Cisco RV042 questions

Similar Questions

• Cisco RV042 VPN hub and spokes, connecting spokes question

  Hello

  I have a few Cisco RV042 router and VPN links them with a hub and spoke topology.

  Each speaks VPN works, they manage to connect to the platform.

  The hub can see each VPN active rays.

  A computer under the hub can connect to a computer in any talks.

  A computer under any talks can connect to a computer running the hub.

  Which works very well.

  Now, what I really need, is to connect computers under a RADIUS to connect to computers under another spoke.

  It don't work.

  Current configuration of LAN:

  HUB IP / mask: 192.168.0.1 / 255.255.255.0

  Spoke1 IP / mask: 192.168.1.1 / 255.255.255.0

  Spoke2 IP / mask: 192.168.2.1 / 255.255.255.0

  I was wondering if the Cisco RV042 can be configured to allow that and HOW?

  If we can not do, should what other router I use as a hub? Should I change the rays as well?

  Thank you and have a nice day

  Hope that this document can point you the right direction.

  https://supportforums.Cisco.com/docs/doc-12534

• Port forwarding Cisco RV042 / RV042G

  Hello

  We use three Cisco RV042 small business routers.

  The problem:

  We want to send HTTPS Wan-side to a port other than 443 side Lan.

  For example: 217.44.55.66 Wan port 443 to 192.168.0.5 port 5001

  There is only this option in RV042: Forwarding-> Service HTTPS [TCP/443 ~ 443] to "IP address" (also Port 443)

  but we need something like this:

  Transfer-> HTTPS Service [TCP/443 ~ 443] to 192.168.0.5:5001

  How can I configure it?

  Greetings from the Germany

  Goetz Hartwig, CSI GmbH

  Hi Ituconsult1

  My name is Mehdi from the Cisco Technical Support, Yes with RV042 we can translate the port

  Please follow these steps:

  1. Please remove the port forwarding rule

  2. go in under UPnP settings, the management of the services and you will see an external port and internal port so please configure external port 443 and internal to 5001 and click Add, please do not enable UPnP

  3. on the same page, please choose the service that you have created and put the server's internal IP address

  Please note the position or mark it as answered to help other customers of Cisco

  Greeting

  Concerning

  Mehdi

• Cisco RV042 cannot create a simple VPN?

  Hello

  I'm confused because I'm trying to set up a simple VPN (client of the bridge), but I can't!

  A SSL VPN or an IPSEC VPN, whatever...

  The RV042 firmware is up-to-date, and I try QuickVPN as a customer vpn (also updated...)

  My configuration details:

  I'm at the: 192.168.2.14/24

  My RV042: 192.168.2.250/24

  And the VPN intend to connect to: 192.168.4.x

  I am currently in testing... that's why I use private IP...

  Customer gateway

  Add a new VPN group Tunnel ofgroup VPN Group No. 1 Name of the tunnel: VPN TEST Interface: WAN1WAN2 Activate:

  Configuration of local groups Type of local security group: Range IPSubnetIP IP address: 192.168.4.0 Subnet mask: 255.255.255.0

  Remote Client installation Remote client: Domain Name (FQDN) Email address (USER FQDN) Client Microsoft VPN XP/2000 Domain name: Microsoft.com

  IPSec configuration

  Input mode:	IKE with preshared key
  Group of the phase 1 of DH:	Group 1-768 bitGroup bitGroup 2-1024 bit 5-1536
  Encryption of the phase 1:	DES3DESAES-128AES-192AES-256
  Authentication of the phase 1:	MD5SHA1
  Phase 1 time in HIS life:	28800 seconds
  Perfect Forward Secrecy:
  Group of the phase 2 DH:	Group 1-768 bitGroup bitGroup 2-1024 bit 5-1536
  Encryption of the phase 2:	DES3DESAES-128AES-192AES-256
  Authentication of the phase 2:	MD5SHA1
  Time for phase 2 of HIS life:	3600 seconds
  Pre-shared key:	123456

  so far, nothing fancy... Ok?

