E4200 (v1.0.05) IPSec problem

Similar Questions

• LRT224 with IPSEC problem - not

  Hi, I have the following router Linksys LRT224.

  I want to configure the IPSEC tunnel (by user or group).

  The OpenVpn works great for users, but it is limited to 5! That's why I want more Tunnel VPN.

  Then I configured the IPSEC tunnel and I connect very well either in the Tunnel, the VPN group.

  The problem is:

  -The client cannot ping of the network

  -LRT224 /VPN:

  Synthesis of information, always check pending connection to the Tunnel and the Client IPSEC (Schrew) is well served, the newspaper I (c2gips1) [2] IP:660 #61: [created Tunnel] ISAKMP Security Association established

  -When I use the VPN group, I see the customer connected, but I couldn't ping from the client to the network router/subnet and vice versa

  In advanced routing, I can see the IP address of the connected client...

  I also use the doc http://support.linksys.com/en-eu/support/business/LRT224 ...

  in the configuration of VPN network schrew, I put:

  Auto Config: Disabled and use an existing adapter and current address

  Please let me know... help! Thank you

  I have done some testing and think it's great. With this feature, you can have a 45 addition VPN tunnels as you mention. I tested with two devices connected at the same time as different IPSec tunnels and the two were able to ping on the Remote LAN devices.

  Material used:

  1. LRT224
  2. Windows 7 x 64 Desktop
  3. HP Jet 7 Tablet
  4. LAPN300
  5. Galaxy S4

  VPN client:

  1. Client VPN Shew app for Windows
  2. Show me how instructions

  LRT224 VPN Client for the Configuration of the gateway:

  

  Shew VPN Client configuration:

  

  

  

  

  

  

  

  

  

  

• Routing IPSec problem?

  Hi all. I have a problem with an IPSec tunnel that I am trying to create between two sites. Transformations and pre-shared keys have been configured, and the tunnel came briefly last night. The problem is that I can't ping across the tunnel's private network. I send a ping and it shuts the public rather than be encrypted in the tunnel. Both sides are using rfc1918 address... but those different spaces therefore routing should not be a problem in this regard. I specify interesting traffic for IPSec using one as follows:

  IPSEC extended access list

  IP 172.16.86.0 allow 0.0.0.255 192.168.0.0 0.0.255.255

  refuse an entire ip

  and the card encryption uses "corresponds to the address IPSEC."

  The ACL IPSEC shows no match. Someone at - it ideas? Thank you.

  It seems that the order of the two lines in the access list 111 is back. Because the first line is more general than the second, the other will never get used and you'll always have NAT traffic to your 172.16.86.0 hosts, even if the traffic is destined for an 192.168 address through the VPN. Swap the two lines, and I bet it'll start working.

  Note that you must be careful when you make changes to an ACL used for NAT and VPN, since the withdrawal of such a list is equivalent to "license ip any any" cause by you be disconnected and locked out of the router, if you are remotely. It is safer to remove NAT and/or the card encryption interface in question before making changes to a remote router.

  HTH - good luck!

• Subnet VPN IPSec problem

  Hello

  I am configuring site to site connection using the pre-shared key VPN. The VPN connection is getting up and running, but I'm having problems on information routing between subnets.

  Our subnet is 192.168.1.0 and we cannot use that subnet for VPN. Because of this, we use 10.240.86.33 for are created the IPSec traffic and destination network (PC) is on 164.2.107.56.

  We cannot connect to the 164.2.107.56 computer network, can someone help us acomplishing this \windows\system32\conifg\system?

  Our configuration is below:

  interface FastEthernet0/0
  Description $FW_OUTSIDE$
  IP 200.111.XXX.XXX 255.255.255.248
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NBAR IP protocol discovery
  NAT outside IP
  IP virtual-reassembly
  route IP cache flow
  automatic duplex
  automatic speed
  No mop enabled
  map SDM_CMAP_1 crypto
  service-policy output SDM-QoS-policy-1
  !
  interface FastEthernet0/1
  Description $ES_LAN$ $FW_INSIDE$
  IP 192.168.1.1 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly
  route IP cache flow
  automatic duplex
  automatic speed
  No mop enabled
  !
  Router eigrp 1
  10.0.0.0 network
  network 192.168.1.0
  No Auto-resume
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 200.111.XXX.XXX 2
  !
  !
  IP http server
  no ip http secure server
  IP nat pool INTERNET 200.111.XXX.XXX 200.111.XXX.XXX netmask 255.255.255.248
  overload INTERNET IP nat inside source map route SHEEP pool
  IP nat inside source static 192.168.1.0 network 164.2.107.0/24
  IP nat inside source 192.168.1.104 static 200.111.XXX.XXX
  IP NAT outside source static network 10.240.86.0 192.168.1.0/24
  !
  recording of debug trap
  access-list 10 permit 192.168.1.0 0.0.0.255
  access-list 15 allow 200.6.103.241
  access-list 15 permit 192.168.1.0 0.0.0.255
  Access-list 100 = 4 SDM_ACL category note
  Note access-list 100 IPSec rule
  access-list 100 permit ip 10.240.86.0 0.0.0.255 164.2.107.56 0.0.0.1
  not run cdp
  !
  !
  SHEEP allowed 10 route map
  corresponds to the IP 10
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 150
  !
  !
  !

  Hello

  It is the router that ends the VPN tunnel? (I don't see the VPN configuration).

  Since you can't use your real address LAN, you need to NAT before you send the traffic through the tunnel.

  First, you apply the NAT rule to translate 192.168.1.0/24 to 10.240.86.33 when you go to 164.2.107.56

  NAT 192.168.1.0 ip access list allow 0.0.0.255 host 164.2.107.56

  NAT route map

  corresponds to the IP NAT

  IP pool local VPNPool 10.240.86.33 10.240.86.33

  IP nat inside source overload map route NAT pool VPNPool

  Next, you create the ACL list for interesting traffic to address coordinated at the address of the site to another

  VPN ip host 10.240.86.33 access list permit 164.2.107.56

  We will see the results.

  Federico.

• HSRP with GRE ipsec problems

  I have the following scenario to connect my main HQ with other directorates:

  Two routers HQ and work by their internal Giga HSRP interface and use WAN connections by serial interfaces to create VPN site-to-site with other branches using GRE over ipsec.

  I need to know is - right configuration or there is another way to do.

  the following sample configuration on both active and standby routers and router for branch

  Active router

  ISAKMP crypto key password address 172.18.x.x

  Crypto ipsec transform-set aes aes - esp esp-sha-hmac

  Crypto card secure ipsec-isakmp 13
  the value of 172.18.x.x peer
  Set transform-set aes
  match address 101

  interface Tunnel3
  Description branch01
  IP 10.100.30.1 255.255.255.0
  KeepAlive 10 3
  source 10.100.0.x tunnel
  destination 172.18.x.x tunnel
  secure cryptographic card

  interface GigabitEthernet0/0
  IP 10.100.0.y 255.255.255.0
  automatic duplex
  automatic speed
  Watch 1 ip 10.100.0.x
  1 standby preempt

  point-to-point interface Serial0/0/0.16
  IP address 172.20.x.x 255.255.255.252

  secure cryptographic card

  access-list 101 permit will host 10.100.0.x host 172.18.x.x

  Standby router

  ISAKMP crypto key password address 172.18.x.x

  Crypto ipsec transform-set aes aes - esp esp-sha-hmac

  Crypto card secure ipsec-isakmp 13
  the value of 172.18.x.x peer
  Set transform-set aes
  match address 101

  interface Tunnel3
  Description branch01
  IP 10.100.30.3 255.255.255.0
  KeepAlive 10 3
  source 10.100.0.x tunnel
  destination 172.18.x.x tunnel
  secure cryptographic card

  interface GigabitEthernet0/0
  IP 10.100.0.z 255.255.255.0
  automatic duplex
  automatic speed
  Watch 1 ip 10.100.0.x
  1 standby preempt

  point-to-point interface Serial0/0/0.16

  IP address 172.19.x.x 255.255.255.252

  secure cryptographic card

  access-list 101 permit will host 10.100.0.x host 172.18.x.x

  Branch router

  ISAKMP crypto key password address 172.20.x.x
  ISAKMP crypto key password address 172.19.x.x
  ISAKMP crypto key password address 10.100.0.x

