Cisco AP group nugget

I learned so much from NETPROs and wanted to give back. In January, I started a website where I will post nuggets.

Here is my second... I hope someone is able to learn!

http://www.my80211.com/Cisco-Labs/2009/3/23/Cisco-AP-group-nugget.html

Thanks, it was very interesting. I knew about the AP groups, but maily broadcasting different SSID on specific access points, not to divide the net - it will be very useful in the future.

One question though, in a multi-controleur environment, I can just add the APs for the group, which are connected to the real controller. When the AP joins another controller (for example, a controller is offline) the APs will be in the default group on this controller (I think). How can I handle this differently?

Tags: Cisco Wireless

Similar Questions

  • The SSID on Cisco WLC support no.

    Hi all

    Can you please help me to provide details on the following Cisco wireless controller?

    1. no support SSID on Cisco WLC

    2. is it possible to limit the SSID on the access point (for example, I have 10 SSID configured on the controller, I want 10 first access points using SSID (SSID 1-5) and rest of the AP SSID 6-10)

    Thank you

    Jamal

    Hi Jamal,.

    Just to add to the great info of Robert (+ 5 points Robert)

    The feature you're looking for is called WLAN substitute in versions 4.x WLC.

    Allowing substitution WLAN

    By default, all defined WLAN transmission on the controller access points. However, you can use WLAN editable to select WLAN is transmitted and who are not on a per access point basis. For example, you can use WLAN to control override goes where in the guest WLAN network or you can use it to disable a specific WLAN in a certain area of the network.

    This doc.

    http://www.Cisco.com/en/us/docs/wireless/controller/4.0/Configuration/Guide/c40wlan.html#wp1114777

    Once you create a new WLAN, WLAN > page edition for the new WLAN. In this page, you can set various parameters specific to this general policy, RADIUS servers, political security WLAN key, and 802.1 x settings.

    * Check Admin status under general strategies to activate the WLAN. If you want AP broadcast the SSID in beacon frames, check the SSID broadcast.

    Note: You can configure up to 16 WLAN on the controller. The Cisco WLAN Solution can control up to sixteen WLAN for Lightweight APs. Each WLAN has an ID separated from WLAN (1 to 16), a WLAN SSID (name of the WLAN) separate and can be assigned to single security policies. Lightweight APs broadcast all Cisco WIFI WLAN SSID Solution assets and apply the policies that you set for each WLAN.

    The good doc.

    http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#C3

    In versions 5.x, you will use AP groups, because in versions 5.x WLC, WLAN substitute has been replaced by the "Groups of AP" feature;

    Creation of groups access Point

    After all the access points have joined the controller, you can create up to 150 groups of access point and assign up to 16 local wireless networks in each group. Each access point announces that the WLAN enabled that belong to his group of access point. The access point no announcement not disabled WLAN in its access point group or WLAN that belong to another group.

    http://www.Cisco.com/en/us/docs/wireless/controller/5.2/configuration/guide/c52wlan.html#wp1128591

    To learn more about George video AP discover excellent groups

    http://www.my80211.com/Cisco-Labs/2009/3/22/Cisco-AP-group-nugget.html

    I hope this helps!

    Rob

  • Design WLC? -1 master to multiple WLC passant

    OK I'll try to be quick...

    Currently, we have 1 WLC controller 4402-50 (in our "non-critical" data center in the office).  This WLC control all points of access to 9 sites, all connected to the office (WLC) through links of qmoe from 10 to 50 MB.

    We have a problem in that because all communities share the same a WLC site can slow down others especially when distribute us applications (some of our sites have cell phones 100% wireless, no connection).

    Most of our band bandwidth/problems surrounds the fact that all the wireless to any place are on the same subnet and cannot use local servers slot in their place (on the local network) and must pass through and return on the WAN.

    Our team of network tells us, to remedy this situation, we would have to spend 100 k to 1 controller at each location.  It is too high for our boss to swallow, and I guess to talk about adding more 4402-50 years who I guess is exaggerated...

