Error of tunneling traffic to 2 networks on the same link?

Hi all

Here is my list of current access to bring up my VPN tunnel. Everything works fine with it, but I have several networks from the source router. How to encrypt traffic from the same source router going to the same router by peers. Do I have to create a different ACL or can just add another license to the current ACL statement?

INT_Traffic extended IP access list
IP address 172.16.0.0 allow 0.0.255.255 172.17.0.0 0.0.255.255

Can I change the ACL above to this? Every time I add the second permit States below, I get the error below.

INT_Traffic extended IP access list
IP address 172.16.0.0 allow 0.0.255.255 172.17.0.0 0.0.255.255

ip permit 172.30.3.0 0.0.0.255 172.30.3.0 ip 0.0.255 or permit 172.16.0.0 0.0.255.255 172.30.4.0 0.0.0.255

peer networks peer Destination source.

Mar 1 04:18:29.842: IPSEC (sa_request):,.
(Eng. msg key.) Local OUTGOING = 192.168.0.1, 192.168.0.2 = distance.
local_proxy = 172.16.0.0/255.255.0.0/0/0 (type = 4),
remote_proxy = 172.30.4.0/255.255.255.0/0/0 (type = 4),
Protocol = ESP, transform = esp - aes 256 esp-sha-hmac (Tunnel),
lifedur = 3600 s and KB 4608000,
SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0
* 04:18:29.850 Mar 1: ISAKMP: set new node 0 to QM_IDLE
* 04:18:29.850 Mar 1: ITS a exceptional applications (102.72.38.92 local port 500, 102.72.38.64 remote port 500)
* 1 Mar 04:18:29.854: ISAKMP: (1001): sitting IDLE. From QM immediately (QM_IDLE)
R2(config-ext-NaCl) #.
* 04:18:29.854 Mar 1: ISAKMP: (1001): start Quick Mode Exchange, M - ID of 623193098
* 04:18:29.858 Mar 1: ISAKMP: (1001): initiator QM gets spi
* 1 Mar 04:18:29.862: ISAKMP: (1001): send package to 192.168.0.2 my_port 500 peer_port 500 (I) QM_IDLE
* 04:18:29.862 Mar 1: ISAKMP: (1001): sending a packet IPv4 IKE.
* 04:18:29.866 Mar 1: ISAKMP: (1001): entrance, node-623193098 = IKE_MESG_INTERNAL, IKE_INIT_QM
* 04:18:29.866 Mar 1: ISAKMP: (1001): former State = new State IKE_QM_READY = IKE_QM_I_QM1
* 04:18:30.422 Mar 1: ISAKMP (0:1001): received packet of 192.168.0.2 dport 500 sport Global 500 (I) QM_IDLE
* 04:18:30.426 Mar 1: ISAKMP: node set-1733728027 to QM_IDLE
* 1 Mar 04:18:30.430: ISAKMP: (1001): HASH payload processing. Message ID =-1733728027
* 1 Mar 04:18:30.430: ISAKMP: (1001): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
SPI 2018370628, message ID =-1733728027, his 664824F8 =
* 1 Mar 04:18:30.434: ISAKMP: (1001): delete message spi 2018370628
R2 (config-ext-nacl) #ID =-623193098
* 04:18:30.434 Mar 1: ISAKMP: (1001): node-623193098 error suppression REAL reason "remove larval.
* 04:18:30.434 Mar 1: ISAKMP: (1001): node-1733728027 error suppression FALSE reason 'informational (en) State 1.
* 04:18:30.438 Mar 1: ISAKMP: (1001): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
* 04:18:30.438 Mar 1: ISAKMP: (1001): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

