establish the GRE/IPSEC behind ADSL router

Similar Questions

• The GRE + IPSEC but have no encypt certain traffic?

  Hello

  I'm banging my head a little bit here. I want to encrypt all traffic between 2 sites except voice.

  On the cisco site, it would appear that the command "crypto map" should appear on the two physical (in this case Dialer) and on the Tunnel interface. Why is it necessary on the Tunnel interface?

  I have configured the following: -.

  !

  match class-map telnet

  game of telnet Protocol

  class-map correspondence citrix

  citrix Protocol game

  match class-map Telnet

  game of telnet Protocol

  Note voice-signaling class-card

  game group-access 151

  class-map correspondence-telephone traffic

  group-access 150 game

  !

  !

  Policy-map VOICE-POLICY

  class of traffic-voice

  priority 96

  voice-signaling class

  bandwidth 8

  citrix class

  bandwidth 24

  telnet class

  class class by default

  Fair/fair-queue

  !

  !

  !

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 2

  preshared authentication

  Group 2

  ISAKMP crypto key 123456 address xxx.xxx.xxx.xxx

  !

  !

  Crypto ipsec transform-set esp - esp-sha-hmac peter-series

  Crypto ipsec transform-set esp-3des esp-md5-hmac DYNA-3DES

  !

  Crypto-map dynamic dynamap 10

  game of transformation-DYNA-3DES

  !

  !

  card crypto xxxx address-local Dialer1

  XXXXX map ipsec-isakmp crypto

  defined peer xxx.xxx.xxx.xxx

  peter-Set transform-set

  match the vpn address

  QoS before filing

  map PeterHomemap 40-isakmp ipsec crypto dynamic dynamap

  !

  !

  !

  Tunnel1 interface

  Description Tunnel to the office

  bandwidth 256

  IP 10.10.20.2 255.255.255.0

  QoS before filing

  KeepAlive 10 3

  source of Dialer1 tunnel

  tunnel destination xxx.xxx.xxx.xxx

  !

  interface Dialer1

  bandwidth 256

  the negotiated IP address

  IP access-group entering

  IP mtu 1458

  NAT outside IP

  inspect the myfw over IP

  encapsulation ppp

  load-interval 30

  Dialer pool 1

  Dialer-Group 1

  card crypto PeterHomemap

  service-policy output VOICE-POLICY

  waiting-224 in

  !

  list of IP - vpn access scope

  deny udp 192.168.9.0 0.0.0.255 192.168.0.0 0.0.255.255 16384 32767 rank

  deny tcp 192.168.9.0 0.0.0.255 eq 1720 everything

  deny tcp 192.168.9.0 0.0.0.255 192.168.0.0 0.0.255.255 eq 1720

  allow gre 10.10.20.2 host 10.10.20.1

  allow gre hote.yyy host xxx.xxx.xxx.xxx

  !

  Note access-list 150 Match all voice traffic

  access-list 150 permit udp everything any 16384 37276 Beach

  Note access-list 151 correspond to all voice traffic

  access list 151 permit tcp any eq 1720 everything

  access list 151 permit tcp any any eq 1720

  Can anyone suggest a better way to accomplish the non-voix encryption only traffic, and also if an expert out there can explain the card crypto interface Tunnel thing, that would be great!

  Thank you

  Peter.

  Let me explain the whole thing in its entirety.

  You have a public IP address or the other site and you form a GRE tunnel to route your IPs private above the GRE tunnel. This traffic includes voice and data. Then create your IPSec policy only traffic to be corresponding encryped (u know have explicitly deny the telephone traffic) and apply the crypto map on the tunnel. Who should install the IPSec VPN for you. This is the best medium for what is as iam concerned (I did in one case as well).

  Instead of carrying all the traffic thorugh one IPSec VPN and data on a GRE traffic, according to me, you can send voice traffic on free WILL and encrypt traffic IPSec over GRE.

  Hope that clarifies.

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• The GRE and IPSec

  We currently have several sites with ISAKMP/IPSec tunnels between routers 2800 and we need some of them migrate to the GRE with IPSec tunnels. Are there problems with endpoint tunnels GRE and IPsec on the same router and interface?

  I didn't know all the problems - apart from the router doing the encryption/decryption & GRE encapsulation/decapsulation, just be respect for traffic through the put.

  I have noted problems with traffic GRE and MTU problems. Cisco recommends a MTU of 1440 at Discretion, I would say that set 1400.

  HTH

• Access to the COR to two XP systems behind a router with a single public IP address

  Hello

  is it possible to access the RDC to two XP systems, with two different port for the DRC, behind a router with a single public IP address?