  Crypto ipsec transform-set aes aes - esp esp-sha-hmac

  Crypto card secure ipsec-isakmp 13
  the value of 172.19.x.x peer
  the value of 172.20.x.x peer
  Set transform-set aes
  match address 101

  interface Tunnel3
  Description branch01
  IP 10.100.30.3 255.255.255.0
  KeepAlive 10 3
  tunnel source 172.18.x.x
  destination of the 10.100.0.x tunnel
  secure cryptographic card

  point-to-point interface Serial0/0/0.16
  IP address 172.18.x.x 255.255.255.252
  secure cryptographic card

  access-list 101 permit will host 172.18.x.x host 10.100.0.x

  I had lots of massages of error with active or standby router and all the VPN settings are correct to the routers of the AC and branches

  % CRYPTO-6-IKMP_MODE_FAILURE: the mode of information processing failed with the peer to 172.18.x.x

  In your current design, I can see HSRP used to provide evacuation route VPN HA outwards.  IPSec plan HA, HSRP is usually deployed when the Wan is attached Ethernet.  In this case, we can build the tunnel using the virtual address HSRP giving a permanent IP address.  The problem with your design, is that to reach the HSRP virtual IP address, you must cross a single hosted serial interface. If this interface is unsuccessful or if there is a problem in the path routed between cryptographic peer, you will never be able to reach the HSRP virtual IP address so the resulting solution will fail.

  If it is the topology we work with, so the only recommendations I can do is to incorporate IP SLAS and followed in your design.  For example, you may track the status of the interface the main router series.  If the interface fails, you could decrement the HSRP interface boot priority in order to force traffic to converge on the backup router path.  With star-ISAKMP KeepAlive configured on the routers in topology, routers should be able to recognize the failure and the timeout of the old SAs.  Because the RADIUS is configured with two counterparts, the router can negotiae new SAs with the backup router.  When the serial interface comes back online, you can have the main router anticipate waking after a delay.  To detect indirect failures on the transit route, you could use ICMP IP SLA and monitoring instead.  This design, however, will be properly tested for stability during the failover process.

• proxy id IPSec problem

  I am trying to create a vpn site-to site l2l and phase 1 ends very well, but during the validation of the id of the proxy in phase 2, the id is not set correctly.

  Here is the config:

  access extensive list ip 10.1.10.0 ssatunnel allow 255.255.255.0 x.x.x.32 255.255.255.224

  3600 seconds, duration of life crypto ipsec security association

  card crypto ssa 1 match address ssatunnel

  card crypto ssa 1 set pfs

  card crypto ssa 1 set type of connection are created only

  Crypto map ssa 1 counterpart set peerip

  ssa 1 set transform-set ssa ikev1 crypto card

  3600 seconds, duration of life card crypto ssa 1 set security-association

  ssa interface card crypto outside

  crypto isakmp identity address

  Crypto ikev1 allow outside

  IKEv1 crypto policy 1

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  lifetime 28800

  tunnel-group peerip type ipsec-l2l

  tunnel-group peerip ipsec-attributes

  IKEv1 pre-shared-key *.

  It keeps using the peer-ip and my public ip address for the proxy-id.  This verification on the remote site so phase faild 2 fails.

  is there something that I am missing.

  Hello

  You can remove card crypto ssa 1 set - type of connection are created only

  It's supposed to work only with a counterpart of ASA configured as a receive-only or two-way

  See you soon

• Re: Problems with Wifi Pro Yoga 2

  I have a:

  Yoga 2 Pro (i7)
  Intel Wireless-N 7260

  Router dual-band Linksys E4200

  I have no problem connecting to the House, however, I can not connect (at all) to the dealrship of car, I have maintained my vehicle to (iPad and mobile connect very well).

  I can connect to my office, however, he falls and reconnects constantly.

  It would be completely little reliable to take on the road.

  
  

• Linksys E4200 - can update firmware and roll backs damage my router?

  Hello

  I had to restore the firmware on my Linksys E4200 (v2) because I had problems after upgrading the firmware. I tried to upgrade again and again met with problems. In short, I improved a few times and restored several times. Currently I'm on the old firmware and I without any problem.