hostname R2
!
boot-start-marker
boot-end-marker
!
!
No aaa new-model
memory iomem size 5
IP cef
!
!
!
!
no ip domain search
property intellectual auth-proxy max-nodata-& 3
property intellectual admission max-nodata-& 3
!
Authenticated MultiLink bundle-name Panel
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
Archives
The config log
hidekeys
!
!
crypto ISAKMP policy 50
BA aes 256
preshared authentication
Group 5
key cisco address 192.168.0.2 crypto ISAKMP xauth No.
!
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac Cisco
!
VPN_MAP 10 ipsec-isakmp crypto map
defined peer 192.168.0.2
game of transformation-Cisco
match address INT_Traffic
!
!
!
!
!
!
!
interface FastEthernet0/0
IP 172.16.0.2 255.255.255.252
automatic duplex
automatic speed
!
interface Serial0/0
the IP 192.168.0.1 255.255.255.252
clock speed of 128000
card crypto VPN_MAP
!
interface FastEthernet0/1
no ip address
Shutdown
automatic duplex
automatic speed
!
interface Serial0/1
no ip address
Shutdown
2000000 clock frequency
!
router RIP
version 2
network 172.16.0.0
network 192.168.0.0
No Auto-resume
!
IP forward-Protocol ND
!
!
IP http server
no ip http secure server
!
INT_Traffic extended IP access list
IP address 172.16.0.0 allow 0.0.255.255 172.17.0.0 0.0.255.255
IP address 172.16.0.0 allow 0.0.255.255 172.30.4.0 0.0.0.255
!
!
!
!
!
!
!
control plan
!
!
!
!
!
!
!
!
!
!
Line con 0
exec-timeout 0 0
Synchronous recording
line to 0
line vty 0 4
opening of session
!
!
end

R2 #.

(1) you can not configure the same subnet for the subnet source and destination. Each end of the VPN must be unique. Therefore, you cannot add "ip 172.30.3.0 allow 0.0.0.255 172.30.3.0 0.0.255" to the ACL INT_Traffic.

(2) If you add another row of ACL under INT_Traffic, you also add the same image mirror ACL on the VPN peer device. You can not simply add the ACL on the router, because the other router wouldn't know the newly created ACL, so this will not work.

You can add the following line under INT_Traffic ACL:

IP address 172.16.0.0 allow 0.0.255.255 172.30.4.0 0.0.0.255

But you must also add the image mirror ACL on the device VPN peer as follows:

IP 172.30.4.0 allow 0.0.0.255 172.16.0.0 0.0.255.255

But, Yes, you can add several lines ACL under INT_Traffic if you want to encrypt via the VPN tunnel. Just make sure that the 2 points above.

Hope that helps.

Tags: Cisco Security

Similar Questions

  • Windows 7 - error message from the address conflict IP appears periodically. Error message "another computer on the network has the same IP address as this computer.

    Error message "another computer on the network has the same IP address as this computer. Contact you network administrator for help resolving this issue. More details are available in the Windows system event log"

    Does anyone have a simple way (for a dummy) to solve this. If I disconnect my wireless router and laptop and turn the two again this sorts the problem temporarily, but it does not provide a definitive solution.  I use a new laptop and my old one has been scrapped, so I do not know whence this 'conflict '.  My old laptop had Windows XP operating system and my new Windows 7.  I hope that someone can provide a solution to this annoying problem.

    Hi Figgerty,

    have you tried these steps?

    http://answers.Microsoft.com/en-us/Windows/Forum/windows_vista-networking/IP-conflict-error-another-computer-on-this-network/4eed87e2-45FD-4FF7-ae29-9a9fb664a8cc

    B Eddie

  • Conflict error IP - 'another computer on the network has the same IP address as this computer.

    "Windows has detected that another computer on the network has the same IP address as this computer. Contact you network administrator for help resolving this issue. More details are available in the Windows system event log. "I don't know what to do.

    I use Vista. How can I find my Windows system log?

    You're welcome Marilyn and thanks for letting us know. Please do not forget to mark this post which has solved this problem as the answer, when you are sufficiently comfortable that it is. Good navigation! :))

  • Message appear conflict of IP address at startup. Another computer already uses the network with the same IP address. How do I cure this?

