CSCug24584 - console ASA crashes with nat sh nat statements duplicate

Similar Questions

• Cisco ASA VPN Site to Site WITH NAT inside

  Hello!

  I have 2 ASA 5505 related to IPSEC Tunnel VPN Site to Site.

  A 192.168.1.0/24 'remotely' inside the network and a local "192.168.200.0/24' inside the network (you can see the diagram)

  The local host have 192.168.200.254 as default gateway.

  I can't add static route to all army and I can't add static route to 192.168.200.254.

  NAT the VPN entering as 192.168.200.1 or a 192.168.200.x free to connect my host correcly?

  If my host sends packet to exit to the default gateway.

  Thank you for your support

  Best regards

  Marco

  The configuration must be applied on the SAA with the 192.168.200.0 subnet it is inside, there must be something like this:

  permit 192.168.1.0 ip access list VPN_NAT 255.255.255.0 192.168.200.0 255.255.255.0

  NAT (outside) X VPN_NAT outside access list

  Global (inside) X Y.Y.Y.Y (where the Y.Y.Y.Y) is the ip address

  If you have other traffic on the vpn through the tunnel that requires no nat, then you must add external nat exemption rules since these lines above obliges all traffic through the asa to have a nat statement.

  See if it works for you, else post your config nat here.

• VPN L2L ASA with NAT

  Hello, I was hoping someone might have an example of a site to site VPN configuration where the ASA is statically NATting its internal network. Basically the same configuration like this, but instead of "not nat", the ASA is NATting. So instead of the remote site, connect to the local network 10.10.10.0/24, ASA would be NAT at 172.16.17.0/24 for example.

  http://www.Cisco.com/en/us/products/ps9422/products_configuration_example09186a0080b4ae61.shtml

  Thank you.

  Mike

  It's not very complicated, just keep in mind that NAT is done before the encryption.

  So if you your network 10.10.10.0/24 nat internal to 172.16.17.0/24:

  public static 172.16.17.0 (Interior, exterior) 10.10.10.0 netmask 255.255.255.0

  You can use the address translated into your crypto-ACL:

  REMOTE VPN ip 172.16.17.0 access list allow REMOTE-NET 255.255.255.0 255.255.255.0

  I suppose that you run ASA v8.3 + that you referred to an older document. If you have a more recent software, the logic is the same but the NAT commands differ.

  Sent by Cisco Support technique iPad App

• Cisco Asa vpn site-to-site with nat

  Hi all

  I need help
  I want to make a site from the site with nat vpn
  Site A = 10.0.0.0/24
  Site B = 10.1.252.0/24

  I want when site A to site B, either by ip 172.26.0.0/24

  Here is my configuration

  inside_nat_outbound to access ip 10.0.0.0 scope list allow 255.255.255.0 10.1.252.0 255.255.255.0

  tunnel-group x.x.x.x type ipsec-l2l
  tunnel-group ipsec-attributes x.x.x.x
  pre-shared-key!

  ISAKMP retry threshold 10 keepalive 2

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  card crypto outside_map 2 match address inside_nat_outbound

  card crypto outside_map 2 pfs set group5
  card crypto outside_map 2 peers set x.x.x.x

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  NAT (inside) 10 inside_nat_outbound

  Global 172.26.0.1 - 172.26.0.254 10 (outside)

  but do not work.

  Can you help me?

  Concerning

  Frédéric

  You must ensure that there is no NAT 0 ACL statement because it will take precedence over the static NAT.

  You don't need:

  Global 172.26.0.1 - 172.26.0.254 10 (outside)

  NAT (inside) 10 access-list nattoyr

  Because it will be replaced by the static NAT.

  In a Word is enough:

  nattoyr to access ip 10.0.0.0 scope list allow 255.255.255.0 10.1.252.0 255.255.255.0

  access extensive list ip 172.26.0.0 vpntoyr allow 255.255.255.0 10.1.252.0 255.255.255.0

  public static 172.26.0.0 (inside, outside) - nattoyr access list

  card crypto outside_map 2 match address vpntoyr

  card crypto outside_map 2 pfs set group5

  card crypto outside_map 2 defined peer "public ip".