    I guess we could use 44xx-6 at most of the places which costs about 50% less, but there might be other options?  The 22xx series may eventually work with the 44xx we have for master/slave even controllers?  My boss would flip if we essentially threw the x 440...

    Needs:

    1. centralization of the secure ssid private and limited open comments ssid (the DNS redirector security)

    2. wlan of each location must ultimatly dump for the LAN before through WAN (aka the controller on each site)

    3 SSID is still universal from 1 site to another for laptops can go from 1 location to all others...

    4 aPs-6-8 at MOST, heavier use is on 20 laptop computers at each location.

    I unfortunately am NOT a network/Cisco guys, just some basic information to point our network team to cheaper alternatives...

    Thank you for your time.

    Hi Dan,.

    If I understand your post you state that because of the slow data connectivity is due to 1 large broadcast domain.  Then you can consider to take advantage of your existing WLC and deploy the AP groups. This will allow you to break the cable side while broadcast domains by keeping the same SSID. I created a video how AP groups working on the link below... You will have taffic crosses over and over again back but not as large a broadcast domain that you currently have.

    http://www.my80211.com/Cisco-WLC-Labs/2009/3/22/Cisco-AP-group-nugget.html

    If you want to bail on the local network, then you may want to HREAP with LOCAL optional switching.

    http://www.Cisco.com/en/us/docs/wireless/controller/6.0/Configuration/Guide/c60hreap.html

  • Is it possible to map a promoter group in Cisco ISE to a group of users in Active Directory, using a RADIUS server?

    Hello!!

    We are working on a mapping between a promoter Cisco ISE group and a user group in Active Directory, but the customer wants the mapping through a RADIUS SERVER, to avoid the ISE by querying directly activate Directory.

    I know it is possible to use a RADIUS SERVER as source of external identity for ISE... but, is possible to use this RADIUS SERVER for this sponsor group manages?

    Thank you and best regards!

    Hi Rodrigo,

    The answer is no. There is no way to integrate the portal Sponsor config with a RADIUS server. Your DB for authentication Portal Sponsor options;

    AD
    LDAP
    User internal ISE DB

    Sent by Cisco Support technique iPhone App

  • CTI ports associated with more than one group?

    Hello

    I wonder if I can make a pool of CTI ports? I have 150 IVR ports under license, how can I agree to all my applications?

    Thank you.

    Hello

    Simply create a "Cisco Media Group" with 150 channels.

    After that, you can set up a "group of Port ICT" with CTI 150 Ports you created in CallManager and after that in the JTAPI triggers, you must associate the 'Call Control Group' parameter to the "Cisco Media Group" that you cooked up, and he must asscoiate dialogue primary group"at the"CTI Port Group"with 150 ports.

    Hope this helps,

    Juan Luis

  • IOS anyconnect vpn group lock and user restrictions

    Dear Experts,

    I now have two questions about cisco IOS vpn on ISR G2:

    1 is it possible to lock user group in IOS anyconnect VPN we can do in ASA? If so, can someone share the steps for her?

    2 - a customer wishes to restrict the anyconnect user login as it might turn the connection to the user on request. That is to say whenever the user wants to connect via vpn to ask the administrator to allow connection. can we do without deleting the username and create again?

    the other may be on ASA or IOS.

    Please see this guide:

    http://www.Cisco.com/c/en/us/support/docs/security/iOS-easy-VPN/117634-c...

    As he points out, "for the Cisco IOS group-lock and the ipsec: use vpn-group, it only works for IPSec (the easy VPN server)." In order to group-lock specific users in specific contexts of WebVPN (and strategies Group attached), authentication domains should be used. »

    If you lock a user to a policy that authenticates, but does provide real access permissions (say an ACL that blocks all traffic to the private network) then you have essentially made their ability to non-functional connection.

    If you use an external AAA server (for example, RADIUS or LDAP), then you can move in and out of the group which is authorized without disable VPN access / delete their account altogether.

  • Problem with AP group.

    I got to set up the subnet via radio.

    We have 32 buildings - all buildings are in their own ip address range and subnet.

