Connection VPN concentrator 3000 problem

Similar Questions

• Recovery of password on the vpn concentrator 3000 4.0 running above

  Hi all

  I looked in the collection of information about a vpn concentrator 3000 for one our clients who have recently begun to support. We have no documentation on the user name or password for the hub:

  The link on cisco http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_password_recovery09186a008009434f.shtml
  tells you how to reset the administrative password. But can someone confirm after doing so, the hub will retain the old configuration, I am very reluctant to do so because we have no documentation anywhere configuration and saw that you can lose it in some of the old pix/switches/routers.

  Thank you very much.

  For what it's worth, I followed this procedure to properly reset the administrator password on a VPN 3000 Concentrator without loss of the active configuration.

• VPN concentrator 3005 - problem of IP attribution

  I have a strange problem with the VPN concentrator 3005. I have the private interface configured with 192.168.3.3/24 as the ip address. For all the users I assign an ip address from the same network (for example) 192.168.3.105/24 or use an IP address pool (192.168.3.100 - 192.168.3.150) the connection fails and the hub will specify that it cannot assign an ip address to the client.

  However, if I configure the user address pool or a client on a subnet different it works and the user GET connected. For example, 192.168.2.105/24. I hit him a back-end switch and do not really want to have to add a router to talk between subnets.

  Am I missing something?

  Any help is appreciated!

  Alan,

  It is recommended to assign another pool of IP addresses for VPN clients to internal network.

  Although it is not recommended, you should be able to assign a Pool of IP addresses that is part of the same internal network and it should work. The only thing that you must be aware of, is that this range of IP addresses assigned to customers should not be used on the internal network

  You can post the VPN3000 logs when its not able to assign an IP address to the VPN Client.

  Let me know if it helps.

  Kind regards

  Arul

  * Please note all useful messages *.

• configuration VPN concentrator 3000 backup

  Hello

  Can someone tell me how can I take backup of my Cisco VPN 3000 series concentrator configuration?

  in GUI and command mode?

  I couldn't find any good document describing.

  Here is the link on how to Backup/restore configs and work with the file system.

  http://www.Cisco.com/en/us/docs/security/vpn3000/vpn3000_47/Administration/Guide/Fileman.html

• VPN concentrator 3000

  I have a small question, I have a backup ACS server which was built just now, I noticed on my hub under Config-online system-online servers = > authentication, I have the primary server for authentication in place, the question is do I add the server to backup ACS as well so if the primary goes it will automatically use the ACS server? Thank you in advance!

  This is how its supposed to work. Given that you have not set up a group of authentication servers list.

  Kind regards

  Prem

  Please rate if this can help!

• Failover with VPN concentrator

  Hi all

  We have unique VPN concentrator which is the single point of failure, so need your help to mitigate the same

  The topology diagram is attached

  Site A and Site B.

  Site B has internet gateways where we have existing VPN.

  The intention to introduce the site A & Concentrator VPN gateway VPN is set as well

  Our design is provided for in

  Connectivity between the two locations & other office is managed by BGP.

  Default route is pointing at the Internet gateway.

  Info by the Internet Segment.

  ·         We have the SP independent IP range

  ·         Switching between 2 SP to site B is obtained by using the iBGP and eBGP

  Challenge: VPN concentrator single Point of failure (the Cisco VPN concentrator 3000)

  Here are the design goals

  ·         Implement internet gateways to the Site - A which will have redundancy level of Portal Site

  ·         Place on the VPN concentrator, which will act as a switch between site

  o If the concentrator vpn site B is out of box A VPN site must support all traffic.

  Concentrator VPN active o replica of Site B

  Is it possible to achieve the objectives of design.

  Please help about the VPN concentrator... How I can set VPN concentrator in failover mode... Just as we do firewalls?

  Help, please

  Hi yogesh,

  Concentrator VPN supports failover through VRRP. Please find the following for your reference document:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2284/products_tech_note09186a0080094490.shtml

  As for the addition of failover for VPN concentrator, you happen to have a spare hub VPN to run VRRP?

