DR/BC Site, SRM, SSO and AD authentication.

You don't know where to put this so feel free to move.

I'm in the midsts of test DR/BC at this time with machines reproducing SRM until our BC site. We have improved at 5.1.1a all levels and since arriving in SSO, we had our fair share of issues. Some we have solved but a particularly important is not being able to authenticate with our domain controller off site on the site of BC when pull us the plug on the metro line.

I can connect to the outside VC via the Web Client using normal references of our main site absolutely perfect, but when I change the LDAP authentication on the off-site DC via the SSO configuration as admin@system-domain page then I can not connect. I get "authentication failed".


I also noticed I 'could not initialize at startup services' and a message informing me about the installation of a vCenter Server system when I login. I am not convinced THAT SSO is configured correctly, even if we have reinstalled three times now.


bc_vc_sso.png


It's obviously an obstacle we have to overcome because if we cannot connect when pull us the plug between the sites to simulate a situation of DR/BC, then we cannot recover virtual machines.


Massive failure.

Problem solved.

Reinstalled one last time and this time a single site configuration. Rebooted everything, including the off-site DC and paid special attention to the Source of identity by using the editor attribute in ADUC to retrieve the DN for users and groups. I also changed the type of authentication to require a username and password and all went fine.

DR is to go.

Tags: VMware

Similar Questions

  • VPN Site to Site Secret shared and can co-exist RADIUS authenticated VPN?

    Hello

    I have a setup VPN site to site between two offices on 515Es PIX (v.6.2 software) and has recently added a vpngroup/shared secret based VPN remote access to one of the offices. Given that just forced me to add a number of different policies to my existing crypto card, it was a plant direct and easily implemented. For more security, I want to use a RADIUS server to give to each remote user their own connections and profiles rather than a group on all password is configured. To do this, however, it seems that I have to add the following additional commands to my existing crypto card:

    client configuration address map mymap crypto initiate

    client card crypto mymap RADIUS authentication

    These do not correspond to the policy number (my site-to-site is 10, and remote access policy is political 20), so I don't know what the effect would be if I added the. It would cause my connection from site to site for authentication RADIUS request (a very bad thing)? If so, do I need another interface to bind a new encryption card to? The answer to this would be greatly appreciated!

    Also, if anyone knows an example configuration for a similar configuration, I can look at, please let me know! Thank you.

    -A.Hsu

    For the site to site connection, you change line isakmp keys and add the parameters of "No.-xauth No.-config-mode" at the end of this one, which tells the PIX not to do the auth RADIUS or assign an IP address, etc. for the specific site-to-site tunnel.

    Example of config is here:

    http://www.Cisco.com/warp/public/110/37.html

    Note that there is no command options I have just said, I just sent an email to the web guys to fix this. Basically, your config will look with the options "No.-xauth No.-config-mode" on the line «isakmp x.x.x.x key...» "for LAN-to-LAN tunnel.

  • ASA (v9.1) VPN from Site to Site with IKEv2 and certificates CEP/NDE MS

    Hi all

    I am currently a problem with VPN Site to Site with IKEv2 and certifiactes as an authentication method.

    Here is the configuration:

    We have three locations with an any to any layer 2 connection. I created each ASA (ASA5510 worm 9.1) to establish one VPN of Site connection to the other for the other two places. Setting this up with pre shared keys and certificates that are signed by the CA MS administrator manually work correctly.

    But when we try to enroll these certificates through the Protocol, CEP/NDE his does not work.

    Here are my steps:

    1 configure the CA Turstpoint to apply to the certification authority

    2. request that the CA through the SCEP protocol works fine

    3. set up a Trustpoint and a pair of keys for the S2S - VPN connection

    4. registration form identity certificate CA via the SCEP Protocol with a one time password works fine

    5. set the trustpoint created as for the S2S - VPN IKEv2 authentication method.

    Now I did it also for the other site of the VPN Tunnel. But when I ping on a host that is on a different location to make appear the Tunnel VPN - the VPN session is not established. In the debugs I see that there are a few problems during authentication of the remote peer.

    On the MS that I see that the certifactes of identity for both ASAs are communicated and not revoked or pending state. The certificate based on the model of the "IPSec (Offline).

    When the CA-Admin and a certificate me manually based on a copy of the model of "Domaincontroller" connection is successfully established.

    So I would like to know which is the correct certificate for IP-Sec peers template to use for the Protocol, CEP and MS Enterprise CA (its server 2008R2 of Microsoft Enterprise)?

    Anyone done this before?

    ASA requires that the local and Remote certificate contains EKU IP Security Tunnel Endpoint (1.3.6.1.5.5.7.3.6) (aka IP Security Tunnel termination). You can create a Microsoft CA model to add.

