Cisco EA4500 - No associated router problem :-(

Similar Questions

• Routing problem between the VPN Client and the router's Ethernet device

  Hello

  I have a Cisco 1721 in a test environment.

  A net 172.16.0.0/19 simulates the Internet and a net 192.168.1.0/24 simulates the net, the VPN tunnel must go to (intranet).

  The net 172.16.0.0 depends on the router 0 FastEthernet, Intranet (VPN) hangs on Ethernet 0.

  The configuration was inspired form the sample Configuration

  "Configuring the Client VPN Cisco 3.x for Windows to IOS using Local extended authentication"

  and the output of the ConfigMaker configuration.

  Authentication and logon works. Client receives an IP address from the pool. But there's a routing problem

  side of routers. Ping client-side - do not work (the VPN client statistics that count encrypt them packets, but not to decrypt).

  Ping the router works too, but decrypt and encrypt customer statistics in VPN packets count progressive

  (customer has a correct route and return ICMP packets to the router).

  The question now is:

  How to route packets between the Tunnel and an Ethernet device (Ethernet 0)?

  conf of the router is attached - hope that's not too...

  Thanks & cordially

  Thomas Schmidt

  -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- snipp .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

  !

  version 12.2

  horodateurs service debug uptime

  Log service timestamps uptime

  encryption password service

  !

  !

  host name * moderator edit *.

  !

  enable secret 5 * moderator edit *.

  !

  !

  AAA new-model

  AAA authentication login userauthen local

  AAA authorization groupauthor LAN

  !

  ! only for the test...

  !

  username cisco password 0 * moderator edit *.

  !

  IP subnet zero

  !

  audit of IP notify Journal

  Max-events of po verification IP 100

  !

  crypto ISAKMP policy 3

  3des encryption

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group 3000client

  key cisco123

  pool ippool

  !

  ! We do not want to divide the tunnel

  ! ACL 108

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  !

  map clientmap client to authenticate crypto list userauthen

  card crypto clientmap isakmp authorization list groupauthor

  client configuration address map clientmap crypto answer

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  !

  interface Ethernet0

  no downtime

  Description connected to VPN

  IP 192.168.1.1 255.255.255.0

  full-duplex

  IP access-group 101 in

  IP access-group 101 out

  KeepAlive 10

  No cdp enable

  !

  interface Ethernet1

  no downtime

  address 192.168.3.1 IP 255.255.255.0

  IP access-group 101 in

  IP access-group 101 out

  full-duplex

  KeepAlive 10

  No cdp enable

  !

  interface FastEthernet0

  no downtime

  Description connected to the Internet

  IP 172.16.12.20 255.255.224.0

  automatic speed

  KeepAlive 10

  No cdp enable

  !

  ! This access group is also only for test cases!

  !

  no access list 101

  access list 101 ip allow a whole

  !

  local pool IP 192.168.10.1 ippool 192.168.10.10

  IP classless

  IP route 0.0.0.0 0.0.0.0 172.16.12.20

  enable IP pim Bennett

  !

  Line con 0

  exec-timeout 0 0

  password 7 * edit from moderator *.

  line to 0

  line vty 0 4

  !

  end

  ^-^-^-^-^-^-^-^-^-^-^-^-^- snapp ^-^-^-^-^-^-^-^-^-^-^-^-^-^-

  Thomas,

  Can't wait to show something that might be there, but I don't see here. You do not have the card encryption applied to one of the interfaces, perhaps it was not copied. Assuming your description you do it, or should it be, applied to the fa0 and you are connected. Try how you ping? Since the router or a device located on E0? If you ping the router, you will need to do an extended ping of E0 to the ip address of the client has been assigned. If your just ping the router without the extension, you will get sales and decrypts that you declare on the client. Have you tried to ping from the client to interface E0? Your default route on the router is pointing to fa0? You have a next hop to affect? You have several NIC on the client pc? Turn off your other network cards to check that you don't have a problem with routing on the client if you have more than one.

  Kurtis Durrett

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Cisco 871 routing problem

  Hello.

