Customer quick RV042 VPN cannot ping lan network

Hi guys,.

I just created a client2gateway on RV042 IPSec tunnel and use the remote PC quick VPN client tries to connect to this router.

Fast VPN showed that the tunnel has been established. But I couldn't ping the LAN behind the router RV042.

Can someone help me?

Thank you.

Hello

Yes, you are right. To use the fast with RV042 VPN, it is necessary to configure the user name and a password for access to the VPN Client page. As this router does not support VLANs, you can only connect the VPN client to the LAN subnet (you cannot connect the client to any beach IP configured with multiple subnets)

Kind regards

Bismuth

Tags: Cisco Support

Similar Questions

Peer AnyConnect VPN cannot ping, RDP each other

I have an ASA5505 running ASA 8.3 (1) and ASDM 7.1 (1). I have a remote access VPN set up and remote access users are able to connect and access to network resources. I can ping the VPN peers between the Remote LAN. My problem counterparts VPN cannot ping (RDP, CDR) between them. Ping a VPN peer of reveals another the following error in the log of the SAA.

Asymmetrical NAT rules matched for flows forward and backward; Connection for icmp outside CBC: 10.10.10.8 outside dst: 10.10.10.9 (type 8, code 0) rejected due to the failure of reverse NAT.

Here's my ASA running-config:

ASA Version 8.3 (1)

!

ciscoasa hostname

domain dental.local

activate 9ddwXcOYB3k84G8Q encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address dhcp setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone CST - 6

clock to summer time recurring CDT

DNS lookup field inside

DNS server-group DefaultDNS

192.168.1.128 server name

domain dental.local

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

network obj_any object

subnet 0.0.0.0 0.0.0.0

network of the RAVPN object

10.10.10.0 subnet 255.255.255.0

network of the NETWORK_OBJ_10.10.10.0_28 object

subnet 10.10.10.0 255.255.255.240

network of the NETWORK_OBJ_192.168.1.0_24 object

subnet 192.168.1.0 255.255.255.0

access-list Local_LAN_Access note VPN Customer local LAN access

Local_LAN_Access list standard access allowed host 0.0.0.0

DefaultRAGroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0

Note VpnPeers access list allow peer vpn ping on the other

permit access list extended ip object NETWORK_OBJ_10.10.10.0_28 object NETWORK_OBJ_10.10.10.0_28 VpnPeers

pager lines 24

Enable logging

asdm of logging of information

logging of information letter

address record [email protected] / * /

exploitation forest-address recipient [email protected] / * / level of information

record level of 1 600 6 rate-limit

Outside 1500 MTU

Within 1500 MTU

mask 10.10.10.5 - 10.10.10.10 255.255.255.0 IP local pool VPNPool

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 711.bin

don't allow no asdm history

ARP timeout 14400

NAT (inside, all) static source all electricity static destination RAVPN RAVPN

NAT (inside, outside) static static source NETWORK_OBJ_10.10.10.0_28 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_10.10.10.0_28

NAT (inside, outside) static source all all NETWORK_OBJ_10.10.10.0_28 of NETWORK_OBJ_10.10.10.0_28 static destination

!

network obj_any object

NAT dynamic interface (indoor, outdoor)

network of the RAVPN object

dynamic NAT (all, outside) interface

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Community SNMP-server

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-DES-SHA-TRANS esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transit

Crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transit

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP ESP-AES-128-SHA ESP - AES - 192 - SHA ESP - AES - 256 - SHA ESP - 3DES - SHA - OF - SHA ESP - AES - 128 - SHA - TRANS ESP - AES - 192 - SHA - TRANS ESP - AES - 256 - SHA - ESP ESP - 3DES - SHA - TRANS TRANS-DES - SHA - TRANS

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

trustpoint crypto ca-CA-SERVER ROOM

LOCAL-CA-SERVER key pair

Configure CRL

Crypto ca trustpoint ASDM_TrustPoint0

registration auto

name of the object CN = ciscoasa

billvpnkey key pair

Proxy-loc-transmitter

Configure CRL

crypto ca server

CDP - url http://ciscoasa/+CSCOCA+/asa_ca.crl

name of the issuer CN = ciscoasa

SMTP address [email protected] / * /

crypto certificate chain ca-CA-SERVER ROOM

certificate ca 01

* hidden *.

quit smoking

string encryption ca ASDM_TrustPoint0 certificates

certificate 10bdec50

* hidden *.

quit smoking

crypto ISAKMP allow outside

crypto ISAKMP policy 10

authentication crack

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 20

authentication rsa - sig

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 40

authentication crack

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 50

authentication rsa - sig

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 60

preshared authentication

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 70

authentication crack

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 80

authentication rsa - sig

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 90

preshared authentication

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 100

authentication crack

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 110

authentication rsa - sig

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 120

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 130

authentication crack

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 140

authentication rsa - sig

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 150

preshared authentication

the Encryption

sha hash

Group 2

life 86400

enable client-implementation to date

Telnet 192.168.1.1 255.255.255.255 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

management-access inside

dhcpd outside auto_config

!

dhcpd address 192.168.1.50 - 192.168.1.99 inside

dhcpd allow inside

!

a basic threat threat detection

threat detection statistics

a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

SSL-trust outside ASDM_TrustPoint0 point

WebVPN

allow outside

SVC disk0:/anyconnect-win-3.1.04072-k9.pkg 1 image

SVC profiles DellStudioClientProfile disk0: / dellstudioclientprofile.xml

enable SVC

tunnel-group-list activate

internal-password enable

chip-tunnel list SmartTunnelList RDP mstsc.exe windows platform

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

Server DNS 192.168.1.128 value

Protocol-tunnel-VPN l2tp ipsec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl

Dental.local value by default-field

WebVPN

SVC value vpngina modules

internal DefaultRAGroup_1 group strategy

attributes of Group Policy DefaultRAGroup_1

Server DNS 192.168.1.128 value

Protocol-tunnel-VPN l2tp ipsec

Dental.local value by default-field

attributes of Group Policy DfltGrpPolicy

Server DNS 192.168.1.128 value

VPN - 4 concurrent connections

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

value of group-lock RAVPN

value of Split-tunnel-network-list Local_LAN_Access

Dental.local value by default-field

WebVPN

the value of the URL - list DentalMarks

SVC value vpngina modules

SVC value dellstudio type user profiles

SVC request to enable default webvpn

chip-tunnel enable SmartTunnelList

wketchel1 5c5OoeNtCiX6lGih encrypted password username

username wketchel1 attributes

VPN-group-policy DfltGrpPolicy

WebVPN

SVC value DellStudioClientProfile type user profiles

username privilege 15 encrypted password 5c5OoeNtCiX6lGih wketchel

username wketchel attributes

VPN-group-policy DfltGrpPolicy

WebVPN

modules of SVC no

SVC value DellStudioClientProfile type user profiles

jenniferk 5.TcqIFN/4yw0Vq1 of encrypted password privilege 0 username

jenniferk username attributes

VPN-group-policy DfltGrpPolicy

WebVPN

SVC value DellStudioClientProfile type user profiles

attributes global-tunnel-group DefaultRAGroup

address pool VPNPool

LOCAL authority-server-group

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared key *.

tunnel-group DefaultRAGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

eap-proxy authentication

type tunnel-group RAVPN remote access

attributes global-tunnel-group RAVPN

address pool VPNPool

LOCAL authority-server-group

tunnel-group RAVPN webvpn-attributes

enable RAVPN group-alias

IPSec-attributes tunnel-group RAVPN

pre-shared key *.

tunnel-group RAVPN ppp-attributes

PAP Authentication

ms-chap-v2 authentication

eap-proxy authentication

type tunnel-group WebSSLVPN remote access

tunnel-group WebSSLVPN webvpn-attributes

enable WebSSLVPN group-alias

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

173.194.64.108 SMTP server

context of prompt hostname

HPM topN enable

Cryptochecksum:3304bf6dcf6af5804a21e9024da3a6f8

: end

Hello

Seems to me that you can clean the current NAT configuration a bit and make it a little clearer.