  Don't know if you know, however, VPN concentrator comes end of life and the last delivery date was November 2007, as a result, you will not be able to buy VPN concentrator more.

  Here's the EOL notificatin for your reference:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5743/ps5749/ps2284/prod_end-of-life_notice0900aecd805cd5a0.html

• problem of traffic flow with tunnel created the network with a tunnel to a VPN concentrator

  Hi, I worked with Cisco and the seller for 2 weeks on this.II am hoping that what we are witnessing will ring a Bell with someone.

  Some basic information:

  I work at a seller who needs from one site to the other tunnel.  There are currently 1 site to another with the seller using a Juniper SSG, which works without incident in my system.  I'm transitioning to routers Cisco 2811 and put in place a new tunnel with the seller for the 2800 uses a different public ip address in my address range.  So my network has 2 tunnels with the provider that uses a Cisco VPN concentrator.  The hosts behind the tunnel use 20x.x.x.x public IP addresses.

  My Cisco router will create a tunnel, but I can't not to hosts on the network of the provider through the Cisco 2811, but I can't get through the tunnel of Juniper.  The seller sees my packages and provider host meets them and sends them to the tunnel.  They never reach the external interface on my Cisco router.

  I'm from the external interface so that my endpoint and the peers are the same IP address.  (note, I tried to do a static NAT and have an address of tunnel and my different host to the same result.)  Cisco has confirmed that I do have 2 addresses different and this configuration was a success with the creation of another successful tunnels toa different network.)

  I tested this configuration on a network of transit area before moving the router to the production network and my Cisco 2811 has managed to create the tunnel and ping the inside host.  Once we moved the router at camp, we can no longer ping on the host behind the seller tunnel.   The seller assured me that the tunnel setting is exactly the same, and he sees his host to send traffic to the tunnel.  The seller seems well versed with the VPN concentrator and manages connections for many customers successfully.

  The seller has a second VPN concentrator on a separate network and I can connect to this VPN concentrator with success of the Cisco 2811 who is having problems with the hub, which has also a tunnel with Gin.

  Here is what we have done so far:

  (1) confirm the config with the help of Cisco 2811.  The tunnel is up.  SH cyrpto ipa wristwatch tunnel upward.
  (2) turn on Nat - T side of the tunnel VPN landscapers
  (3) confirm that the traffic flows properly a tunnel on another network (which would indicate that the Cisco config is ok)
  (4) successfully, tunnel and reach a different configuration hosting
  (5) to confirm all the settings of tunnel with the seller
  (6) the seller confirmed that his side host has no way and that it points to the default gateway
  (7) to rebuild the tunnel from scratch
  8) confirm with our ISP that no way divert traffic elsewhere.  My gateway lSP sees my directly connected external address.
  (9) confirm that the ACL matches with the seller
  (10) I can't get the Juniper because he is in production and in constant use

  Is there a known issue with the help of a VPN concentrator to connect to 2 tunnels on the same 28 network range?

  Options or ideas are welcome.  I had countless sessions with Cisco webex, but do not have access to the hub of the seller.  I can forward suggestions.

  Here's a code

  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA 3des
  preshared authentication
  Group 2

  Crypto ipsec transform-set mytrans aes - esp esp-sha-hmac

  Crypto-map dynamic dynmap 30
  Set transform-set RIGHT

  ISAKMP crypto key address No.-xauth

  interface FastEthernet0/0
  Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE $ 0/0
  IP 255.255.255.240
  IP access-group 107 to
  IP access-group out 106
  NAT outside IP
  IP virtual-reassembly
  route IP cache flow
  automatic duplex
  automatic speed
  crypto mymap map

  logging of access lists (applied outside to get an idea of what will happen.  No esp traffic happens, he has never hits)

  allowed access list 106 esp host host newspaper
  106 ip access list allow a whole
  allowed access list 107 esp host host Journal
  access-list 107 permit ip host host Journal

  access-list 107 permit ip host host Journal
  107 ip access list allow a whole

  Crypto isa HS her
  IPv4 Crypto ISAKMP Security Association
  status of DST CBC State conn-id slot
    QM_IDLE ASSETS 0 1010