  I have a Cisco 871 router with this network diagram

  10.218.10.117 host - 10.218.10.118 4 | CISCO 871 | 172.18.122.5-FE0 - 172.18.122.6 host

  I want the 172.18.122.6 host can do ping to the 10.218.10.117 host at the other end of the router, but its does not work, what is the problem with this config? could someone give me a hand?

  With the help of 1222 off 131072 bytes

  !

  version 12.4

  no service button

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  hostname ALCALÁ-CNT-UIO

  !

  boot-start-marker

  boot-end-marker

  !

  enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  activate the password XXXXXXXXXXXXXXX

  !

  No aaa new-model

  !

  resources policy

  !

  IP subnet zero

  IP cef

  !

  !

  !

  !

  !

  !

  interface FastEthernet0

  !

  interface FastEthernet1

  !

  interface FastEthernet2

  !

  interface FastEthernet3

  !

  interface FastEthernet4

  IP 10.218.10.118 255.255.255.252

  automatic speed

  full-duplex

  !

  interface Vlan1

  IP 172.18.122.5 255.255.255.0

  !

  router RIP

  redistribute connected

  10.0.0.0 network

  network 172.18.0.0

  !

  IP classless

  !

  !

  no ip address of the http server

  no ip http secure server

  !

  Dialer-list 1 ip protocol allow

  !

  !

  control plan

  !

  !

  Line con 0

  no activation of the modem

  line to 0

  line vty 0 4

  password XXXXXXXXXXXX

  opening of session

  !

  max-task-time 5000 Planner

  end

  Better compliance

  The f

  Jeff,

  Each host can ping their side? You have default gateways configured on the hosts?

  HTH,
  John

  Please note all useful messages *.

• Cisco SG300 / ASA 5505 intervlan routing problem

  Dear all

  I have a problem with the configuration correctly sg300 layer 3 behind the ASA 5505 switch (incl. license more security)

  The configuration is the following:

  CISCO SG300 is configured as a layer 3 switch

  VLAN native 1: 192.168.1.254, default route ip address (inside interface ASA 192.168.1.1)

  VLAN defined additional switch

  VLAN 100 with 192.168.100.0/24, default gateway 192.168.100.254

  VLAN 110 with 192.168.110.0/24, default gateway 192.168.110.254

  VLAN 120 with 172.16.0.0/16, default gateway 172.16.10.254

  Of the VLANS (100,110,120) different, I am able to connect to all devices on the other VIRTUAL local networks (with the exception of Native VLAN 1; is not the ping requests)

  From the switch cli I can ping my firewall (192.168.1.1) and all the other gateways of VLANs and vlan (VLAN1, 100, 110, 120) devices

  Asa cli I can only ping my switch (192.168.1.254) port, but no other devices in other VLAN

  My question is this. What should I change or installation in the switch configuration or asa so that other VLANs to access the Internet through the ASA. I will not use the ASA as intervlan routing device, because the switch does this for me

  I tried to change the asa int e0/1 in trunkport (uplink port switch also), to enable all the VLANS, but as soon as I do that, I can not ping 192.168.1.254 ASA cli more.

  Any help is greatly appreciated

  Concerning

  Edwin

  Hi Edwin, because the switch is layer 3, the only necessary behavior is to ensure that default gateways to the computer are set on the SVI interface connection to the switch to make sure that the switch is transfer traffic wished to the ASA.

  The configuration between the ASA and the switch must stay true by dot1q, such as the vlan all other, unidentified native VLAN tagged.

  Also, if I'm not wrong, on the SAA you must set the security level of the port to 100.

  -Tom
  Please evaluate the useful messages

• IPsec VPN site to site between router problem Cisco ASA. Help, please

  Hello community,

  I'm stuck in configuring VPN site to site between ASA (OS 9.1) and router Cisco IOS (IOS 15, 2 - 4.M4)

  Attachment is router configuration and ASA. I also include the router debug output.

  It seems that the two parties must isakmp missmatch configuration, but I have already disabled the KeepAlive parameters. I also turn off PFS setting on both sides. But it does not work. I have no idea on this problem.

  Please help me. Any help appreciated.

