
  !
  Configuration group customer crypto isakmp PALL
  key *.
  pool VPN_IP_POOL_PALL
  ACL 101
  include-local-lan
  Max - 1 users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is limited to the PALL access only.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.            ^ C
  ISAKMP crypto profile vpn_isakmp_profile
  game of identity EMT group
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 1
  ISAKMP crypto profile vpn_isakmp_profile_2
  match of group identity PALL
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac VPN_TRANSFORM
  tunnel mode
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  !
  Profile of crypto ipsec VPN_PROFILE_MPE
  Set the security association idle time 3600
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile Set isakmp-profile
  !
  Profile of crypto ipsec VPN_PROFILE_PALL
  Set the security association idle time 1800
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile_2 Set isakmp-profile
  !
  !
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to208.98.212.xx
  the value of 208.98.212.xx peer
  game of transformation-ESP-3DES-SHA
  match address 102
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.40.254 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet3
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet4
  IP address 208.98.213.xx 255.255.255.224
  IP access-group 111 to
  NAT outside IP
  IP virtual-reassembly in
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_MPE ipsec protection profile
  !
  tunnel type of interface virtual-Template2
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_PALL ipsec protection profile
  !
  interface Vlan1
  Description of control network
  IP 192.168.125.254 255.255.255.0
  IP access-group CONTROL_IN in
  IP access-group out CONTROL_OUT
  IP nat inside
  IP virtual-reassembly in
  IP tcp adjust-mss 1452
  !
  interface Vlan2
  Description Internet network
  IP 192.168.5.254 255.255.255.0
  IP access-group INTERNET_IN in
  IP access-group out INTERNET_OUT
  IP nat inside
  IP virtual-reassembly in
  !
  local IP VPN_IP_POOL 192.168.40.100 pool 192.168.40.150
  local IP VPN_IP_POOL_PALL 192.168.40.151 pool 192.168.40.152
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  !
  IP nat inside source static tcp 192.168.125.2 25000 25000 FastEthernet4 interface
  IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
  IP route 0.0.0.0 0.0.0.0 FastEthernet4 permanent 208.98.236.xx
  !
  CONTROL_IN extended IP access list
  Note the access control
  Note the category CCP_ACL = 17
  allow any host 192.168.125.254 eq non500-isakmp udp
  allow any host 192.168.125.254 eq isakmp udp
  allow any host 192.168.125.254 esp
  allow any host 192.168.125.254 ahp
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  IP 192.168.125.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
  Note Access VNC
  permit tcp host 192.168.125.2 eq 25000 one
  Comment by e-mail to WIN911
  permit tcp host 192.168.125.2 any eq smtp
  Note DNS traffic
  permit udp host 192.168.125.2 host 64.59.135.133 eq field
  permit udp host 192.168.125.2 host 64.59.128.120 eq field
  Note Everything Else block
  refuse an entire ip
  CONTROL_OUT extended IP access list
  Note the access control
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  ip permit 192.168.40.0 0.0.0.255 192.168.125.0 0.0.0.255
  Note Access VNC
  allow any host 192.168.125.2 eq 25000 tcp
  Comment by e-mail to WIN911
  allow any host 192.168.125.2 eq smtp tcp
  Note DNS responses
  allowed from any host domain eq 192.168.125.2 udp
  Note deny all other traffic
  refuse an entire ip
  INTERNET_IN extended IP access list
  Note Access VNC on VLAN
  allow any host 192.168.125.2 eq 25000 tcp
  Note block all other controls and VPN
  deny ip any 192.168.125.0 0.0.0.255
  deny ip any 192.168.40.0 0.0.0.255
  Note leave all other traffic
  allow an ip
  INTERNET_OUT extended IP access list
  Note a complete outbound Internet access
  allow an ip
  WAN_IN extended IP access list
  allow an ip host 207.229.14.xx
  Note PERMIT ESTABLISHED TCP connections
  allow any tcp smtp created everything eq
  Note ALLOW of DOMAIN CONNECTIONS
  permit udp host 64.59.135.133 eq field all
  permit udp host 64.59.128.120 eq field all
  Note ALLOW ICMP WARNING RETURNS
  allow all all unreachable icmp
  permit any any icmp parameter problem
  allow icmp all a package-too-big
  allow a whole icmp administratively prohibited
  permit icmp any any source-quench
  allow icmp all once exceed
  refuse a whole icmp
  allow an ip
  !
  auto discovering IP sla
  not run cdp
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 103
  !
  access-list 1 remark out to WAN routing
  Note CCP_ACL the access list 1 = 16 category
  access-list 1 permit 192.168.125.2
  access-list 1 permit 192.168.5.0 0.0.0.255
  Note access-list 23 SSH and HTTP access permissions
  access-list 23 permit 192.168.125.0 0.0.0.255
  access-list 23 permit 192.168.40.0 0.0.0.255
  access-list 23 allow one
  Note access-list 100 VPN traffic
  access-list 100 permit ip 192.168.125.0 0.0.0.255 any
  access-list 100 permit ip 192.168.40.0 0.0.0.255 any
  Note access-list 101 for PALL VPN traffic
  access-list 101 permit ip 192.168.125.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 4
  Note access-list 102 IPSec rule
  access-list 102 permit ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  Note access-list 103 CCP_ACL category = 2
  Note access-list 103 IPSec rule
  access-list 103 deny ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  access-list 103 allow ip 192.168.5.0 0.0.0.255 any
  access-list 103 allow the host ip 192.168.125.2 all
  Note access-list 111 CCP_ACL category = 17
  access-list 111 permit udp any host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp any host 208.98.213.xx eq isakmp
  access-list 111 allow esp any host 208.98.213.xx
  access-list 111 allow ahp any host 208.98.213.xx
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.5.0 0.0.0.255
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.4.0 0.0.1.255
  access-list 111 permit udp host 208.98.212.xx host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp host 208.92.12.xx host 208.92.13.xx eq isakmp
  access-list 111 allow esp host 208.92.12.xx host 208.92.13.xx
  access-list 111 allow ahp host 208.92.12.xx host 208.92.13.xx
  access-list 111 permit icmp any host 208.92.13.xx
  access-list 111 permit tcp any host 208.92.13.xx eq 25000
  access-list 111 permit tcp any host 208.92.13.xx eq 22
  access-list 111 permit tcp any host 208.92.13.xx eq telnet
  access-list 111 permit tcp any host 208.92.13.xx eq www
  !
  !
  !
  control plan
  !
  !
  !
  MGCP behavior considered range tgcp only
  MGCP comedia-role behavior no
  disable the behavior MGCP comedia-check-media-src
  disable the behavior of MGCP comedia-sdp-force
  !
  profile MGCP default
  !
  !
  !
  !
  exec banner ^ C
  % Warning of password expiration.
  -----------------------------------------------------------------------