  In the old days, it was not wise to update the firmware of some peripheral hardware too often, because some devices has agreed that a limited number of updates to firmware... don't ask me why :-)

  Is this also the case with the Linksys E4200 or can I upgrade and roll back as often as the requires, or as often as I want to try to upgrade because of new features...?

  Thank you

  SJW

  As long as you do the right steps during the upgrade/downgrade the router (loading the firmware using a wired computer, not to interrupt the upgrade/downgrade process, load the right file, etc.), the unit should be fine.

• Cisco Cisco IPSEC VPN to encrypt but not decrypt

  Hello

  I have a vpn ipsec problem.

  packets are encapsulated and décapsulés but only in one direction. I don't understand why.

  VPN is already mounted on another router, I want to change the router but can't get the vpn have the new router

  Thank you for helping me

  PS: Sorry for my English

  Hello

  I looked at the configuration of your router RT-897VA once again, and I don't know if static NAT statements in there are supposed to work or not, but they won't because you have not specified any inside and outside interfaces. Configuration changes below correspond to the configuration of your router RT, check if their implementation makes a difference (the changes are indicated in bold):

  RT-897VA #show run
  Building configuration...

  Current configuration: 3933 bytes
  !
  ! 11:56:34 configuration was last modified THIS Friday, November 4, 2016
  !
  version 15.4
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  RT-897VA host name
  !
  boot-start-marker
  boot-end-marker
  !
  !
  !
  No aaa new-model
  clock timezone THIS 1 0
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !

  !
  !
  !
  !
  domain IP XXXXX
  IP-name 194.2.0.20 Server
  IP-name 194.2.0.50 server
  IP cef
  No ipv6 cef
  !
  !
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  VPDN enable
  !
  VPDN-Group 1
  ! Default L2TP VPDN group
  accept-dialin
  L2tp Protocol
  virtual-model 1
  tunnel L2TP non-session timeout 15
  !
  !
  default value for the field
  !
  !
  !
  !
  !
  !
  !
  CTS verbose logging
  license udi pid C897VA-K9 sn FCZ2030DL
  !
  !
  username password privilege 15 itef 0...
  !
  !
  !
  !
  !
  VDSL controller 0
  !
  property intellectual ssh rsa keypair-name XXX
  property intellectual ssh version 2
  !
  !
  crypto ISAKMP policy 1
  BA aes
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key cleidentique address IP-WAN-B
  !
  !
  Crypto ipsec transform-set aes - esp esp-sha-hmac toto
  tunnel mode
  !
  !
  !
  crypto map ipsec-isakmp TUNNEL 1
  counterpart Set IP-WAN-B
  Set transform-set toto
  match address TUNNEL-DATA
  crypto map ipsec-isakmp TUNNEL 2
  counterpart Set IP-WAN-B
  Set transform-set toto
  match TUNNEL-TOIP address
  !
  !
  !
  !
  !
  !
  ATM0 interface
  no ip address
  Shutdown
  No atm ilmi-keepalive
  !
  interface BRI0
  no ip address
  encapsulation hdlc
  Shutdown
  Multidrop ISDN endpoint
  !
  interface Ethernet0
  no ip address
  Shutdown
  !
  interface GigabitEthernet0
  Description BOX-SWITCH
  switchport trunk vlan 101 native
  switchport mode trunk
  no ip address
  spanning tree portfast
  !
  interface GigabitEthernet1
  no ip address
  !
  interface GigabitEthernet2
  no ip address
  !
  interface GigabitEthernet3
  no ip address
  !
  interface GigabitEthernet4
  no ip address
  !
  interface GigabitEthernet5
  no ip address
  !
  interface GigabitEthernet6
  no ip address
  !
  interface GigabitEthernet7
  no ip address
  !
  interface GigabitEthernet8
  WAN description
  IP address IP WAN - A 255.255.255.240
  IP virtual-reassembly in
  NAT outside IP
  automatic duplex
  automatic speed
  card crypto TUNNEL
  !
  interface Vlan1
  no ip address
  !
  interface Vlan101
  VLAN-DATA description
  IP 192.168.101.251 255.255.255.0
  IP nat inside
  IP virtual-reassembly in
  !
  interface Vlan111
  VLAN-TOIP description
  IP 192.168.111.251 255.255.255.0
  IP virtual-reassembly in
  !
  IP forward-Protocol ND
  no ip address of the http server
  no ip http secure server
  !
  !
  IP nat inside source static tcp IP 25 expandable 25 192.168.101.2
  IP nat inside source static tcp IP 80 80 extensible 192.168.101.2
  IP nat inside source static tcp 192.168.101.2 extensible IP 443 443
  IP nat inside source static tcp 192.168.101.31 3201 IP extensible 3201
  IP nat inside source static tcp 192.168.101.31 80 extensible IP 3280
  IP nat inside source static tcp IP 443 33443 extensible 192.168.101.11
  overload of IP nat inside source list NAT interface GigabitEthernet8
  IP route 0.0.0.0 0.0.0.0 XXXX (ADSL router)
  IP route 192.168.100.0 255.255.255.0 IP-WAN-B