  Thank you

   
   

  I didn't look any further, but this may be a reason:

   crypto map mymap 1 ipsec-isakmp dynamic dyn1 

  The dynamic CM must always be the last sequence in a card encryption:

   no crypto map mymap 1 ipsec-isakmp dynamic dyn1 crypto map mymap 65000 ipsec-isakmp dynamic dyn1

  Try this first, then we can look further.

• Cisco SA540 - classic routing problem - 0.0.0.0 in static road

  Hello, I am a bit newbie with routing device,

  I had several public IP address

  I got a Cisco Pix 501and want to replace it with a Cisco SA540

  My Wan IP on Pix 501 is 195.68.x.z
  My Lan IP on Pix 501 is 62.23.a.b (and 62.23.a.c,...)

  My rules Pix 501 translation is: inside the interface. inside: everything: 0.0.0.0. Apart from the interface. same as orginal
  My Pix 501 static route: outside | IP address 0.0.0.0. Mask 0.0.0.0. Gateway IP 195.168.x.y | Metric 1

  So when a computer with 62.23.a.X want access to the internet the static route he say to throuw the 195.168.x.y of the IP Address of the gateway (as I undestand)

  I replicate this config on my SA540

  Also, through the Web user interface, I configure the Wan and Lan IP
  and then in the routing menu, I check "Classic routing" so I go to the static Menu to add the same route as in my Pix 501, but I can't put 0.0.0.0 in iP address or IP subnet mask.

  Can someone help me?

  Thank you very much.

  Hello

  I hope this finds you doing well.  Just thought I would add a few things here...

  You have probably seen this, but... Here is the link to the page SA500:

  https://www.myciscocommunity.com/docs/doc-10526

  Yes, when you configure the device as a router, you need to configure routing.  Try to remove the routes and the readd.

  In addition, a little off topic, but if you want to stay with an ASA5505, there used to be a tool that would turn your PIX configus ASA.  I don't remember where this link is now... but it used to fairly simple transition.

  After you have configured the routing, since your internal machine, have you tried a trace route?  On what device the traceroute fails?

  In case you wish to speak to a support representative, here is the link to find the correct number:

  http://www.Cisco.com/en/us/support/tsd_cisco_small_business_support_center_contacts.html

  HTH,

  Andrew Lee Lissitz

• C6180 print wireless with Cisco E1000 router problems

  Hello

  I recently got a new Cisco E1000 wireless router and am not able to print to my HP C6180 printer wireless.  I ran the diagnostics wireless to the printer and all past.  The printer has an IP address, etc.  However, neither my wife nor I can print without wire (connected to the printer works) on its Apple or my PC.  She gets "the printer is offline.  I found an old post which has me download and install the diagnostic utility network HP but that the utility could not find all the printers and after tinkering with it I could get still not work.  I think the printer wireless radio is dead (but then how do I connect to the router and have an IP address, and go to the configuration utility) or the N wireless router is not compatible?  Or hopefully something we can fix.  Thank you very much in advance for your help.

  Ross

  If the printer has an IP address, then it must be connected to the router OK.  You've restarted the router?

  We could define an IP address of the printer:

  -Print a the front of the printer Network Setup Page. Note the IP address of the printer.
  -Enter the IP address in a browser to reveal the internal settings of the printer.
  -Choose the network tab, then wireless along the left side, then on the IPv4 tab.
  -On this screen, you want to set a manual IP address. You must assign an IP address outside the range that the router sets automatically (called the DHCP range). Yours is 192.168.1.100 a.149.  Allows to select 192.168.1.200 for your printer.
  -Apply the subnet 255.255.255.0 (unless you know it's different, if so, use it)
  -Enter the IP of your router (on the Page of the Network Config) for the bridge and the first DNS. Let the second white.
  -Click 'apply '.

  Now, stop the router and printer, start the router, wait, and then start printing.

  After that, you will have to redo 'Add printer' using the new IP address.

• PowerConnect 6248 routing problem

  Hi all

  I have a very frustrating problem with routing using a PowerConnect 6248 switch.