  Unplug IMMEDIATELY if you are not an authorized user
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 23 in
  password *.
  transport input telnet ssh
  transportation out all
  line vty 5 15
  access-class 160 in
  password *.
  transport of entry all
  transportation out all
  !
  max-task-time 5000 Planner
  Scheduler allocate 20000 1000
  !
  end

  Thank you.

  It seems that DNS has failed, because it is indeed happened to internet, but it does not work when internet DNS resolution.

  Go ahead and try to ping this 157.166.226.25, and it's on the browser http://157.166.226.25/, CNN.com. Let's try those. Also just in case where to configure a DNS SERVER on your router.

  - http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/2418...

  Disable any ZBF just in case.

  David Castro,

  Kind regards

• Road of default remote access VPN session

  ASA version 8.2.2

  How do you assign remote access VPN sessions a single default route?  Other than the default route assigned to ASA.  For example, my VPN ASA (handles vpn sessions), defaults to the Internet.  I wish that sessions VPN for remote access by default internal network first, then follow the default route to the Internet on another firewall.

  The SAA outside the IP address of the interface is a public.  Inside is a private 10.x.x.x.  VPN clients receive 172.17.x.x.

  Thank you

  After the command 'road' added keyword "tunnel".

  in the tunnel

  Specifies the route as the default gateway of tunnel for the VPN traffic.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/QR.html#wp1767323

• Cisco ASA VPN session reflect a public IP of different source

  Hi all

  I tested and managed to successfully establish the vpn on my cisco asa 5520.

  On my syslog, I can see "parent anyconnect session has begun" during my setting up vpn and "webvpn session is over" at the end of my vpn session

  where public ip used to establish the vpn address is reflected. However after the line "webvpn session is over", I can see other lines in my syslog example "group = vpngroup, username = test, ip = x.x.x.x, disconnected session, session type: anyconnect parent, duration 0 h: 00m23s, xmt bytes: 0, rcv:0 bytes, reason: requested user" where x.x.x.x is not the ip address used to establish my vpn for remote access, it is not related to my vpn ip address below. I am very sure that the x.x.x.x ip failed any vpn for my cisco asa5520. So why it is reflected in my logs to asa cisco? Pls advise, TIA!

  Hello

  Think I remember some display on a similar question in the past. Did some research on google and the next BugID was mentioned in the discussion.

  113019 syslog reports an invalid address when the VPN client disconnects.
  CSCub72545
   

  Description

• Cisco 881 - maximum number of VPN tunnels allowed?

  Hello

  I know it sounds simple and easy question, but I can't find the answer anywhere - so here it is: -.

  I need to know the maximum number of vpn tunnels that can manage a Cisco 881.

  (In the context, we have a group of users who work from home and office, so their laptops have the cisco vpn client, I need to know how much of these vpn connections the 881 can manage both before, he died a death)

  Host-, I read somewhere a line that State maximum number of users is 20 but believe it was referring to a VOIP service.

  Thanks in advance.

  The 881 supports 20-tunnel IPSec:

  http://www.Cisco.com/en/us/prod/collateral/routers/ps380/data_sheet_c78_459542_ps380_Products_Data_Sheet.html

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• SSL VPN may be configured on the router from Cisco 881/K9?

  I'm now confused if SSL VPN can be configured on the router from Cisco 881/K9.

  Please someone advise me.

  If Yes, for only 5 users, what I need to buy the license or license is supplied with the router?

  Thank you.

  Yes, and you need a license:

  FL-WEBVPN-10-K9

  License SSL VPN functionality for up to 10 users (incremental), to 12.4 T based only IOS versions

  FL-SSLVPN10-K9

  License SSL VPN functionality for up to 10 users (incremental) for the only based 15.x IOS versions

• Cisco 881 can ping internet but computers behind the router cannot

  I have a cisco 881, which can ping internet but not of any computer behind it. Computers receive a static IP address, that is why there is no DHCP assigned to any LAN interface. Here's the running configuration:

  Building configuration...