  "Mymap" ipsec-isakmp crypto map 1
  Peer =.
  Extend the 116 IP access list
  access - list 116 permit ip host host (which is a public IP address))
  Current counterpart:
  Life safety association: 4608000 kilobytes / 2800 seconds
  PFS (Y/N): N
  Transform sets = {}
  myTrans,
  }

  OK - so I have messed around the lab for 20 minutes and came up with the below (ip are IP test:-)

  (4) ip nat pool crypto-nat 10.1.1.1 10.1.1.1 prefix length 30 <> it comes to the new address of NAT

  !
  (1) ip nat inside source list 102 interface FastEthernet0/0 overload <> it comes to the interface by default NAT

  !
  IP nat inside source map route overload of crypto-nat of crypto-nat pool <> it is the policy of the NAT function

  !

  (6) access-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 <> defines the IP source and destination traffic

  !

  (2) access-list 102 deny ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 <> does not NAT the normal communication

  (3) access-list 102 deny ip 10.1.1.1 host 172.16.2.0 0.0.0.255 <> does not re - NAT NAT

  (1) access-list 102 permit ip 172.16.1.0 0.0.0.255 any <> allows everyone else to use the IP Address of the interface for NAT

  !

  (5) crypto-nat route-map permit 5 <> condition for the specific required NAT
  corresponds to the IP 101 <> game of traffic source and destination IP must be NAT'td

  (7) access list 103 permit ip 10.1.1.1 host 172.16.2.0 0.0.0.255 <> crypto acl

  Then, how the works above, when a package with the what IP 172.16.1.0/24 source wants to leave the router to connect to google, say the source will change to IP interface (1).  When 172.16.1.0/24 wants to talk to172.16.2.0/24, it does not get translated (2).  When the remote end traffic equaled the following clause of NAT - the already NAT'td IP will not be affected again (3) when a host 172.16.1.0/24 wants to communicate with 172.16.2.20/24 we need a NAT NAT specific pool is required (4).  We must define a method of specific traffic to apply the NAT with a roadmap (5) which applies only when the specific traffic (6), then simply define the interesting traffic to the VPN to initiate and enable comms (7) corresponding

• 501 to 3000 PIX VPN concentrator

  I know that a lot of these configs have been covered here and have read a few today. Here's my dilemma.

  We have a VPN concentrator in our GOING to Florida. We set up a remote site of contract in another State. The customer is what allows us to place our PIX 501 on their (private) network and out to the internet to return to our VPN concentrator. According to the staff of the company, you have to cross a their corporate firewall. We have assigned a private to our internal ethernet IP address and has assigned a private one for us to use on our external interface on the PIX. The two private investigation periods are in the 192.168.129.x/24 (our inside) and 192.168.96.x/26 (on the outside provided by customer)

  Initially, they were to provide a public IP address peer with against our public IP hub. Now, they are unable to do so.

  They provided a possible PAT range of public IP addresses to go against, but there is no way of knowing what particular IP peer against. Is it possible to be able to point the VPN concentrator for a range of public IP addresses and hope a peers. I can ping from the PIX coming out to our public address of VPN concentrators. Any help would be appreciated.

  We configure ezvpn, however, the problem is that the vpn tunnel can only be activated from the pix not starting from the hub.

• 3000 VPN concentrator using ospf md5 authentication failed

  Hi all

  I just tested ospf with a 3005 VPN connected with a cisco router using ospf md5 authentication, but fail. Cisco router, I can see neighbouring State ospf is "INIT", but can not see any connection VPN 3005, physical connection is good, ping can be reached between them. I tried the command "ip ospf authentication message-digest & ip ospf authentication-key ' and"ip ospf message-digest-key"command in the router the password is the same in both sides and the md5 id has been set. But when I use simple authentication or disable authentication that the neighbor relationship can ride. Any body met this case before? Thank you!

