Enable ASA 9.1 problems with tunnel-group-list

Similar Questions

• How to associate policies crypto with tunnel-group?

  Hi, when I review the configuration of the VPN from point to point, I have a question. The ASA has three peer-to-peer VPN configuration. So, there are also three groups of tunnel in there. My question is how each VPN to ensure encryption policy tunnel-group? In the anther Word, what encryption policy associated with tunnel-group? Thank you.

  This is the phase 1, they work from top to bottom.  When you try to negotiate the tunnel between two counterparts, in the background, they send all of your policies and according to which is first (from top to bottom) is used.

  For example.

  If your counterpart device uses (3des, md5, pre-shared key and group 2), it will not match the policy 1 and the rest of the policy will not be considered.

  Kind regards

  Sandra

• AnyConnect tunnel-group automatic assignment without selecting any group-tunnel-group-list alias and user-group strategy.

  Objective is that the anyconnect user must select group-alias, so that when a user enters his username and password he must go to his political group and tunnel-group specific. as I removed this command in webvpn 'no tunnel-group-list don't enable '. This I can not connect (user does not authenticate).

  1 - my question is why his past does not?

  Solution:

  If I keep only a single tunnel-group by default and make several group policies and assign to each user with his specific group policy that it works. in user attribute means I have only question following the commands it works, but if I put "group-lock value test-tunnel" that it did not identify.

  Please explain why.

  WebVPN

  allow outside

  limit the cache-fs 50

  SVC disk0:/anyconnect-win-3.0.10055-k9.pkg 1 image

  enable SVC

  internal strategy of group test-gp

  attributes of the strategy of group test-gp

  VPN-tunnel-Protocol svc webvpn

  the address value test-pool pools

  username, password test test

  username test attributes

  VPN-tunnel-Protocol svc

  group-lock value test-tunnel

  Strategy Group-VPN-test-gp

  tunnel-group test-tunnel type remote access

  attributes global-tunnel-group test-tunnel

  Group Policy - by default-test-gp

  tunnel-group test-tunnel webvpn-attributes

  allow group-url https://192.168.168.2/test

  Yes, you have the right solution. You only need to create 1 group of tunnel and multiple group policy. Under the attribute of the user, you re then group policy of vpn that you want the user assigned too.

  You can also authenticate users against AD and configure ldap attribute map to map the user to a specific group policy automatically.

  Here is an example of configuration if you happen to have the AD and will authenticate against AD:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00808d1a7c.shtml

  Hope that helps.

• Problem with Tunnel VPN L2L between 2 ASA´s

  Hi guys,.

  I have some problems with my VPN Site to site tunnel between 2 ASA (5520/5505).

  I watched a lot of videos on youtube, but I can't find out why the tunnel does not...

  Both devices can ping eachothers WAN IP address (outside interfaces), but I don't see any traffic between the 2 sites. It seems that the tunnel is not open to everyone. When i PING from the local to the Remote LAN (which should be an interesting traffic for the tunnel...), the its IKEv1 remains empty...

  Am I missing something? I can't understand it more why same phase 1 is not engaged.

  You NAT won't. In your config file traffic is NATted initially and then does not match any more crypto ACL. You must move the rule dynamic NAT/PAT until the end of the table on two ASAs NAT:

   no nat (INSIDE,OUTSIDE) source dynamic any interface nat (INSIDE,OUTSIDE) after-auto source dynamic any interface

• Problem with tunnel IPSEC with NAT

  Hello

  I had an ipsec tunnel between a former Cisco router at a remote site. I'm the config 887 to an ASA migration. The remote site cannot establish the tunnel. This is the only site having problems. There are one number of other sites remote connection back without problem.