I suggest the following changes

network of the VPN-POOL object

10.10.10.0 subnet 255.255.255.0

the object of the LAN network

subnet 192.168.1.0 255.255.255.0

PAT-SOURCE network object-group

object-network 192.168.1.0 255.255.255.0

object-network 10.10.10.0 255.255.255.0

NAT static destination LAN LAN (indoor, outdoor) static source VPN-VPN-POOL

destination VPN VPN-POOL POOL static NAT (outside, outside) 1 static source VPN-VPN-POOL

NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

The above should allow
- Dynamic PAT for LAN and VPN users
- NAT0 for traffic between the VPN and LAN
- NAT0 for traffic between the VPN users
You can then delete the previous NAT configurations. Naturally, please save the configuration before you make the change, if you want to revert to the original configuration.

no static source nat (inside, everything) all electricity static destination RAVPN RAVPN

No source (indoor, outdoor) nat static static NETWORK_OBJ_10.10.10.0_28 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_10.10.10.0_28

No source (indoor, outdoor) nat static everything all NETWORK_OBJ_10.10.10.0_28 of NETWORK_OBJ_10.10.10.0_28 static destination

No network obj_any object

No network object RAVPN

In case you do not want to change the settings a lot you might be right by adding this

network of the VPN-POOL object

10.10.10.0 subnet 255.255.255.0

destination VPN VPN-POOL POOL static NAT (outside, outside) 1 static source VPN-VPN-POOL

But the other above configurations changes would make NAT configurations currently simpler and clearer to see every goal of "nat" configurations.

-Jouni

ASA VPN cannot ping ip local pool

Hello

We have ASA 5510 a device be deployed for a period of time. Everything works fine except customers local VPN cannot ping local customer VPN which get their IP address to the local swimming pool. They can ping anywhere on the local network of company, but not each other. I don't know there's a logical explantion for this because of an ACL but all appreciated the advice...

Thanks in advance

Keith

Hi Keith,

I think that, in order to allow a customer VPN reach another VPN client, the SAA should turn the VPN traffic (because it will receive the traffic of a VPN tunnel and re - again to send another tunnel.)

Can you add "same-security-traffic intra-interface permits" and try again?

Federico.

Site to site between ASA 8.2 VPN, cannot ping

Two 8.2 ASA is configured with a VPN tunnel from site to site, as shown in the diagram:

Here is my setup for both.

Clients on the inside network to the ASA cannot ping inside, network clients, else the ASA. Why not?

When the rattling from inside network SALMONARM inside network of KAMLOOPS, the following debug logs can be seen on SALMONARM:

%ASA-7-609001: Built local-host outside:10.30.7.2

%ASA-6-302020: Built outbound ICMP connection for faddr 10.30.7.2/0 gaddr 192.168.0.216/55186 laddr 10.45.7.1/512

%ASA-6-302021: Teardown ICMP connection for faddr 10.30.7.2/0 gaddr 192.168.0.216/55186 laddr 10.45.7.1/512

%ASA-7-609002: Teardown local-host outside:10.30.7.2 duration 0:00:02

%ASA-7-609001: Built local-host outside:10.30.7.2

%ASA-6-302020: Built outbound ICMP connection for faddr 10.30.7.2/0 gaddr 192.168.0.216/55186 laddr 10.45.7.1/512

%ASA-6-302021: Teardown ICMP connection for faddr 10.30.7.2/0 gaddr 192.168.0.216/55186 laddr 10.45.7.1/512

%ASA-7-609002: Teardown local-host outside:10.30.7.2 duration 0:00:02

%ASA-7-609001: Built local-host outside:10.30.7.2

%ASA-6-302020: Built outbound ICMP connection for faddr 10.30.7.2/0 gaddr 192.168.0.216/55186 laddr 10.45.7.1/512

...

Each attempt to ping responds with "Request timed out" on the computer of ping.

Why clients cannot mutually ping on the VPN tunnel?

Hello

Create a NAT0 ACL at both ends.

ex: 10.30.0.0 ip access-list extended SHEEP 255.255.0.0 allow 10.45.0.0 255.255.0.0

NAT (inside) 0 access-list SHEEP

THX

Edit: at the beginning, I mentioned ACL #, it may not work.

VPN tunnel is up but cannot ping LAN stations

Hello

I'm trying to set up easy vpn server on cisco 881/k9 router.

Using the version of cisco vpn client 5.0, I can connect to the vpn server.

Can get the IP address of the LAN subnet on the vpn client.

On the side of vpn, I can see the vpn session using isakmp crypto #show her

But I can't ping from client vpn to any LAN station.

Someone please check my setup and find out.

This is my first time setting on the router cisco VPN.

Building configuration...