    I have read cisco ap group instructions...  I'm missing something... Maybe the concept of its operation.

    We have a SSID for University - Let's say SSID - College

    Under College - we would like to see the ip address range and subnet under each building.  32 buildings with various number of AP.

    Problem is that I'm even old address ip under Gallaudet even I already put in place the various dhcp scope...

    How to troubleshooot who?

    WCS and WLC are on the latest version

    -Allen-

    Hi Allen.

    Configuration of the AP groups.

    -Create all interfaces of controller/interfaces of each building.

    -Create the SSID; in your case 'college', the interface that you attached to this SSID initially is not relevant if you are using AP group. For example, use the interface to the building where is the WLC.

    -Create groups of AP; You must create a group for each building and map the College SSID to the interface to which belongs the building. Record.

    -Finally, fix the Ap´s which belongs to this building to each group of AP.

    The AP´s then reboot and only the ssid of the College will be published mapping their traffic to the interface you select AP-groups.

    If you move from one building to another, the IP address is maintained that even if you are in a different subnet (WLC this traffic tunnels) If you disconnected, then reconnect you wil acquire an IP address that belongs to the network of the building you are.

    You can see in the interface chart in the clients IP address, the trap associated with you and if your traffic is "tunnel" because you come from another subnet.

    Best regards.

  • Multiple users Active Directory membership mapping group

    Hi all

    We got 4.2 ACS and two types of user access to our network:

    1_ we got some users in 'CiscoAdmins' Active Directory, corresponding group mapped Cisco ACS group is "switch Admins.

    2_ we also have some users in "VPN_Users' group Active Directory, corresponding mapped Cisco ACS group is"VPN_Users.

    In the "Command mapping" page on Cisco ACS 4.2, we put tte group 'CiscoAdmins' Active Directory mapping at the top "VPN_Users' Active Directory group mapping. So what happens is, if a user belongs to two "CiscoAdmins" and "VPN_Users" groups in Active Directory, users always goes in the "Switch_Admins" group in Cisco ACS.

    However for some users (who belong to two groups in Active Directory), we need to apply some IP allocation and specific authorization.

    The suggestiongs are welcome.

    Thanks in advance.

    Dumlu

    Yes, check ACS for belonging to the user group and it can determine if the user is a member of several groups and then map the corrosponding ACS group. Little additional material on the ACS group mapping

    http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/GrpMap.html#wp940538#wp940538

    -

    Note: Please rate the answer if it helped

  • DMM / SnS and definition of filters

    When you set filters in your DMM to import your Active Directory domain users, is there a way to move these specific users see the and hand Rolls (Editor / author)?   Maybe it's a side script thing SnS, but I have not found this process.

    Here is a current example of a DMM import which does not place users in the rolls, but they Gets a DMM group.  I would like assigns combining Show and part editor and / or rolls of the author.

    (&(objectclass=user) (memberof = CN = MVTC OR = Cisco, OU = Groups, DC = domain, DC = wfu, DC = net))

    I agree, it would be nice, but there is no way to automatically assign roles to a user group.  Have users in groups makes it easier to manually assign roles well.

  • RA VPN doesn't work is not on the second external interface

    I've temporarily came from two Internet service providers in our ASA 5510.  Which works very well.  I tried to configure the VPN to our second outside interface (outside-XO) and who does not.  The first/original VPN works great.  Can someone look at the config and tell me if I did something wrong.  It is not a customer number, because it is able to connect fine on the first interface.  Thank you.