  So I create my username for the test:

  VPN Client Access User name: New password: Confirm the new password: Allow the change of password: YesNo. Active: DTSInfo-online Active

  The user is created and activated...

  For the test, I have disabled the firewall (router + windows 7).

  A dnow, when I lunch the QuickVPN client:

  

  Then, when I have lunch:

  > Connection...

  > Activation of policy...

  > Verification of network...

  > The remote gateway is not responding. You don't want to wait? [NO]

  > Disconecting from the server...

  This means that, after activation of the policy, I am connected on the router (user status: active). But when he check network... I am offline!

  There is the newspaper of the RV042:

  dec 18 12:57:50 2012	The VPN log	description of the additional connection (qknips1)
  dec 18 12:57:50 2012	The VPN log	listen to IKE messages
  dec 18 12:57:50 2012	The VPN log	forget the secrets
  dec 18 12:57:50 2012	The VPN log	loading of the secrets of ' / etc/ipsec.d/ipsec.secrets'
  18 12:57:57 dec 2012	The VPN log	(qknips1): removal of connection

  If I'm signed for 7 seconds... Why?

  Can someone help me?

  When I try with the built-in Windows VPN client, newspapers are filled just more... ^ ^

  Help! hour

  Thanks (and sorry for my bad English ^ ^)

  Hello

  Please use our forum

  Hi Skip my name is Johnnatan and I'm part of the community of support to small businesses. I ve seen your post and I see you are using Windows 7 and that you disable your firewall to test your connection. A configuration of the computer and the router must be in order to solve your problem.

  Computer

  As you use Windows 7, you must enable the Windows Firewall and create 2 rules, also make sure that Ipsec communication is allowed, you can follow these steps:

  http://www6.nohold.NET/CiscoSB/Loginr.aspx?login=1&PID=2&app=search&VW=1&articleid=2922

  Router:

  Go firewall > basic settings and

  Disable: Block WAN request

  Enable: Remote Management

  Go to VPN > VPN Passthrough and make sure everything is activate.

  I hope that you will find this answer useful, if it was satisfactory to you, please indicate the question as answer. Please note post you consider useful.

  Greetings,

  Johnnatan Rodriguez Miranda.

  Support of Cisco network engineer.

• Supported on the Cisco RV042 router settings

  Hello

  Anyone know if these settings are supported on router CiscoRV042

  shared secret - authentication-

  -AES-256 / SHA1 encryption

  -IKE: Diffie-Hellman (Group 2)

  -Phase 1 IKE every 1440 minutes.

  -The phase 2 (IPsec) all 3600 sec (every hour) of IKE

  Thank you.

  These are all very standard parts of IPSEC.

  See page 45 of the

  http://www.Cisco.com/en/us/docs/routers/CSBR/RV042/Admin/Guide/RV042_V10_UG_C-Web.PDF

  Copied here

  IPSec configuration

  So that any encryption occur, both ends of a

  VPN tunnel must agree on the encryption methods,

  decryption and authentication. This is done by sharing

  a key for the encryption code. Key management, the

  default mode is IKE with pre-shared key.

  Overlay Mode Select IKE with pre-shared key or manual.

  Both ends of a VPN tunnel must use the same mode of

  key management. After selecting the mode, the

  settings available on this screen may change depending

  on the selection you have made. Follow the instructions

  for the mode you want to use. (Manual mode is available

  for VPN tunnels only, no VPN group.)

  IKE with preshared key

  IKE is used to negotiate Internet Key Exchange Protocol

  for Security Association (SA) key material. IKE use it

  Pre-shared key for authentication to the remote peer of IKE.

  The phase 1 DH group Phase 1 is used to create the SA. DH

  (Diffie-Hellman) is a key exchange protocol used for

  Phase 1 of the authentication before establishing process

  pre-shared keys. There are three groups of different premium

  length of the key. Group 1 is 768 bits, and group 2 is 1024 bits.

  Group 5 is 1 536 bits. If the network speed is preferred, select

  Group 1. If it is better to network security, select group 5.