  Best regards

  Teru Lei

  Hello

  This is a known bug, I also met this before: CSCef38044

  It is not possible to accumulate OSPF with newer versions of IOS, on which they'RE ability is enabled using MD5 hash neighborship. They'RE capa is activated somewhere of 12.2 T. This behavior can be found on CVPN 4.1.5 and above whose 4.7 also.

  I tested it with several IOS and OS CVPN - same result. The symptom: router ospf neighborship remains in the State INIT/DROTHER.

  Workaround is to configure the router:

  router ospf 1

  No they're ability

  This will solve your problem.

  Attila Suba

• VPN concentrator + PIX on LAN-&gt; customers can not reach local servers

  Hello

  I have a problem wrt. remote access clients coming via a VPN3000 concentrator and trying to access local servers.

  For the topology:

  The internal network is 10.0.1.0/24. It connects with the outside world, as well as via a PIX DMZ; the PIX has 10.0.1.1 in the internal network.

  On the same LAN (internal), I have the VPN concentrator for the inside address 10.0.1.5. It assigns addresses in the 10.0.100.0/24 range to the

  VPN client-PCs.

  I can sucessfully connect using the VPN client SW to the hub, i.e. remote access clients out addresses

  the 10.0.100.0/24 range.

  The problem: access from VPN clients to internal network is * not * possible; for example, a customer with 10.0.100.1 cannot connect to

  internal to the 10.0.1.28 server.

  To my knowledge, this is a routing problem because the server (10.0.1.28) has no idea on how to reach customers in

  10.0.100.0/24. The only thing that the server is a default static route pointing to the PIX, i.e. 10.0.1.1.

  So I set up a static route on the PIX for 10.0.100.0 pointing to the hub-VPN, that is

  Mylan route 10.0.100.0 255.255.255.0 10.0.1.5 1

  This does not solve my problem though.

  In the PIX logs, I see the entries as follows:

  % 3 PIX-106011: deny entering (no xlate) tcp src trainee: 10.0.1.28 (atlas) / 445 intern dst: 10.0.100.1 (pending) 1064

  The PIX seems to abandon return packages, i.e. traffic from the server back to the client

  To my knowledge, the problem seems to be:

  Short traffic VPN - client-> Concentrator VPN-> Server-> PIX - where it gets moved.

  My reasoning: the PIX only sees the package back, i.e. the package back from the server to the client - and therefore decreasing the

  package because he has not seen the package from the client to the server.

  So here are my questions:

  (o) how do I configure the PIX that I be connectivity between my remote VPN clients (10.0.100.0/24) and

  computers servers on the local network (10.0.1.0/24)?

  (o) someone else you have something like this going?

  PS: Please note that the first obvious idea, installation of static routes on all machines on the local network is not an option here.

  Thank you very much in advance for your help,.

  -ewald

  Hello, PIX the because can not route traffic on the same interface (prior to version 7.0 anyway), I suggest you two places your hub to the outside with the inside of the legs on a zone demilitarized or (if you can not do a makeover of the network) you remove your pool with 10.0.100.0 - addresses and create a pool with 10.0.1.0 - addresses which is a part of the address space. No, NOT all. A little book that it is not used inside.

  Best regards

  Robert Maras

• 837 routers not reconnected to VPN concentrator

  When our grave 3015 VPN concentrator fails and restarts all non-837 routers connect again in a minute or 2, but the 837 hours or need a manual reset (clear isakmp). There are a number of different versions of IOS, and I presume some sort timeout setting must be configured. Despite scouring the forum, I can not know where I am going wrong. Any help appreciated.

  There is nothing in the specification IKE/ISAKMP who treats each detectig peer the other peer has declined, because of this, you can get data to enter a black hole when one side always considers that the tunnel is up and the other side has crashed/restarted and is attempting to build a new tunnel.

  To work around this problem we came with ISAKMP KeepAlive, or dead-Peer Detection (DPD). This sends a packet keepalive above the tunnel of PHase 1 every x seconds (configurable). If one end dies then the other end knows consolidated it fairly quickly and will lower its tunnels also.