  The Setup is

  192.168.1.x (main site inside) - ASA - 86.x.x.x (outside) - Internet - 159.x.x.x (side remote outdoors) - Firewall - 10.10.10.x

  The remote site will not accept the 192.168.1.x range so I'm NATing 192.168.50.x which is what they want to see

  The config I have is

  network of the NAT_TO_Remote1 object
  192.168.50.0 subnet 255.255.255.0
  network of the Remote1 object
  subnet 10.10.10.0 255.255.252.0

  NAT NAT_TO_Remote1 (Interior, exterior) destination 192.168.1.0 source static static Remote1 Remote1

  IKEv1 crypto policy 30
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400

  Crypto ipsec transform-set esp-3des esp-sha-hmac ikev1 3DES-SHA1

  card crypto Outside_map 10 corresponds to the address Qualcom_VPN
  card crypto Outside_map 10 set peer 159.x.x.x
  card crypto Outside_map 10 set transform-set 3DES-SHA1 ikev1
  card crypto Outside_map 10 set pfs Group1
  Outside_map interface card crypto outside

  RemoteSite_VPN list extended access allowed host ip 192.168.50.20 10.10.10.0 255.255.252.0
  RemoteSite_VPN list extended access allowed host ip 192.168.50.30 10.10.10.0 255.255.252.0
  RemoteSite_VPN list extended access allowed host ip 192.168.50.40 10.10.10.0 255.255.252.0

  tunnel-group 159.x.x.x type ipsec-l2l
  tunnel-group 159.x.x.x General-attributes
  Group Policy - by default-RemoteSites
  159.x.x.x group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.

  I was wondering if I'm missing something obvious here.

  Hello

  You must check the IPSEC transform set and see if they have enabled PFS group or not?

  card crypto Outside_map 10 set pfs Group1

  Try using group2, or turn it off.

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.

• problems with customization select lists and popup LOVs

  Hello
  
  
  I have 2 problems on selection lists and popup LOVs.
  
  The first is on a list in tabular form.
  It must be created with APEX_ITEM. SELECT_LIST_FROM_LOV or similar and take its values of a named LOV.
  This worked fine, but now it should also have the possibility to enter a free value.
  I tried to accomplish this by creating an APEX_ITEM. POPUP_FROM_LOV, but there is a problem with the function which is called the icon of the right arrow to the input field (for eg. genList_f11_5()).
  If the line is added by addRow, then it works fine, but if the line is not empty
  Then the function call is as genList_f11_$ _row () and the input field becomes worthless, when an LOV is selected.
  
  
  The other problem is on a list of selection that should have the opportunity to enter a custom value and
  It should also be able to select multiple values. I tried to implement this in a text box that contains the selected values, and a multiple select list, with an event handler in each option. The user can click on options and they would be copied into the text box. The problem is that I couldn't make the event handler works in Internet Explorer.
  
  I would like ideas on one of these problems.
  
  
  
  Tiina

  Hello

  It can be created at APEX_ITEM. TEXT.
  APEX_ITEM also generates the name attribute that I use the jQuery selector in the sample.
  Use jQuery UI autocomplete just similarly as in my example with APEX_ITEM

  Kind regards
  Jari

• Problem with AP group.

  I got to set up the subnet via radio.

  We have 32 buildings - all buildings are in their own ip address range and subnet.

  I have read cisco ap group instructions...  I'm missing something... Maybe the concept of its operation.

  We have a SSID for University - Let's say SSID - College

  Under College - we would like to see the ip address range and subnet under each building.  32 buildings with various number of AP.

  Problem is that I'm even old address ip under Gallaudet even I already put in place the various dhcp scope...

  How to troubleshooot who?

  WCS and WLC are on the latest version

  -Allen-

  Hi Allen.

  Configuration of the AP groups.

  -Create all interfaces of controller/interfaces of each building.

  -Create the SSID; in your case 'college', the interface that you attached to this SSID initially is not relevant if you are using AP group. For example, use the interface to the building where is the WLC.

  -Create groups of AP; You must create a group for each building and map the College SSID to the interface to which belongs the building. Record.

  -Finally, fix the Ap´s which belongs to this building to each group of AP.

  The AP´s then reboot and only the ssid of the College will be published mapping their traffic to the interface you select AP-groups.

  If you move from one building to another, the IP address is maintained that even if you are in a different subnet (WLC this traffic tunnels) If you disconnected, then reconnect you wil acquire an IP address that belongs to the network of the building you are.

  You can see in the interface chart in the clients IP address, the trap associated with you and if your traffic is "tunnel" because you come from another subnet.

  Best regards.