  NAT extended IP access list
  deny ip 192.168.101.0 0.0.0.255 192.168.100.0 0.0.0.255
  IP 192.168.101.0 allow 0.0.0.255 any
  access list IP-TUNNEL-DATA extents
  IP 192.168.101.0 allow 0.0.0.255 192.168.100.0 0.0.0.255
  TUNNEL-TOIP extended IP access list
  IP 192.168.110.0 allow 0.0.0.255 192.168.111.0 0.0.0.255
  !
  access list IP-TUNNEL-DATA extents
  IP 192.168.101.0 allow 0.0.0.255 192.168.100.0 0.0.0.255
  permit tcp host 192.168.101.3 192.168.0.0 0.0.0.255 established
  TUNNEL-TOIP extended IP access list
  IP 192.168.111.0 allow 0.0.0.255 192.168.110.0 0.0.0.255
  !
  !
  !
  control plan
  !
  !
  MGCP behavior considered range tgcp only
  MGCP comedia-role behavior no
  disable the behavior MGCP comedia-check-media-src
  disable the behavior of MGCP comedia-sdp-force
  !
  profile MGCP default
  !
  !
  !
  !
  !
  !
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  privilege level 15
  password...
  opening of session
  transport input telnet ssh
  line vty 5 15
  privilege level 15
  password...
  opening of session
  transport input telnet ssh
  !
  Scheduler allocate 20000 1000
  !
  !
  !
  end

• With E1200 slow download speeds

  I have an E1200 that will work very well for a while, then suddenly the download speed for all wireless devices will be reduced to between 20-30 KB/s.  It happened last night when we were watching videos on Hulu.  We were explosive along the end, when all of a sudden the connection was pretty awful that it had to stop watching.  We have no idea of what has changed – there is only two of us in the House and we were both passively watch Hulu.

  It's already happened, and generally change something like the wireless channel fixed it, but not this time.

  The computers that we have connected to the router via Ethernet gets stuck between 1 to 3 MB/s, so I know that's not the modem or the access provider.

  The intensity of the signal is good (4-5 bars).  I tried to reposition the router and the wireless receiver, but that did not help.

  I have the latest firmware for the router, as far as I know (v2.0.02).

  I tried all channels available (including the ' Auto').  I tried to change the width of the channel between Auto and 40 MHz.  I tried to reset the router to factory settings and re - download my configuraiton.  I tried to set QoS.

  Any other ideas?

  Hmmm I have a router E4200 and had the same problem. But when I disabled it Support WMM and I was able to make it work properly.

• IM stops working after a minute or two - troubleshooting explains internet connection problems found (the IPsec negotiation failure prevents the connection)

  Need to patch to get IPsec to start working in Internet instant Mesasenger - I fought this for about 3 months. I can't do a Messenger call for more than a minute before having to re - connect - it's driving me crazy - fix your product - Paul * address email is removed from the privacy *.  Settings information (network security) Diagnostics that can block connections:

  filter name: Messaging microsoft instant - name for the provider context: windows Instant Messenger - provider name: Microsoft Corp.Provider - description: Microsoft Windows Firewall: IPsec provider

  Hi paulrhea,
   
  -What version of the operating system are you using?
  -You are able to go online with no problems?
  -Have you been able to use the Messenger without any problem before?
   
