DMVPN router behind a firewall

Similar Questions

• DMVPN router behind ASA - need help please.

  Hello

  After reading many other discussions on this topic, it appears with the correct IOS and NAT - T active router, you bring up DMVPN behind a NAT device.

  I tried to perform this task, but I can not even phase 1 going to the DMVPN. The routing was checked and I can ping the routers DMVPN public IP. I'm sure that the configurations for routers are good, but asked if any additional NAT is required on the ASA.

  Here is the topology:

  Plate rotating DMVPN > ASA > Internet > ASA > DMVPN Branch

  The SAA on the side of the hub is in our data center and in production with several site-to-site and traffic to DMZ. Devices DMVPN is a Cisco 2921 and 1921. When I run a "debug crypto isakmp" on both routers, I see ISAKMP messages are sent on the branch DMVPN router. Nothing in the hub and no hits on the ASA ACL. I tried both the public IP address and the private IP address of the ACL on the ASA.

  I have attached the relevant training and can post more if necessary.

  Thank you

  Brandon

  Hello

  I finally had time to laboratory it.

  I used this topology:

  I have

  DMVPN - nat.png

  

  ASA (config) # sh run nat
  NAT (INSIDE, OUTSIDE) static source HUB-ROUTER-REAL-IP interface service udp-eq-4500 udp-eq-4500
  NAT (INSIDE, OUTSIDE) static source HUB-ROUTER-REAL-IP interface service udp-eq-500 udp-eq-500
  !
  object network HUB
  dynamic NAT interface (INSIDE, OUTSIDE)

  ASA (config) # sh run access-list
  extended OUTSIDE permitted udp access list any HUB-ROUTER-REAL-IP eq isakmp object
  list access extended OUTSIDE permitted udp any eq HUB-ROUTER-REAL-IP 4500

  R2 #sh run inter t0

  interface Tunnel0
  172.16.0.1 IP address 255.255.255.0
  no ip redirection
  no ip next-hop-self eigrp 1
  no ip split horizon eigrp 1
  dynamic multicast of IP PNDH map
  PNDH id network IP-99
  source of tunnel FastEthernet0/0
  multipoint gre tunnel mode
  tunnel key 100000
  Tunnel ipsec DMVPN-IPSEC-PROFILE protection profile

  So it should be the same configuration that you use.

  The only thing is that I had to ' stop/no shut' tunnel interface and removing some config that I also need to clear the connection on the ASA using "clear conn."

  R2 #sh dmvpn
  Legend: Attrb--> S - static, D - dynamic, I - incomplete
  Local N - using a NAT, L-, X - no Socket
  # Ent--> entries number of the PNDH with same counterpart NBMA
  State of the NHS: E--> RSVPs, R--> answer, W--> waiting
  UpDn time--> upward or down time for a Tunnel
  ==========================================================================

  Interface: Tunnel0, IPv4 PNDH details
  Type: hub, PNDH peers: 2,.

  # Ent Peer NBMA Peer Tunnel Addr add State UpDn Tm Attrb
  ----- --------------- --------------- ----- -------- -----
  1 200.20.0.10 172.16.0.2 UNTIL 00:11:28
  1 200.30.0.10 172.16.0.3 AT 00:11:22

  R2 #.

• It is possible to configure router CISCO1921/K9 from site to Site vpn behind a firewall?

  I am looking to buy CISCO1921/K9 to configure vpn site to site with Amazon VPN. We are behind a firewall. I try to install the new CISCO1921/K9 router according to the scheme of quick text below. My setup work? and what are the ports will it transfer to my firewall?

  INTERNET--> Modem to ISP---> firewall - CISCO1921/K9

  Hi Paul,.

  (192.168.1.0/24) - router (10.1.1.1)-(10.1.1.2) firewall(81.92.61.x/27)---Internet

  The configuration is very simple...

  1. There will be no modifications on the configuration of the VPN router with the exception that the interface of the router (turning to the firewall) will be to have private IP 10.1.1.1

  2. you will need to take a public IP of your range of public (e.g. 81.92.61.2) and will share the same to your remote location which they set up as peers IP to their end.

  3. now you have to configure 2 NAT type on your firewall.