  The phase 1 encryption select an encryption method: SOME

  (56-bit), 3DES (168-bit), AES-128 (128-bit), AES-192 (192-

  ILO) or AES-256 (256-bit). The method determines the

  length of the key used to encrypt or decrypt ESP packets

  AES - 256 is recommended because it is the safest.

  Make sure that both ends of the VPN tunnel using the same

  encryption method.

  The phase 1 authentication select a method of

  authentication, MD5 or SHA. The authentication method

  determines how the ESP packets are validated. MD5 is

  a one-way hash algorithm that produces a 128-bit

  Digest. SHA is a one-way hashing algorithm which produces

  a 160-bit digest. SHA is recommended because it is more

  Fix. Make sure that both ends of the VPN tunnels using the

  same authentication method.

  Phase 1 life time sets the duration of a VPN

  tunnel is active in Phase 1. The default is 28800

  seconds.

  Perfect Forward Secrecy if the perfect forward secrecy

  (PFS) is enabled, the IKE Phase 2 negotiation will be

  generate new key material for encryption of IP traffic and

  authentication, then pirates using brute force to break

  encryption keys will not be able to obtain future IPSec

  keys.

  Phase 2 DH group if the functionality of perfect forward secrecy

  is disabled, then no new key will be generated, so you don't have

  no need to adjust the Phase 2 DH group (the key for Phase 2

  will be the key in Phase 1).

  There are three groups of different main key lengths.

  Group 1 is 768 bits, and group 2 is 1024 bits. Group 5 is

  1 536 bits. If the network speed is preferred, select group 1.

  If it is better to network security, select group 5. You do

  no need to use the same group of DH that you used for

  Phase 1.

  Encryption of the phase 2 Phase 2 is used to create an or

  several IPSec security associations, which are then used to key IPSec sessions.

  Select an encryption method: NULL, (56-bit), 3DES

  (168 bit), AES-128 (128-bit), AES-192 (192-bit) or AES-

  256 (256-bit). It determines the length of the key used to

  encrypt or decrypt packets ESP. AES-256 is recommended

  because it is the safest. Both ends of the VPN tunnel

  must use the same encryption of Phase 2 setting.

  The phase 2 authentication select a method of

  authentication, NULL, MD5 or SHA. Authentication

  method determines how the ESP packets are validated.

  MD5 is a one-way hash algorithm that produces a

  Digest of 128 bits. SHA is a one-way hashing algorithm that

  produces a 160-bit "Digest". SHA is recommended because

  It's safer. Both ends of the VPN tunnel must use

  the same Phase 2 authentication setting.

  Phase 2 HIS life time sets the duration of a VPN

  tunnel is active in Phase 2. The default value is 3600 seconds.

  Pre-shared key that specifies the pre-shared key used

  to authenticate the remote peer of IKE. Enter a key of

  keyboard and hexadecimal characters, for example, [email protected]/ * /.

  or 4d795f40313233. This field allows a maximum of 30

  characters and hexadecimal values. The two ends of the

  the VPN tunnel must use the same pre-shared key. It's

  We recommend that you change the pre-shared

  Key periodically in order to maximize the VPN security.

• GANYMEDE on Cisco WLC question

  I just installed a Cisco 5508 WLC on our network.  I have the IP address of management in the VLAN management and the controller I set up "no label".  WLC has two ports connected to a Cisco 4507 switch in the config of the channel port.

  I ping the controller of the network very well, I ping the server RADIUS of the controller.  I have the setup of the priority as "GANYMEDE + LOCAL."  However when I try to connect in the WLC and look at the debug, it shows I'm authentication and that's all, for some reason any traffic authorization is failed.  Using wireshark I confirmed that the request comes from the IP Management Interface.

  I followed the instructions in this link:

  http://www.Cisco.com/en/us/customer/docs/wireless/controller/5.0/Configuration/Guide/c5sol.html

  Any ideas?

  Hello

  It seems that you have not configured the ACS correctly.

  The AEC must return the required attributes.

  Please follow the http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a0080851f7c.shtml#topic3document.

  HTH,

  Tiago

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• RV042 Question of static routing

  I am currently using RV042 in the two-WAN backup mode. However, I tried the redundant option and think it's to give me more bandwidth and better performance than only the WAN.