Current configuration: 5938 bytes
!
! Last configuration change at 01:38:31 UTC Thursday, April 21, 2011 by evantage
!
version 15.0
no service button
tcp KeepAlive-component snap-in service
a tcp-KeepAlive-quick service
horodateurs service debug datetime localtime show-timezone msec
Log service timestamps datetime localtime show-timezone msec
encryption password service
sequence numbers service
!
hostname FarEastP
!
boot-start-marker
boot-end-marker
!
logging buffered 51200
recording console critical
!
AAA new-model
!
!
AAA authentication login default local
AAA authentication login ciscocp_vpn_xauth_ml_1 local
AAA authorization exec default local
AAA authorization ciscocp_vpn_group_ml_1 LAN
!
!
!
!
!
AAA - the id of the joint session
iomem 10 memory size
!
Crypto pki trustpoint TP-self-signed-3333835941
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 3333835941
revocation checking no
rsakeypair TP-self-signed-3333835941
!
!
TP-self-signed-3333835941 crypto pki certificate chain
certificate self-signed 01
30820240 308201A 9 A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030
2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
69666963 33333333 38333539 6174652D 3431301E 170 3131 30343230 31363434
30355A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
4F532D53 5369676E 656C662D 43 65727469 66696361 74652 33 33333338 65642D
33353934 3130819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
810094A 1 7C2D79CE A6BEE368 3EB0B5B7 9A2CFE42 6A 145915 E67EF01D 350558E3
040B 6379 E6360CB3 4 D 0360DA61 184225 AAB44CA5 6BE23D05 55DAA45A 4647 5 FEB
6F143346 6BF18824 EFC3A31F 2A48AD8D 524F2324 EB331E50 8407577F E751DFF2
DD926D88 25 23143 11 C 66750 68267 C 61 C38B62C4 3B16E5AE AC91B2F8 ABA3546D
02 30203 010001A 3 68306630 1 130101 FF040530 030101FF 30130603 0F060355 D
551D 1104 08466172 45617374 50301F06 23 04183016 8014E95E 03551D 0C300A82
66B6A8C2 CF1BD38F 684FD4DF C3854AEB ACA7301D 0603551D 0E041604 14E95E66
B6A8C2CF 1BD38F68 4FD4DFC3 854AEBAC A7300D06 092 HAS 8648 86F70D01 01040500
03818100 05803840 EFBF9A3B F4D64899 8E03C836 34861307 57193CC5 DA510446
E4081D1A 2CF243BF 41AC9F36 83DAE9DB 9480F154 7CF792A5 76C1452C EEFD8661
8443DC4C 8E507A8F B2ECCAEB CDE26E41 E477E290 79AE5D72 FD81057C B5DCE1C2
36E0F740 65108014 A8992360 92F0423D E14F9240 1D162BC3 EFBB75A2 9E64ABC6 D76BE894
quit smoking
no ip source route
!
!
DHCP excluded-address 192.168.1.1 IP 192.168.1.100
DHCP excluded-address IP 192.168.1.201 192.168.1.254
!
dhcp pool IP CCP-pool1
network 192.168.1.0 255.255.255.0
domain FarEastP
default router 192.168.1.1
DNS-server 192.168.1.2 165.21.83.88
!
!
no ip cef
no ip domain search
name-server IP 192.168.1.2
name of the IP-server 165.21.83.88
No ipv6 cef
!
!
license udi pid CISCO881-K9 sn FHK142971LH
!
!
username admin privilege 15 secret 5 $1$ W2eu$ lr. TpEfJuOE1iKQjFPHIT /.
username privilege 15 secret 5 evantage P602 $1$$ 8TeJh5.SCHsY2TGd0.TnD1
username privilege 5 secret 5 sshukla $1$ oflM$ cHZdlpLdWr.nn1UwiCEs7.
username privilege 5 secret 5 rtandon $1$ yGAU$ BxJ6eQqG32WeI2gI4BDWh1
sagrawal privilege 5 secret 5 username $1$ $1Kkz E6NOTt9LCXiGTarAxrc/i1
username secret privilege 5 asarie $5 1. CVw $0ohz3WtLqU8USiMBqxIjA.
username secret privilege 5 rbiyani 5 $1$ KkY / $02lEPCahuIpzoQcXln2yD.
username privilege 5 secret 5 clovejoy $1$ WMbu$ t.er4RPRTnYNNwwkVGMuX.
username privilege 5 secret 5 Lakshmi $1$ ZMC4$ Sjlcmcw2uvhzU9bwEw1Us.
username privilege 5 secret 5 benmansour yPMa $1$$ I.q.7NW2uQo0s5FTHkxZM1
username secret privilege 5 usha 5 $1$ bX1I$ X6X4eSSeq48k0Kq8Qt7Rn.
username privilege 5 secret 5 aditya $1$ w2Vt$ HOz81M2UfLeni.PNUX2aJ.
!
!
synwait-time of tcp IP 10
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
crypto ISAKMP policy 10
!
ISAKMP crypto group configuration of VPN client
TP!zlflN\2\4go,xtP+xFapuWlKDvr#dVrS6L4TF5NJl2GXugUgv%LfQ+!drgUK key
DNS 192.168.1.2 165.21.83.88
fareastp field
pool SDM_POOL_1
ACL 101
max - 20 users
netmask 255.255.255.0
!
!
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
!
crypto dynamic-map DYNVPN 1
game of transformation-ESP-3DES-SHA
!
!
map clientmap client to authenticate crypto list ciscocp_vpn_xauth_ml_1
card crypto clientmap isakmp authorization list ciscocp_vpn_group_ml_1
client configuration address map clientmap crypto answer
clientmap card crypto 65535-isakmp dynamic ipsec DYNVPN
!
!
!
!
!
interface Loopback0
no ip address
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
WAN description $ ES_WAN$
IP 119.75.60.170 255.255.255.252
penetration of the IP stream
NAT outside IP
IP virtual-reassembly
automatic duplex
automatic speed
clientmap card crypto
!
interface Vlan1
LAN description
IP 116.12.248.81 255.255.255.240 secondary
IP 192.168.1.1 255.255.255.0
penetration of the IP stream
IP nat inside
IP virtual-reassembly
!
local IP SDM_POOL_1 192.168.1.201 pool 192.168.1.254
local IP POOL_2 10.10.1.2 pool 10.10.1.200
IP forward-Protocol ND
IP http server
local IP http authentication
IP http secure server
IP http timeout policy slowed down 60 life 86400 request 10000
!
IP nat inside source static tcp 192.168.1.2 1723 1723 interface FastEthernet4
IP nat inside source static tcp 192.168.1.4 5003 interface FastEthernet4 5003
IP nat inside source static tcp 192.168.1.4 16000 16000 FastEthernet4 interface
IP nat inside source static tcp 192.168.1.4 16001 interface FastEthernet4 16001
overload of IP nat inside source list 111 interface FastEthernet4
IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
IP route 0.0.0.0 0.0.0.0 119.75.60.169
!
recording of debug trap
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
!
!
!
allowed SDM_RMAP_1 1 route map
corresponds to the IP 101
!
!
control plan
!
!
Line con 0
no activation of the modem
line to 0
line vty 0 4
transport input telnet ssh
!
max-task-time 5000 Planner
Scheduler allocate 4000 1000
Scheduler interval 500
end

The VPN pool assigned to the VPN client must be in another unique subnet as internal networks.

Please also post all your ACL to see if NAT and crypto ACL has been set up correctly.

Your NAT ACL must include "deny ip" above all permit declarations.

Customer remote VPN cannot ping certain IP

My Cisco VPN client can establish the tunnel with my successful ASA5505 Office vpn but cannot ping some IP such as an internal server (10.100.194.6).

FIREWALL-1 # ping 10.100.194.6
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 10.100.194.6, wait time is 2 seconds:
!!!!!
Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/1 ms

Why I can't ping certain IP?

Help, please.

Thank you.

Hey Kevin,

Check out the capture, it is obvious that there is a problem of internal routing as we can see packets from the VPN client requests, but there is no response from the server package.

Please ensure that the server has pointing on the Firewall VPN subnet route.
HTH.

Kind regards

Dinesh Moudgil

PS: Please check the useful messages.

Remote VPN cannot ping any host on remote site

Hi all!

I tried to deploy remote vpn on my asa 5515-x. And my VPN client properly connected, but I can't ping any host on a remote network.