    ASA Version 7.1 (2)
    !
    hostname FW01
    dot.com domain name
    activate the password * encrypted
    names of
    !
    interface Ethernet0/0
    nameif outside
    security-level 0
    IP address *.229.200 255.255.255.192
    !
    interface Ethernet0/1
    Speed 100
    full duplex
    nameif inside
    security-level 100
    IP 192.168.2.3 address 255.255.255.0
    !
    interface Ethernet0/2
    nameif outside-XO
    security-level 0
    IP address *.157.100 255.255.255.192
    !
    interface Management0/0
    nameif management
    security-level 100
    IP 192.168.14.254 255.255.255.0
    management only
    !
    passwd * encrypted
    banner login attention is a private network. Unauthorized intruders will BE prosecuted to the extent of the ACT!
    boot system Disk0: / asa712 - k8.bin
    passive FTP mode
    clock timezone PST - 8
    clock summer-time recurring PDT 2 Sun Mar 2:00 1 Sun Nov 02:00
    DNS server-group DefaultDNS
    dot.com domain name
    permit same-security-traffic intra-interface
    object-group service tcp Server
    HTTPS and www description
    EQ object of the https port
    port-object eq www
    object-group service tcp Mail
    SMTP POP3 access description
    EQ Port pop3 object
    EQ smtp port object
    port-object eq 32000
    non-standard tcp service object-group
    Port Description 1429 and 1431
    port-object eq 1431
    port-object eq 1429
    object-group service DNS tcp - udp
    Description to allow outside DNS resolution
    area of port-object eq
    object-group service FTP tcp
    FTP description
    port-object eq ftp
    SMTPMail tcp service object-group
    Description SMTP only access
    EQ smtp port object
    IQWebServer tcp service object-group
    Www and port 8082 description access
    port-object eq www
    EQ object Port 8082
    EQ object of the https port
    port-object eq 8999
    SFTP tcp service object-group
    Description SFTP_SSH
    EQ port ssh object
    outside_access_in list extended access permit tcp any host *. *.229.201 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.229.202 object-group Mail
    outside_access_in list extended access permit tcp any host *. *.229.202 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.229.202 object-group DNS
    outside_access_in list extended access permit tcp any host *. *.229.203 - group of non-standard items
    outside_access_in list extended access permit tcp any host *. *.229.204 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.229.205 - group of non-standard items
    outside_access_in list extended access permit tcp any host *. *.229.208 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.157.101 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.157.102 object-group Mail
    outside_access_in list extended access permit tcp any host *. *.157.102 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.157.102 object-group DNS
    outside_access_in list extended access permit tcp any host *. *.157.103 - group of non-standard items
    outside_access_in list extended access permit tcp any host *. *.157.104 - a group of Web server objects
    outside_access_in list extended access permit tcp any host *. *.157.105 - group of non-standard items
    outside_access_in list extended access permit tcp any host *. *.157.108 - a group of Web server objects
    access-list 150 extended permit tcp any any eq smtp
    access-list sheep extended ip 192.168.0.0 allow 255.255.0.0 10.1.1.0 255.255.255.0
    access-list sheep extended permits all ip 10.1.1.0 255.255.255.240
    Splt_tnl list standard access allowed 192.168.0.0 255.255.0.0
    Splt_tnl list standard access allowed 10.1.1.0 255.255.255.0
    access-list extended webcap permit tcp any host *. * eq.164.210 smtp
    access-list extended webcap permit tcp host * smtp eq.164.210 all
    pager lines 24
    Enable logging
    logging asdm-buffer-size 200
    buffered logging critical
    exploitation forest asdm errors
    Outside 1500 MTU
    Within 1500 MTU
    management of MTU 1500
    outside-XO MTU 1500
    mask 10.1.1.1 - 10.1.1.15 255.255.255.0 IP local pool VPNpool
    mask 192.168.14.244 - 192.168.14.253 255.255.255.0 IP local pool VPNCisco
    ICMP allow any inside
    ASDM image disk0: / asdm512.bin
    enable ASDM history
    ARP timeout 14400
    Global (outside) 1 *. *.229.194
    Global (outside-XO) 1 *. *. 157.66
    NAT (inside) 0 access-list sheep
    NAT (inside) 1 192.168.0.0 255.255.0.0
    public static tcp (indoor, outdoor) * domaine.229.202 192.168.14.166 netmask 255.255.255.255 area
    public static tcp (indoor, outdoor) *.229.202 www 192.168.14.2 www netmask 255.255.255.255
    public static tcp (indoor, outdoor) *.229.202 smtp smtp 192.168.14.2 mask 255.255.255.255 subnet
    public static tcp (indoor, outdoor) *.229.202 192.168.14.2 pop3 pop3 netmask 255.255.255.255
    public static tcp (indoor, outdoor) *.229.202 32000 192.168.14.2 32000 netmask 255.255.255.255
    static (inside, outside) *. * 192.168.14.6.229.203 netmask 255.255.255.255
    static (inside, outside) *. * 192.168.14.28.229.204 netmask 255.255.255.255
    static (inside, outside) *. * 192.168.14.205.229.205 netmask 255.255.255.255
    static (inside, outside) *. * 192.168.14.29.229.208 netmask 255.255.255.255
    static (inside, outside) *. * 192.168.14.3.229.201 netmask 255.255.255.255
    TCP static (inside, outside-XO) *. * domaine.157.102 192.168.14.166 netmask 255.255.255.255 area
    TCP static (inside, outside-XO) *. *.157.102 www 192.168.14.2 www netmask 255.255.255.255