• ASA SSL VPN problem with 8.2 (2)

  Hello everyone,

  I have a couple of ASA 5520 image 8.2 (1) running in active failover mode / standby.

  A few months ago, I downloaded the 8.2 (2) on the cisco website and charge to the ASA.
  After loading the new image, they called me for problems
  functioning of the application of webvpn.

  The web app seems to work, but in a mode of read-only, because you could not

  change the content of the files.

  I couldn't find a way to make it work, so I decided to downgrade to 8.2 (1).
  and as I loaded it the old image, the problem disappeared.

  Now I see that it is available the image 8.2 (3).
  To avoid the risk of hard work I tetsted on a piece of spare 5510, and with the disappoint, I found
  the problem was the same.

  Everyone is facing such a problem or can suggest me how to solve?

  Thanks in advance.

  Marco.

  Can you please provide more details about what application does not work through WebVPN interface without client?  Have you tried to activate Smart Tunneling for this application?

• Problem with tab groups

  So I decided to try the groups to tabs, because I had never actually used the feature before. Now, every time I open Firefox the tab or tabs that belonged to the Group of open again. How can I stop this?

  Hello

  The reset Firefox feature can solve a lot of problems in restaurant Firefox to its factory default condition while saving your vital information.
  Note: This will make you lose all the Extensions, open Web sites and preferences.

  To reset Firefox, perform the following steps:

  1. Go to Firefox > help > troubleshooting information.
  2. Click on the button 'Reset Firefox'.
  3. Firefox will close and reset. After Firefox is finished, it will display a window with the imported information. Click Finish.
  4. Firefox opens with all the default settings applied.

  Information can be found in the article Firefox Refresh - reset the settings and Add-ons .

  This solve your problems? Please report to us!

  Thank you.

• Problem with logic groups combining data at the point of importation

  I really hope that you will be able to help me with a problem I've had for the last few days.
  
  The scenario I have requires a logical group be created as the source data must be mapped differently if its + ve or - ve even thought the source account is the same.
  
  I created a logical group complex and added the corresponding logical group account in the account mapping table. The group uses the definition of rule 001806 *.
  
  The accounts that would be affected by this rule are below the values:
  18060000 - 2093096.69
  18060000 2093096.69
  18060005 - 2474955.48
  18060005 2474955.48
  18060015 11319512.13
  18060015-8000000 (a PEAK partner)
  18060015 - 3319512.13 (a PEAK partner)
  
  The + ve values need to go to an asset account and the values of ve - to a liability account.
  
  At the stage of import, I have a zero value which seem to be the sum of the values of the first 4, substantive values 3 then appear on individual lines.
  
  Step validate the asset HFM account displays the 3 + values of ve (15.8 M) Although 2 of them apparently wide net to zero with the values of the first and the third - ve. However, the liability account shows the background raising 2 (11. 3 m) as its missing the other 2 values - ve. Assets and liabilities HFM values should be the same
  
  In the account mapping, I'm using the following script for the + ve (its been reformatted for this forum):
  ' If varValues (9) > '0' Result = "BSA401000" Else Result = "Ignore" End If
  
  The script - ve is:
  ' If varValues (9) < "0" Result = "BSL625600" Else Result = "Ignore" End If
  
  I later changed the logical group to be Simple, but I get a similar result, although what I am trying to reach seems to be detailed in the Administrator's Guide FDM under the heading create accounts within Simple logic groups
  
  I understand that it is a little lengthy so apologies if you need more information, then please let me know and I will happy to provide more
  
  Thank you, James

  You could even put in place two mapping rules and avoid the complexity of a logic rule, if you wish. The mapping will continue to the next line if it does not meet the criterion, and there is no result.

  Side assets would be with a name of rule vAsset (you can change this, but it must be unique to the next line)
  If varValues (9) > 0 then result = "BSA401000."

  and then you add a second line to your card with a name of vLiab rule and check the sign flip.

  If varValues (9)< 0="" then="" result="BSL6256002">

  In the past I have avoided the rules of logic to the extent possible, by adding removes the ability to drill holes in the source file.