Here is my configuration:

ASA 1.0000 Version 2

!

names of

!

interface GigabitEthernet0/0

nameif inside

security-level 100

IP 192.168.10.252 255.255.255.0

!

interface GigabitEthernet0/1

nameif outside

security-level 0

IP x.x.x.x 255.255.255.252

!

interface GigabitEthernet0/2

DMZ description

nameif dmz

security-level 50

IP 192.168.20.252 255.255.255.0

!

interface GigabitEthernet0/3

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/4

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/5

No nameif

no level of security

no ip address

!

interface Management0/0

nameif management

security-level 100

IP 192.168.2.40 255.255.255.0

management only

!

boot system Disk0: / asa861-2-smp - k8.bin

passive FTP mode

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

internal subnet object-

192.168.10.0 subnet 255.255.255.0

network dmz subnet object

subnet 192.168.20.0 255.255.255.0

Note to access-list LAN_VLAN_10 split_tunnel

split_tunnel list standard access allowed 192.168.10.0 255.255.255.0

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

management of MTU 1500

MTU 1500 dmz

IP local pool testpool 192.168.10.240 - 192.168.10.250 mask 255.255.255.0

no failover

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ASDM image disk0: / asdm - 714.bin

don't allow no asdm history

ARP timeout 14400

!

internal subnet object-

NAT dynamic interface (indoor, outdoor)

network dmz subnet object

NAT (dmz, outside) dynamic interface

Route outside 0.0.0.0 0.0.0.0 93.174.55.181 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

identity of the user by default-domain LOCAL

AAA authentication LOCAL telnet console

the ssh LOCAL console AAA authentication

Enable http server

http 192.168.0.0 255.255.0.0 management

http 192.168.10.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

Crypto ipsec transform-set esp - esp-md5-hmac ikev1 firstset

Crypto-map dynamic dyn1 ikev1 transform-set firstset 1 set

dynamic mymap 1 dyn1 ipsec-isakmp crypto map

mymap outside crypto map interface

Crypto ikev1 allow outside

IKEv1 crypto policy 1

preshared authentication

the Encryption

md5 hash

Group 2

life 43200

Telnet 0.0.0.0 0.0.0.0 inside

Telnet 0.0.0.0 0.0.0.0 management

Telnet timeout 5

SSH 0.0.0.0 0.0.0.0 management

SSH timeout 5

Console timeout 0

interface ID client DHCP-client to the outside

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal group testgroup strategy

testgroup group policy attributes

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list split_tunnel

user1 fvosA8L1anfyxTw3 encrypted password username

tunnel-group testgroup type remote access

tunnel-group testgroup General attributes

address testpool pool

strategy-group-by default testgroup

testgroup group tunnel ipsec-attributes

IKEv1 pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

What's wrong?

TNX!

Hello

I would like to change the current reserve of VPN to something overlapping to the LAN.

You're also missing NAT0 for the VPN Client connection that is your problem more likely.

You can try these changes

mask of 192.168.100.1 - local 192.168.100.254 pool POOL VPN IP 255.255.255.0

tunnel-group testgroup General attributes

No address testpool pool

address VPN-POOL pool

no ip local pool testpool 192.168.10.240 - 192.168.10.250 mask 255.255.255.0

the object of the LAN network

192.168.10.0 subnet 255.255.255.0

network of the VPN-POOL object

255.255.255.0 subnet 192.168.100.0

NAT static destination LAN LAN (indoor, outdoor) static source VPN-VPN-POOL

You can also change your settings for encryption for anything other than a. You can use AES.

Hope this helps

Let us know if this helped.

Don't forget to mark a reply as the answer if it answered your question.

Feel free to ask more if necessary

-Jouni

VPN - cannot ping the next hop

Then some advice... I have configured a server VPN - pptp on my router, create a vpn for the customer at the site. For the moment, the client computer can connect and a connection to the router. I can ping from client to the router (192.168.5.1) but cannot ping 192.168.5.2 (switch) or 192.168.10.X (workstations)

What I try to achieve is to access the internal network (192.168.10.X), which is the end of the layer 3 switch. Any help/extra eyes would be good.

Here is my design of the network and the config below:

Client computer---> Internet---> (1.1.1.1) Cisco router (192.168.5.1) 881---> switch Dell Powerconnect 6248 (192.168.5.2)--> Workstation (192.168.10.x)

Router Cisco 881

AAA new-model

!

AAA of authentication ppp default local

!

VPDN enable

!

!

VPDN-group VPDN PPTP

!

accept-dialin

Pptp Protocol

virtual-model 1

!

interface FastEthernet0

Description link to switch

switchport access vlan 5

!

interface FastEthernet1

no ip address

!

interface FastEthernet2

no ip address

!

interface FastEthernet3

switchport access vlan 70

no ip address

!

interface FastEthernet4

Description INTERNET WAN PORT

IP [IP EXTERNAL address]

NAT outside IP

IP virtual-reassembly in

full duplex

Speed 100

card crypto VPN1

!

interface Vlan1

no ip address

!

interface Vlan5

Description $ES_LAN$

IP 192.168.5.1 255.255.255.248

no ip redirection

no ip unreachable

IP nat inside

IP virtual-reassembly in

!

interface Vlan70

IP [IP EXTERNAL address]

IP virtual-reassembly in

IP tcp adjust-mss 1452

!

!

!

interface virtual-Template1

IP unnumbered FastEthernet4

encapsulation ppp

peer default ip address pool defaultpool

Ms-chap PPP chap authentication protocol

!

IP local pool defaultpool 192.168.10.200 192.168.10.210

IP forward-Protocol ND

IP http server

23 class IP http access

local IP http authentication

IP http secure server

IP http timeout policy inactive 600 life 86400 request 10000

!

overload of IP nat inside source list no. - NAT interface FastEthernet4

IP route 0.0.0.0 0.0.0.0 [address IP EXTERNAL]

Route IP 192.168.0.0 255.255.0.0 192.168.5.2

!

No. - NAT extended IP access list

deny ip 192.168.0.0 0.0.255.255 10.1.0.0 0.0.255.255

IP 192.168.0.0 allow 0.0.255.255 everything

VLAN70 extended IP access list

ip [IP EXTERNAL] 0.0.0.15 permit 192.168.10.0 0.0.1.255

permit tcp [IP EXTERNAL] 0.0.0.15 any eq smtp

permit tcp [IP EXTERNAL] 0.0.0.15 any eq www

permit any eq 443 tcp [IP EXTERNAL] 0.0.0.15

permit tcp [IP EXTERNAL] 0.0.0.15 any eq field

permits any udp [IP EXTERNAL] 0.0.0.15 eq field

list of IP - VPN access scope

IP 192.168.10.0 allow 0.0.1.255 10.1.0.0 0.0.1.255

Licensing ip [IP EXTERNAL] 0.0.0.15 10.1.0.0 0.0.1.255

WAN extended IP access list

!

Layer 3 switch - Dell Powerconnect 6224

!

IP routing

IP route 0.0.0.0 0.0.0.0 192.168.5.1

interface vlan 5

name "to connect to the Cisco router.

Routing

IP 192.168.5.2 255.255.255.248

output

!

interface vlan 10

"internal network" name

Routing

IP 192.168.10.1 255.255.255.0

output

!

interface ethernet 1/g12

switchport mode acesss vlan 5

output

!

interface ethernet 1/g29

switchport mode access vlan 10

output

!

Hi Samuel,.

I went through your configuration and picked up a few problematic lines...