    If you absolutely must go with the 'bad' cert, there is a command

    ignore-ipsec-keyusage

    but it is obsolete and not recommended.

    Meanwhile at the IETF:

    RFC 4809

    3.1.6.3 extended Key use

    Extended Key Usage (EKU) indications are not required.  The presence
    

    or lack of an EKU MUST NOT cause an implementation to fail an IKE
    

    connection.

  • VPN site to Site btw Pix535 and 2811 router, can't get to work

    Hi, everyone, I spent a few days doing a VPN site-to site between PIX535 and 2811 router but returned empty-handed, I followed the instructions here:

    http://www.Cisco.com/en/us/products/ps9422/products_configuration_example09186a0080b4ae61.shtml

    #1: config PIX:

    : Saved

    : Written by enable_15 to the 18:05:33.678 EDT Saturday, October 20, 2012

    !

    8.0 (4) version PIX

    !

    hostname pix535

    !

    interface GigabitEthernet0

    Description to cable-modem

    nameif outside

    security-level 0

    address IP X.X.138.132 255.255.255.0

    OSPF cost 10

    !

    interface GigabitEthernet1

    Description inside 10/16

    nameif inside

    security-level 100

    IP 10.1.1.254 255.255.0.0

    OSPF cost 10

    !

    outside_access_in of access allowed any ip an extended list

    access extensive list ip 10.1.0.0 inside_nat0_outbound allow 255.255.0.0 10.20.0.0 255.255.0.0

    inside_nat0_outbound list of allowed ip extended access all 10.1.1.192 255.255.255.248

    outside_cryptomap_dyn_60 list of allowed ip extended access all 10.1.1.192 255.255.255.248

    access extensive list ip 10.1.0.0 outside_1_cryptomap allow 255.255.0.0 10.20.0.0 255.255.0.0

    pager lines 24

    cnf-8-ip 10.1.1.192 mask - 10.1.1.199 IP local pool 255.255.0.0

    Global interface 10 (external)

    15 1.2.4.5 (outside) global

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 15 10.1.0.0 255.255.0.0

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 X.X.138.1 1

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA MD5-ESP-3DES ESP-DES-MD5

    life together - the association of security crypto dynamic-map outside_dyn_map 20 28800 seconds

    Crypto-map dynamic outside_dyn_map 20 kilobytes of life together - the association of safety 4608000

    Crypto-map dynamic outside_dyn_map 40 value transform-set ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA

    life together - the association of security crypto dynamic-map outside_dyn_map 40 28800 seconds

    Crypto-map dynamic outside_dyn_map 40 kilobytes of life together - the association of safety 4608000

    Dynamic crypto map outside_dyn_map 60 match address outside_cryptomap_dyn_60

    Crypto-map dynamic outside_dyn_map 60 value transform-set ESP-3DES-MD5 ESP-3DES-SHA ESP-DES-MD5 ESP-DES-SHA

    life together - the association of security crypto dynamic-map outside_dyn_map 60 28800 seconds

    Crypto-map dynamic outside_dyn_map 60 kilobytes of life together - the association of safety 4608000

    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-SHA-3DES ESP-MD5-3DES ESP-DES-SHA ESP-DES-MD5

    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define security association lifetime 28800 seconds

    cryptographic kilobytes 4608000 life of the set - the association of security of the 65535 SYSTEM_DEFAULT_CRYPTO_MAP of the dynamic-map

    card crypto outside_map 1 match address outside_1_cryptomap

    outside_map game 1 card crypto peer X.X.21.29

    card crypto outside_map 1 set of transformation-ESP-DES-SHA

    outside_map map 1 lifetime of security association set seconds 28800 crypto

    card crypto outside_map 1 set security-association life kilobytes 4608000

    outside_map card crypto 65534 isakmp ipsec dynamic SYSTEM_DEFAULT_CRYPTO_MAP

    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

    outside_map interface card crypto outside

    ISAKMP crypto identity hostname

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    the Encryption

    sha hash

    Group 1

    life 86400

    crypto ISAKMP policy 20

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP policy 65535

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Crypto isakmp nat-traversal 3600