  On the side of the router configuration is the following:

  ISAKMP crypto keepalive

  Make sure that you have configured in your 837. There was also some problems in the code very early with these KeepAlive, so if you do not have this command, but all your 837 seem to be code running earlier than the other routers, I would say that their transition to the last code that will insert itself into their memory/flash, which should solve your problem.

• A connection VPN (PPTP), who worked previously no longer works.

  original title: VPN works not

  PROBLEM:
  
  I'm running Vista 64 Ultimate SP2, with all Microsoft Updates applied.  My original CD is pre - SP1.
  A connection VPN (PPTP), who worked previously no longer works.
  I think that the problem is related to an installation of Virtual PC or iTunes, but I can't confirm either way.
  Unfortuantely, I do not have a restore point dated to before the problem.

  DETAILS OF THE PROBLEM:
  
  When I'm viewing the network drivers in Device Manager, the following drivers displayed an error:

  Miniport Wan (IP)
  Miniport Wan WAN (IPv6)
  Miniport Wan (Network Monitor)
  Miniport WAN (PPPOE)
  Miniport Wan WAN (PPTP)

  The error for each text is: "Windows cannot load the driver for this hardware device. The driver may be corrupted or missing. (Code 39) »

  The following drivers do NOT display an error:

  Miniport Wan WAN (L2TP)
  Miniport WAN (SSTP)

  SOLUTIONS ALREADY ATTEMPTED:
  
  Uninstalling Virtual PC has not solved the problem.
  Uninstall device drivers and re - install it as described in the following web pages did not help the problem:

  http://www.chicagotech.NET/NetForums/viewtopic.php?p=988&SID=39aeb8e5e43c459
  http://www.howtonetworking.com/Vista/rebuildminiport.htm
  http://www.experts-exchange.com/software/System_Utilities/Remote_Access/VPN/Q_24291900.html

  In general, I am able to uninstall device drivers, but re-plant fails (sometimes reported as successful, sometimes not).

  I have presented a problem report on the failure of resettlement of Microsoft (including the following in the log files), but have received no solution:

  DMIC8E.tmp.log.XML
  LOGC9F.tmp
  netrasa.inf
  Setupapi.app.log
  Setupapi.dev.log

  I noticed that the device (loser) of WAN Miniport (PPTP) lists two files: 'ndistapi.sys' and "raspptp.sys", of which the first is NOT digitally signed, but the second is.  However, the peripheral Miniport WAN (L2TP) (work) lists only one file: "rasl2tp.sys" which is signed digitally.  This brings me to the question if my netrasa.inf installation file is currupted. (?)

  Any help would be greatly appreciated.  I am technically competent and can deal with editing the registry, etc, but need a plan of attack.

  Thank you!

  -Tad Richard

  Hi Tadrichard,

  Thanks for choosing Microsoft answers Forum.

  Is there an error when they try to establish the connection, if so, what is the error?

  Are there errors in the event logs?

  Forward for you help.
  Kind regards
  Support of yama - Microsoft.

• Connection VPN, but NO traffic

  This seems to be a common theme, but no other positions are exactly like mine.

  I have 4 clients of VPN (different versions) software that can connect to a VPN concentrator 3005. 2 clients work very well, they connect and can ping the server. I have two clients who connect but cannot ping the server.

  1 customer - who can NOT ping. VPN client 4.0.3c on XP Pro IP 10.10.0.0/16 private leaving a 501 PIX via Internet to a VPN 3005 concentrator inside a LAN 10.100.30.0/24.

  ---> PIX 501 VPN client - > Internet VPN Conc 3005--->---> LAN---> Server

  2nd customer who cannot ping. 4.6 VPN client. on XP Pro private IP 192.168.17/24 leaving a MS Win 2 K through the Internet server in a VPN 3005 concentrator inside a LAN 10.100.30.0/24.

  Client VPN---> Win 2 K server - > Internet VPN Conc 3005--->---> LAN---> Server

  Both can make the VPN connection to the VPN Conc throughout the day, but cannot ping the server. BUT other clients can ping the server.