  Current configuration: 6435 bytes
  !
  ! Last modification of the configuration at 22:15:30 UTC Friday, March 11, 2016
  !
  version 15.5
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  router host name
  !
  boot-start-marker
  boot-end-marker
  !
  !
  logging buffered 51200 warnings
  !
  No aaa new-model
  BSD-client server url https://cloudsso.cisco.com/as/token.oauth2
  iomem 10 memory size
  !
  Crypto pki trustpoint TP-self-signed-76299383
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 76299383
  revocation checking no
  rsakeypair TP-self-signed-76299383
  !
  !
  TP-self-signed-76299383 crypto pki certificate chain
  certificate self-signed 01
  30820227 30820190 A0030201 02020101 300 D 0609 2A 864886 F70D0101 05050030
  2F312D30 2B 060355 04031324 494F532D 66 2 536967 6E65642D 43657274 53656C
  69666963 37363239 39333833 31333031 33313231 30333034 301E170D 6174652D
  5A170D32 30303130 31303030 3030305A 302F312D 302B 0603 55040313 24494F53
  2D53656C D 662 5369 676E6564 2D 436572 74696669 63617465 2 373632 39393338
  3330819F 300 D 0609 2A 864886 F70D0101 01050003 818 0030 81890281 8100B39C
  1F1F1B5A 620D3DB7 E4B82486 D8A6E928 E880F817 20D8D5D8 744 HAS 6985 B48A0AEF
  072919 6ABF6428 C 9 272B2F4E 28382554 1D1CC5CD 701F9646 38EEE5CE 67F475C4
  DD5B464B ECBD78AF A5B6B36B D2791CFE E6CB886F B030E179 7A209BC4 1CDC6BA1
  711616 C 4FD6BE16 4 489DCC5F A5EE9729 365858FD 1654EA5F 3B7F90B2 19470203
  010001A 3 53305130 1 130101 FF040530 030101FF 301F0603 551 D 2304 0F060355
  18301680 1465D9D2 8C6F18DF 98EF832A 03DE7ADD 97301 06 03551D0E D45A6C59
  04160414 65D9D28C 6F18DF98 EF832A03 DE7ADDD4 5A6C5997 300 D 0609 2A 864886
  818100A 6 05050003 928BFD76 AEE144B3 540415EE 7DC2339D B6142CF6 F70D0101
  60E3A6DF 06DA321C B711183C 80755902 2D1D9407 857F05ED B987C08D 25002B5F
  F3C0F996 8CDA1830 3F85456B 6C6F2A4B 774B93DC 256AB90E 5A46126C C2D044DB
  3B76F1A2 0E98D2F0 A0D656CF 5031C7D7 1D9D2F88 188927 4 EEAA3915 E97C7B83
  ECF7239B 5B7F0FDD E4C9CA
  quit smoking
  !
  !
  !
  !
  !
  !
  !
  !