  If you use Windows 7 or Windows Vista, follow the suggestion given here.
   
  Try to disable the firewall for the moment and check if it helps fix the problem.
   

  If the problem is resolved, you may need to contact the manufacturer of the program for the settings that can be changed or if there are other updates for this program.

  Note: Firewall can keep the computer worm, pirates etc. Therefore, be sure to turn on the firewall once you are finished with the test.

  If it is Windows Firewall, see the article below:

  Allow a program to communicate through Windows Firewall

  Additional reference on:

  Windows Firewall is blocking a program

• Problems with ports ethernet E4200

  I have problems with my ethernet ports on my router E4200 V1.  I do not get on flow rate of 12 Mbps on a single connected wired computer.  If I replace it with a simple switch 5 port I get 60 Mbit/s using the same cables.  I looked through the creation and cannot come up with any solution.

  Any help would be greatly appreciated.

  Thank you

  Mike

  OK I tore across the network.  Started from scratch and found the problem.  It is quite strange, but everything works fine!

  I discovered through the process of elimination that the cisco router did not like my Panamax Lan UTP.  Cisco is apparently more strict with the signal than the simple switch or refurbished netgear router.  I had the protection on the power strip 6 Max near the iMac.  The totally weird part is that slowed down the entire network.  Streaming is now pending on 60Mbps at each connection to the local network.

  Thank you all for your time I walked through this weird problem.

  Mike

• E4200 w 2 - re1000 and still have problems with wireless coverage

  I have a big enough House, 4500 square feet, and there a lot of bricks and stucko.  I wired ethernet ports in most of the rooms.

  For my Apple TV and tower PC, PS3, I used a wired connections.

  But we have a lot of devices without wireless, 4 laptops and 3 iphones, 3 ipads so good wireless coverage is a must.  I'm not looking for a budget solution, just the best solution that I can.  I also have a wireless baby monitor and an ATT Wireless TV receiver.  I have no end of problems with wireless on my devices.

  Without a lot of research I boght a couple re1000 thought that would be the solution to my problem, but they don't really work as well as I would like.  I wish I had done my research as I think that the right solution is to have the other AP in the connection from the House to a 'hand' AP via wired connection (connection wired bridge mode?).  I could adjust only force and channel to maximize coverage for the House.

  Here is what is a must:

  One SSID in the House

  Everything must be on the same network.  I have a wired camera Foscam and use the features of the homegroup in windows.

  Taking as a basis the e4200, what other should AP I buy to connect to the main via a wired connection?

  I don't know how to close your home is to other houses, so I don't know if you might encounter interference from 2.4 ghz to your neighbors or other sources.

  I see that WAP610 is not simultaneous... only selectable.  iPhones are only 2.4 ghz

  Whatever it is, you can keep the same SSID for your entire network, but you may need to use different wireless channels.  Everything meets your criteria above.

  The only unknown is your neighbors (and other sources) Wireless interference.

  You can download inSSIDer, which will give you a better idea of what you're against, but it is not infallible.

  http://www.MetaGeek.NET/products/inSSIDer/

• Problems to connect via the Cisco VPN client IPSec of for RV180W small business router

  Hello

  I tried to configure my router Cisco of RV180W as a customer VPN IPSec, but have encountered a problem that I hope someone can help me with. "" I managed to do the work of configuration so that the Cisco's VPN IPSec client authenticates successfully with the XAUTH user, I put on the router, but during the negotiation, the client ends with the following, which appears several times on the router error message: ' Mar 20 Oct 19:41:53 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [34360] has no config mode.

  I've read around the internet and a number of people seem to say that the Cisco VPN Client is not compatible with the router, but the same thing happens to my iPhone VPN client.

  Is it possible that this can be implemented? Below, I have attached the full configuration files and the log files. Thank you much in advance.