  Network configuration is the following:

  VLAN3

  172.16.0.254/24

  VLAN4

  192.168.0.254/24

  PC on each VLAN using the switch VLAN interface IP (x.x.x.254) as the gateways.

  Switch has configured default route to 192.168.0.248 which is a router with excess of 100 subnets frame relay cloud. 192.168.0.248 has routes suitable for all remote subnets via a serial interface, a static route to VLAN 3 (172.16.0.0/24) traffic through 192.168.0.254 and one way by default via a PIX 515 (192.168.0.253). Router and PIX is connected to access VIRTUAL 4 LAN ports. The PIX has a route to VLAN 3 traffic through 192.168.0.254.

  The problem is that VIRTUAL 3 all hosts on the local network cannot access the Internet. They can ping the gateways in the order - 172.16.0.254, 192.168.0.248 and 192.168.0.253. I have disabled IP forwarding on the router and the switch with no effect.

  I built this configuration in Cisco Packet Tracer 5.0 (it works) and we are running exactly the same IP configuration with a Nortel switch instead of the Dell 6248 (this also works).

  Absoloutely perplexed to find out what I'm missing! I also noticed that if I perform a traceback while in the CLI on the router using a source IP address of the interface VLAN that it blocks the interface on the switch.

  I would be very grateful to anyone who can punch me in the right direction.

  I've included the config switch below.

  Configure
  database of VLAN
  VLAN 2-4
  subnet of VLAN association 172.16.0.0 255.255.255.0 3
  subnet of VLAN association 192.168.11.0 255.255.255.0 2
  subnet of VLAN association 192.168.0.0 255.255.255.0 4
  output
  battery
  1 2 Member
  output
  IP 10.10.10.1 255.255.255.0
  no console logging
  no ip redirection
  IP routing
  IP route 0.0.0.0 0.0.0.0 192.168.0.248
  bootpdhcprelay enable
  bootpdhcprelay IP_serveur 192.168.0.3
  router RIP
  no activation
  output
  interface vlan 2
  name of the "voice."
  Routing
  IP 192.168.11.254 255.255.255.0
  output
  interface vlan 3
  name "workstations".
  Routing
  IP 172.16.0.254 255.255.255.0
  output
  interface vlan 4
  "Name servers".
  Routing
  IP 192.168.0.254 255.255.255.0
  output
  level of 3c9fd59f1a240ff455a9d9e8eebae936 user name 'admin' password encrypted 15
  router ospf
  no activation
  output
  !
  interface ethernet 1/g1
  switchport mode trunk
  switchport trunk allowed vlan add 2-4
  switchport trunk allowed vlan remove 1
  output
  !
  interface ethernet 1/g2
  switchport mode trunk
  switchport trunk allowed vlan add 2-4
  switchport trunk allowed vlan remove 1
  output
  !
  interface ethernet 1/g3
  switchport access vlan 2
  output
  !
  interface ethernet 1/g4
  switchport access vlan 2
  output
  !
  interface ethernet 1/g5
  switchport access vlan 2
  output
  !
  interface ethernet 1/g6
  switchport access vlan 4
  output
  !
  interface ethernet 1/g7
  switchport mode trunk
  switchport trunk allowed vlan add 2-4
  switchport trunk allowed vlan remove 1
  output
  !
  interface ethernet 1/g8
  switchport access vlan 3
  output
  !
  interface ethernet 1/g9
  switchport access vlan 4
  output
  !
  interface ethernet 1/g10
  switchport access vlan 3
  output
  !
  interface ethernet 1/g11
  switchport access vlan 3
  output
  !
  interface ethernet 1/g12
  switchport access vlan 3
  output
  !
  interface ethernet 1/g13
  switchport access vlan 3
  output
  !
  interface ethernet 1/g14
  switchport access vlan 3
  output
  !
  interface ethernet 1/g15
  switchport access vlan 3
  output
  !
  interface ethernet 1/g16
  switchport access vlan 3
  output
  !
  interface ethernet 1/g17
  switchport access vlan 3
  output
  !
  interface ethernet 1/g18
  switchport access vlan 3
  output
  !
  interface ethernet 1/g19
  switchport access vlan 3
  output
  !
  interface ethernet 1/g20
  switchport access vlan 3
  output
  !
  interface ethernet 1/g21
  switchport access vlan 3
  output
  !
  interface ethernet 1/g22
  switchport access vlan 3
  output
  !
  interface ethernet 1/g23
  switchport mode trunk
  switchport trunk allowed vlan add 2-4
  switchport trunk allowed vlan remove 1
  output
  !
  interface ethernet 1/g24
  switchport access vlan 3
  output
  !
  interface ethernet 1/g25
  switchport access vlan 4
  output
  !
  interface ethernet 1/g26
  switchport access vlan 4
  output
  !
  interface ethernet 1/g27
  switchport access vlan 4
  output
  !
  interface ethernet 1/g28
  switchport access vlan 4
  output
  !
  interface ethernet 1/g29
  switchport access vlan 4
  output
  !
  interface ethernet 1/g30
  switchport access vlan 4
  output
  !
  interface ethernet 1/g31
  switchport access vlan 4
  output
  !
  interface ethernet 1/g32
  switchport access vlan 4
  output
  !
  interface ethernet 1/g33
  switchport access vlan 4
  output
  !
  interface ethernet 1/g34
  switchport access vlan 4
  output
  !
  interface ethernet 1/g35
  switchport access vlan 4
  output
  !
  interface ethernet 1/g36
  switchport access vlan 4
  output
  !
  interface ethernet 1/g37
  switchport access vlan 4
  output
  !
  interface ethernet 1/g38
  switchport access vlan 4
  output
  !
  interface ethernet 1/g39
  switchport access vlan 4
  output
  !
  interface ethernet 1/g40
  switchport access vlan 4
  output
  !
  interface ethernet 1/g41
  switchport access vlan 4
  output
  !
  interface ethernet 1/g42
  switchport access vlan 4
  output
  !
  interface ethernet 1/g43
  switchport access vlan 4
  output
  !
  interface ethernet 1/g44
  switchport access vlan 4
  output
  !
  interface ethernet 1/g45
  switchport access vlan 4
  output
  !
  interface ethernet 1/g46
  switchport access vlan 4
  output
  output