  !
  DHCP excluded-address IP 192.168.136.22 192.168.136.30
  DHCP excluded-address IP 192.168.131.22 192.168.131.254
  !
  IP dhcp Internet pool
  network 192.168.131.0 255.255.255.0
  DNS-server 70.28.245.227 184.151.118.254
  router by default - 192.168.131.157
  !
  !
  !
  name of the IP-server 70.28.245.227
  name of the IP-server 184.151.118.254
  IP cef
  No ipv6 cef
  !
  !
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  !
  !
  !
  !
  !
  CTS verbose logging
  udi pid C881-K9 sn FGL1927224B standard license
  !
  !
  Archives
  The config log
  hidekeys
  username * 15 secret 5 privilege TOHi $1$ $ xwZvR0n8p6r00xE5nnBE11
  !
  !
  !
  !
  !
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 96.45.14.xx
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  Crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
  tunnel mode
  Crypto ipsec transform-set esp-SHA2-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  Crypto ipsec transform-set esp-3des SHA3-ESP-3DES esp-sha-hmac
  tunnel mode
  !
  !
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to96.45.14.xx
  the value of 96.45.14.xx peer
  game of transformation-ESP-3DES-SHA2
  match address 102
  !
  !
  !
  !
  !
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  no ip address
  !
  interface FastEthernet3
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet4
  port WAN Description
  DHCP IP address
  response to IP mask
  NAT outside IP
  IP virtual-reassembly in
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto
  !
  interface Vlan1
  Description of control network
  IP 192.168.131.157 255.255.255.0
  IP access-group VLAN1_In in
  IP nat inside
  IP virtual-reassembly in
  !
  local pool IP VPN 192.168.131.152 192.168.131.155
  default IP gateway - 174.0.0.1
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  IP high speed-flyers
  Top 10
  Sorting bytes
  !
  IP route 0.0.0.0 0.0.0.0 174.0.0.1 permanent
  !
  VLAN1_In extended IP access list
  Note the incoming traffic
  Note the category CCP_ACL = 1
  Note the crosstalk
  deny ip 192.168.135.0 0.0.0.255 192.168.130.0 0.0.1.255
  deny ip 192.168.136.0 0.0.0.255 192.168.130.0 0.0.1.255
  Note the crosstalk
  deny ip 192.168.130.0 0.0.1.255 192.168.135.0 0.0.0.255
  deny ip 192.168.130.0 0.0.1.255 192.168.136.0 0.0.0.255
  allow an ip
  VLAN1_Out extended IP access list
  Note for diagnosis
  Note the category CCP_ACL = 1
  Note Diag
  IP enable any any newspaper
  allow_all extended IP access list
  Note the category CCP_ACL = 1
  IP enable any any newspaper
  !
  !
  Note category of access list 1 = 2 CCP_ACL
  access-list 1 permit 192.168.1.0 0.0.0.255
  Note access-list category 2 CCP_ACL = 2
  access-list 2 permit 192.168.130.0 0.0.0.255
  Note access-list 100 category CCP_ACL = 4
  Note access-list 100 IPSec rule
  access-list 100 permit ip 192.168.131.0 0.0.0.255 192.168.125.0 0.0.0.255
  Note access-list 100 IPSec rule
  access-list 100 permit ip 192.168.131.0 0.0.0.255 192.168.120.0 0.0.0.255
  Note access-list 101 category CCP_ACL = 4
  Note access-list 101 IPSec rule
  access-list 101 permit ip 192.168.131.0 0.0.0.255 192.168.125.0 0.0.0.255
  Note access-list 102 CCP_ACL category = 4
  Note access-list 102 IPSec rule
  access-list 102 permit ip 192.168.131.128 0.0.0.31 192.168.125.0 0.0.0.255
  Note access-list 103 CCP_ACL category = 4
  Note access-list 103 IPSec rule
  access-list 103 allow ip 192.168.131.0 0.0.0.255 192.168.125.0 0.0.0.255
  !
  control plan
  !
  !
  !
  MGCP behavior considered range tgcp only
  MGCP comedia-role behavior no
  disable the behavior MGCP comedia-check-media-src
  disable the behavior of MGCP comedia-sdp-force
  !
  profile MGCP default
  !
  !
  !
  !
  !
  !
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class allow_all in
  access-class allow_all out
  privilege level 15
  password *.
  opening of session
  transport telnet entry
  telnet output transport
  !
  max-task-time 5000 Planner
  Scheduler allocate 20000 1000
  !
  !
  WebVPN WAN gateway
  IP address 192.168.126.9 port 44443
  redirect http port 80
  SSL trustpoint TP-self-signed-76299383
  development
  !
  WebVPN context PLC
  WAN gateway
  !
  SSL authentication check all
  development
  !
  default group policy
  functions compatible svc
  SVC-pool of addresses "VPN" netmask 255.255.255.224
  SVC Dungeon-client-installed
  generate a new key SVC new-tunnel method
  SVC split include 192.168.131.0 255.255.255.224
  mask-URL
  by default-default group policy
  !
  end

  Any ideas?

  Thank you.

  I see ip nat inside and ip nat outside interfaces configured on. But I don't see any translation of address configured. This would preclude anything inside the unit to be able to access the Internet.

  HTH

  Rick

• No internet access through VPN

  Hi, I have the router Cisco 881 (MPC8300) with c880data-universalk9 - mz.153 - 3.M4.bin when users establish a VPN connection to the corporate network, had access to all the resources but no internet access, please help me what else I need to configure to achieve my goal. I don't want to split the tunnel, internet via VPN, users must have. In my opinion, I have put an additional configuration for NAT, but my router not recognize u-Turn and NAT commands on the object on the network.

  My config:

  Building configuration...

  Current configuration: 13562 bytes
  !
  ! Last configuration change at 09:52:38 PCTime Saturday, May 16, 2015, by admin
  version 15.3
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  XXX host name
  !
  boot-start-marker
  start the flash system: c880data-universalk9 - mz.153 - 3.M4.bin
  boot-end-marker
  !
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login ciscocp_vpn_xauth_ml_1 local
  AAA authentication login ciscocp_vpn_xauth_ml_2 local
  AAA authorization exec default local
  AAA authorization ciscocp_vpn_group_ml_1 LAN
  AAA authorization ciscocp_vpn_group_ml_2 LAN
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  iomem 10 memory size
  clock timezone PCTime 1 0
  PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
  !
  Crypto pki trustpoint TP-self-signed-1751279470
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1751279470
  revocation checking no
  rsakeypair TP-self-signed-1751279470
  !
  !
  TP-self-signed-1751279470 crypto pki certificate chain
  certificate self-signed 01
  XXXX
  !
  !
  Protocol-IP port-map user - 2 tcp 8443 port
  user-Protocol IP port-map - 1 tcp 3389 port
  !