First of all, you can't have your vpn-pool to be in the range of 192.168.10.x/24, because you already have this subnet used behind the switch (this would be possible if you had 192.168.10.x range connected directly to the router). In addition, you may not link your virtual model to the WAN ip address, it must be bound to an interface with a subnet that includes your IP vpn-pool range.

The cleaner for this is,

Create a new interface of back of loop with a new subnet

!

loopback interface 0

192.168.99.1 IP address 255.255.255.0

!

New vpn set up, pool

!

IP local pool defaultpool 192.168.99.200 192.168.99.210

!

Change your template to point the new loopback interface,

!

interface virtual-Template1

IP unnumbered loopback0

encapsulation ppp

peer default ip address pool defaultpool

Ms-chap PPP chap authentication protocol

!

All vpn clients will get an IP address of 192.168.99.200 192.168.99.210 range. And they will be able to get the router and up to the desired range 192.168.10.x/24 behind the router. Packages get the switch, then to the host. Host will respond through the gateway (switch)-> router-> Client.

PS: Sooner, even if your packages arrive at the host, the host will never try to send the response back through the gateway (switch) packets because STI (hosts) point of view, the package came from the same local network, so the host will simply try to "arp" for shippers MAC and eventually will expire)

I hope this helps.

Please don't forget to rate/brand of useful messages

Shamal

Site to Site VPN - cannot ping remote subnet

Hi all.

I have a site to site VPN IPSEC between a 5510 (HQ) and 5505 (Remote). Everything works on the tunnel. Crypto cards and ACL is symmetrical. I see that the tunnel is in place for the required subnets. However, I can not ping of internal subnets inside 5510 to Remote LAN inside 5505 and vice versa. I have other rays VPN 5510 where I can ping within remote LAN successfully x.x.x.x. Can figure out what I'm missing. I can ping internet points, but cannot ping HQ.

Any suggestions?

I'm also an instant learn the ASAs, so I'm not an expert. I know that I encouraged outside ICMP. My statement SHEEP and crypto are running off of the same group of objects that lists subnets of HQ.

Thanks in advance.

5505 lack the command:

management-access inside

Federico.

PIX - PIX VPN and Client VPN - cannot access core network

I hub and spoke PIX and a VPN Client that connects to speak it PIX, much the same as the example configuration here: -.

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00800948b8.shtml

This example shows the client VPN access to the network behind PIX RADIUS. I want the client to also be able to access the central network, i.e. the client connects to the pix speaks via vpn, and traffic is routed through the vpn to PIX - PIX to the central site.

How this would change the configuration contained in the example?

See you soon,.

Jon

You can not do this, the PIX cannot route a package back on the same interface, it is entered in the. The only way to do that is to have the client connect to the hub PIX, but then they would not be able to get to the network behind PIX distance either.

Or that the customer would connect on a different interface in the PIX of distance, but this would mean another connection ISP on this PIX. Example of config is here: http://www.cisco.com/warp/public/110/client-pixhub.html

Cannot ping Lan devices in Vlan

Hello

I looked for a solution to this for the week without success. I came across a Cisco C3560, which is used because of its ability of poe to power some Deskphones Voip. While the works of great poe, machines connected to the switch can only communicate with each other and don't can't ping or otherwise access any device connected directly to the router of the network.

The Cisco switch is configured with a vlan and a default gateway, but nothing comes out by behind the switch. On connected devices can ping by default gateway (192.168.0.1 - a tp-link router), receive a lease dhcp from the router said successfully and can connect to the internet, but on the local network, nothing works. (unable to connect to the printer connetced directly to the router or other computers connected directly to the router.

Any advice? I am new to cisco switches, don't know what I'm doing here. I'm just trying to get devices that are connected directly to the switch to communicate with devices connected directly to the router.

Switch#show runBuilding configuration...

Current configuration : 1528 bytes!version 12.2service configno service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Switch!enable secret 5 {}{}{}{}{}{}{}{}{}{}{}{}!no aaa new-modelclock timezone UTC 2system mtu routing 1500ip subnet-zero!!!!no file verify autospanning-tree mode pvstspanning-tree extend system-id!vlan internal allocation policy ascending!interface FastEthernet0/1!interface FastEthernet0/2!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24 switchport mode access!interface GigabitEthernet0/1!interface GigabitEthernet0/2!interface Vlan1 ip address 192.168.0.26 255.255.255.0 no ip route-cache!ip default-gateway 192.168.0.1ip classlessip default-network 192.168.0.0ip http server!access-list 1 permit any log!control-plane!!line con 0line vty 0 4 password XXXXXXXXX login length 0line vty 5 15 password XXXXXXXX login length 0!end

 Switch#show interface

Vlan1 is up, line protocol is up Hardware is EtherSVI, address is 001e.bd27.c4c0 (bia 001e.bd27.c4c0) Internet address is 192.168.0.26/24 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 3 packets/sec 138534 packets input, 9472693 bytes, 0 no buffer Received 0 broadcasts (68 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 30296 packets output, 2248820 bytes, 0 underruns 0 output errors, 1 interface resets 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/2 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c484 (bia 001e.bd27.c484) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:56, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 46000 bits/sec, 37 packets/sec 5 minute output rate 582000 bits/sec, 71 packets/sec 1941044 packets input, 327622438 bytes, 0 no buffer Received 38375 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 30699 multicast, 0 pause input 0 input packets with dribble condition detected 3224783 packets output, 2069682884 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/4 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c486 (bia 001e.bd27.c486) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 129069 packets input, 64947010 bytes, 0 no buffer Received 9953 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9759 multicast, 0 pause input 0 input packets with dribble condition detected 600269 packets output, 45540585 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/6 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c488 (bia 001e.bd27.c488) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:50, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 32693 packets input, 4244428 bytes, 0 no buffer Received 9942 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9759 multicast, 0 pause input 0 input packets with dribble condition detected 588460 packets output, 45003331 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/8 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c48a (bia 001e.bd27.c48a) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:30, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 32694 packets input, 4243413 bytes, 0 no buffer Received 9934 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9757 multicast, 0 pause input 0 input packets with dribble condition detected 588485 packets output, 45009466 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/12 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c48e (bia 001e.bd27.c48e) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:28, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 32742 packets input, 4252075 bytes, 0 no buffer Received 9947 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9763 multicast, 0 pause input 0 input packets with dribble condition detected 588497 packets output, 45019272 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/13 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c48f (bia 001e.bd27.c48f) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:13, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 148160 packets input, 73818106 bytes, 0 no buffer Received 9973 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9760 multicast, 0 pause input 0 input packets with dribble condition detected 599666 packets output, 49045070 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/14 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c490 (bia 001e.bd27.c490) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:05, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 129165 packets input, 68409495 bytes, 0 no buffer Received 9982 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 9773 multicast, 0 pause input 0 input packets with dribble condition detected 600283 packets output, 45551497 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/18 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c494 (bia 001e.bd27.c494) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:49, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 21000 bits/sec, 18 packets/sec 5 minute output rate 13000 bits/sec, 16 packets/sec 606386 packets input, 88151136 bytes, 0 no buffer Received 159883 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 55198 multicast, 0 pause input 0 input packets with dribble condition detected 941617 packets output, 308269004 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/20 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c496 (bia 001e.bd27.c496) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:54, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 1000 bits/sec, 1 packets/sec 5 minute output rate 1000 bits/sec, 2 packets/sec 515813 packets input, 87006769 bytes, 0 no buffer Received 21466 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 19952 multicast, 0 pause input 0 input packets with dribble condition detected 1858112 packets output, 1700009146 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