  NAT source:-when your router will initiate VPN

  Before NAT: Destination - Source 10.1.1.1-(homologous remote IP)

  After NAT: Destination - Source 81.92.61.2-(homologous remote IP)

  Destination NAT:-when the remote location will launch the VPN

  before NAT: Destination - Source (remote peer IP)-(81.92.61.2)

  After NAT: Destination - Source (remote peer IP)-(10.1.1.1)

  I hope this is clear :)

• Will be - this safe to use XP behind a firewall after the end of LIFE?

  I have a netbook that I use as an external 1 TB NAS with a hard drive device on my LAN.  I use it also for connection of MagicJack.  I have a firewall in my router and the only thing that that accesses this machine online is updated antivirus and places / receives calls from Magic Jack.  I don't respect the minimum specifications for Windows 7.

  If I keep this machine behind the firewall and prevent web access, it will be safe to stay with XP after the end of life?  MagicJack is a security breach?  My only other option is to switch to a Linux distribution, but I need to configure to run on a Windows network and it seems that you have to do back flips to get the MagicJack to work on Linux.
  Any advice will be appreciated.

  End of the security updates is something much more...

  antivirus support, but again, you are not protected completely...
  http://answers.Microsoft.com/en-us/protect/Forum/protect_other-protect_updating/Microsoft-will-continue-to-provide-updates-to-our/3ecaa09a-Abda-44f7-BCE3-91375c47b325

• Use Virtual Cener behind a firewall - high security

  OK, 2 ESX servers are connected behind a firewall. My VC/VIM is a virtual machine on the second ESX host. I installed VC on the virtual machine and was able to connect to it very well. Virtual Infrastructure Client connects to the server VC/VIM. When I try to add one of the ESX servers to my new 'Datacener' I go through the guests of identification and so on. I get to the point where it gives me a list of all the VMS on the server, then click on the "Finish" button and I get an error...

  "Failed to connect to host".

  Keep in mind here that the ESX what IP console is on another segment of the VC/VM.

  Any ideas on what prevents traffic? Appropriate for VIC to work ports are correct. Did I miss a port somewhere?

  Thank you

  How is the routing between the n/w for the n/w VM Console? It is a layer 3 with intravLAN active routing switch or go you through a router? can you run a scan of the virtual machine on the ESX server console IP port and see what all the ports are open. I doubt if the VMware-vpxa agent is installing on the ESX Server.

  You can manually copy the installation script for the VPXagent on the ESX Server and start the installation manually. Check if the connected ESX Server getts now.

  -Surya

• ACS 4.0 behind a firewall

  Hi, we have an ACS 4.0 behind a firewall...

  I want to know what are the ports that must be open beyond 2002 to end of remote connection... ?

  Any idea... ?

  Hello

  ACS is accessible via tcp, 2002, for the initial connection. For subsequent access (moving from one page to the other), it will be used at random ports 2003 or higher (tcp).

  To access this box remotely, you must open a range of ports, for example-> 3500 2002 or 2002-> 5000. PLS, be careful when you specify the range, as too many ports allowed ports COULD present a risk to your ACS server.

  example:

  list of access outside the range of allowed hosts 2002 5000 tcp

  Hope this helps.

  Rgds,

  AK

• Monitoring of the BONE located behind a firewall

  We must monitor the infrastructure of the operating system on our web servers. These servers are locked for NIS accounts SSH connections, but we can configure a local user with permissions of SSH to a remote agent.

  If we wanted to install a Manager agent on that server instead, is anyway to configure agent manager so that the data is only collected in a survey of the FMS, rather than pushing for the https port 8443 on network internal? Basically, do the transfer information officer Manager of a 'pull' instead of a 'push '.

  Or y at - it a way to get this information to the FMS server internal without opening a two-way port, or not allowing a connection on one direction to be open?

  Or the bottom line here - what is the accepted best practice to create a secure communication information of OS of DMZ servers behind a firewall of SGF?

  Unfortunately, it is currently the only solution.

  In the next major release, we'll add a feature where you can enable reverse-vote for Manager of the specific agent. Those who would be interviewed by the FMS instead of pushing their data and the connection will always be initialized by the FMS.

  This will reverse the direction of the connection and the FMS now needs to open a connection in the demilitarized zone. This will remove the requirement to open an outgoing socket of the DMZ to the host of the FMS.