    internal GroupPolicy1 group strategy

    cnf-vpn-cls group policy internal

    attributes of cnf-vpn-cls-group policy

    value of 10.1.1.7 WINS server

    value of 10.1.1.7 DNS server 10.1.1.205

    Protocol-tunnel-VPN IPSec l2tp ipsec

    field default value x.com

    sean U/h5bFVjXlIDx8BtqPFrQw password user name is nt encrypted

    IPSec-attributes tunnel-group DefaultRAGroup

    pre-shared-key secret1

    RADIUS-sdi-xauth

    tunnel-group DefaultRAGroup ppp-attributes

    ms-chap-v2 authentication

    tunnel-group cnf-vpn-cls type remote access

    tunnel-group global cnf-vpn-cls-attributes

    cnf-8-ip address pool

    Group Policy - by default-cnf-vpn-cls

    tunnel-group cnf-CC-vpn-ipsec-attributes

    pre-shared-key secret2

    ISAKMP ikev1-user authentication no

    tunnel-group cnf-vpn-cls ppp-attributes

    ms-chap-v2 authentication

    tunnel-group X.X.21.29 type ipsec-l2l

    IPSec-attributes tunnel-Group X.X.21.29

    Pre-shared key SECRET

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:9780edb09bc7debe147db1e7d52ec39c

    : end

    #2: 2811 router config:

    !

    ! Last configuration change to 09:15:32 PST Friday, October 19, 2012 by cnfla

    ! NVRAM config update at 13:45:03 PST Tuesday, October 16, 2012

    !

    version 12.4

    horodateurs service debug datetime msec

    Log service timestamps datetime msec

    no password encryption service

    !

    hostname THE-2800

    !

    !

    Crypto pki trustpoint TP-self-signed-1411740556

    enrollment selfsigned

    name of the object cn = IOS - Self - signed - certificate - 1411740556

    revocation checking no

    rsakeypair TP-self-signed-1411740556

    !

    !

    TP-self-signed-1411740556 crypto pki certificate chain

    certificate self-signed 01

    308201A 8 A0030201 02020101 3082023F 300 D 0609 2A 864886 F70D0101 04050030

    2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

    69666963 31343131 37343035 6174652D 3536301E 170 3132 31303136 32303435

    30335A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D

    4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 34313137 65642D

    34303535 3630819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101

    8100F75F F1BDAD9B DE9381FD 7EAF9685 CF15A317 165B 5188 1 B 424825 9C66AA28

    C990B2D3 D69A2F0F D745DB0E 2BB4995D 73415AC4 F01B2019 C4BCF9E0 84373199

    E599B86C 17DBDCE6 47EBE0E3 8DBC90B2 9B4E217A 87F04BF7 A182501E 24381019

    A61D2C05 5404DE88 DA2A1ADC A81B7F65 C318B697 7ED69DF1 2769E4C8 F3449B33

    010001A 3 67306530 1 130101 FF040530 030101FF 30120603 0F060355 35AF0203

    1104 B 0 300982 074C412D 32383030 551D 551 2304 18301680 14B56EEB 301F0603

    88054CCA BB8CF8E8 F44BFE2C B77954E1 52301 D 06 04160414 B56EEB88 03551D0E

    054CCABB 8CF8E8F4 4BFE2CB7 7954E152 300 D 0609 2A 864886 F70D0101 04050003

    81810056 58755 56 331294F8 BEC4FEBC 54879FF5 0FCC73D4 B964BA7A 07D 20452

    E7F40F42 8B 355015 77156C9F AAA45F9F 59CDD27F 89FE7560 F08D953B FC19FD2D

    310DA96E A5F3E83B 52D515F8 7B4C99CF 4CECC3F7 1A0D4909 BD08C373 50BB53CC

    659 4246 2CB7B79F 43D94D96 586F9103 9B4659B6 5C8DDE4F 7CC5FC68 C4AD197A 4EC322 C

    quit smoking

    !

    !

    !

    crypto ISAKMP policy 1

    preshared authentication

    ISAKMP crypto key address SECRET X.X.138.132 No.-xauth

    !

    !

    Crypto ipsec transform-set the-2800-trans-set esp - esp-sha-hmac

    !

    map 1 la-2800-ipsec policy ipsec-isakmp crypto

    ipsec vpn Description policy

    defined by peer X.X.138.132

    the transform-set the-2800-trans-set value

    match address 101

    !

    !

    !

    !

    !

    !

    interface FastEthernet0/0

    Description WAN side

    address IP X.X.216.29 255.255.255.248

    NAT outside IP

    IP virtual-reassembly

    automatic duplex

    automatic speed

    No cdp enable

    No mop enabled

    card crypto 2800-ipsec-policy

    !

    interface FastEthernet0/1

    Description side LAN

    IP 10.20.1.1 255.255.255.0

    IP nat inside

    IP virtual-reassembly

    full duplex

    automatic speed

    No mop enabled

    !