FastEthernet0/24 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 001e.bd27.c49a (bia 001e.bd27.c49a) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 546556 packets output, 41182636 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

GigabitEthernet0/1 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is 001e.bd27.c481 (bia 001e.bd27.c481) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not set Full-duplex, 1000Mb/s, link type is auto, media type is 10/100/1000BaseTX SFP input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 556000 bits/sec, 83 packets/sec 5 minute output rate 76000 bits/sec, 63 packets/sec 4457827 packets input, 3961330567 bytes, 0 no buffer Received 15028 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 11213 multicast, 0 pause input 0 input packets with dribble condition detected 3822373 packets output, 728132696 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out

Switch#show vlan

VLAN Name     Status         Ports---- -------------------------------- --------- -------------------------------1     default active    Fa0/1, Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16                        Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Gi0/1, Gi0/21002 fddi-default act/unsup1003 token-ring-default act/unsup1004 fddinet-default act/unsup1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------1 enet 100001 1500 - - - - - 0 01002 fddi 101002 1500 - - - - - 0 01003 tr 101003 1500 - - - - - 0 01004 fdnet 101004 1500 - - - ieee - 0 01005 trnet 101005 1500 - - - ibm - 0 0

Remote SPAN VLANs------------------------------------------------------------------------------

Primary Secondary Type Ports------- --------- ----------------- ------------------------------------------

Hello

first thing, please edit your post and remove your remote vty lines access password

never send passwords on a public forum for the just in case production equipment

line vty 0 4
password xxxxxx

***********************

Your question

What is the configuration of the router as a switch which seems to work correctly you're saying and I configured its doing its job, don't forget you said that you cannot route no between the router and the router switch should take care of this, whats the vlan ports on the router are on is - what the same subnet do they get an ip address in the same subnet off dhcp as devices of switching, if they do, and you cannot ping them to the same subnet theres something upward on the side of the router it would treat for layer 3 routing ip traffic

the ping to the router devices connected to the cisco switch and can the device on the router cannot ping devices switches

If you move a device out of the router and attach it to the doe sit switch still work ok, reach the talk of the internet to other devices on the switch?

As there is a layer 2 switch you don't need this command you have your entry door you can remove it.. .IP default-network 192.168.0.0

Phones AnyConnect VPN cannot connect to network ASA high-speed AT & T uverse

Phones AnyConnect VPN are configured to connect to the ASA 5510 running 8.4 (4), and it uses the Active Directory credentials to connect. The connection is successful external ISP systems including Comcast and smaller independent service providers. However, when all of us at the AT & T uverse service take this phone 7965 even at home it networks fails to make any connection to the ASA at all. A capture of packets on the ASA shows no activity connection to the IP address of our uverse.

What's more, is that we can successfully authenticate the VPN of the phone when using the local account credentials (e.g. username admin password * priv 15) that are entered on the SAA. AT & T said that they are not blocking the ports. It is the confusion that this works for users to access local connection, but not with A/D.

So I guess the question is: what is the first handshake TCP/UDP composed when a Cisco IP phone links AnyConnect SSL to an ASA and negotiates the authentication of the number of A/D? For example, what are the port numbers used in this handshake? I couldn't find all the diagrams illustrating the HRT and the RFC for DTLS do not seem to have the answer either.

Thanks in advance.

-Athonia

Note: we have a TAC case open currently with subject ASA 5510 VPN Edition w / 250 annyconnect user - SSL VPN for phones. Configuration

I too ran on this issue and here is a description of what I found.

If you use automatic network detection first trys phone ping the TFTP server, he has learned from the DHCP server or manually set with the parameter of the alternate TFTP server. If the TFTP server is accessible the VPN will not connect and will not allow the user to connect manually.

ATT Uverse use DHCP option 150, the same option as Cisco UC uses to automatically set the TFTP servers, to locate the local home gateway so that the STB can join him. For this reason, you should notice that when you have a VPN phone on the network and view network settings the IP address of the TFTP server is the IP address of your default gatewat (The ATT router).

Because of the automatic detection of network works in ping the TFTP server that the phone will always think that it is connected to the local network. The workaround is to manually set the TFTP server on the phone * to the IP address that the TFTP server would have been if she had leared it from the DHCP server on your corporate network. The reason you should do this instead of just using a Bogon address, is that once the VPN is connected it tryes to register to the address that you specified.

Please let me know if this solves your problem as it did in our case.

* If you do not know how to set the TFTP replacement setting you must first select the "replacement" TFTP protocol and press on * #. This will allow you to change the default no to Yes. The below named parameter TFTP Server 1 will then allow you to manually specify the address.

Cannot ping inner network via VPN site-2-site

I have the following Setup of the site 2 site VPN.

The pain I feel is host 172.168.88.3 in site A is not able to ping 172.168.200.3 in site B and vice versa. Think I've added static routes and lists ACLs correctly on 3560 switches (acting as an access point) and the two PIX to access internal networks. 172.168.9.3 host can ping 172.168.200.3 very well. All advice is appreciated.

Thank you very much.

My configs are as follows:

PIX HAS

8.0 (3) version PIX

!

PIX - A host name

activate u18hqwudty78klk9s encrypted password

names of

!

interface Ethernet0

Speed 100

full duplex

nameif outside

security-level 0

IP address x.x.x.250 255.255.255.240

!

interface Ethernet1

nameif inside

security-level 100

IP 172.168.9.1 255.255.255.0

!

uh78mklh78yMs encrypted passwd

connection of the banner it is a private network. Unauthorized access is prohibited!

Banner motd this is a private network. Unauthorized access is prohibited!

passive FTP mode

clock timezone GMT/UTC 0

summer time clock GMT/BST recurring 1 Sun Mar 01:00 last Sun Oct 02:00

DNS domain-lookup outside

DNS server-group Ext_DNS

Server name 82.72.6.57

Server name 63.73.82.242

the LOCAL_LAN object-group network

object-network 172.168.9.0 255.255.255.0

object-network 172.168.88.0 255.255.255.0

Internet_Services tcp service object-group

port-object eq www

area of port-object eq

EQ object of the https port

port-object eq ftp

EQ object of port 8080

EQ port ssh object

port-object eq telnet

the WAN_Network object-group network

object-network 172.168.200.0 255.255.255.0

ACLOUT list extended access allowed object-group LOCAL_LAN udp any eq log field

ACLOUT list extended access allow icmp object-group LOCAL_LAN no matter what paper

ACLOUT list extended access permitted tcp object-group LOCAL_LAN connect to any object-group Internet_Services

Access extensive list ip 172.168.88.0 ACLOUT allow 255.255.255.0 172.168.200.0 255.255.255.0 connect

access-list extended ACLIN all permit icmp any what newspaper echo-reply

access-list extended ACLIN all permit icmp any how inaccessible journal

access-list extended ACLIN allowed icmp no matter what newspaper has exceeded the time