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  outside_map interface card crypto outside

  tunnel-group "public ip" type ipsec-l2l

  tunnel-group "public ip" ipsec-attributes

  pre-shared key *.

  -Make sure that it not there no NAT ACL 0 including the above statements and check if NAT happening (sh xlate) and the

  traffic is being encryption (sh cry ips its)

  Federico.

• A Site with NAT

  Hi all, thanks for looking. I'm a very basic user to a Cisco ASA 5510, I tend to do most of the things in the ASDM GUI interface.

  We need to create a site to site with a client connection. It's pretty easy but there is a caveat, we can use our internal IPS that they already use the range elsewhere. If we gave them two different IP, for example 192.158.22.101 and 192.158.22.102. I created the site to the site using these two survey periods, but these do not exist internally on the machines because they are not IPs on our network, which is using 192.158.44.0.

  The question I have is how can I get the IP addresses 192.158.44.101 and 192.158.44.102 to become 92.158.22.101 and 92.158.22.102 before being sent via this connection. I tried to add the NAT to the object of an IP address related, but I'm obviously missing something.

  The other option, I do not fear to do, is to add a new range of internal IP 192.158.22.0 addresses, but I don't know how do either.

  Any help would be appreciated, I'm really bad here and spent two weeks on this subject already. I searched for it, but it seems that it is either too basic for most people wonder or slightly different, for example, they have control of the two sites.

  Hello

  Add to that dieng said here is the config for NATTING as two IPS 192.158.44.101 and 102:

  network object obj - 192.158.44.101

  Home 192.158.44.101

  network object obj - 192.158.44.102

  Home 192.158.44.102

  object obj -192.158.22.101 network

  Home 192.158.22.101

  object obj -192.158.22.102 network

  host 192.158.22.102

  object obj remote network

  10.x.x.x subnet 255.255.255.0

  You need two NAT statements for this:

  NAT (inside, outside) source dynamic obj - 192.158.44.101 obj -192.158.22.101 destination static obj-remote obj-remote

  nat source (indoor, outdoor) obj dynamic obj - 192.158.44.102 - 192.158.22.102 destination static obj obj-remote control-remote control

  It will be useful.

  Kind regards

  Aditya

  Please evaluate the useful messages.

• Application of VPN S2S (with NAT)

  Hello experts,

  ASA (8.2) and standard Site 2 Site Internet access related configs.

  Outside: 1.1.1.1/24-> peer IP VPN S2S.

  Inside: Pvt subnets

  Standard "Nat 0' orders and crypto ACL for our remote offices, local networks with IP whp program.

  Requirement:

  Need to connect the PC to external clients (3.3.3.3 & 4.4.4.4) on tcp/443 via vpn S2S on our LAN. Client only accepts only the host with public IPs.

  I need NAT to my internal IP to the public IP say 1.1.1.2 and establish the VPN tunnel between 1.1.1.1-> PRi Client-side & secondary IPs (Cisco router).

  (without losing connectivity to remote offices). No policy NAT work here?

  ex:

  My Intern: 10.0.0.0/8 and 192.168.0.0/16
  Assigned IP available for NAT (some time to connect to the client only): 1.1.1.5

  External client LAN IPs: 3.3.3.3 & 4.4.4.4

  PAT: permit TOCLIENT object-group MYLAN object-group CUSTOMER LAN ip extended access-list

  NAT (inside) 5-list of access TOCLIENT

  5 1.1.1.5 (outside) global
      
   Crypto: tcp host 1.1.1.5 allowed extended CRYPTO access list object-group CUSTOMER LAN eq 443

  Outsidemap 1 crypto card matches the address CRYPTO
   
  Customer will undertake to peer with IP 1.1.1.1 only.

  Do I need a ' Nat 0' configs here?

  Also, for the specifications of the phase 2, it is not transform-set options gives. Info given was

  Phase2: AH: people with mobility reduced, life: 3 600 s, PFS: disabled, LZS Compression: disabled.
  This works with options of the phase 2?

  Thanks in advance

  MS

  Hello

  «Existing NAT (inside) 1 & global (outside) does not interfere with NAT 5 when users try to reach the ClientLAN.»

  Your inside nat index is '1', while the dynamic policy-nat is index '5 '.