    IP nat inside source map route sheep interface FastEthernet0/0 overload

    access-list 10 permit X.X.138.132

    access-list 99 allow 64.236.96.53

    access-list 99 allow 98.82.1.202

    access list 101 remark vpn tunnerl acl

    Note access-list 101 category SDM_ACL = 4

    policy of access list 101 remark tunnel

    access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255

    access-list 110 deny ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255

    access-list 110 permit ip 10.20.0.0 0.0.0.255 any

    public RO SNMP-server community

    !

    !

    !

    sheep allowed 10 route map

    corresponds to the IP 110

    !

    !

    !

    !

    WebVPN gateway gateway_1

    IP address X.X.216.29 port 443

    SSL trustpoint TP-self-signed-1411740556

    development

    !

    WebVPN install svc flash:/webvpn/svc.pkg

    !

    WebVPN gateway-1 context

    title 'b '.

    secondary-color white

    color of the title #CCCC66

    text-color black

    SSL authentication check all

    !

    !

    policy_1 political group

    functions compatible svc

    SVC-pool of addresses "WebVPN-Pool."

    SVC Dungeon-client-installed

    SVC split include 10.20.0.0 255.255.0.0

    Group Policy - by default-policy_1

    Gateway gateway_1

    development

    !

    !

    end

    #3: test Pix to the router:


    ITS enabled: 1

    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

    Total SA IKE: 1

    1 peer IKE: X.X.21.29

    Type: user role: initiator

    Generate a new key: no State: MM_WAIT_MSG2

    > DEBUG:

    12:07:14 pix535:Oct 22 Oct 22 12:20:28 EDT: % PIX-vpn-3-713902: IP = X.X.21.29, Removing peer to peer table has not, no match
    !
    22 Oct 12:07:14 pix535: 22 Oct 12:20:28 EDT: % PIX-vpn-4-713903: IP = X.X.21.29, error: cannot delete PeerTblEntry
    #4: test the router to pix:
    LA - 2800 #sh crypto isakmp his
    IPv4 Crypto ISAKMP Security Association
    status of DST CBC State conn-id slot
    X.X.138.132 X.X.216.29 MM_KEY_EXCH 1017 ASSETS 0
    > debug
    LA - 2800 #ping 10.1.1.7 source 10.20.1.1
    Type to abort escape sequence.
    Send 5, echoes ICMP 100 bytes to 10.1.1.7, time-out is 2 seconds:
    Packet sent with a source address of 10.20.1.1
    Oct 22 16:24:33.945: ISAKMP: (0): profile of THE request is (NULL)
    22 Oct 16:24:33.945: ISAKMP: created a struct peer X.X.138.132, peer port 500
    22 Oct 16:24:33.945: ISAKMP: new created position = 0x488B25C8 peer_handle = 0 x 80000013
    22 Oct 16:24:33.945: ISAKMP: lock struct 0x488B25C8, refcount 1 to peer isakmp_initiator
    22 Oct 16:24:33.945: ISAKMP: 500 local port, remote port 500
    22 Oct 16:24:33.945: ISAKMP: set new node 0 to QM_IDLE
    22 Oct 16:24:33.945: ISAKMP: find a dup her to the tree during the isadb_insert his 487720 A 0 = call BVA
    22 Oct 16:24:33.945: ISAKMP: (0): cannot start aggressive mode, try the main mode.
    22 Oct 16:24:33.945: ISAKMP: (0): pair found pre-shared key matching 70.169.138.132
    Oct 22 16:24:33.945: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
    Oct 22 16:24:33.945: ISAKMP: (0): built the seller-07 ID NAT - t
    Oct 22 16:24:33.945: ISAKMP: (0): built of NAT - T of the seller-03 ID
    Oct 22 16:24:33.945: ISAKMP: (0): built the seller-02 ID NAT - t
    22 Oct 16:24:33.945: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    22 Oct 16:24:33.945: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1
    Oct 22 16:24:33.945: ISAKMP: (0): Beginner Main Mode Exchange
    Oct 22 16:24:33.945: ISAKMP: (0): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_NO_STATE
    22 Oct 16:24:33.945: ISAKMP: (0): sending a packet IPv4 IKE.
    22 Oct 16:24:34.049: ISAKMP (0:0): packet received dport 500 sport Global 500 (I) MM_NO_STATE X.X.138.132
    22 Oct 16:24:34.049: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    22 Oct 16:24:34.049: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2
    Oct 22 16:24:34.049: ISAKMP: (0): treatment ITS payload. Message ID = 0
    Oct 22 16:24:34.049: ISAKMP: (0): load useful vendor id of treatment
    Oct 22 16:24:34.049: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    Oct 22 16:24:34.049: ISAKMP: (0): provider ID is NAT - T v2
    Oct 22 16:24:34.049: ISAKMP: (0): load useful vendor id of treatment
    Oct 22 16:24:34.049: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
    22 Oct 16:24:34.053: ISAKMP: (0): pair found pre-shared key matching 70.169.138.132
    Oct 22 16:24:34.053: ISAKMP: (0): pre-shared key local found
    22 Oct 16:24:34.053: ISAKMP: analysis of the profiles for xauth...
    22 Oct 16:24:34.053: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
    22 Oct 16:24:34.053: ISAKMP: DES-CBC encryption
    22 Oct 16:24:34.053: ISAKMP: SHA hash
    22 Oct 16:24:34.053: ISAKMP: default group 1
    22 Oct 16:24:34.053: ISAKMP: pre-shared key auth
    22 Oct 16:24:34.053: ISAKMP: type of life in seconds
    22 Oct 16:24:34.053: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
    22 Oct 16:24:34.053: ISAKMP: (0): atts are acceptable
    . Next payload is 0
    22 Oct 16:24:34.053: ISAKMP: (0): Acceptable atts: real life: 0
    22 Oct 16:24:34.053: ISAKMP: (0): Acceptable atts:life: 0
    22 Oct 16:24:34.053: ISAKMP: (0): fill atts in his vpi_length:4
    22 Oct 16:24:34.053: ISAKMP: (0): fill atts in his life_in_seconds:86400
    22 Oct 16:24:34.053: ISAKMP: (0): return real life: 86400
    22 Oct 16:24:34.053: ISAKMP: (0): timer life Started: 86400.
    Oct 22 16:24:34.053: ISAKMP: (0): load useful vendor id of treatment
    Oct 22 16:24:34.053: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    Oct 22 16:24:34.053: ISAKMP: (0): provider ID is NAT - T v2
    Oct 22 16:24:34.053: ISAKMP: (0): load useful vendor id of treatment
    Oct 22 16:24:34.053: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
    22 Oct 16:24:34.053: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    22 Oct 16:24:34.053: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2
    Oct 22 16:24:34.057: ISAKMP: (0): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_SA_SETUP
    22 Oct 16:24:34.057: ISAKMP: (0): sending a packet IPv4 IKE.
    22 Oct 16:24:34.057: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    22 Oct 16:24:34.057: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3
    22 Oct 16:24:34.181: ISAKMP (0:0): packet received dport 500 sport Global 500 (I) MM_SA_SETUP X.X.138.132
    22 Oct 16:24:34.181: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    22 Oct 16:24:34.181: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4
    Oct 22 16:24:34.181: ISAKMP: (0): processing KE payload. Message ID = 0
    Oct 22 16:24:34.217: ISAKMP: (0): processing NONCE payload. Message ID = 0
    22 Oct 16:24:34.217: ISAKMP: (0): pre-shared key found peer corresponding to X.X.138.132
    Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment
    Oct 22 16:24:34.217: ISAKMP: (1018): provider ID is the unit
    Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment
    Oct 22 16:24:34.217: ISAKMP: (1018): provider ID seems the unit/DPD but major incompatibility of 55
    Oct 22 16:24:34.217: ISAKMP: (1018): provider ID is XAUTH
    Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment
    Oct 22 16:24:34.217: ISAKMP: (1018): addressing another box of IOS
    !
    Oct 22 16:24:34.221: ISAKMP: (1018): load useful vendor id of treatment
    22 Oct 16:24:34.221: ISAKMP: (1018): vendor ID seems the unit/DPD but hash mismatch
    22 Oct 16:24:34.221: ISAKMP: receives the payload type 20
    22 Oct 16:24:34.221: ISAKMP: receives the payload type 20
    22 Oct 16:24:34.221: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    22 Oct 16:24:34.221: ISAKMP: (1018): former State = new State IKE_I_MM4 = IKE_I_MM4
    22 Oct 16:24:34.221: ISAKMP: (1018): send initial contact
    22 Oct 16:24:34.221: ISAKMP: (1018): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
    22 Oct 16:24:34.221: ISAKMP (0:1018): payload ID
    next payload: 8
    type: 1
    address: X.X.216.29
    Protocol: 17
    Port: 500
    Length: 12
    22 Oct 16:24:34.221: ISAKMP: (1018): the total payload length: 12
    Oct 22 16:24:34.221: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
    22 Oct 16:24:34.221: ISAKMP: (1018): sending a packet IPv4 IKE.
    22 Oct 16:24:34.225: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    22 Oct 16:24:34.225: ISAKMP: (1018): former State = new State IKE_I_MM4 = IKE_I_MM5
    ...
    22 Oct 16:24:38.849: ISAKMP: (1017): purge the node 198554740
    22 Oct 16:24:38.849: ISAKMP: (1017): purge the node 812380002
    22 Oct 16:24:38.849: ISAKMP: (1017): purge node 773209335...
    Success rate is 0% (0/5)
    # THE-2800
    Oct 22 16:24:44.221: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
    22 Oct 16:24:44.221: ISAKMP (0:1018): increment the count of errors on his, try 1 5: retransmit the phase 1
    Oct 22 16:24:44.221: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
    Oct 22 16:24:44.221: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
    22 Oct 16:24:44.221: ISAKMP: (1018): sending a packet IPv4 IKE.
    22 Oct 16:24:44.317: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132
    Oct 22 16:24:44.317: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.
    Oct 22 16:24:44.321: ISAKMP: (1018): retransmission jumped to the stage 1 (time elapsed since the last transmission 96)
    22 Oct 16:24:48.849: ISAKMP: (1017): serving SA., his is 469BAD60, delme is 469BAD60
    22 Oct 16:24:52.313: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132
    Oct 22 16:24:52.313: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.
    Oct 22 16:24:52.313: ISAKMP: (1018): retransmission due to phase 1 of retransmission
    Oct 22 16:24:52.813: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
    22 Oct 16:24:52.813: ISAKMP (0:1018): increment the count of errors on his, try 2 of 5: retransmit the phase 1
    Oct 22 16:24:52.813: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
    Oct 22 16:24:52.813: ISAKMP: (1018): package X.X138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
    22 Oct 16:24:52.813: ISAKMP: (1018): sending a packet IPv4 IKE.
    Oct 22 16:24:52.913: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.
    Oct 22 16:24:52.913: ISAKMP: (1018): retransmission jumped to the stage 1 (time elapsed since the last transmission of 100)
    22 Oct 16:25:00.905: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132
    22 Oct 16:25:00.905: ISAKMP: node set 422447177 to QM_IDLE
    ....
    22 Oct 16:25:03.941: ISAKMP: (1018): SA is still budding. New application of ipsec in the annex
    . (local 1 X. X.216.29, remote X.X.138.132)
    22 Oct 16:25:03.941: ISAKMP: error during the processing of HIS application: failed to initialize SA
    22 Oct 16:25:03.941: ISAKMP: error while processing message KMI 0, error 2.
    Oct 22 16:25:12.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
    22 Oct 16:25:12.814: ISAKMP (0:1018): increment the count of errors on his, try 4 out 5: retransmit the phase 1
    Oct 22 16:25:12.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
    Oct 22 16:25:12.814: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
    22 Oct 16:25:12.814: ISAKMP: (1018): sending a packet IPv4 IKE.
    Oct 22 16:25:22.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
    22 Oct 16:25:22.814: ISAKMP (0:1018): increment the count of errors on his, try 5 of 5: retransmit the phase 1
    Oct 22 16:25:22.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
    Oct 22 16:25:22.814: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
    22 Oct 16:25:22.814: ISAKMP: (1018): sending a packet IPv4 IKE.
    Oct 22 16:25:32.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
    22 Oct 16:25:32.814: ISAKMP: (1018): peer does not paranoid KeepAlive.
    ......