  !
  !
  !
  IP domain name dmn.local
  8.8.8.8 IP name-server
  IP-server names 8.8.4.4
  IP cef
  No ipv6 cef
  !
  !
  license udi pid CISCO881-K9 sn FCZ174992C8
  !
  !
  username privilege 15 secret 5 xxxx xxxx
  username secret VPNUSER 5 xxxx
  !
  !
  !
  !
  !
  !
  type of class-card inspect sdm-nat-user-protocol--2-1 correspondence
  game group-access 105
  corresponds to the user-Protocol - 2
  type of class-card inspect entire game SDM_AH
  match the name of group-access SDM_AH
  type of class-card inspect entire game PAC-skinny-inspect
  Skinny Protocol game
  type of class-card inspect entire game SDM_IP
  match the name of group-access SDM_IP
  type of class-card inspect entire game PAC-h323nxg-inspect
  match Protocol h323-nxg
  type of class-card inspect entire game PAC-cls-icmp-access
  match icmp Protocol
  tcp protocol match
  udp Protocol game
  type of class-card inspect entire game PAC-h225ras-inspect
  match Protocol h225ras
  type of class-card inspect entire game SDM_ESP
  match the name of group-access SDM_ESP
  type of class-card inspect entire game PAC-h323annexe-inspect
  match Protocol h323-annex
  type of class-card inspect entire game PAC-cls-insp-traffic
  match Protocol pptp
  dns protocol game
  ftp protocol game
  https protocol game
  match icmp Protocol
  match the imap Protocol
  pop3 Protocol game
  netshow Protocol game
  Protocol shell game
  match Protocol realmedia
  match rtsp Protocol
  smtp Protocol game
  sql-net Protocol game
  streamworks Protocol game
  tftp Protocol game
  vdolive Protocol game
  tcp protocol match
  udp Protocol game
  type of class-card inspect the correspondence SDM_GRE
  match the name of group-access SDM_GRE
  type of class-card inspect entire game PAC-h323-inspect
  h323 Protocol game
  type of class-card inspect correspondence ccp-invalid-src
  game group-access 103
  type of class-card inspect entire game PAC-sip-inspect
  sip protocol game
  type of class-card inspect correspondence sdm-nat-https-1
  game group-access 104
  https protocol game
  type of class-card inspect all match mysql
  match the mysql Protocol
  type of class-card inspect correspondence ccp-Protocol-http
  http protocol game
  type of class-card inspect entire game CCP_PPTP
  corresponds to the SDM_GRE class-map
  inspect the class-map match PAC-insp-traffic type
  corresponds to the class-map PAC-cls-insp-traffic
  type of class-card inspect entire game SDM_EASY_VPN_SERVER_TRAFFIC
  match Protocol isakmp
  match Protocol ipsec-msft
  corresponds to the SDM_AH class-map
  corresponds to the SDM_ESP class-map
  type of class-card inspect correspondence ccp-icmp-access
  corresponds to the class-ccp-cls-icmp-access card
  type of class-card inspect the correspondence SDM_EASY_VPN_SERVER_PT
  corresponds to the SDM_EASY_VPN_SERVER_TRAFFIC class-map
  !
  type of policy-map inspect PCB - inspect
  class type inspect PCB-invalid-src
  Drop newspaper
  class type inspect mysql
  inspect
  class type inspect PCB-Protocol-http
  inspect
  class type inspect PCB-insp-traffic
  inspect
  class type inspect PCB-sip-inspect
  inspect
  class type inspect PCB-h323-inspect
  inspect
  class type inspect ccp-h323annexe-inspect
  inspect
  class type inspect ccp-h225ras-inspect
  inspect
  class type inspect ccp-h323nxg-inspect
  inspect
  class type inspect PCB-skinny-inspect
  inspect
  class class by default
  drop
  type of policy-card inspect sdm-license-ip
  class type inspect SDM_IP
  Pass
  class class by default
  Drop newspaper
  type of policy-card inspect sdm-pol-NATOutsideToInside-1
  class type inspect sdm-nat-https-1
  inspect
  class type inspect sdm-nat-user-protocol--2-1
  inspect
  class type inspect CCP_PPTP
  Pass
  class class by default
  Drop newspaper
  type of policy-card inspect PCB-enabled
  class type inspect SDM_EASY_VPN_SERVER_PT
  Pass
  class class by default
  drop
  type of policy-card inspect PCB-permits-icmpreply
  class type inspect PCB-icmp-access
  inspect
  class class by default
  Pass
  !
  safety zone-to-zone
  security of the area outside the area
  ezvpn-safe area of zone
  zone-pair security PAC-zp-self-out source destination outside zone auto
  type of service-strategy inspect PCB-permits-icmpreply
  zone-pair security PAC-zp-in-out source in the area of destination outside the area
  type of service-strategy inspect PCB - inspect
  source of PAC-zp-out-auto security area outside zone destination auto pair
  type of service-strategy inspect PCB-enabled
  sdm-zp-NATOutsideToInside-1 zone-pair security source outside the area of destination in the area
  type of service-strategy inspect sdm-pol-NATOutsideToInside-1
  in the destination box source sdm-zp-in-ezvpn1 ezvpn-pairs area security
  type of service-strategy inspect sdm-license-ip
  source of sdm-zp-out-ezpn1 of security area outside zone ezvpn-zone time pair of destination
  type of service-strategy inspect sdm-license-ip
  safety zone-pair sdm-zp-ezvpn-out1-source ezvpn-zone of destination outside the area
  type of service-strategy inspect sdm-license-ip
  safety zone-pair source sdm-zp-ezvpn-in1 ezvpn-area destination in the area
  type of service-strategy inspect sdm-license-ip
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA aes 256
  preshared authentication
  Group 2
  !
  Configuration group customer crypto isakmp Domena
  key XXXXXX
  DNS 192.168.1.2
  Dmn.local field
  pool SDM_POOL_1
  Save-password
  Max-users 90
  netmask 255.255.255.0
  banner ^ Cwelcome ^ C
  ISAKMP crypto ciscocp-ike-profile-1 profile
  match of group identity Domena
  client authentication list ciscocp_vpn_xauth_ml_2
  ISAKMP authorization list ciscocp_vpn_group_ml_2
  client configuration address respond
  virtual-model 1
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac ESP_AES-256_SHA
  tunnel mode
  !
  Profile of crypto ipsec CiscoCP_Profile1
  game of transformation-ESP_AES-256_SHA
  set of isakmp - profile ciscocp-ike-profile-1
  !
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.9.1 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  no ip address
  !
  interface FastEthernet3
  no ip address
  !
  interface FastEthernet4
  Description $ETH - WAN$ $FW_OUTSIDE$
  IP x.x.x.x 255.255.255.248
  NAT outside IP
  IP virtual-reassembly in
  outside the area of security of Member's area
  automatic duplex
  automatic speed
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ezvpn-safe area of Member's area
  ipv4 ipsec tunnel mode
  Tunnel CiscoCP_Profile1 ipsec protection profile
  !
  interface Vlan1
  Description $ETH_LAN$ $FW_INSIDE$
  IP 192.168.1.1 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly in
  Security members in the box area
  IP tcp adjust-mss 1452
  !
  local IP SDM_POOL_1 192.168.10.10 pool 192.168.10.100
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  The dns server IP
  IP nat inside source list 3 interface FastEthernet4 overload
  IP nat inside source static tcp 192.168.1.3 interface FastEthernet4 443 443
  IP nat inside source static tcp 192.168.1.2 8443 interface FastEthernet4 8443
  IP route 0.0.0.0 0.0.0.0 X.x.x.x
  !
  SDM_AH extended IP access list
  Note the category CCP_ACL = 1
  allow a whole ahp
  SDM_ESP extended IP access list
  Note the category CCP_ACL = 1
  allow an esp
  SDM_GRE extended IP access list
  Note the category CCP_ACL = 1
  allow a gre
  SDM_IP extended IP access list
  Note the category CCP_ACL = 1
  allow an ip
  !
  not run cdp
  !
  Note access-list 3 INSIDE_IF = Vlan1
  Note CCP_ACL category in the list to access 3 = 2
  access-list 3 Let 192.168.1.0 0.0.0.255
  Note access-list 23 category CCP_ACL = 17
  access-list 23 permit 192.168.1.0 0.0.0.255
  access-list 23 allow 10.10.10.0 0.0.0.7
  Note access-list 100 Auto generated by SDM management access feature
  Note access-list 100 category CCP_ACL = 1
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 22
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq www
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 443
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq cmd
  access-list 100 tcp refuse any host 192.168.1.1 eq telnet
  access-list 100 tcp refuse any host 192.168.1.1 eq 22
  access-list 100 tcp refuse any host 192.168.1.1 eq www
  access-list 100 tcp refuse any host 192.168.1.1 eq 443
  access-list 100 tcp refuse any host 192.168.1.1 eq cmd
  access-list 100 deny udp any host 192.168.1.1 eq snmp
  access ip-list 100 permit a whole
  Note access-list 101 category CCP_ACL = 1
  access-list 101 permit ip 192.168.1.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 1
  access-list 102 permit ip 192.168.1.0 0.0.0.255 any
  Note access-list 103 CCP_ACL category = 128
  access-list 103 allow the ip 255.255.255.255 host everything
  access-list 103 allow ip 127.0.0.0 0.255.255.255 everything
  access-list 103 allow ip 93.179.203.160 0.0.0.7 everything
  Note 104 CCP_ACL category = 0 access-list
  IP access-list 104 allow any host 192.168.1.3
  Note access-list 105 CCP_ACL category = 0
  IP access-list 105 allow any host 192.168.1.2