  "" For the phase 2 in general, we define Crypto ipsec transform-set TEST ".

  Sure, the remote tunnel peers even accept transform set, everything you put up with the example below and distant homologous put the same tunnel.

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  "In this scenario, no need to define any what and just add empty transform don't set statement under card crypto?

  No you need a defined transformation.

  "3. If we want to limit the destination port 443, I need to use separate VPN filters?

  That's right, use a vpn-filter.

  "4. we have several phase 1 configs, but wanted to use AES256 & DH5 (new policy)"... for s2s, these options work fine. ""

  Of course, you have set the phase 1, as required.

  Thank you

  Rizwan James

• Public static political static NAT in conflict with NAT VPN

  I have a situation where I need to create a VPN site-to site between an ASA 5505 using IOS 7.2 and a Sonicwall NSA4500. The problem arises where the LAN behind the Cisco ASA has the same subnet an existing VPN currently created on the Sonicwall. Since the Sonicwall cannot have two VPN both run on the same subnet, the solution is to use policy NAT on the SAA as well as for the Sonicwall, the new VPN seems to have a different subnet.

  The current subnet behind the ASA is 192.168.10.0/24 (The Sonicwall already has a private network virtual created for another customer with the same subnet). I try to translate it to 192.168.24.0/24. The peer LAN (behind the Sonicwall) is 10.159.0.0/24. The ASA relevant configuration is:

  interface Vlan1

  IP 192.168.10.1 255.255.255.0

  access extensive list ip 192.168.24.0 outside_1_cryptomap allow 255.255.255.0 10.159.0.0 255.255.255.0

  list of access VPN extended permit ip 192.168.10.0 255.255.255.0 10.159.0.0 255.255.255.0

  public static 192.168.24.0 (inside, outside) - list of VPN access

  card crypto outside_map 1 match address outside_1_cryptomap

  In addition, there are other static NAT instructions and their associated ACLs that allow certain traffic through the firewall on the server, for example:

  public static tcp (indoor, outdoor) interface smtp SERVER smtp netmask 255.255.255.255

  The problem is this: when I enter the static strategy statement NAT, I get the message ' WARNING: real-address conflict with existing static "and then it refers to each of the static NAT statements reflecting the external address to the server. I've thought about it, and it seemed to me that the problem was that policy NAT statement must be the first statement of NAT (it is the last one) so that it is run first and all traffic destined to the VPN to the Sonicwall (destination 10.159.0.0/24) tunnel would be properly treated. If I left him as the last statement, then the other static NAT statements would prevent a part of the 10.159.0.0/24 network-bound traffic to be correctly routed through the VPN.

  So, I tried first to my stated policy NAT upward in the ASDM GUI interface. However, moving the declaration was not allowed. Then I tried to delete the five static NAT statements that point to the server (an example is above) and then recreate them, hoping that would then move up the policy statement NAT. This also failed.

  What Miss me?

  Hello

  I assumed that we could have changed the order of the 'static' , the original orders, but as it did not work for some reason any then it seems to me that you suggested or change, that I proposed should work.

  I guess that your purpose was to set up static political PAT for the VPN for some these services, then static PAT of public network access, then static NAT to policy for the rest of the network in-house.

  I guess you could choose any way seems best for you.

  Let me know if get you it working. I always find it strange that the original configuration did not work.

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• Identity firewall does not work with NAT

  We implement an environment that restrict access to Internet with rules based on users and groups to Active Directory.

  There were many difficulties, but the current state is:

  -The 'Test' of the firewall server-> identity Options results GOOD group

  -The 'Test' of Agent of Active Directory on Windows-> identity Options GOOD results

  -The rules we applied on the inside Firewall identity-based Interface are no "respected".

  The environment:

  -We have two ASA 5520 to failover.

  -There are four contexts in this pair of ASA.

  -Now we are activating the firewall of identity in a context.

  -Of course, the AD are in one of the inside of this context, networks.

  On the Configuration Guide of the identity of Firewall, to

  http://www.Cisco.com/en/us/docs/security/ASA/asa84/asdm64/configuration_guide/access_idfw.html#wp1349541

  We have seen that there are a lot of features that are not supported:

  ...