  Router log file (I changed the IP addresses > respectively as well as references to MAC addresses)

  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: floating ports NAT - T with counterpart > [44074]
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] WARNING: notification to ignore INITIAL-CONTACT > [44074] because it is admitted only after the phase 1.
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT - D payload does not match for > [4500]
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT - D payload does not match for > [44074]
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: received unknown Vendor ID
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: received Vendor ID: CISCO-UNITY
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT detected: is located behind a device. NAT and alsoPeer is behind a NAT device
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: request sending Xauth for > [44074]
  Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: ISAKMP Security Association established for > [4500] -> [44074] with spi =>.
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: receives the type of the attribute 'ISAKMP_CFG_REPLY' of > [44074]
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: login successful for the user "myusername".
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: myusername XAuthUser connected from the IP >
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: sending of information Exchange: Notify payload [10381]
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: receives the type of the attribute 'ISAKMP_CFG_REQUEST' of > [44074]
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: ignored attribute 5
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: attribute ignored 28683
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no mode config
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: attribute ignored 28684
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no config mode
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for > [44074] has no mode config
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: remove the invalid payload with doi:0.
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: purged-Association of ISAKMP security with proto_id = ISAKMP and spi =>.
  Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: myusername XAuthUser Logged Out of the IP >
  Mar 20 Oct 20:03:16 2015 (GMT + 0000): [r1] [IKE] INFO: ISAKMP Security Association deleted for > [4500] -> [44074] with spi =>

  The router configuration

  screen_shot_10-20 - 15_at_09.00_pm.png

  

  IKE policy

  screen_shot_10-20 - 15_at_09.00_pm_001.png

  

  screen_shot_10-20 - 15_at_09.01_pm.png

  

  VPN strategy

  screen_shot_10-20 - 15_at_09.02_pm.png

  

  screen_shot_10-20 - 15_at_09.02_pm_001.png

  

  Client configuration

  Hôte : < router="" ip=""> >

  Authentication group name: remote.com

  Password authentication of the Group: mysecretpassword

  Transport: Enable Transparent Tunneling; IPSec over UDP (NAT/PAT)

  Username: myusername

  Password: mypassword

  Please contact Cisco.

  Correct, the RV180 is not compatible with the Cisco VPN Client.  The Iphone uses the Cisco VPN Client.

  You can use the PPTP on the RV180 server to connect a PPTP Client.

  In addition, it RV180 will allow an IPsec connection to third-party customers 3.  Greenbow and Shrew Soft are 2 commonly used clients.

• Problem with tunnel IPSEC with NAT

  Hello

  I had an ipsec tunnel between a former Cisco router at a remote site. I'm the config 887 to an ASA migration. The remote site cannot establish the tunnel. This is the only site having problems. There are one number of other sites remote connection back without problem.

  The Setup is

  192.168.1.x (main site inside) - ASA - 86.x.x.x (outside) - Internet - 159.x.x.x (side remote outdoors) - Firewall - 10.10.10.x

  The remote site will not accept the 192.168.1.x range so I'm NATing 192.168.50.x which is what they want to see

  The config I have is

  network of the NAT_TO_Remote1 object
  192.168.50.0 subnet 255.255.255.0
  network of the Remote1 object
  subnet 10.10.10.0 255.255.252.0

  NAT NAT_TO_Remote1 (Interior, exterior) destination 192.168.1.0 source static static Remote1 Remote1

  IKEv1 crypto policy 30
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400

  Crypto ipsec transform-set esp-3des esp-sha-hmac ikev1 3DES-SHA1

  card crypto Outside_map 10 corresponds to the address Qualcom_VPN
  card crypto Outside_map 10 set peer 159.x.x.x
  card crypto Outside_map 10 set transform-set 3DES-SHA1 ikev1
  card crypto Outside_map 10 set pfs Group1
  Outside_map interface card crypto outside

  RemoteSite_VPN list extended access allowed host ip 192.168.50.20 10.10.10.0 255.255.252.0
  RemoteSite_VPN list extended access allowed host ip 192.168.50.30 10.10.10.0 255.255.252.0
  RemoteSite_VPN list extended access allowed host ip 192.168.50.40 10.10.10.0 255.255.252.0

  tunnel-group 159.x.x.x type ipsec-l2l
  tunnel-group 159.x.x.x General-attributes
  Group Policy - by default-RemoteSites
  159.x.x.x group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.

  I was wondering if I'm missing something obvious here.

  Hello

  You must check the IPSEC transform set and see if they have enabled PFS group or not?

  card crypto Outside_map 10 set pfs Group1

  Try using group2, or turn it off.

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.