  -----------------------------------------------------------------------
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 102 in
  transport input telnet ssh
  line vty 5 15
  access class 101 in
  transport input telnet ssh
  !
  !
  end

  I'd be grateful for help

  concerning

  Hello

  Enter the subnet pool VPN to access-list 3 for source NAT

  You may need to check the firewall also rules to allow the connection based on areas you

  HTH,

  Averroès

• Internet works is not in LAN behind a router from Cisco 881

  My internet does not work in local network that is behind the router from Cisco 881. Here is the configuration of the router.

  Help, please...

  Current configuration: 1478 bytes
  !
  ! Last modification of the configuration at 08:16:12 UTC Wednesday, February 6, 2036
  !
  version 15.1
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname R1
  !
  boot-start-marker
  boot-end-marker
  !
  enable secret 5 CATz $1$ $ VqnIsAQvFHHnV9E/Q6RMV0
  !
  No aaa new-model
  iomem 10 memory size
  !
  !
  IP source-route
  !
  !
  DHCP excluded-address IP 192.168.1.1
  !
  IP dhcp pool dhcppool1
  import all
  network 192.168.1.0 255.255.255.0
  default router 192.168.1.1
  DNS-server 202.56.230.2 202.56.230.7
  !
  !
  IP cef
  name of the IP-server 202.56.230.2
  name of the IP-server 202.56.230.7
  No ipv6 cef
  !
  !
  license udi pid CISCO881-K9 sn FGL1539254Q
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  interface FastEthernet4
  IP 182.73.122.54 255.255.255.252
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  !
  interface Vlan1
  IP 192.168.1.1 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  !
  router RIP
  version 2
  network 192.168.1.0
  !
  IP forward-Protocol ND
  IP http server
  no ip http secure server
  !
  overload of IP nat inside source list 101 interface FastEthernet4
  IP route 0.0.0.0 0.0.0.0 182.73.122.53
  !
  access-list 101 permit ip 0.0.0.0 255.255.255.0 any
  !
  !
  !
  !
  !
  control plan
  !
  !
  Line con 0
  exec-timeout 5 30
  password vinayak123
  opening of session
  no activation of the modem
  line to 0
  line vty 0 4
  password vinayak123
  opening of session
  transport of entry all
  !
  end

  Hello @[email protected] / * /;

  Thank you for your message. I had a glance on the configuration for you. You used a network as opposed to a wild card mask in your access control list for your NAT statement. This changed the field from the source to 0.0.0.0 automatically, which is going to be does not match your interior traffic and NAT'ing outside.