  
  

• Cisco 861 ezVPN license remote problem

  I bought a new Cisco 861 SRI with safety advanced on this subject.

  When I look in the Dashboad license in Cisco Configuration professional it tells me I have advsecurity licenses with deployment status 'Deployed' function and the State 'active, in use '.

  But when I want to configure any type of VPN I get the following error message:

  License of technology (advsecurity) associated with this feature is not deployed on this router. Use the link below to deploy the technology license.

  When I click the link I find myself in the dashboard to license again.

  I Don t have another file license and advanced security features should be sufficient for VPN. At least that's what

  http://www.Cisco.com/en/us/prod/collateral/routers/ps380/data_sheet_c78_461543.html said.

  What should I do to be able to configure the VPN?

  Thankx a lot for any help

  Dirk

  What version of CCP do you use?  I see a few other customer cases with this error and it looks like there may be a problem with CCP 2.5.  Customers who use 2.3 CCP do not see this error when applying the license through the user interface.

  Todd

• EA4500: There is a problem with this Web site's secure certificate.

  When I navigate to the Web page of the router, I get a message that "there is a problem with this Web site's secure certificate."

  I'm using https.

  Does this mean that https does not work on the EA4500?

  N °, this means that the browser does not trust the certificate sent by the router. The connection is always encrypted.

• Connectivity of the wireless router problem

  I have a Cisco's Linksys WRT160N wireless router.  After it is up and running, all my wireless devices work fine.  My sons Wii for my laptop, my wifes iPod Touch. But the strangest thing is happening.  I have problems connecting to the internet with my desktop computer that is hard wired to the linksys router.

  Often I can connect any... other times it's quite slow compared to when I plug my office directly to a cable modem.  Finally, sometimes certain aspects of the Web page will appear while others won't.