  My problem is that in redundant mode, I am unable to use a few sites that I use on a regular basis. One of the sites is our Web Timesheet hosted service and their website will just crazy when I try to access the router set up in redundant mode. I am still not able to connect to their site, and it is important for my daily work.

  My question is - can I configure static for some sites routes so that the router knows he must access them through my WAN alone? For example, if my site of timesheet software is 123.123.123.123, and my favorite WAN gateway is 68.68.68.68, I can the router only to access this site through the specific gateway, even if the router is configured to use either WAN?

  I tried static routes and it doesn't seem to work at all.

  For example:

  Site: 123.123.123.123

  SM: 255.255.255.0

  Gateway 68.68.68.68

  When I save it and run the tracert to 123.123.123.123, it passes through the other door, and not that I mentioned here.

  Any tips are appreciated.

  Thank you
  Alex P.

  If your help it balance mode, go to system management support and scroll down to protocol binding.  Chances are you're going to a site secured with the two beginning of work and the site sees a connection with two upcoming ip home addresses and interrupts the connection.  You can perform a binding protocol for all your https traffic out a wan for all your network ip addresses and this should solve the problem.  You can do it for mail and other protocols that would be stripped by the dual wan.  I hope this helps.
  

• Problem VPN gateway to gateway Cisco RV042 861

  Hello. I have problems with tunneling IPSec between a RV042 and a Cisco 861. I configured the IKE, turn the value, the access list and the Crypto map into the pit 861 the console and I configured the tunnel in the RV042 web application with the same IKE encryption, Diffie-Hellman group and authentication but the connection does not work. Advice or review for this type of connection? Thank you.

  Your default traffic will be natting to the outside world.

  You need without Nat Traffc of Source ip to Destination ip that you authorized in the VPN access list.

  Mean simply to deny source ip to destination ip in NAT ACL.

• Cisco vWLC - questions while implementing - practice design recommendations

  Hi Forum,

  I am right now with the implementation of a virtual wireless LAN controller in one of our customers environment.

  Customer is facing several problems and I'm not sure how to solve them - then maybe the supportforum could give me answers or advice.

  (1.) the client complains about not being able to see several ports on the vWLC when you implement a second vNIC in VMWare (via the show summary of the vWLCs CLI port command). According to my understanding of the vWLC always show only a 'physical' port and interfaces n (depending on how many interfaces is created on the vWLC) - mapping is accomplished through the vWLC - so basically as that administrator we are not able to see the exact mapping and always only a single port "physical"?

  (2.) the customer was told that the vWLC essentially works except the bypass between the tunnel CAPWAP for VMWare to the router - I'm not sure what he means by that, but I guess it has something to do with the marking of the dynamic interfaces / VLAN to the ESX and later of the ESX via vNIC to the vWLC - advice? (Please take account also details of design of question 3)

  3.) is it ok to TAG all the VLAN via a vNIC without using the service port? I mean create a vNIC transporting and marking of the management and the VLAN database? Or is it mandatory to separate the management of data using a dedicated with the service port subnet VLANS? Suggestions for best practice to get the job of controller - especially on the part of VMWare?

  If you need further details please do not hesitate to ask

  Kind regards

  Christian

  You are right, you can mark the VLAN for management and data is not required to use the service port. You're management interface will also be Manager AP interface on what APs registry. You can not have 2 management. You can have 1 management officially and 1 for the AP Manager.

  Internal DHCP on vwlc is not supported. You need to do a dhcp relay. If you need more information let me know.

  Thank you

  PS: Please do not forget to rate and score as good response if this solves your problem

• Profile of Cisco 42 '' question marking QoS DCSP for signage package

  Hello

  We have 42 profile Cisco with below specifiction.

  Software version: TCNC4.2.1.265253 product: TANDBERG profile 42 C20

  All the call made by Gatekeeper (VCS 7.1)

  DiffServ QoS is configured on the device.

  During the sip call or SIP registration, regardless of the package comes from video endpoint. I see the value DSCP is 0x00

  But any package from VCS, I see the DCSP value is AF31 0x1a.