  The following features of ASA do not support the use of the object based on the identity and the FULL domain name:

  Route-map

  -Crypto card

  -WCCP

  -NAT

  -Group (except filter VPN) policy

  -DAP

  ...

  When using NAT does not, just remove NAT.

  How to configure this feature? Identity with NAT work?

  This is the reason why you have not any user ip in ASA mappings.

  Domain configured in ASA name must be the netbios domain name and it must be matched with one that you see 'adacfg dc list' output, otherwise ASA will drop all user agent AD ip report.

  You can have a try with the following new configs.

  field of the identity of the user TEST4 aaa-Server AD-TEST4

  identity of the user by default-field TEST4

  inside_access_in list extended access deny the user ip TEST4\rodrigo a whole

• IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

  Hello

  My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

  "Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

  NAT takes place before the encryption verification!

  In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

  Thanks for any help

  Best regards

  Heiko

  Hello

  Try to change your static NAT with static NAT based policy.

  That is to say the static NAT should not be applicable for VPN traffic

  permissible static route map 1

  corresponds to the IP 104

  access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

  access-list 104 allow the host ip 10.1.110.10 all

  IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

  HTH

  Kind regards

  GE.

• VPN with NAT Interface

  Hello

  I am trying to set up a VPN between a VLAN I have defined and another office. I have been using nat on the interface for internet access with a NAT pool.

  I created the VPN with crypto card and the VPN is successfully registered.

  The problem I encounter is that with NAT is enabled, internet access is working but I can ping through the VPN.

  If I disable NAT, VPN works perfectly, but then him VLAN cannot access the internet.

  What should I do differently?

  Here is the config:

  Feature: 2911 with security package

  Local network: 10.10.104.0/24

  Remote network: 192.168.1.0/24

  Public beach: 65.49.46.68/28

  crypto ISAKMP policy 104

  BA 3des

  preshared authentication

  Group 2

  lifetime 28800

  ISAKMP crypto key REDACTED address 75.76.102.50

  Crypto ipsec transform-set esp-3des esp-sha-hmac strongsha

  OFFICE 104 ipsec-isakmp crypto map

  defined by peer 75.76.102.50

  Set transform-set strongsha

  match address 104

  interface GigabitEthernet0/0

  IP 65.49.46.68 255.255.255.240

  penetration of the IP stream

  NAT outside IP

  IP virtual-reassembly

  full duplex

  Speed 100

  standby mode 0 ip 65.49.46.70

  0 6 2 sleep timers

  standby 0 preempt

  card crypto OFFICE WAN redundancy

  interface GigabitEthernet0/2.104

  encapsulation dot1Q 104

  IP 10.10.104.254 255.255.255.0

  IP nat pool wan_access 65.49.46.70 65.49.46.70 prefix length 28

  overload of IP nat inside source list 99 pool wan_access

  access-list 99 permit 10.10.104.0 0.0.0.255

  access-list 104. allow ip 10.10.104.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 104. allow ip 192.168.1.0 0.0.0.255 10.10.104.0 0.0.0.255

  access-list 104 allow icmp 10.10.104.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 104 allow icmp 192.168.1.0 0.0.0.255 10.10.104.0 0.0.0.255

  ISAKMP crypto #sh her

  IPv4 Crypto ISAKMP Security Association

  DST CBC conn-State id

  65.49.46.70 75.76.102.50 QM_IDLE 1299 ACTIVE

  Hello!

  Please, make these changes:

  extended Internet-NAT IP access list

  deny ip 10.10.104.0 0.0.0.255 192.168.1.0 0.0.0.255

  IP 10.10.104.0 allow 0.0.0.255 any

  IP nat inside source list Internet-NAT pool access-wan overload

  * Please do not remove the old NAT instance until you add that above.

  Please hold me.

  Thank you!

  Sent by Cisco Support technique Android app

• Assign a static IP to guest with NAT Virt network adapter?

  I'll put up a * nix VM that I want to give out-bound network connectivity, but I want to make its services available only on my local machine (for example MySQL).  VMWare Player with NAT assigned a DHCP address, but because it is not update my host name resolution, to access a service on the client, I need to use the IP address.