  To fix this, please run the following commands and test once more.

  no access-list 101access-list 101 permit ip 192.168.1.0 0.0.0.255 any

  Thank you

  Luke

  Please evaluate the useful messages and mark the correct answers.

• Several external IPs on Cisco 881

  Nice day

  I have a Cisco 881 router on which I am putting in place some NAT to allow external connections on some IP addresses replacing my ISP to connect to some ports on my internal servers.   Unfortunately, I'm not a network engineer and something seems to be non-tout to right with my setup.

  My ISP, I have IP 184.183.156.98, he was assigned to the WAN port on my router Cisco 881 (FastEthernet4), and I have this working properly.  Rules of Port forwarding I have in place that use this IP address work very well.   In addition, I have the small block of IPs 184.183.150.161 - 164.   None of the port forwarding rules put in place for these seem to work at all.

  If you need the full config file, please let me know.  This section below seems to be the relevant bits to my question, the entries in bold are the port forwarding rules that I think should work, but who do not seem to.

  !

  interface FastEthernet4

  WAN description $ FW_OUTSIDE$

  IP 184.183.156.98 255.255.255.252

  no ip redirection

  no ip unreachable

  NAT outside IP

  IP virtual-reassembly in

  automatic duplex

  automatic speed

  !

  overload of IP nat inside source list 23 interface FastEthernet4

  IP nat inside source static tcp 192.168.10.205 1024 184.183.150.162 1024 extensible

  IP nat inside source static tcp 192.168.10.205 1025 184.183.150.162 1025 extensible

  IP nat inside source static tcp 192.168.10.205 1026 184.183.150.162 1026 extensible

  IP nat inside source static tcp 192.168.10.205 184.183.150.162 1027 1027 extensible

  IP nat inside source static tcp 192.168.10.205 3061 184.183.150.162 3061 extensible

  IP nat inside source static tcp 192.168.10.205 3064 184.183.150.162 3064 extensible

  IP nat inside source static tcp 192.168.10.210 888 184.183.150.163 888 extensible

  IP nat inside source static tcp 192.168.10.93 1024 184.183.150.164 1024 extensible

  IP nat inside source static tcp 192.168.10.93 1026 184.183.150.164 1026 extensible

  IP nat inside source static tcp 192.168.10.93 184.183.150.164 1027 1027 extensible

  IP nat inside source static tcp 192.168.10.93 184.183.150.164 3060 3060 extensible

  IP nat inside source static tcp 192.168.10.93 6901 184.183.150.164 6901 extensible

  IP nat inside source static udp 192.168.10.93 6901 184.183.150.164 6901 extensible

  IP nat inside source static tcp 192.168.10.250 88 184.183.156.98 88 extensible

  IP nat inside source static tcp 192.168.10.250 37777 184.183.156.98 37777 extensible

  IP route 0.0.0.0 0.0.0.0 184.183.156.97

  !

  Note access-list 23 CCP_ACL category = 19

  access-list 23 allow 192.168.10.0 0.0.0.255

  access-list 23 allow 192.168.20.0 0.0.0.255

  access-list 23 allow 192.168.30.0 0.0.0.255

  access-list 23 permit 192.168.40.0 0.0.0.255

  Note access-list 23 VPN Internet acccess

  access-list 23 allow 192.168.50.0 0.0.0.255

  Thank you

  Adam Corbett

  Adam

  From what you have posted your config looks very good. Are you sure that your ISP routes these IPs to your external interface?

  How do you test it?

  Jon

• How much max VPN session is my ASA

  This is my version to see the ASA5512 VPN

  "Other peers VPN: 250" means that I can use 250 IPSEC session? If I still use MAX 250 VPN Cisco AnyConnect Secure Mobility Client session?
  "Total peer VPN: 250" means that I can use 2 Anyconnect premium + 248 250 IPSEC or IPSEC session at the same time?

  "AnyConnect for Mobile: Disabled" means, I can't use AnyConnect Secure mobility Client (smartphone apps) connect to the ASA by AnyConnect SSL? Can I use AnyConnect secure mobility Client (smartphone apps) connect to the ASA by IPSEC?

  The devices allowed for this platform:
  The maximum physical Interfaces: unlimited perpetual
  VLAN maximum: 100 perpetual
  Guests of the Interior: perpetual unlimited
  Failover: Active/active perpetual
  Encryption - A: enabled perpetual
  AES-3DES-Encryption: activated perpetual
  Security contexts: 2 perpetual
  GTP/GPRS: Disabled perpetual
  AnyConnect Premium peers: 2 perpetual
  AnyConnect Essentials: Disabled perpetual
  Counterparts in other VPNS: 250 perpetual
  Total VPN counterparts: 250 perpetual
  Shared license: disabled perpetual
  AnyConnect for Mobile: disabled perpetual
  AnyConnect Cisco VPN phone: disabled perpetual
  Assessment of Advanced endpoint: disabled perpetual
  Proxy UC phone sessions: 2 perpetual
  Proxy total UC sessions: 2 perpetual
  Botnet traffic filter: disabled perpetual
  Intercompany Media Engine: Disabled perpetual
  The IPS Module: Disabled perpetual
  Cluster: Disabled perpetual

  THX

  Hello!