IP 172.168.200.0 allow Access - list extended ACLIN 255.255.255.0 172.168.9.0 255.255.255.0 connect

standard access list split_tunnel_list allow 172.168.9.0 255.255.255.0

Access log list split_tunnel_list note LOCAL_LAN

access-list extended SHEEP allowed ip object-group LOCAL_LAN 172.168.100.0 255.255.255.0 connect

access extensive list ip 172.168.9.0 inside_nat0_outbound allow 255.255.255.0 172.168.200.0 255.255.255.0 connect

access extensive list ip 172.168.9.0 outside_cryptomap_20 allow 255.255.255.0 172.168.200.0 255.255.255.0 connect

pager lines 24

Enable logging

logging buffered information

logging trap information

host of logging inside the 172.168.88.3

Outside 1500 MTU

Within 1500 MTU

IP local pool testvpn 172.168.100.1 - 192.168.100.99

no failover

ICMP unreachable rate-limit 1 burst-size 1

ASDM image Flash: / pdm

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Access-group ACLIN in interface outside

ACLOUT access to the interface inside group

Route outside 0.0.0.0 0.0.0.0 x.x.x.45 1

Route inside 172.168.88.0 255.255.255.0 172.168.88.254 1

Route inside 172.168.199.0 255.255.255.0 172.168.199.254 1

Route outside 172.168.200.0 255.255.255.0 172.168.9.1 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 172.168.9.1 255.255.255.255 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-md5-hmac Set_1

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto dynamic-map outside_dyn_map 1 set of transformation-Set_1

Crypto dynamic-map outside_dyn_map 1 the value reverse-road

outside_map 1 card crypto ipsec-isakmp dynamic outside_dyn_map

card crypto outside_map 20 match address outside_cryptomap_20

card crypto outside_map 20 peers set x.x.x.253

outside_map crypto 20 card value transform-set ESP-AES-256-SHA

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 1

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 10

preshared authentication

aes-256 encryption

sha hash

Group 5

life 86400

No encryption isakmp nat-traversal

Telnet 0.0.0.0 0.0.0.0 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

a basic threat threat detection

Statistics-list of access threat detection

NTP server 130.88.203.12 prefer external source

internal testvpn group policy

attributes of the strategy of group testvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list split_tunnel_list

Viv ZdlkjGlOTGf7dqdb encrypted user name password

type tunnel-group testvpn remote access

tunnel-group testvpn General-attributes

address testvpn pool

Group Policy - by default-testvpn

testvpn group of tunnel ipsec-attributes

pre-shared-key *.

tunnel-group x.x.x.253 type ipsec-l2l

x.x.x.253 group of tunnel ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

inspect the icmp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:bb6ead3350227b3745c14b9ba340b84a

: end

B PIX

8.0 (3) version PIX

!

hostname PIX - B

enable password ul; encrypted jk89A89hNC0Ms

names of

!

interface Ethernet0

Speed 100

full duplex

nameif outside

security-level 0

IP address x.x.x.253 255.255.255.240

!

interface Ethernet1

nameif inside

security-level 100

IP 172.168.200.1 255.255.255.0

!

interface Ethernet2

Shutdown

No nameif

no level of security

no ip address

!

2ljio897hFB.88fU encrypted passwd

Banner motd this is a private network. Unauthorized access is prohibited!

passive FTP mode

DNS domain-lookup outside

DNS server-group Ext_DNS

Server name x.x.x.57

Server name x.x.x.242

the LOCAL_LAN object-group network

object-network 172.168.200.0 255.255.255.0

Internet_Services tcp service object-group

port-object eq www

area of port-object eq

EQ object of the https port

port-object eq ftp

EQ object of port 8080

the WAN_Network object-group network

networks WAN Description

object-network 172.168.88.0 255.255.255.0

ACLOUT list extended access allowed object-group LOCAL_LAN udp any eq field

ACLOUT list extended access allow icmp object-group LOCAL_LAN all

ACLOUT list extended access permitted tcp object-group LOCAL_LAN any Internet_Services object-group

access-list extended ACLIN allow all unreachable icmp

access-list extended ACLIN permit icmp any one time exceed

access-list extended ACLIN permit icmp any any echo response

IP 172.168.88.0 allow Access - list extended ACLIN 255.255.255.0 172.168.200.0 255.255.255.0

IP 172.168.9.0 allow Access - list extended ACLIN 255.255.255.0 172.168.200.0 255.255.255.0

IP 172.168.199.0 allow Access - list extended ACLIN 255.255.255.0 172.168.200.0 255.255.255.0

access extensive list ip 172.168.200.0 inside_nat0_outbound allow 255.255.255.0 172.168.9.0 255.255.255.0

access extensive list ip 172.168.200.0 outside_cryptomap_20 allow 255.255.255.0 172.168.9.0 255.255.255.0

pager lines 24

Enable logging

monitor debug logging

debug logging in buffered memory

logging trap information

Outside 1500 MTU

Within 1500 MTU

no failover

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Access-group ACLIN in interface outside

ACLOUT access to the interface inside group

Route outside 0.0.0.0 0.0.0.0 x.x.x.253 1

Route outside 172.168.88.0 255.255.255.0 172.168.200.1 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

dynamic-access-policy-registration DfltAccessPolicy

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

card crypto outside_map 20 match address outside_cryptomap_20

card crypto outside_map 20 peers set x.x.x.250

outside_map crypto 20 card value transform-set ESP-AES-256-SHA

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

aes-256 encryption

sha hash

Group 5

life 86400

No encryption isakmp nat-traversal

Telnet timeout 5

SSH timeout 5

Console timeout 0

management-access inside

a basic threat threat detection

Statistics-list of access threat detection

tunnel-group x.x.x.250 type ipsec-l2l

x.x.x.250 Group of tunnel ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

inspect the icmp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:ccb8392ce529a21c071b85d9afcfdb30

: end

3560 G/W

version 12.2

no service button

horodateurs service debug uptime

Log service timestamps uptime

no password encryption service

!

hostname 3560_GW

!

enable secret 5 $1$ cOB4$ Uklj8978/jgWv? TSSP

!

No aaa new-model

mtu 1500 routing system

IP subnet zero

IP routing

!

!

!

!