  Please note this ia a small home network without any parameters of the field. I use IP to access DRC.

  You comments are appreciated.

  Thank you

  Use different ports for the DRC on both XP and configure the router to redirect to the appropriate port on the appropriate computer.

  See the article in the Microsoft Knowledge Base How to change the listening port for remote desktop .

• I need help to set up the linksys adsl router

  Hello world!

  I have LINKSYS WIRELESS - N HOME ADSL2 + MODEM ROUTER (wag120n) and I connect to the internet via the cable that I took my friend who already SPEEDTOCH ADSL ROUTER, I bought the d-link wireless card and I install it in one of my PC
  what I need is to set up my linksys wireless router for my two PCs, on via the wireless and another an ethernet cable, how can I do?

  thanks4all

  Follow this link to configure the router.

• I have windows vista business edition is installed on the desktop and Vista home edition on my laptop I can't access files on the laptop and vice versa, I am using a d-link adsl router can u help me solve the issues___Thanks__Peter

  I have windows vista business edition is installed on the desktop and Vista home edition on my laptop I can't access files on the laptop and vice versa, I am using a d-link adsl router can u help me solve problems

  Thank you
  Peter

  Hello

  The easiest way is with a crossover cable - a special wire to connect the two systems.
  You can get one at your local computer store - they are not expensive.

  Also check with the site of the manufacturer of your router, because they will have in-depth details on how to
  set up the network.

  ====================================

  Or you can set up a wired or wireless network.

  Setting up a network home
  http://Windows.Microsoft.com/en-us/Windows-Vista/setting-up-a-home-network

  Home network, wireless network and computer networking Made Easy
  http://www.home-network-help.com/

  Windows Vista tip: How to install and connect to a wireless network
  http://www.watchingthenet.com/Windows-Vista-tip-how-to-Setup-and-connect-to-a-wireless-network.html

  Ad-hoc networking
  http://windowshelp.Microsoft.com/Windows/en-us/help/0e158c21-4C70-4235-879d-0c9133218e561033.mspx
  Set up a computer-to-computer (ad hoc) network
  http://windowshelp.Microsoft.com/Windows/en-us/help/293c504f-b944-4d5d-835c-f080129bd5dc1033.mspx

  How to set up an Ad Hoc wireless network in Windows Vista
  http://www.home-network-help.com/ad-hoc-wireless.html

  Create an ad hoc WiFi network secure on Windows Vista
  http://www.Intel.com/support/wireless/WLAN/sb/CS-025386.htm

  Networking tutorial home
  http://www.tehnomagazin.com/computer/home-networking-tutorial.htm
  Practically networked - everything you could possibly want to know.
  http://www.practicallynetworked.com/

  I hope this helps.
  Rob - bicycle - Mark Twain said it is good.

• The GRE over IPSec vpn

  VAC

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008009438e.shtml#diag

  It's lab that I did today, and offcouse, I am able to understand this laboratory bus are confusion

  1. Why do we use a card encryption on both interfaces (phiycal tunnel interface or interface)

  
  

  2. when I remove the interface tunnel encryption card I have this message

  ( R2691 #* 01:12:54.243 Mar 1: ISAKMP: (1002): purge node 2144544879 )

  Please tell me what is the meaning of this message

  3. but I do not see vpn works great. It comes to cryto his and crypto isakmp his

  R2691 #sh crypto ipsec his

  Interface: Serial0/0

  Crypto map tag: vpn, local addr 30.1.1.21

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (30.1.1.21/255.255.255.255/47/0)

  Remote ident (addr, mask, prot, port): (10.1.1.1/255.255.255.255/47/0)

  10.1.1.1 current_peer port 500

  LICENCE, flags is {origin_is_acl},

  #pkts program: 65, #pkts encrypt: 65, #pkts digest: 65

  #pkts decaps: 66, #pkts decrypt: 66, #pkts check: 66

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0

  #pkts not unpacked: 0, #pkts decompress failed: 0

  Errors in #send 2, #recv 0 errors

  local crypto endpt. : 30.1.1.21, remote Start crypto. : 10.1.1.1

  Path mtu 1500, mtu 1500 ip, ip mtu IDB Serial0/0

  current outbound SPI: 0xDBF65B0E (3690355470)

  SAS of the esp on arrival:

  SPI: 0x44FF512B (1157583147)

  transform: esp-3des esp-md5-hmac.

  running parameters = {Tunnel}

  Conn ID: 5, flow_id: SW:5, crypto card: vpn

  calendar of his: service life remaining (k/s) key: (4598427/3368)