    TCP static (inside, outside-XO) *. *.157.102 smtp smtp 192.168.14.2 mask 255.255.255.255 subnet
    TCP static (inside, outside-XO) *. *.157.102 192.168.14.2 pop3 pop3 netmask 255.255.255.255
    TCP static (inside, outside-XO) *. *.157.102 32000 192.168.14.2 32000 netmask 255.255.255.255
    static (inside, outside-XO) *. * 192.168.14.3.157.101 netmask 255.255.255.255
    static (inside, outside-XO) *. * 192.168.14.6.157.103 netmask 255.255.255.255
    static (inside, outside-XO) *. * 192.168.14.28.157.104 netmask 255.255.255.255
    static (inside, outside-XO) *. * 192.168.14.205.157.105 netmask 255.255.255.255
    static (inside, outside-XO) *. * 192.168.14.29.157.108 netmask 255.255.255.255
    Access-group outside_access_in in interface outside
    Access-group outside_access_in in interface outside-XO
    Route outside 0.0.0.0 0.0.0.0 *. * 1.229.193
    Route inside 192.168.0.0 255.255.0.0 192.168.2.1 1
    Route outside-XO 0.0.0.0 0.0.0.0 *. * 2.157.65
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00
    Timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    Timeout, uauth 0:05:00 absolute
    attributes of Group Policy DfltGrpPolicy
    No banner
    WINS server no
    DNS server no
    DHCP-network-scope no
    VPN-access-hour no
    VPN - connections 3
    VPN-idle-timeout 480
    VPN-session-timeout no
    VPN-filter no
    Protocol-tunnel-VPN IPSec
    disable the password-storage
    disable the IP-comp
    Re-xauth disable
    Group-lock no
    disable the PFS
    IPSec-udp disable
    IPSec-udp-port 10000
    Split-tunnel-policy tunnelall
    Split-tunnel-network-list no
    by default no
    Split-dns no
    disable secure authentication unit
    disable authentication of the user
    user-authentication-idle-timeout 30
    disable the IP-phone-bypass
    disable the leap-bypass
    disable the NEM
    Dungeon-client-config backup servers
    the firewall client no
    rule of access-client-none
    WebVPN
    url-entry functions
    HTML-content-filter none
    Home page no
    4 Keep-alive-ignore
    gzip http-comp
    no filter
    list of URLS no
    value of customization DfltCustomization
    port - forward, no
    port-forward-name value access to applications
    SSO-Server no
    value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information
    SVC no
    SVC Dungeon-Installer installed
    SVC keepalive no
    generate a new key SVC time no
    method to generate a new key of SVC no
    client of dpd-interval SVC no
    dpd-interval SVC bridge no
    deflate compression of SVC
    Cisco strategy of Group internal
    Cisco group policy attributes
    value of server WINS 192.168.14.4 192.168.14.11
    value of 192.168.14.4 DNS server 192.168.14.11
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list Splt_tnl
    field default value *.com
    username * password * encrypted
    username * password * encrypted privilege 0
    username * password * encrypted
    username * password * encrypted
    username * password * encrypted
    username * password * encrypted privilege 15
    username * password * encrypted privilege 15
    the ssh LOCAL console AAA authentication
    Enable http server
    http 0.0.0.0 0.0.0.0 outdoors
    http 192.168.0.0 255.255.0.0 inside
    http 192.168.1.0 255.255.255.0 management
    http 192.168.14.0 255.255.255.0 management
    http 0.0.0.0 0.0.0.0 outside-XO
    SNMP-server host within the public 192.168.14.27 of the community
    location of the SNMP server *.
    contact SNMP Network Admin Server
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA
    dynamic-map of crypto-XO_dyn_map 10 outside the value transform-set ESP-3DES-SHA
    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
    outside_map interface card crypto outside
    outside-XO_map 65535 ipsec-isakmp crypto map outside Dynamics-XO_dyn_map
    card crypto outside-XO_map interface outside-XO
    ISAKMP allows outside
    ISAKMP enable outside-XO
    part of pre authentication ISAKMP policy 10
    ISAKMP policy 10 3des encryption
    ISAKMP policy 10 sha hash
    10 2 ISAKMP policy group
    ISAKMP life duration strategy 10 86400
    ISAKMP nat-traversal 20
    IPSec-attributes tunnel-group DefaultL2LGroup
    ISAKMP keepalive retry threshold 600 10
    IPSec-attributes tunnel-group DefaultRAGroup
    ISAKMP keepalive retry threshold 600 10
    tunnel-group, type Cisco ipsec-ra
    attributes global-tunnel-group Cisco
    address pool VPNpool
    Group Policy - by default-Cisco
    tunnel-group Cisco ipsec-attributes
    pre-shared-key *.
    ISAKMP keepalive retry threshold 600 10
    Telnet 192.168.0.0 255.255.0.0 inside
    Telnet 192.168.14.109 255.255.255.255 inside
    Telnet 192.168.14.36 255.255.255.255 inside
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 inside
    SSH timeout 5
    Console timeout 10
    management-access inside
    dhcpd lease 3600
    dhcpd ping_timeout 50
    !
    INSPECT class-map
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    Policy-map global_policy
    class INSPECT
    inspect the dns
    inspect the http
    inspect the icmp
    inspect the tftp
    inspect the ftp
    inspect the h323 ras
    inspect h323 h225
    inspect the snmp
    inspect the sip
    inspect esmtp
    class inspection_default
    inspect the ftp
    !
    global service-policy global_policy
    TFTP server inside 192.168.14.21 TFTP-root /.
    192.168.14.2 SMTP server
    Cryptochecksum:5eedeb06395378ed1c308a70d253c1b6
    : end