  ASA5512 can contain up to 250 concurrent VPN of any type: IPsec Site to Site or IPsec Remote access or Anyconnect SSL VPN or IPsec IKEv2, or even without VPN client.

  This means you can use 2 Anyconnect premium + 248 IPSEC VPN from Site to Site. Or, for example, 200 simultaneous IPsec Site to Site VPN + 25 Client VPN (IPsec IKEv1) + 25 AnyConnect VPN (SSL or IPsec IKE v2). But not more than 250 and then at the same time.

  "AnyConnect for Mobile" is now obsolete. The license for Anyconnect schema was changed in early 2015. You can see the new pattern here:

  http://www.Cisco.com/c/dam/en/us/products/security/AnyConnect-og.PDF

  With the new scheme, if you need to connect mobile devices (iOS, Android and so on), using the Anyconnect client, you just need to have a license Anyconnect MORE for the necessary amount of users/devices. License AnyConnect more open along the lines in the output of the show version:

  AnyConnect Premium Peers : 250 perpetual

  AnyConnect for Mobile : Enabled perpetualAnyConnect for Cisco VPN Phone : Enabled perpetualAdvanced Endpoint Assessment : Enabled perpetual

  But, despite the exit "AnyConnect peers Premium: 250 perpetual", you will have the right to use no more then amount ordered... If you need advanced features, for example, Suite B cryptography or VPN without customer, you must order license Anyconnect Apex for amount of users/devices needed. For ASA5512, you need to order licenses Anyconnect more or Apex, but no more so for 250 users, because ASA5512 can't take no more then 250 simultaneous connections. If you want to use the Anyconnect client for mobile devices and you use IPsec IKEv2 for VPN, you will also need order licenses Anyconnect more or Apex. I hope this helps.

• Internet problems after having disconnected the VPN session

  I was wondering if someone could tell me a solution for this problem I have.  A year or more ago.

  When I had Vista (32 bit), I used to use Cisco's VPN IPSEC client.  At the time, I found that when I disconnect a VPN session, something on my machine would get watered upward.  In other words, I could no longer RDP to my machine from another machine (which I would do so on the internet).  I also found that I could not access other services on my machine to other machines as well through the internet.

  Basically, I found this case I disabled/re-enabled my NIC (do it manually or by restarting), I was able to connect once more to my machine.

  Now I have Windows 7 (64-bit).  So now I also use Cisco SSL VPN client.  I had hope that this should disappear with the new operating system and the new VPN client, but the problem persists!  Fortunately, the Windows 7 Task Manager can be triggered based on the events that occur.  I created a task that will disable/re-enable my NIC whenever he sees the event of disconnection of SSL in the registry.  While this is a great workaround for me, I would go at the bottom of the issue.  I even helped others in my office with the same question by providing my elegant solution!

  Side note: my friend just asked me why he couldn't TRACERT what either.  He spoke to me through our enterprise IM client while VPN was in our network.  I asked if he was on the VPN on the attempt, and he said that it has disconnected first thinking it was the case.  I suggested to him that he can hit the same question that I have, in that the VPN is somehow corrupt its TCP stack or something.  I asked to disconnect from the VPN, once again, turn his NIC, and lo-and-here it could once more tracert.

  This issue is documented anywhere?  Are there patches?

  TIA,

  MCDONAMW

  What version of AnyConnect you test with?  This could be related to bug CSCsz12568 that has been fixed in the 2.4 client later.  What you can do is capture a snapshot of the Windows routing table before connecting, once connected, disconnected and then again later to see if there is not strange roads that can be bad traffic orientation.

• How to limit maximum SSL VPN sessions by group policy on ASA5510?

  How to limit maximum SSL VPN sessions by group policy on ASA5510?

  There are ideas?

  There are 2-Group Policy: within a maximum of 10 connections, in the second - 15 (total licenses for SSL VPN 25 connections).

  Hi Anton,.

  It is an interesting question.

  Please check the following options, depending on your scenario:

  simultaneous VPN connections

  Pour configurer configure the number of simultaneous connections allowed for a user, use the command simultaneous vpn connections in the configuration of group policy or username configuration mode. To remove the attribute from the running configuration, don't use No form of this command. This option allows inheritance of a value from another group policy. Enter 0 to disable the connection and prevent the access of the user.

  simultaneous vpn connections {integer}

  No vpn - connections

  http://www.Cisco.com/en/us/docs/security/ASA/asa84/command/reference/uz.html#wp1664777

  There is a global command, although may not be useful, I wanted to share it with you:

  VPN-sessiondb max-session-limit

  --> To specify the maximum limit of VPN session.

  Best option:

  What you can do is to create a pool of IP 10 IP addresses in one and 15 in the other, this way you let only 10 connections and 15 respectively.

  IP local pool only_10 192.168.1.1 - 192.168.1.10

  IP local pool only_15 192.168.2.1 - 192.168.1.15

  Then,

  attributes of the strategy of group only_10

  the address value only_10 pools

  !

  attributes of the strategy of group only_20

  the address value only_20 pools