  Concerning
  JOINT TASK FORCE

• Problem with a group of query

  Hi all
  
  My sql query tries to return the number of clients with their points total in some predefined intervals, so I created a table with the interval id and a threshold indicating the minimum threshold.
  Customer table:

     client         Total points
  
  client1        3
  client2        15
  Client 3       47

  ..
  
  
  Table of interval:

     id     threshold      label
  1      0                between 0 and 4 points
  2      5                between 5 and 19 points
  3      20              between 20 and 100 points

  My sql query looks like this:
  

    SELECT  
    max(interval.id),
    count(*)
   
      FROM clients, intervals 
      WHERE Total points >= interval.threshold group by max 1
    

  the problem is that this query returns the cumulative account, that is, all clients are considered in the interval from 0 (0-> 4points) and all those who have more than 5 points are in the range 2 and so on...
  
  I do not know the DB with this select,
  any help is appreciated
  
  Thank you

  Check out my post published on...

• Someone had problems with the Group Me app?

  After you download this app and sync my contacts, I have an unknown person in my list of contacts that the person is in my address book.  I do not know this person and I couldn't get a response from the Group Me support app, and their page url does not exist.  Support people sent me a generic email and told me how to remove a member, but I have been unable to solve the problem of the way that they describe. Now, I can't get rid of that person.  I am afraid that they have access to all my contact information now.

  https://help.groupme.com/HC/en-us/community/topics is the community for the App... it doesn't seem that there's a lot of traffic

  I would normally ask here, but the number of post on the homepage is VERY low

  It belongs to the family of 'Skype' products owned ultimately by Microsoft

• Problem with the group items

  Hello world. Thank you for taking the time to look over my examples.
  
  I can't group items with XSL.
  
  Entry XML code:
  < country >
  < info enum = "CTRY" name = 'United States' States-total = "50" / >
  < enum info = 'ST' name = 'New York' population = "8 244 910" / >
  < enum info = 'ST' name = 'Chicago' population = "2 707 120" / >
  < info enum = "CTRY" name = 'Germany' States-total = "16" / >
  < enum info = 'ST' name = 'Berlin' population = "3 469 910" / >
  < enum info = 'ST' name = 'Brandenburg' population = "2 500 000" / >
  < / country >
  ------------------------------------------------------------------------------------------
  My XSL:
  < xsl: template match = "/" >
  < country >
  < xsl: for-each select = "Country/info" >
  "< xsl: if test="@enum='CTRY "" > "
  < CountryInfo >
  < name > country: < xsl: value-of select="@name"/ > < / name >
  "districts of <>< xsl: value-of select="@total-states "> < / xsl: value-of > < / districts >
  < xsl: for-each select = "info/country /" >
  "< xsl: if test="@enum='ST "" > "
  < State >
  < stateName > state name: < xsl: value-of select="@name"/ > < / stateName >
  < statePop > State Population: < xsl: value-of select="@population"/ > < / statePop >
  < / state >
  < / xsl: if >
  < / xsl: foreach >
  < / CountryInfo >
  < / xsl: if >
  < / xsl: foreach >
  < / country >
  < / xsl: template >
  
  My unwanted result:
  < country >
  < CountryInfo >
  < name > country: United States of America < / name >
  < > 50 districts < / districts >
  < State >
  < stateName > name of the State: New York < / stateName >
  < statePop > State Population: 8 244 910 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Chicago < / stateName >
  < statePop > State Population: 2 707 120 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Berlin < / stateName >
  < statePop > State Population: 3 469 910 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Brandenburg < / stateName >
  < statePop > State Population: 2 500 000 < / statePop >
  < / state >
  < / CountryInfo >
  < CountryInfo >
  < name > country: Germany < / name >
  < > 16 districts < / districts >
  < State >
  < stateName > name of the State: New York < / stateName >
  < statePop > State Population: 8 244 910 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Chicago < / stateName >
  < statePop > State Population: 2 707 120 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Berlin < / stateName >
  < statePop > State Population: 3 469 910 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Brandenburg < / stateName >
  < statePop > State Population: 2 500 000 < / statePop >
  < / state >
  < / CountryInfo >
  < / country >
  ---------------------------------------------------------------------------------------
  ++++++++++++++++++++++++++++++++++++++++++++
  My other XSL:
  < xsl: template match = "/" >
  "< xsl: for each group-select =" Country/info"group-by="@enum ">
  < xsl: for each group-select = "current - group ()" group-by="@name" >
  "< xsl: if test="@enum='CTRY "" > "
  < country >
  < CountryInfo >
  < name > country: < xsl: value-of select="@name"/ > < / name >
  "districts of <>< xsl: value-of select="@total-states "> < / xsl: value-of > < / districts >
  "< xsl: for each group-select =" info/country / "group-by="@enum ">
  "< xsl: if test="@enum='ST "" > "
  < State >
  < stateName > state name: < xsl: value-of select="@name"/ > < / stateName >
  < statePop > State Population: < xsl: value-of select="@population"/ > < / statePop >
  < / state >
  < / xsl: if >
  < / xsl: for each group->
  < / CountryInfo >
  < / country >
  < / xsl: if >
  < / xsl: for each group->
  < / xsl: for each group->
  < / xsl: template >
  