    Hello

    Should work.

    What I think is the routes:

    Route outside 0.0.0.0 0.0.0.0 *. * 1.229.193
    Route outside-XO 0.0.0.0 0.0.0.0 *. * 2.157.65

    If the first interface is ok, the ASA does not go to route packets via the second interface, so VPN will be not through this interface.

    On the client, can you PING the two IPs outside of ASA or only the first?

    Try to add a static route on the SAA to secondary education outside interface pointing to the address of the customer and try to connect via VPN and see if it works.

    Orders:

    HS cry isa his

    HS cry ips its

    Will be a big help as well, when the VPN connection attempt failed.

    Federico.

  • Inside the default Route

    We have an ASA 5550. How do you put the statement inside the default route?  When I put inside default route (road inside 0.0.0.0 0.0.0.0 172.16.3.254 in tunnel), I can't get on the internet when I connect to the client VPN Cisco with Group Policy techsupport (complete tunnel).  However, I can get on the internet with tunnel of split for the splitunnel group policy.  The config is attached.  Please let me know if you need additional information.

    Do you have any suggestions?

    Thank you.

    You have no need configure the road inside the subcutaneous tunnel no split policy keyword. With the current configuration, you should be able to access the Internet through the external interface. You try to send internet traffic to your internet gateway internal? Or the ASA outside interface of the default gateway for the internet VPN Client traffic?