  But we have configured singnaling (value 26) QoS on Cisco profile 42 end point. Screenshot is attached.

  Also, we have configured VCS Diffserv QoS and value 26.

  In this case, why we are not able to see any marking signs of Cisco profile 42?

  I have attached the screenshot of output wiresark. Also, I downloaded wireshark message output.

  For the RTP stream, we can see package is marked as being configured IE AF41.

  There is no other device does not change the marking.

  Please suggest.

  Rgds

  Rajesh

  Thanks teak: it's mactching DDT allright!

  If moving to TCNC5.1.6 or even TCNC6.0.0 (just released) should solve the problem.

• IPhone and cisco vpn question

  All, I have an IPhone and I'm VPN'ing in a SAA with IOS 8.2.2.  I do not have vpn'ing of issues, but I have a question that is causing quite a stir here.  When I try to use names rather than IP addresses (trying to access a server or an internal Web site), the client does not receive DNS answers.  I can get to the servers via IP, but not by the name of the server.  I can use the same PCF file for my laptop, and it works fine.  Someone at - it a resolution to this scenario?  Any help appreciated.

  Add the domain name in the attributes of Group Policy: -.

  value by default-domain MYDOMAIN.COM

  Manish

• L2l using routers Cisco VPN question

  I can successfully configure an L2L IPSec VPN between two ASAs but using a similar configuration on Cisco routers, I can't establish a tunnel ping to the local LAN interface on the other, but two, NY and Burlington, routers can ping each and other WAN interface. Here is the configuration of routers and a version of the show; I have attached the config files complete and the screenshot of the topology.
  I appreciate all help.
  The f

  F0/0 - ISP - F0/0 Burlington NY

  See the version

  Cisco IOS Software, software 3600 (C3640-IK9S-M), Version 12.4 (25), RELEASE SOFTWARE (fc1)
  Technical support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2010 by Cisco Systems, Inc.
  Updated Thursday, August 18, 10 06:59 by prod_rel_team

  ROM: ROMMON emulation Microcode
  ROM: 3600 Software (C3640-IK9S-M), Version 12.4 (25), RELEASE SOFTWARE (fc1)

  The availability of NY is 0 minutes
  System returned to ROM by unknown charge cause - suspect boot_data [BOOT_COUNT] 0 x 0, BOOT_COUNT 0, BOOTDATA 19
  System image file is "tftp://255.255.255.255/unknown".

  Cisco 3640 (R4700) Prozesseur (revision 0xFF) 124928K / 6144K bytes of memory.
  Card processor ID FF1045C5
  R4700 CPU at 100 MHz, 33, Rev 1.2 implementation
  2 FastEthernet interfaces
  Configuration of DRAM is wide with parity 64-bit capable.
  125K bytes of NVRAM memory.
  8192 K bytes of processor onboard flash system (read/write)

  Configuration register is 0 x 2102

  NY router

  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  address of ThisIsAWeekKey key crypto isakmp 172.16.2.2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac L2L
  !
  Burlington 1-isakmp ipsec crypto map
  defined peer 172.16.2.2
  game of transformation-L2L
  match address Burlington-NW
  !
  !
  interface FastEthernet0/0
  address 172.16.1.2 IP 255.255.255.252
  automatic duplex
  automatic speed
  card crypto Burlington
  !
  interface FastEthernet1/0
  IP 10.0.1.1 255.255.255.0
  automatic duplex
  automatic speed
  !
  no ip address of the http server
  no ip http secure server
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 172.16.1.1
  !
  !
  Burlington-NW extended IP access list
  ip licensing 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255

  Burlington router

  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  address of ThisIsAWeekKey key crypto isakmp 172.16.1.2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac L2L
  !
  NY 1 ipsec-isakmp crypto map
  defined peer 172.16.1.2
  game of transformation-L2L
  match address NY - NW
  !
  !
  interface FastEthernet0/0
  IP 172.16.2.2 255.255.255.252
  automatic duplex
  automatic speed
  card crypto NY
  !
  interface FastEthernet1/0
  IP 10.0.2.1 255.255.255.0
  automatic duplex
  automatic speed
  !
  no ip address of the http server
  no ip http secure server
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 172.16.2.1
  !
  !
  NY - NW extended IP access list
  IP 10.0.2.0 allow 0.0.0.255 10.0.1.0 0.0.0.255

  No problem, we learn every day

  Please kindly marks the message as answered while others can also learn from your post. Thank you.