  Question: Is damaged?  Or is there something that I am missing.  You would think it would be right forweard enough... OH, I have also replaced the cables from the desktop to the router and have already done all the reboot that I care to do as well as redo the ip address in the part of the repair of my control panel.

  Any ideas?

  Access the Page of configuration of your router and lower the MTU size of the router to Auto/1500 to 1400.

• Connection to the router problem WRT160Nv2 WUSBF54G

  Currently have the Mac OS X, XP SP3 and XP Home computers on my wireless router. No problems. Set them all to run WPA Personal 2 and AES. No problem everything works fine.

  This device has refused to connect has tried several combinations, but no go. Any help?

  WUSBF54G

  After locating the patch discussed above links feature could not connect to the network.

  Found and downloaded the drivers from Linksys and it worked fine.

  Here is the information:

  WUSBF54G Wireless-G USB Network Adapter with Wi - Fi Finder free

  WRT1600N V2 Linksys/Cisco router

  WUSB54G_20060522.exe drivers downloaded.

  Unzipped the folder drivers and followed the steps of discs for the resettlement of the file manager.

  Everything is workning.

• VPN clients cannot access remote sites - PIX, routing problem?

  I have a problem with routing to remote from our company websites when users connect via their VPN client remotely (i.e. for home workers)

  Our headquarters contains a PIX 515E firewall. A number of remote sites to connect (via ADSL) to head office using IPSEC tunnels, ending the PIX.

  Behind the PIX is a router 7206 with connections to the seat of LANs and connections to a number of ISDN connected remote sites. The default route on 7206 points to the PIX from traffic firewall which sits to ADSL connected remote sites through the PIX. Internal traffic for LAN and ISDN connected sites is done via the 7206.

  Very good and works very well.

  When a user connects remotely using their VPN client (connection is interrupted on the PIX) so that they get an IP address from the pool configured on the PIX and they can access resources located on local networks to the office with no problems.

  However, the problem arises when a remote user wants access to a server located in one of the remote sites ADSL connected - it is impossible to access all these sites.

  On the remote site routers, I configured the access lists to allow access from the pool of IP addresses used by the PIX. But it made no difference. I think that the problem may be the routes configured on the PIX itself, but I don't know what is necessary to solve this problem.

  Does anyone have suggestions on what needs to be done to allow access to remote sites for users connected remotely via VPN?

  (Note: I suggested a workaround, users can use a server on LAN headquarters as a "jump point" to connect to remote servers from there)

  with pix v6, no traffic is allowed to redirect to the same interface.

  for example, a remote user initiates an rdp session for one of the barns adsl. PIX decrypts the packet coming from the external interface and looks at the destination. because the destination is one of adsl sites, pix will have to return traffic to the external interface. Unfortunately, pix v6.x has a limitation that would force the pix to drop the packet.

  with the v7, this restriction has been removed with the "same-security-traffic control intra-interface permits".

  http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

• Cisco ASA Anyconnect LAN access problem

  I have very simple network at home with the WAN IP address, ASA uses DHCP and gateway. plain of network of all no complications.

  X.X.X.X like a WAN

  192.168.1.0/24 as a LAN

  IP Pool 192.168.6.0/24 (VPN Pool)

  I am trying to configure AnyConnect (AC) so that I can connect remotely and get my resources on the LAN while out. I am to connect with AC and when you use split tunnel I'm browsing the web very well, but I have no access to the local network (without ICMP or TCP/UDP)

  Route looks good in customer AC

  unsecured network 0.0.0.0/0
  secure network 192.168.1.0/24

  What I'm missing for LAN access?, nat statement, list of access...?

  _____________________________

  Output of the command: "show run".