  • ASA 5505 VPN Client Ipsec config problems

    I configured the asa the wizard to Setup vpn, but this still does not work properly. Vpn connect without problem, but I can't access all the resources on the 192.168.1.x subnet. Don't know what I'm missing here, here's a copy of my config.

    ASA Version 8.0 (3)
    !
    host name
    domain name
    activate the password
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    192.168.1.3 IP address 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    "Public ip" 255.255.255.0 IP address
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passwd
    passive FTP mode
    DNS lookup field inside
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    Server name 192.168.1.28
    domain fmrs.org
    GroupVpn_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
    vpngroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
    outside_access_in list extended access permit tcp any any eq pptp
    outside_access_in list extended access will permit a full
    inside_nat0_outbound list of allowed ip extended access all 192.168.99.0 255.255.255.0
    inside_nat0_outbound list of allowed ip extended access entire 192.168.1.0 255.255.255.0
    inside_access_in to access ip 192.168.1.0 scope list allow 255.255.255.0 any
    access extensive list ip 192.168.99.0 inside_access_in allow 255.255.255.0 any
    inside_access_in list of allowed ip extended access all 192.168.99.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    mask 192.168.99.2 - 192.168.99.100 255.255.255.0 IP local pool GroupPool
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any inside
    ICMP allow all outside
    ASDM image disk0: / asdm - 602.bin
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 1 192.168.1.0 255.255.255.0
    public static tcp (indoor, outdoor) interface 192.168.1.62 pptp pptp netmask 255.255.255.255
    inside_access_in access to the interface inside group
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 66.76.199.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout, uauth 0:05:00 absolute
    dynamic-access-policy-registration DfltAccessPolicy
    RADIUS protocol AAA-server fmrsdc
    fmrsdc AAA-server 192.168.1.28
    Timeout 5
    fmrsasa key
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    crypto ISAKMP allow inside
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    No encryption isakmp nat-traversal
    No vpn-addr-assign aaa
    No dhcp vpn-addr-assign
    Console timeout 0
    dhcpd outside auto_config
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    GroupVpn internal group policy
    GroupVpn group policy attributes
    value of server WINS 192.168.1.28
    value of server DNS 192.168.1.28
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list GroupVpn_splitTunnelAcl
    FMRs.org value by default-field
    ID password cisco
    tunnel-group GroupVpn type remote access
    attributes global-tunnel-group GroupVpn
    address pool GroupPool
    authentication-server-group fmrsdc
    Group Policy - by default-GroupVpn
    IPSec-attributes tunnel-group GroupVpn
    pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    inspect the pptp
    inspect the icmp
    !
    global service-policy global_policy
    context of prompt hostname
    Cryptochecksum:b5df903e690566360b38735b6d79e65e
    : end

    Please configure the following:

    ISAKMP nat-traversal crypto

    management-access inside

    You should be able to ping of the SAA within the IP 192.168.1.3

  • SSL VPN traffic

    Hello

    I have configured the client SSL VPN on SAA. I'm able to establish SSL VPN with the ASA and obtaining the IP address of subnet defined (CorporateVPN 172.16.0.100 - 172.16.0.110). But when I try to ping inside the property intellectual treats which is 172.16.0.1 and other machine in the range LAN getting loss of packets to the remote machine.

    What could be the problem?

    Below is the configuration of the SAA.

    ASA Version 7.2 (1)
    !
    Cisco - ASA host name
    test.com domain name
    activate the password password
    names of
    DNS-guard
    !
    interface Ethernet0/0
    Description connected to ISP
    nameif outside
    security-level 0
    IP address "public IP".