  Stefan

• Difference b/w PIX & router (router with the firewall option)

  Hi all

  I want to know that how we can differ with router (router with the firewall option) PIX bcz can also make Staefull packet filtering. What PIX device that reviewed by the customer to use PIX of the router.

  Thank you best regards &,.

  Guelma

  Hello

  There is a discussion in this forum on this topic; Check "Firewalling: PIX vs IOS Firewall" last conversation was released January 10, 2006. Let me know if it helps.

  Rgrds,

  Haitham

• Tunnel of speaks of talking DMVPN routing via hub

  I have a DMVPN network with several linked sites and everything works fine, with one exception. Two sites (which can connect spoke to speak perfectly well to all other spoke routers in the network) can not directly connect and route the traffic through the hub. Routing tables (EIGRP) you will see the routes are properly being announced, however see the PNDH ip indicates the following

  Router 1 (spoke router initiateing the connection)

  10.31.248.246/32 by 10.31.248.246, created Tunnel10 00:00:25, expire 00:09:34

  Type: dynamic, flags: implicit router

  The NBMA Address: * address of Router 2 *.

  (non-socket)

  2 router (router talk recipient)

  10.31.248.244/32 via 10.31.248.244

  Tunnel10 created at 00:01:53, expire 00:01:12

  Type: dynamic, flags: temporary

  The NBMA Address: * address of our server DMVPN router *.

  Any help to fix this would be extremely appreciated because the two offices are in Asia and our server router is the United States which means a round-trip time which should be approximately 50 ms between those offices is actually taking more than 400 ms

  Hello

  What happens, is that ROUTER1 already resolved correctly ROUTER2 via PNDH, but for some reason any cannot establish IPsec to send a response of PNDH to Router 2.

  Can you check if ISAKMP/IPsec between these two routers trying to establish when you ping from one side to the other? My guess is you'll see MM_NO_STATE ;-)

  M.

• SX10 - how to access the web interface behind a firewall

  Howdy

  I have a very simple configuration, router and behind her SX10. I can't access the web interface of the remote unit. Is there a port that I need to activate or something?

  When the device was connected directly to the modem, with the public IP address, I was able to connect to the web interface.

  any suggestions here?

  I enter anything in the field AllowRemote.

  Thanks in advance!

  Web interface can be accessed using HTTP ether (80) or HTTPS (443).  To you how you want to deploy, but you can use NAT on the router, port forwarding, or even put the SX10 in DMZ on the router.

• Device behind a Firewall other, ASA VPN

  I have a client who wants to put their VPN / behind the ASA ASA main connected to the Internet.  Both devices have an inside leg for the internal network, but the ASA VPN connects directly to the Internet ASA.

  Topology:

  Outisde FW: Internet transfer Procedure > ASA/FW > leg DMZ to ASA/VPN

  ASA VPN: Outside the L3 Interface interface DMZ of ASA/FW link

  On the outside NAT FW I would be the external address of the VPN / ASA outside the public IP address is available and I have a rule that allows all IP from outside to outside the private IP VPN.  Inside = 192.168.254.1 outside = public IP address.

  Configured on the VPN / ASA, ASA standard SSL Remote Access.

  When I hit the NAT public IP address, nothing happens.  I've run packet - trace on the FW outside, and everything seems good.

  Someone at - it a sampling plan / config for a similar topology?     Internet > ASA/FW > dmz-leg > ASA/VPN

  Thanks in advance,
  Bob

  Can share you your NAT and routing configuration? Of these two ASAs

• Should I block icmp on my edge router or my firewall?

  Originally, we were blocking icmp on our border router traffic (2811), but recently we changed this block on the firewall (ASA) instead. I have been informed that blocking on the router would cause too much overhead on the router, since it is now seen to inspect all traffic, and the firewall was better equipped for this.

  What is the standard of the industry? Cisco recommend that?

  Something like that, although I recommend you this announcement on the forum of firewall for confirmation.

  ! refuse the Fragments non-initial ICMP

  access-list 101 deny icmp any any fragment

  ! permit messages "dest unreachable."

  access-list 101 permit icmp any 3

  ! allow the message "time exceeded".

  access-list 101 permit icmp any any 11

  ! allow the message "source quench"

  access-list 101 permit icmp any 4

  ! license problem message "parameter.

  access-list 101 permit icmp any any 12

  ! allow "echo reply" messages

  access-list 101 permit icmp any any 0

  ! refuse all other icmp

  access-list 101 deny icmp a whole

  You could consider strengthening the unreachable destination too. They should look like this for each type and code that you want to allow:

  ! allow messages 'dest unreach - unreach port.