    When my kids play online on the X - Box I get an error message on my laptop when I start after them. It is said there is an IP address conflict and that another device is already on the network with the same IP address. It does not affect me access internet even if. How can I fix thi.

    Hello

    1. which is the version of Windows installed on the computer? For example, Windows 7, Vista

    2. only the error message appears only when the Xbox is connected to the computer or at both times?

    3. have you made any software or changes to the material on the computer before this problem?

    Please answer these questions and provide additional information so that we can better guide you.

  • My PC shows that there is someone else on my network with the same IP address. Could this be my Kindle Fire?

    I get the message on my computer that there is someone else on my network with the same IP address.  Could this be my Kindle Fire, that generated the message?

    In many cases, the ip addresses are assigned automatically by the router and if this is the case, something that can happen (happened to me) is that if several computers are attached (via wifi or ethernet or a combination of the two) and the router restarts while a computer is in sleep mode, when the router reboots it know that the computer sleeps is here and it can affect the ip address that has been already assigned to another computer.  When the computer sleep resumes usage it will trigger the dupicate ip address error.  In this case, you can just stop everything and restart.  The following discusses other causes and solutions: http://windows.microsoft.com/en-US/windows7/Get-help-with-There-is-an-IP-address-conflict-message

  • 2 IP networks on the same wiring

    Hi all!

    I have a small question on networks in ESXi 4.1.

    I have a virtual machine that needs to access two IP networks on the same cable (I call them A and B for the moment).

    The virtual machine will be a replacement of a former physics. The taxpayer has two network adapters connected to the same switch, but with different IP configurations, and it works fine.

    When I do the same thing on the net virtual machine a works fine and net B does not work.

    The old machine responds to the pings to both A and B, then the underlying infrastructure is OK.

    Only one who is listed under 'network' on the vSwitch properties

    Is this feasible?

    Any help is appreciated.

    Yes, you can as long you're not vlan tagging - if you create a virtual machine with two network cards, assignment of different IP addresses can connect to the same virtual switch - IP addresses will be transported to swich physics and moved accordingly as long as the physical switch can access gateways approraite. If you use tags vlan in the port group VM that you will need to set a port trink on your physical switch as the vmroyale indicates if traffic can be handled approriately-

    If you find this or any other answer useful please consider awarding points-

  • my windows says that another computer is running in the same network with the same ip address, please contact

    Today morning when I opened my samsung mini, it displays a message that another computer is running on the same network with the same ip address please find a solution for this

    In most home networks where multiple devices are connected to a router, router will assign an IP address to each device (via DHCP). This method keeps usually different devices to get the same IP address, but if you restart your router, it will not address remembered that he released before it was restarted.  This condition can also occur if you manually assigned an IP address to a device located in the router's DHCP range.  If the problem is not due to manually assign an IP address, then this condition will be corrected over time.  But if you're in a hurry, you can unplug your router from the wall and stop all computing devices on it.  Then plug the router back in and bring up all your devices again one by one.

    HTH,

    JW

  • How to configure a multihomed in Windows 7, wired network and wireless networks at the same time?

    Hello

    I have a fixed computer Windows 7, I need to configure for the use of wire and wireless networks.

    On the phone we transfer vast amounts of data, astronomy cameras than only products of 20 to 30 seconds, space images 3-4 GB each. The cameras are connected to the top of a tower, which in turn is connected via a 45 feet cable CAT-5 to the search engine.

    Internet access requires a wireless network connection.

    These two connections work - separately. I have to disable an and activate the other to pass. This jump back and foth is obviously a bit inconvenient.

    How to configure Windows 7 to manage both types of networks at the same time? On another forum I learned this kind of configuration is called multihoming, and it's something difficult to achieve.