  I would like to assign a static IP address on the guest, so I can add an easy to use in the host of my host file.  I can update my guest network interface file to not assign no problem.  I'm worried that I can use an IP address that overlaps the VMWare DHCP pool (and may occur a conflict of address when I turn on a new virtual machine), or outside the range of the virtual switch.

  Is this possible with VMWare Player, and is there something in the configuration files, that I might be able to change this?

  Default 192.168.x.1 address is used for the adapter to the virtual host, 192.168.x.2 as the address of the NAT gateway and 192.168.x.128... 254 for DHCP, which means that you can assign static IP addresses between 192.168.x.3 and... 127.

  However, you can configure rather a reserve in the vmnetdhcp.conf file by adding for example

  host LuckyLuke {}
  Hardware ethernet 00: 0C: 29:23:b6:12;
  fixed-address 192.168.156.77;
  }

  just in front of the brand ' # end ' . Please replace "156" by your own subnet. In the example above, the VMS with MAC address "00: 0C: 29:23:b6:12" will receive the IP "192.168.156.77". BTW. hostname (in this case "LuckyLuke") does not matter, it must just be unique in the file.

  André

• iMac crashes with gpu reset from model

  Hi guys,.

  Since that I've updated to El captain, my iMac does not last over 5-10 minutes. He continues to break up with a black screen or gray, for the most part by watching youtube.

  In the Console, I found a lot of crashes with "GPU reset":

  Wed Jan 27 19:34:24 2016

  Event: GPU Reset

  Date/time: Kill Jan 27 19:34:24 2016

  Application:

  Path:

  OS version: Mac OS X Version 10.11.3 (Build 15 d 21)

  Graphics hardware: AMD Radeon HD 6970 M

  Signature: 0

  Report data:

  GPURestartReportStart

  ------------------------

  Hung channels: PM4

  ------------------------

  AccelChannel [00]: PM4

  Pending order from: UnknownCtx

  PendingCommandTimestamp: 0x00000001, TotalDWords: 0 x 00000415, GART Offset = 0 x 0000000040080000, stamp_idx = 0, estamp = 0 x 00000001

  PendingCommandStart:

  PendingCommandEnd

  ------------------------

  [00] HWChannel PM4: enabled, NotIdle

  LastReadTimestamp: 0x00000000

  NextSubmitTimestamp: 0x00000002

  [PM4, ts:0 x 00000001]: no waiting semaphore

  [PM4, ts:0 x 00000001]: semaphore signal: 0xffffff8049d66e00

  HWSemaphore 0xffffff8049d66e00 Signal Event: [PM4 channel [0] TS:0 00000001 lastReadTS:0 00000000 x x]

  ------------------------

  HangFlags 0 x 00000006 GPU: AsicHangState 0 x 00000006, AsicResetRequirement 0x00000002

  IndividualEngineHang: 0

  NonEngineBlockHang: 1

  FenceNotRetired: 1

  PerEngineReset: 0

  FullAsicReset: 1

  HangEngineBitmap: 0x00000000

  ------------------------

  PCIe AMDBartsGraphicsAccelerator material: [1:0:0] State: ENABLED

  Configuration: deviceBits: 0 x 00816720, capabilityBits: 0 x 30940100

  TotalVideoRAMBytes: 0 x 0000000040000000 (1073741824)

  ------------------------

  [00] engine PM4: enabled, NotIdle

  [00] PM4 Channel: enabled, NotIdle

  ------------------------

  [01] engine AIMS: enabled, Idle

  [01] DMA channel: enabled, Idle

  ------------------------

  [03] UVD engine: disabled, Idle

  [02] UVD Channel: disabled, Idle

  ------------------------

  [04] engine SPU: disabled, Idle

  [03] SPU Channel: disabled, Idle

  ------------------------

  : * GPU Debug Info check out *.

  : 0 00006720: 0 00000092: 0 x 00000001 x x: 0 x 00000018: 0x0000a880: 0x00000001: 0x00000001: 0 x 00006720

  ...

  complete log can be found here:

  https://drive.Google.com/file/d/0B0vWxunrQlxuLXRHd184dlhUZTQ/view

  If I'm lucky, it will restart, but sometimes I'm stuck on a gray boot screen

  I tried:

  -Reset the PRAM

  -force the disk check

  -unplug and wait 30 seconds.