  Acccess-list 101 permit icmp any any 3 of 3

  See here:

  http://www.IANA.org/assignments/ICMP-parameters

• Place a FIOS for VPN router behind PIX 501

  I have a Verizon FIOS internet connection and one of their routers wide wireless broadband, and this is a configuration of base completely... their router DHCP and firewalls, and the connection has a dynamic address.  I would put the PIX 501 behind the Verizon router as one of its clients and make the VPN PIX of other PIX 501 at other locations, such as my entire network has access to remote networks.

  Is this possible, and if yes, any who could some suggest configurations (how to address internal and external, static routes ports that may be required somewhere, etc.)?

  Thanks for any help.

  When installing my FiOS, I had already asked that it be installed on the Ethernet cable. Don't know they need to do something for you to spend the coax to Ethernet.

  The best way to test it would be to find the Media Converter (follow the coaxial cable between your FiOS router to the demarc and there should be a box with a coaxial port, some phone Sockets and an Ethernet port). If you unplug the coaxial cable and plug a laptop computer on the Ethernet port, see if your laptop takes a public IP address. If Yes, then you just have to run to your PIX501 Ethernet cable and you should be ready.

  Just to note that Verizon, according to your region, reserved DHCP assignments. This means that you may need to call Verizon and ask them to release the previous assignment of DHCP-MAC addresses. I had this happen recently. They must release the assignment then your PIX will pull a new IP address and they will book your new IP - MAC address assignment. They do this to speed up the connection to a cold start time on the router.

  Basically, they are filtering by MAC address, but rather through a sticky ARP where they clear the entry, and then the next device that connects records his MAC address and then only that device is permitted to connect to this leg of the cable. So there is a bit of work you have to do, but the most difficult part would be sitting on hold waiting for a tech, if you call to Verizon.

• How one not acquire Modules for ffx installed behind the firewall?

  I have several installations of firefox on platforms behind several firewalls without internet access. They are maintained to easily access LAN servers, containing notes/logs, etc.. I used several addons, more precisely the all-in-One sidebar for several years. However the current addon page to automatically install the active browser rather than provide a download I can migrate to other browsers. Info in the text below is a MSW platform, but also have many * nix installs that I would like to support.

  Question - how does a download and NOT ask on an active browser, but rather migrate to other facilities in offline mode.

  Hello, when I right click on the button Add to firefox on https://addons.mozilla.org/en-US/firefox/addon/all-in-one-sidebar/ and select Save link under , then as the addon file will be downloaded which could then be transferred to the other pc without internet access.

• Invisible router 'behind' the time Capsule

  Hej there.

  technical question, I don't know why it works like this.

  our network configuration looks like:

  1 - modem DSL (free WIFI), working as router and DHCP in the network (192.168.1.1)

  2 Time Capsule is connected to the Modem DSL-(via the WAN Port of the TC) and works as the Apple-WLAN for all wireless devices. In Mode "Bridge".

  All WLAN devices are connected to the WLAN Time Capsule.

  Question / problem:

  Why I am not able to communicate with a wireless device connected to the WLAN Time Capsule for the DSL Modem using a browser and open the Web of the DSL Modem interface to 192.168.1.1. ?

  Any ideas what is wrong? Thank you for your support

  Question / problem:

  Why I am not able to communicate with a wireless device connected to the WLAN Time Capsule for the DSL Modem using a browser and open the Web of the DSL Modem interface to 192.168.1.1. ?

  What IP address is your computer?

  Your computer MUST be the IP address 192.168.1.x (x is a number between 2-254)

  Please open your airport utility... Click on the TC so that it displays the summary and page after the screenshot of it.

  What model is your TC?

  (I can get this info from the screenshot if you post at least for what I need).

  It seems that some questions may arise.

  Could also contribute to a screenshot of the IP configuration on the computer.

  You enabled IPv6 link-local only?

  A bridge TC may have problems of routing on the WAN port when filled... Since your TC is filled please connect the modem to the LAN of TC port instead of the WAN port... Restart both routers + computer and tell me if this solves the problem.