No file verify auto

pvst spanning-tree mode

spanning tree extend id-system

!

internal allocation policy of VLAN ascendant

!

interface GigabitEthernet0/1

!

interface GigabitEthernet0/2

uplink Description to Cisco_ASA

switchport access vlan 9

!

interface GigabitEthernet0/3

!

interface GigabitEthernet0/4

!

interface GigabitEthernet0/5

!

interface GigabitEthernet0/6

!

interface GigabitEthernet0/7

!

interface GigabitEthernet0/8

!

interface GigabitEthernet0/9

!

interface GigabitEthernet0/10

!

interface GigabitEthernet0/11

!

interface GigabitEthernet0/12

!

interface GigabitEthernet0/13

!

interface GigabitEthernet0/14

!

interface GigabitEthernet0/15

!

interface GigabitEthernet0/6

!

interface GigabitEthernet0/7

!

interface GigabitEthernet0/8

!

interface GigabitEthernet0/9

!

interface GigabitEthernet0/10

!

interface GigabitEthernet0/11

!

interface GigabitEthernet0/12

!

interface GigabitEthernet0/13

!

interface GigabitEthernet0/14

!

interface GigabitEthernet0/15

!

interface GigabitEthernet0/16

!

interface GigabitEthernet0/17

!

interface GigabitEthernet0/18

!

interface GigabitEthernet0/19

!

interface GigabitEthernet0/20

!

interface GigabitEthernet0/21

!

interface GigabitEthernet0/22

!

interface GigabitEthernet0/23

switchport access vlan 88

switchport mode access

spanning tree portfast

!

interface GigabitEthernet0/24

switchport access vlan 9

switchport mode access

spanning tree portfast

!

interface GigabitEthernet0/25

trunk of the description and the port of A_2950_88 1

switchport trunk encapsulation dot1q

!

interface GigabitEthernet0/26

!

interface GigabitEthernet0/27

trunk of the description and the port of A_2950_112 1

switchport trunk encapsulation dot1q

Shutdown

!

interface GigabitEthernet0/28

!

interface Vlan1

no ip address

Shutdown

!

interface Vlan9

IP 172.168.9.2 255.255.255.0

!

interface Vlan88

IP 172.168.88.254 255.255.255.0

!

interface Vlan199

IP 172.168.199.254 255.255.255.0

!

IP classless

IP route 0.0.0.0 0.0.0.0 172.168.9.1

IP route 172.168.88.0 255.255.255.0 172.168.9.1

IP route 172.168.100.0 255.255.255.0 172.168.9.1

IP route 172.168.200.0 255.255.255.0 172.168.9.1

IP http server

!

!

control plan

!

Banner motd ^ C is a private network. ^ C

!

Line con 0

line vty 0 4

opening of session

line vty 5 15

opening of session

!

end

Hi Robert,.

I went through the configuration on both the PIX firewall and see that trafficking is not defined for 172.168.88.0/24-->172.168.200.0/24.

If you check the card crypto a PIX configuration, it says:

address for correspondence outside_map 20 card crypto outside_cryptomap_20<--This acl="" defines="" interesting="">

and the outside_cryptomap_20 of the acl says:

access extensive list ip 172.168.9.0 outside_cryptomap_20 allow 255.255.255.0 172.168.200.0 255.255.255.0 connect

Is the same on the PIX B:

address for correspondence outside_map 20 card crypto outside_cryptomap_20

access extensive list ip 172.168.200.0 outside_cryptomap_20 allow 255.255.255.0 172.168.9.0 255.255.255.0

To allow users to talk to each other, apply to these commands:

On the PIX:

access extensive list ip 172.168.88.0 outside_cryptomap_20 allow 255.255.255.0 172.168.200.0 255.255.255.0

access extensive list ip 172.168.88.0 inside_nat0_outbound allow 255.255.255.0 172.168.200.0 255.255.255.0

and PIX B:

IP 172.168.200.0 allow access-list extended outside_cryptomap_20 255.255.255.0 172.168.88.0 255.255.255.0

access extensive list ip 172.168.200.0 inside_nat0_outbound allow 255.255.255.0 172.168.88.0 255.255.255.0

Let me know if it helps.

Thank you

Vishnu Sharma

ASA 5520: Remote VPN Clients cannot ping LAN, Internet

I've set up a few of them in my time, but I am confused with this one. Can I establish connect via VPN tunnel but I can't ping or go on the internet. I searched the forum for similar and found a little issues, but none of the fixes seem to match. I noticed a strange thing is when I run ipconfig/all of the vpn client, the IP address that has been leased over the Pool of the VPN is also the default gateway!

I have attached the config. Help, please.

Thank you!

Exemption of NAT ACL has not yet been applied.

NAT (inside) 0-list of access Inside_nat0_outbound

In addition, you have not split tunnel, not sure you were using internet ASA for the vpn client internet browsing.

You can also enable icmp inspection if you test in scathing:

Policy-map global_policy
class inspection_default

inspect the icmp

Hope that helps.

PIX501 customer VPN - cannot access inside the network with VPN Session

What follows is based on the config on the attached link:

http://www.Cisco.com/en/us/Partner/Tech/tk583/TK372/technologies_configuration_example09186a008009442e.shtml

PIX Ver 6.2 (3) - VPN Client 3.3.6(A) - Windows XP Client PC

We can establish the VPN to the PIX501 session, but we cannot access the network private behind the pix.

Here is the config - I can't determine why it does not work, we are desperate to get there as soon as POSSIBLE!

We have the same problem with the customer 4.0.3(c)

Thanks in advance for any help!

=======================================

AKCPIX00 # sh run

: Saved

:

6.2 (3) version PIX

ethernet0 nameif outside security0

nameif ethernet1 inside the security100

hostname AKCPIX00

domain.com domain name

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol they 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol 2000 skinny

fixup protocol sip udp 5060

names of

access-list 101 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

Outside 1500 MTU

Within 1500 MTU

external IP address #. #. #. # 255.255.240.0

IP address inside 192.168.1.5 255.255.255.0

alarm action IP verification of information

alarm action attack IP audit

IP local pool akcpool 10.0.0.1 - 10.0.0.10

history of PDM activate

ARP timeout 14400

Global 1 interface (outside)

(Inside) NAT 0-list of access 101

NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

Route outside 0.0.0.0 0.0.0.0 #. #. #. # 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

Timeout, uauth 0:05:00 absolute

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

AAA-server local LOCAL Protocol

the ssh LOCAL console AAA authentication

No snmp server location

No snmp Server contact

SNMP-Server Community public

No trap to activate snmp Server

enable floodguard

Permitted connection ipsec sysopt

No sysopt route dnat

Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

Crypto-map dynamic dynmap 10 transform-set RIGHT

map mymap 10-isakmp ipsec crypto dynamic dynmap

mymap outside crypto map interface

ISAKMP allows outside

part of pre authentication ISAKMP policy 10

encryption of ISAKMP policy 10

ISAKMP policy 10 md5 hash

10 2 ISAKMP policy group

ISAKMP life duration strategy 10 86400

vpngroup address akcpool pool akcgroup

vpngroup dns 192.168.1.10 Server akcgroup

vpngroup akcgroup by default-domain domain.com

vpngroup split tunnel 101 akcgroup

vpngroup idle 1800 akcgroup-time

vpngroup password akcgroup *.

vpngroup idle 1800 akc-time

Telnet timeout 5

SSH #. #. #. # 255.255.255.255 outside

SSH timeout 15

dhcpd address 192.168.1.100 - 192.168.1.130 inside

dhcpd dns 192.168.1.10

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd allow inside

Terminal width 80

Cryptochecksum:XXXXX

: end

AKCPIX00 #.

Config looks good - just as domestic mine to my local network. The only thing I can think is that you may have entered commands in the wrong order - which means, you could have isakmp or encryption before the config map was complete. Write memory, then reloading the pix is a way to reset everything. If you do not want downtime:

mymap outside crypto map interface

ISAKMP allows outside

Enter these two commands should be enough to reset the ipsec and isakmp.

Customer quick RV042 VPN cannot ping lan network

Similar Questions

Maybe you are looking for