  ??? Help?

  See MTU:

  http://www.Cisco.com/en/us/Tech/tk175/TK15/technologies_tech_note09186a0080093bc7.shtml

  NAT - T see:

  command:

  ISAKMP nat-traversal 20

  Link:

  http://www.Cisco.com/en/us/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a9.html#wp1027312

  Network address translation (NAT), including translation of address of Port (PAT), is used in many networks where IPSec is also used, but there are a number of incompatibilities that prevent IPSec packets to cross successfully. NAT route NAT devices enables ESP packets to pass through one or more NAT devices.

  The firewall supports NAT traversal as described by the Version 2 and Version 3 of the IETF "UDP Encapsulation of IPsec packets" project, available at http://www.ietf.org/html.charters/ipsec-charter.htmland NAT traversal is supported for dynamic and static cryptographic cards. Route NAT is disabled by default on the firewall.

  To enable NAT traversal, check that ISAKMP is enabled (you can activate it with the if_name isakmp enable command) then use the nat traversal [natkeepalive] command isakmp. (This command appears in the configuration if both ISAKMP is enabled and NAT traversal). If you have enabled NAT traversal, you can disable it with the nat-traversal No. isakmp command. The valid values for natkeepalive are from 10 to 3600 seconds. The default value is 20 seconds.

• VPN IPSEC RV220w problem

  Hello, I hope someone can help with my problem.

  I have a RV220w in the office, I set it for ipsec vpn connections. Behind the router, there is a NAS for file storage.

  My setup as follows:

  RV220w 192.168.1.1 with dyndns, configured for ipsec vpn with default Client strategies.

  Remote location (my laptop) local IP: 192.168.3.2

  Remote site VPN IP (given by ShrewVPN): 192.168.30.5

  I managed to connect to the router at home with ShrewVPN and I can ping each client connected to RV220w.

  The problem is that I can't connect to the web interface of the router or the NAS web interface or any other web page intranet (the browser gives no error, but continues to load without displaying the web page). Even if I can access the web pages of my laptop.

  In addition, in windows Explorer when I log into the NAS, although I can go through the files, I can't copy the files from my laptop on the NAS and vice versa, I still get timeout error (I checked the permissions on the NAS and also I managed to copy a txt file small 1 KB) (, but no luck with large files).

  I also tried with QuickVPN client, but I got the same results.

  When I connect with pptp windows everything works like a charm.

  My laptop has windows 7 64 bit.

  If you need other configuration details, please advice.

  Thank you

  Hi Spyros, one of the differences between IPsec and PPTP is that IPsec requires the client that connects to use another LAN IP address, when you connect. Unlike PPTP, it is assigned by the router.

  Another difference is that the requirement of bandwidth is much higher for IPsec connections.

  I don't think it's a problem of IP subnet as you are able view readers to all least, then it means that the unit can accept connections from different subnets. But it is possible, it may be a problem of download speed. QVPN needs Mbit upload environ.5 to have an activity and a reliable and quality connection.

  Another problem may be a matter of downtime with IPsec encryption. The RV220W has a non routable WAN address. This suggests to me that you have another router upstream. Time to answer through the IPsec tunnel can be volatile because of the translation through multiple jumps.

  -Tom
  Please mark replied messages useful

• Cisco VPN Client behind PIX 515E,-&gt; VPN concentrator

  I'm trying to configure a client as follows:

  The user is running Cisco VPN Client 4.0. They are behind a 6.1 PIX 515E (4), and I need to connect to a VPN concentrator located outside of our network. We use PAT for address translation. As far as I know, to allow ipsec through Firewall 1 tunnel, I need to upgrade the pix to 6.3 and activate "fixup protocol esp-ike.

  Is there another way to do this? I am also curious to know how much more easy/better this will work if we were dealing with pptp.

  You don't necessarily need to fixup protocol esp-ike active. The remote Hub there encapsulation NAT - T enabled so that clients behind the NAT can run?