    Having studied more about it, there is another possible solution called Internet connection sharing. that may be easier. I haven't used this option for years (since the routers were introduced) but is still active.

    Disable DHCP on the Dovado or use a cable between the PC and the laptop.

    Turn on the wireless on the PC and make sure that you have an internet connection. Disable wireless on the laptop. Connect the PC's LAN ports and laptop (via router or a cable crossover).

    IN the network of PCs and next to the connections Sharing Center, you must have 2 Ethernet and WiFi options. Double click on WiFi, then on the next screen, click Properties.

    The second tab in the next screen is sharing, check allow other users of the network to connect and then OK.

    Define the IP addresses for PC and laptop as in my previous post, but this time on the laptop set the default gateway to the IP address of the Wired of the PC port, the 1st DNS to the address of the Huawei and value of secondary school who suggested for your ISP.

    This affects your PC to access wireless internet and allows the laptop to access the internet via the PC

    Basic information about ICS are HERE

    Manuals for the Dovado HERE

  • It says I have a download error, and every time I download it says the same thing

    It says I have a download error, and every time I download it says the same thing

    Mac or Windows and EXACTLY what version of the operating system?

    Recent Mac AND Windows operating systems have been known to cause problems "weird."

    Are you using a computer administrator account will be full read/write permissions?

    Please read https://forums.adobe.com/thread/1499014

    -try some steps such as changing browsers and disable your firewall

    -also clear the cache of your browser if you start with a fresh browser

    -check the file hosts for blocked entries https://forums.adobe.com/thread/1912777

    http://myleniumerrors.com/installation-and-licensing-problems/creative-cloud-error-codes-w ip.

    https://helpx.Adobe.com/creative-cloud/KB/creative-cloud-desktop-application-failed.html

    http://helpx.Adobe.com/creative-cloud/KB/failed-install-creative-cloud-desktop.html

  • When I download creative cloud and go into apps download illustrator, under the applications section, it says download error. tried to download several times more, again the same error. What can I do?

    When I download creative cloud and go into apps download illustrator, under the applications section, it says download error. tried to download several times more, again the same error. What can I do?

    Hello

    I think that you have found the "download error" in the Apps Panel.

    Please check the help below document:

    Download error in the applications tab of Creative Cloud Desktop Application

    You can also view the threads below:

    https://forums.Adobe.com/thread/1832357

    Persistent Cloud error - error download - creative

    Re: Creative Cloud "Download error" message

    Kind regards

    Sheena

  • Error message 0 x 80004005 Unspecified error trying to connect to either network drives and printers network on the same network or network drives that are on the same workgroup.

    Essentially, this problem started last Friday and I tried all possible combinations and the thing that I know so far about how to solve this problem and I terribly need a solution because I use this laptop in a University to take notes and print them out / store them on the network. Right now I can ping both servers (one is a print server and the other server network file storage), but in both cases, when I try to connect to them using windows Explorer by the name of \\server name\share or \\printserver\ (the other usually allows me to see a table of printers that are in different locations and I choose who I connected to my laptop). The other method, I have tried to use, which works normally and does not now to map the network drive storage is the net use command, if I try this method, I will get a "system error 1231 has occurred the network location cannot be reached". The third method (which is more commonly used I think) is the ability to connect a network drive in Windows Explorer, usually if I use the third method, I get a response from the storage server file asking for user credentials, now I get the same error message as when I try to connect with the first method of.

    The biggest mystery of this all is that this happens regardless if I'm on the wired or wireless, and in both scenarios, I have access to the internet available, but as mentioned above, no access to storage or a network printer.

    * Use at your own risk, but it worked in my case (ensure you know / remember passwords field before doing so).

    If (since) you are using Windows 7 and you suddenly have problems connecting to a resource of the area (especially after a password reset):

    1) go to:->-> advanced user accounts manage user accounts-> manage passwords

    (2) If you see Windows credentials, delete them all.