    22 Oct 16:25:32.814: ISAKMP: (1018): removal of reason ITS status of 'Death by retransmission P1' (I) MM_KEY_EXCH (post 70.169.138.132)

    22 Oct 16:25:32.814: ISAKMP: (1018): removal of reason ITS status of 'Death by retransmission P1' (I) MM_KEY_EXCH (post 70.169.138.132)

    22 Oct 16:25:32.814: ISAKMP: Unlocking counterpart struct 0x488B25C8 for isadb_mark_sa_deleted(), count 0

    22 Oct 16:25:32.814: ISAKMP: delete peer node by peer_reap for X.X.138.132: 488B25C8

    22 Oct 16:25:32.814: ISAKMP: (1018): error suppression node 1112432180 FALSE reason 'IKE deleted.

    22 Oct 16:25:32.814: ISAKMP: (1018): error suppression node 422447177 FALSE reason 'IKE deleted.

    22 Oct 16:25:32.814: ISAKMP: (1018): node-278980615 error suppression FALSE reason 'IKE deleted.

    22 Oct 16:25:32.814: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

    22 Oct 16:25:32.814: ISAKMP: (1018): former State = new State IKE_I_MM5 = IKE_DEST_SA

    22 Oct 16:26:22.816: ISAKMP: (1018): purge the node 1112432180

    22 Oct 16:26:22.816: ISAKMP: (1018): purge the node 422447177

    22 Oct 16:26:22.816: ISAKMP: (1018): purge the node-278980615

    22 Oct 16:26:32.816: ISAKMP: (1018): serving SA., its A 487720, 0 =, delme = A 487720, 0

    The PIX is also used VPN client, such as the VPN Cicso 5.0 client access, works very well. Router is used as a server SSL VPN, too much work

    I know there are a lot of data here, I hope that these data may be useful for diagnostic purposes.