• ASA Cisco VPN question

  Hi Mokhalil82,

  It's pretty weird that the ASA will show phases 1 and 2 upward and the Watchguard show that phase 1 is not.

  It is possible that the tunnel will appear next to the ASA but gets terminated in the same instant that thus we see the phase 1 and 2 momentarily upward.
  Would you be able to share the outputs debug?

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages

  Thanks for the update, Mokhalil82

  For the last time, to simultaneously debug both sides and share issues, I think we can dig with that information.
  In addition, if we can capture packet as well, that will be useful.

  Make sure that the date and time is correct on both sides.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• RV042 connectivity

  Hello.

  I recently flashed my firmware version RV042: 1.3.12.19 - tm

  I am now affected intermittently Ithe nternet connectivity issues. Whatever site I visit, it is not uncommon to discover:

  • missing web page elements (e.g. images)
  • long load times

  TROUBLESHOOTING

  So far I have tried:

  • (hard and soft) reboot the RV042 several times
  • connection of different computers (PC/Vista, macBook/OSX) for the RV042
  • change the physical connection to a different port (1-4)
  • reviewing the configuration of the router (currently the installer with a DMZ. For testing purposes, I tried to disable the port DMZ.)

  The result is always the same, no change.

  FRAMEWORK

  • the RV042 unit is less than 1 year (bought new)
  • the problems started right now that I have updated the firmware of the device

  I'd like to go back to the original version of the firmware: 1.3.12.6.

  Everyone knows this?  Any thoughts on how I can fix this?

  @ all those who encounter this problem

  SYMPTOMS

  For me, I've lived intermittently / randomly:

  > long time for loading web pages

  > missing web page items

  SOLUTION

  Router Linksys/Cisco RV042 firmware version 1.3.12.19 - tm, contains an error that prevents it from automatically setting the MTU size.

  To correct the problem, I took advice of sk8erboi {thanks sir!} and changed the MTU to auto to manual (1500bytes).  After the change is made, I restarted the whole network (PC, router,...).  It has been about a week since the change, and everything works well again.

  ADDITIONAL NOTES

  The Cisco/Linksys documentation incorrectly States that the MTU is set from the menu option next: Firewall > General > MTU

  Here you can find the MTU auto/Manual:

  Setup > network > WAN connection Type > scroll to the bottom of the page

  As already mentioned, I was contacted by two different employees CISCO/Linksys and they made it clear that they will offer no help without a TAC: "I suggest you open a Tac case. You must have a valid contract with Cisco TAC prosecute. »

  Given that it's Aussie an easy solution, I'm surprised (and disappointed) that they do not say: "there is a bug, move the router to manual MTU"

  FRAMEWORK

  -My RV042 unit is less than 1 year (bought new)

  -the questions began at the present time I upgraded the firmware of the device to version 1.3.12.19 - tm

  -my router is configured as a WAN with DMZ, in other words, no Dual WAN

• Setup WAN RV042

  Hi all

  We have two Internet service providers. It assigns the IP address if DHCP. The others we gave a pool of static IP addresses, but address WAN IP is on a different segment than the default gateway of the WAN as in the following example:

  WAN IP: 192.168.10.110

  Mask: 255.255.255.248

  RE default gateway: 192.168.20.1

  Default gateway all double WAN routers we've tested allow not the IP address of the WAN on a different segment than the SOHO WAN. My question is: the Cisco RV042 allows the IP address of the WAN on a different segment than the default gateway of the WAN?

  Thank you all.

  Yes, theres no big thing we can do programming routers will not have networks mix matched in the address.  When a provider does this, they are kind of transmission by proxy their gateway address to protect themselves.  In all reality, you have a gateway address in your network, they are simply not provide to you.