    !
    interface Ethernet0/1
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/2
    Description connected to the local network
    nameif inside
    security-level 100
    172.16.0.1 IP address 255.255.255.0
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    nameif management
    security-level 0
    IP 192.168.1.1 255.255.255.0
    management only
    !
    2KFQnbNIdI.2KYOU encrypted passwd
    boot system Disk0: / asa721 - k8.bin
    passive FTP mode
    clock timezone GMT 3 30
    management of the DNS domain-lookup service
    DNS server-group DefaultDNS
    Server name 203.123.165.75
    test.com domain name
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    management of MTU 1500
    mask 172.16.0.100 - 172.16.0.110 255.255.255.0 IP local pool CorporateVPN
    IP verify reverse path to the outside interface
    IP verify reverse path inside interface
    no failover
    ASDM image disk0: / asdm521.bin
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 1 172.16.0.0 255.255.255.0
    Route outside 0.0.0.0 0.0.0.0 Gateway 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout, uauth 0:05:00 absolute
    internal GroupPolicy1 group strategy
    attributes of Group Policy GroupPolicy1
    Protocol-tunnel-VPN IPSec l2tp ipsec webvpn
    WebVPN
    enable SVC
    SVC Dungeon-Installer installed
    time to generate a new key of SVC 30
    SVC generate a new method ssl key
    internal Netadmin group strategy
    Group Policy attributes Netadmin
    Protocol-tunnel-VPN IPSec l2tp ipsec webvpn
    WebVPN
    Required SVC
    SVC Dungeon-Installer installed
    time to generate a new key of SVC 30
    generate a new key SVC new-tunnel method
    dpd-interval SVC 500 customer
    dpd-interval SVC 500 gateway
    username cisco password encrypted privilege 15 ffIRPGpDSOJh9YLq
    attributes username cisco
    VPN-group-policy Netadmin
    http server enable 444
    http 192.168.1.0 255.255.255.0 management
    http 0.0.0.0 0.0.0.0 outdoors
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    attributes global-tunnel-group DefaultWEBVPNGroup
    address pool CorporateVPN
    tunnel-group NetForceGroup type webvpn
    attributes global-tunnel-group NetForceGroup
    address (inside) CorporateVPN pool
    address pool CorporateVPN
    Group Policy - by default-Netadmin
    No vpn-addr-assign aaa
    No dhcp vpn-addr-assign
    Telnet 192.168.1.0 255.255.255.0 management
    Telnet timeout 10
    SSH timeout 5
    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns migrated_dns_map_1
    parameters
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the migrated_dns_map_1 dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    !
    global service-policy global_policy
    WebVPN
    allow outside
    SVC disk0:/crypto_archive/sslclient-win-1.1.1.164 2 image
    enable SVC
    context of prompt hostname
    Cryptochecksum:13f5616c7345efb239d7996741ffa7b3
    : end

    Yes, 'inside access management' is only to manage/ping of the SAA within the interface. Without this command, they would still be able to access the internal network. This command is only used to manage the SAA within the interface itself.

  • From a few access points SSID

    Hi all

    I'll create a new WLAN id/identifier SSID in Cisco 4402 wireless controller and as soon as I did that create the ssid will be pushed to all access points, but I want to broadcast the SSID that at a few access points, is anyway we achieve this in the controller itself or WCS. Please let me know

    Thank you

    Hello

    Yes, you can shape this traffic. His call to Cisco AP groups. You can simply consult the configuration for confi efforts guide. What is the code, you are on, if you are on 4.2 you can Overide WLAN.

    I hope this helps...

  • A Cisco ME-3600 X-24FS-M can support pppoe bba-global group?

    Hello

    I'm new on routing and switching, nicely naked with me. I have a Cisco 1941 router that I'm trying to reproduce on a Cisco 3600 ME X-24FS-M but whenever I try to configure pppoe bba-world group I can't to, configuration see error below:

    xxx_xxx (config) #bba - pppoe global group
    ^
    Invalid entry % detected at ' ^' marker.

    xxx_xxx (config) #.

    Y at - it any other way for me to set up a group of bba or a way to activate on a Cisco ME?

    Thanks again.

    Hello

    1941 is a router and 3600 X is a switch. That's why many devices you need to 1941 will be unavailable on 3600 X, and this is one of them. You can use Cisco Feature Navigator to find the features supported on a specific image of the platform or the software.

    -

    pajaja

Maybe you are looking for