    All suggestions and tips are greatly appreciated.

    Sean

    Recommended action:

    On the PIX:

    no card crypto outside_map 1

    !

    crypto ISAKMP policy 5

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    !

    card crypto outside_map 10 correspondence address outside_1_cryptomap

    crypto outside_map 10 peer X.X.216.29 card game

    outside_map crypto 10 card value transform-set ESP-3DES-SHA

    life safety association set card crypto outside_map 10 28800 seconds

    card crypto outside_map 10 set security-association life kilobytes 4608000

    !

    tunnel-group X.X.216.29 type ipsec-l2l

    IPSec-attributes tunnel-Group X.X.216.29

    Pre-shared key SECRET

    !

    On the router:

    crypto ISAKMP policy 10

    preshared authentication

    Group 2

    3des encryption

    !

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    output

    !

    card 10 la-2800-ipsec policy ipsec-isakmp crypto

    ipsec vpn Description policy

    defined by peer X.X.138.132

    game of transformation-ESP-3DES-SHA

    match address 101

    !

    No crypto card-2800-ipsec-policy 1

    Let me know how it goes.

    Portu.

    Please note all useful posts

    Post edited by: Javier Portuguez

  • VCenter Mgmt and calculation with single SSO and related modes?

    I am a great vCAC environment design and want to separate not only Mgmt/Compute clusters, but also of the vCenters.   I want to be able to manage these inLinkedMode vCenter.  My plan is to have 2 vCenter VM and VM Web/asingleSSO.    When you install the two vCenters, I've just direct them to the server shared Web SSO, and then enableLinkedMode?

    Will this work?  Something else I'm missing?  AsingleWeb server instance will be able to manage multiple vCenters?

    Thank you

    -MattG

    Hello, MattG.

    Yes, you can use 1 SS and 1 service WebClient for "single-pane-of-view" for 2 vCenters, I did the same thing recently, and you need not related modes. Just point your SSO and Web when installing two vCenters. But in this case, you can manage both of them single point in the Web Client, no thick vSphere client. If you need to manage two of them only heavy customer too, then you should make the related modes, but in this case as far as I know, you must also install multi-site SSO, not simple SSO node. I use the first schema.

    Sorry for my bad English.

  • will be failover testing with success when the network between the site of protect and recover is broken

    Hi friends,

    When the network between the site of protect and recover is broken, will be the successful test SRM failover?

    Thank you.

    Hello

    There was a theme with exactly the same question, but I'm not.

    IIRC, the answer was: it depends on storage / Some SRA. of them need connectivity.

    Michael.

  • Creative cloud, Mac and Proxy authentication

    Hello good people,

    I'm in a bit of trouble with CC, Mac and the Proxy authentication.

    To download my Mac CC wonder password and username authentication proxy, which is enabled in the network, the advanced - settings HTTP proxy preferences . I am able to browse the web and access the Adobe creative web part.

    I used an open wireless connection to download CC and it worked.

    Now when I try to open it asks me to insert the password and user name for proxy.

    I have entered the credentials of well-known work, but the guest retains his return.

    I've seen other posts related to this, I wonder if anyone has found answers?

    Have you tried to add several sites of adobe in order to bypass the authentication proxy on the proxy server, but it did not work, either

    Any help is appreciated mucho!

    Hello

    I solved this.

  • How to open 2 sites on start and 1 Web site when you click the home button?

    How to open 2 sites on start and 1 Web site when you click the home button?

    You can change your shortcut on the desktop Firefox with two starting URLS. To try:

    • Shortcut on the desktop: right-click on the icon, choose Properties
    • Icon taskbar pinned: clic click right on the icon, right click in Mozilla Firefox, click on properties

    Windows normally selects the shortcut tab. If this is not the case, go ahead and click on the shortcut tab.

    You will see the target highlighted. On 64-bit Windows, which is usually either not less the following:

    "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

    For the specific shortcut launch pages, you can add them to the end, for example:

    "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -url "http://www.dilbert.com/" -url "http://www.gocomics.com/pearlsbeforeswine"

    After OK'ing the Properties dialog box, you can test everything right now to confirm that Firefox is now launching a window with tabs. Either:

    • Double-click the shortcut on the desktop
    • right click on taskbar icon pinned, click Mozilla Firefox

    Who do you want?