  : Saved
  :
  ASA Version 9.1 (5)
  !
  hostname asa01
  domain name asa

  names of
  192.168.6.2 mask - 192.168.6.100 local pool Pool VPN IP 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  switchport access vlan 5
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  interface Vlan2
  Outside description
  nameif outside
  security-level 0
  IP address XXXX
  !
  interface Vlan5
  nameif dmz
  security-level 50
  IP 192.168.100.1 address 255.255.255.0
  !
  boot system Disk0: / asa915 - k8.bin
  passive FTP mode
  clock timezone PST - 8
  clock summer-time recurring PDT
  DNS lookup field inside
  DNS domain-lookup outside
  DNS domain-lookup dmz
  DNS server-group DefaultDNS
  domain naisus.local
  permit same-security-traffic intra-interface
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.6.0_25 object
  subnet 192.168.6.0 255.255.255.128
  object-group Protocol DM_INLINE_PROTOCOL_1
  icmp protocol object
  icmp6 protocol-object
  outside_access_in list extended access permit icmp any any idle state
  outside_access_in extended access list allow icmp6 all all idle state
  outside_access_in_1 list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  list of access allowed standard LAN 192.168.1.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  host of logging inside 192.168.1.99
  forest-hostdown operating permits
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 dmz
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 741.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.6.0_25 NETWORK_OBJ_192.168.6.0_25 non-proxy-arp-search of route static destination
  !
  NAT source auto after (indoor, outdoor) dynamic one interface
  Access-group outside_access_in_1 in interface outside
  Route outside 0.0.0.0 0.0.0.0 X > X > X >
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
  registration auto
  full domain name no
  name of the object CN = asa01, CN = 192.168.1.1
  ASDM_LAUNCHER key pair
  Configure CRL
  trustpool crypto ca policy
  string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
  certificate 8b541b55
  308201c 3 c 3082012 a0030201 0202048b 0d06092a 864886f7 0d 010105 541b 5530
  XXXX
  quit smoking
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 access remote trustpoint ASDM_Launcher_Access_TrustPoint_0
  Telnet 192.168.1.0 255.255.255.0 inside
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH 192.168.1.0 255.255.255.0 inside
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0

  dhcpd outside auto_config
  !
  dhcpd address 192.168.1.100 - 192.168.1.199 inside
  dhcpd dns 8.8.8.8 75.75.75.75 interface inside
  dhcpd naisus.home area inside interface
  dhcpd allow inside
  !
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  NTP server 50.116.56.17 source outdoors
  NTP server 108.61.73.243 source outdoors
  NTP server 208.75.89.4 prefer external source
  SSL-trust outside ASDM_Launcher_Access_TrustPoint_0 point
  Trust ASDM_Launcher_Access_TrustPoint_0 inside the vpnlb-ip SSL-point
  SSL-trust ASDM_Launcher_Access_TrustPoint_0 inside point
  WebVPN
  allow outside
  AnyConnect image disk0:/anyconnect-win-3.1.07021-k9.pkg 1 regex 'Windows NT'
  AnyConnect image disk0:/anyconnect-macosx-i386-3.1.07021-k9.pkg 2 regex "Intel Mac OS X.
  AnyConnect image disk0:/anyconnect-linux-64-3.1.07021-k9.pkg 3 regex "Linux".
  AnyConnect enable
  tunnel-group-list activate
  attributes of Group Policy DfltGrpPolicy
  VPN - connections 30
  VPN-idle-timeout 5
  internal GroupPolicy_AC_Profile group strategy
  attributes of Group Policy GroupPolicy_AC_Profile
  WINS server no
  4.2.2.2 DNS server value
  client ssl-VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value LAN
  naisus.local value by default-field
  XX XX encrypted privilege 15 password username
  name of user XX attributes
  WebVPN
  chip-tunnel tunnel-policy tunnelall
  type tunnel-group AC_Profile remote access
  attributes global-tunnel-group AC_Profile
  address pool VPN-pool
  Group Policy - by default-GroupPolicy_AC_Profile
  tunnel-group AC_Profile webvpn-attributes
  enable AC_Profile group-alias
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:xxx
  : end

  I'm not positive that's causing the problem, but I noticed that you have defined incoherent poolside VPN as a 24 (in the command name and that name is associated with the tunnel group) and 25 (in the command object on the network that is also referenced in the statement of NAT exempting NAT to that object). True your pool assigns addresses from the lower half of the 24, but still...

  I try to simplify things by using a single object for something like that, which is used in several places. With the help of objects the way they are intended, and which allows to avoid any discrepancies.