  Other undesirable results:
  < country >
  < CountryInfo >
  < name > country: United States of America < / name >
  < > 50 districts < / districts >
  < State >
  < stateName > name of the State: New York < / stateName >
  < statePop > State Population: 8 244 910 < / statePop >
  < / state >
  < / CountryInfo >
  < / country >
  < country >
  < CountryInfo >
  < name > country: Germany < / name >
  < > 16 districts < / districts >
  < State >
  < stateName > name of the State: New York < / stateName >
  < statePop > State Population: 8 244 910 < / statePop >
  < / state >
  < / CountryInfo >
  < / country >
  +++++++++++++++++++++++++++++++++++++++++
  
  Expected result:
  < country >
  < CountryInfo >
  < name > country: United States of America < / name >
  < > 50 districts < / districts >
  < State >
  < stateName > name of the State: New York < / stateName >
  < statePop > State Population: 8 244 910 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Chicago < / stateName >
  < statePop > State Population: 2 707 120 < / statePop >
  < / state >
  < / CountryInfo >
  < CountryInfo >
  < name > country: Germany < / name >
  < > 16 districts < / districts >
  < State >
  < stateName > name of the State: Berlin < / stateName >
  < statePop > State Population: 3 469 910 < / statePop >
  < / state >
  < State >
  < stateName > name of the State: Brandenburg < / stateName >
  < statePop > State Population: 2 500 000 < / statePop >
  < / state >
  < / CountryInfo >
  < / country >
  
  If possible, how can I produce my desired given result XML entry code?
  

• Duplicate an application: problems with security groups

  Hello
  
  In order to fix a problem (listed here Re: Migration of LCM: Calc scripts not available ), we need to duplicate a request (recreate but changing the name of the type of plan and on the same server)
  
  The whole process of creating the application (distinct name) went well, but when I try to import security using LCM, I received a message on the groups, it does not find.
  
  Import failed. Total - 43, success - 0 error Details - Impossible to import the access - group (groupname) not found, error-(nom d'utilisateur non valide trouvé dans le fichier.) details Could not import the access authorization-
  
  (Fault to import - error details - impossible to import access permissions - group not found - error details-
  
  Export security settings went well. I changed the XML, so the new app name, but still had the same problem.
  
  No idea where it might be?
  
  Thanks in advance!

  Do you have service users for the new Shared Services application.

  See you soon

  John
  http://John-Goodwin.blogspot.com/

• Problem with public mailing list as the owner of the call handler

  I configured a call aa with extention Manager 2000.

  Also set up a Point of road Cti with 2000 on Callmanager extension. The Cti route Point will send all calls to voicemail.

  When I choose a Subscriber as the owner of the call handler, I can compose 2000 and attain salvation.

  But when I choose a public mailing list as the owner of the call handler, I hear the system error during a call to 2000. There that anything wrong here?

  I tried to reproduce your problem on the 4.0 unit (3) Sr and CCM 4.0 (1) but has not had a problem. I changed the owner of a PDL with a single Subscriber.

  I think that your problem may actually be the bond of MESSAGES for the CH. Make sure that the recipient is valid. If it is NULL, you'd hear failsafe.