  • error message says "another computer on the network has the same IP address.

    can interfere with my internet connection.  How can I fix this (plain English please.  "I'm not a COMPUTER expert.)

    This means that you have two devices with the same IP address on your network. It simply means that two machines are configured with the same IP address (you have a PS3, XBox360, another computer/laptop?).

    Each device needs a unique IP address works properly on a network. A reboot will usually solve the problem, unless both devices have their IP address a static address.

    Here's how you check/change it (Windows XP):

    1. click on START > network and Internet > network connections.
    2. double-click on your connection LAN or Internet.
    3. click on properties.
    4. click on the general tab.
    5. Select Protocol Internet (TCP/IP), and then click Properties.
    6. click on the general tab.
    7. select Obtain IP address automatically and DNS server automatically get an address.
    8 OK on all windows and when you are back on the desktop, restart your system.

    In addition, the Fund this site for more information!
    http://support.Microsoft.com/kb/306126

    I hope this helps!

    Brett M.
    Windows outreach team

  • Voice traffic of users connected to the same SSID

    Hello

    I have a doubt about the following scenario. Let's say I have a controller and a separate SSID for Wireless IP Phone. Users connected to this same ssid sends traffic directly between devices or the traffic passing through the tunnel? Can I activate local switching Reap H in this scenario? I'm new to the scenario of voice so forgive me on all errors.

    The controller is on the same principle. VG/Call manager is also on the same principle.

    AP in local mode or switched central would pass all traffic to the controller. So the question would be, this mode raises questions with the voice of your network?  H - REAP or FlexConnect how it is now called, can pass traffic directly to the switch, the AP is connected to, but it has limits.  The limits lie on the FlexConnect design guide.

    -Scott

    Please evaluate the useful messages *.

  • "Another computer on the network has the same IP address as this computer. Contact you network administrator for help resolving this issue. More details are available in the Windows system event log"

    Please, anyone can help as I don't know what to do? I am running Vista to the Windows Welcome page
    I am the administrator and I have no other computers attached to my laptop?
    I use the same USB port to connect to internet, but recently, I had to try another USB port I get the above error message.
    I have no idea how to do to correct the situation and would appreciate guidance step by step.
    Thank you.

    Hi RDCICON,

    1. which device you are connected to the USB port?

    2. you still get the same message when you connect the usb device or use the device on another computer?

    Method 1:

    You can try to run the tool built into Vista Network Diagnostics. To do this, click Start, go to network and select network share.

    On the left side of the window select the diagnosis and repair.
    It should help to find which device is listed with the duplicate IP address.

    Method 2: Release and renew the IP address by following these steps.

    a. Click Start. Click Run, type cmd, press ENTER.

    b. at the command prompt, type the following command and press ENTER

    ipconfig/release

    ipconfig / renew

    Method 3:

    Check and confirm the DHCP client service is started and set to automatic.

    If the DHCP client service is not running, then set it to autostart. Steps to set the auto service:

    a. click the Start button

    b. type services.msc in the search box.

    c. search for DHCP client and set it to automatic and make sure that it is started.

    Method 4:

    Reset the router and see if the problem persists.

    You can refer to the 3mentioned of general troubleshooting method in the following article to reset the router.

    http://support.Microsoft.com/kb/956196#Gm3

    You can also see the producers of the router manual or contact support for additional assistance.

    Hope this information is useful.

  • AnyConnect Client - connect to two different ASA virtual private networks at the same time?

    If I am already connected to a remote access using Anyconnect VPN, is it possible to connect to another on a different ASA?

    The option to connect is grayed out until I disconnect one. I don't see any way to launch another Anyconnect session!

    I can connect to one successfully by themselves.

    Neither one is "all traffic" tunneling, just a couple secure hosts for each of them.

    Thank you!

    I think that you can only connect to a VPN at the same time. So unfortunately not possible.

Maybe you are looking for