  • The Bank site requires Java and they say that you no longer support it.

    The Bank site requires Java and they say that you no longer support it. Now, I have to use IE which I really dislike.

    How about you to reconsider your decision in the light of the inconvenience it has caused to your users?

    Your System details list shows the Java plugin.

    • Next-generation Java plug-in 11.45.2 for Mozilla browsers

    It is not the latest version of Java and can be blocked by Firefox.

    You can find the latest version of Java 32 bits for Firefox here:

  • How you stay connected on my accounts on sites like reddit and gmail? I changed my settings to allow cookies, but I still need to login each time.

    How you stay connected on my accounts on sites like reddit and gmail? I changed my settings to allow cookies, but I still need to login each time.

    Websites to remember you and automatically log you in are stored in a cookie.

    • Create a cookie exception permit to keep such cookies, especially for sites Web secure and if the cookies expire when Firefox is closed.
    • Tools > Options > privacy > Cookies: Exceptions

    In case you use "clear history of Firefox closing:

    • do not delete Cookies
    • do not delete Site preferences

    Note that compensation "Preferences of Site" clears all exceptions for cookies, images, windows pop up, installation of software and passwords.

    Deletion of cookies will delete all specified (selected) cookies, including cookies with an exception to allow.

  • I have Firfox 18.0.1. On a single Web site my usercode and password entries are considered not valid. The same words and password work fine in IE and Google.

    On a single Web site my usercode and password entries are considered not valid. The same words and password work fine in IE and Google.

    I found that my Norton Toolbar had been disabled so I enabled it. When I tried the site it worked. Go figure.

  • Several sites, including gmail and all of myspace, recommend that upgrade to the latest version of my browser in order to enjoy a betetr experience.

    Several sites, including gmail and all of myspace, recommend that upgrade to the latest version of my browser in order to enjoy a betetr experience. Seems that these sites will not recognize that I am under firefox 10.0.2, these sites work fine in chrome, but not firefox.

    Message on the gmail website:
    A few important features may not work in this version of your browser, if you have been directed to the basic HTML version.

    Message on myspace:
    Upgrade your browser for a better experience of Myspace.

    Can you try to reset your useragent parameter? Instruction can be found here, see the statement of Helper7677 3rd

  • Have Windows 7 running on Parallels Desktop with a Mac. Get "setup.exe is not a valid Win32 application" when trying to download a program with Windows Explorer. I can download from these sites with Vista and XP with other computers.

    Have Windows 7 running on Parallels Desktop with a Mac. Get "setup.exe is not a valid Win32 application" when trying to download a program with Windows Explorer. I can download from these sites with Vista and XP with other computers. Now, I can't download the programs that are supposed to solve the problem! including FoxFire

    Try to download from this site:

  • When you use Firefox, a site jumped upward and said it is Firefox search virus. He said then I got dangerous viruses and need to download a security program. It's for real? The site is update32.escmce.ce.ms

    When you use Firefox, a site jumped upward and said it is Firefox search virus. He said then I got dangerous viruses and need to download a security program. It's for real? The site has been update32.escmce.ce.ms I googled this site and it does not exist. Now, I'm worried about security on my computer.

    Sounds very similar to what I had come last week. I did not now what the site was, but I noticed that the box seems to be analysis what were the Windows system files, it could not have been real. I do not download anything either, and I think that if you have not then you are probably safe. I am far from being an expert in the field and am sure that someone with more expertise will also. I learned that the best thing to do is vacuum history of cache, cookies and remove and close the browser. Don't try not even close the box that I have read. I don't know if I did or not. I think that there is some nasty things circulating right now try to deceive us in their installation on our Macs. I agree that it's a very scary experience. I was shaking when it first happened to me.

  • It might make me totally distracted, but in the password protocol, it seems all sites want one and then somehow I've now changed my passwords?

    Hello

    It might make me totally distracted, but in the password protocol, it seems all sites want one and then somehow I've now changed my passwords? IE: Google, Microsoft...

    Some people say that I need only a pswd for all sites?

    Some say all change every month... you, the experts say?

    Thank you

    Hello

    One of the worst things you can do with passwords is to have the same password for everything. For example, someone like a hacker finds your password by e-mail. You can use the e-mail address as username for several things, such as the online stores, financial sites, etc.. Once they know this address combination and e-mail password works on a single site, hackers can try on many popular sites. You are then not only your email hacked, but a lot of things.

    There are more tips here:

    http://www.microsoft.com/en-GB/security/online-privacy/passwords-create.aspx .

Maybe you are looking for