  I'm out of ideas

  The SMC reset 2 - 3 times to reset the management system (SCM) controller on your Mac - Apple Support disconnect at the back of the iMac not the wall.

  Try a boot sure try safe mode if your Mac does not end commissioning - Apple Support

• FSX can run fine on Windows 8, but now does not - install crashes with 1722

  To the right,.

  I have a HUGE problem with reinstalling Flight Sim X on Windows 8.  When I installed it first, it ran fine, until one day he crashed it so bad that it would not even close or uninstall properly - I had update my system just to remove it.  Now, I am trying to reinstall it, but it won't reinstall - the installation program runs in a first time, but when it comes to registration of fonts, it crashes with a 1722 followed of a 1603.  I already tried to use licensing reset tool http://support.microsoft.com/kb/928080, but it does not work either!  What should I do?  Thanks in advance!

  Just to be sure: you confirm that you have opened the CMD console in administrator mode to run the resetsldl command?

• CC of hearing crashes with multiband compressor

  The company I work for just improved CS6 cc. I work on a 30-minute television show, and my normal workflow for editing the dialog box includes the use of compressor multiband on almost every track. It works very well for the first piece, I applied too, but Audition keeps crashing when I apply for a second track multiband compressor. Here are the steps that precisely he crash.

  Apply 30 Band EQ on both tracks (high-low General roll-off).

  Apply Multiband Compressor for track 1, choose predefined broadcast, adjust the voice.

  Apply Multiband Compressor track 2, choose broadcast preset, press SPACEBAR to play to adjust, then hearing crashes.

  I tried not to use a preset and hearing still crashes when I hit the game. By writing this and test other things, I've noticed that it crashes with any instance of a compressor (singleband, tube modelled, etc.).

  Here are the specs of the system that I use.

  Mac Pro (new)

  10.9.3 OSX

  3 Ghz 8 Core Xeon E5

  32 GB of Ram

  Edit a Thunderbolt Drive in Raid-0

  I am running the latest version of the CC of the hearing

  Someone know how to fix this or has encountered the same problems?

  We have received reports from some users of OS X, which saw a crash when opening some of the effects of 3rd party that give us for hearing.  The issue must be resolved in the latest version updated 7.1 day.  You are running the latest version?  If so and you still experience this issue, please send us the incident report file using the following steps:

  After that hangs in the hearing, launch Applications/Utilities/Console.app

  Click on 'User diagnostic reports' and look for the newest item for hearing

  Drag this to an email as an attachment and send it to [email protected]

  While we certainly appreciate the reports of incidents since the crash window, it is not a simple task to identify a specific report item, and we usually use this to identify trends to crash or to link to a specific user.  It is much faster and more reliable to send the file via email address above.

  Thank you.

• Notes crashing with El Capitan 10.11.6. Are updated recent bug fixes.

  Notes crashing with El Capitan 10.11.6. Are updated recent bug fixes. It always sends Apple incident reporting, so I am surprised that they have not yet set. This is a brand new Apple iMac computer, I went for the best to have a trouble-free operation (I hate LAGS). But the computer hangs out sometimes which is disappointing. No one knows what to do to keep my computer running efficiently? In addition, someone at - it a solution to the issue with Notes crashing?

  Try each of them in order. A test to see if the computer works properly:

  1. Reset the PRAM
  2. Reset the controller (SMC) system management
  3. Start the computer in Safe Mode, and then restart normally. It's slower than a standard home.
  4. Repair the disk by booting to the HD recovery immediately after that the chime press the command and R keys until the Utility Menu appears. Choose disk utility and click on the continue button. Select the withdrawal (usually Macintosh HD) volume entry in the list to one side.  Click first aid button in the toolbar. Wait the fact button appear. Disk utility and return in the Utility Menu. Restart the computer from the Apple Menu.
  5. Download and install the update of OS X El Capitan 10.11.6 Combo.
  6. Reinstall OS X by booting from the Recovery HD using the command and R keys. When the Utility Menu appears, select reinstall OS X and then click on the continue button.