  Size IV: 8 bytes

  support for replay detection: Y

  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  SPI: 0xDBF65B0E (3690355470)

  transform: esp-3des esp-md5-hmac.

  running parameters = {Tunnel}

  Conn ID: 6, flow_id: SW:6, crypto card: vpn

  calendar of his: service life remaining (k/s) key: (4598427/3368)

  Size IV: 8 bytes

  support for replay detection: Y

  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  R2691 #sh crypto isakmp his

  IPv4 Crypto ISAKMP Security Association

  status of DST CBC State conn-id slot

  30.1.1.21 10.1.1.1 QM_IDLE 1002 ASSETS 0

  ISAKMP Crypto IPv6 security association.

  How can 2: I know it using GRE over IPsec.

  I also join my topology on which I made lab

  Also beyond what I remember, in the old codes he was required to have a card encryption on tunnel and physical interface, but now is not.

  Since we use GRE over IPSEC, so for the verification of the tunnel I'll do the following steps:

  (1.) to check if the tunnel interface is in place. "show ip int br".

  2.) check if the statistics of tunnel are increasing and packages are browsing through it. 'show interface '.

  3.) check if crypto ACL includes only interesting traffic listed as GRE counterparts.

  (4.) If Yes, check the IPSEC Security Association statistics. "See the crypto ipsec his."

  If all of them are correct statistical evidence with respective counters increase traffic is passing by GRE and then by wrapping in IPSEC.

  I hope this helps.

  Kind regards

  Anuj

• Impossible to establish a VPN connection with a router configured as a Cisco server using client VPN 5.0.00.0340

  Hei guys,.

  Please help me on this one because I'm stuck enough on her...

  I am trying to connect to a Cisco 3700 router configured as a VPN server by using a VPN client and the VPN connection does not settle.

  This is an extract from the log:

  130 12:48:30.585 07/01/11 Sev = Info/5 IKE / 0 x 63000001
  Peer supports XAUTH
  131 12:48:30.585 07/01/11 Sev = WARNING/3 IKE/0xE3000057
  The HASH payload received cannot be verified
  132 12:48:30.600 07/01/11 Sev = WARNING/2 IKE/0xE300007E
  Failed the hash check... may be configured with password invalid group.
  133 12:48:30.600 07/01/11 Sev = WARNING/2 IKE/0xE300009B
  Impossible to authenticate peers (Navigator: 904)
  134 12:48:30.600 07/01/11 Sev = Info/4 IKE / 0 x 63000013
  SEND to > ISAKMP OAK INFO (NOTIFY: INVALID_HASH_INFO) for 200.100.50.173

  I enclose the whole journal extract... The message "BOLD" is quite obvious, you mean, but I'm 100% sure, in the login entry, I typed correctly the group password: pass

  My topology is very basic, as I am setting this up only to get a clue of the operation of the Cisco VPN. It is built in GNS3:
  -2 3700 routers: one of them holds the configuration of the VPN server and the other would be the ISP through which the remote worker would try to establish a VPN connection. I am also attaching the configuration file for the router configured as a VPN router.

  Behind the second router there is a virtual XP machine on which I have installed VPN client...

  My connection entry in the customer is to have the following parameters:
  Host: 200.100.50.173 , //which is the IP address of the VPNServer
  Authentication-> authentication-> name group: grup1 password: pass / / I'm quite positive that I typed the correct password... even if the log messages are linked to a misidentification.

  I use public addresses only, because I noticed there is a question about behind the NAT VPN connections and is not not very familiar to the NAT.

  Another aspect which can be of any importance is that "allow Tunneling of Transport" in the tab Transport to the input connection is disabled

  and the VPNServer router logs the following error message when you try to establish the connection:

  * 01:08:47.147 Mar 1: % CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE 200.100.50.34 package was not encrypted and it should have been.
  * 01:08:47.151 Mar 1: % CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE 200.100.50.34 package was not encrypted and it should have been.
  

  You have no idea why I can't connect? Y at - it something wrong with my configuration of VPN server... or with the connection entry in the VPN client?

  Thank you

  Iulia

  Depending on the configuration of the router, the group name is grup1 and the password is baby.

  You also lack the ipsec processing game that you would need to apply to the dynamic map.

  Here is an example configuration for your reference:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080235197.shtml

  Hope that helps.

• PIX and ADSL router.

  I have, in a site, a PIX 515 connected to a C827H (an ADSL router as PPPoE). This router provides access to the Net. In another site, I have another PIX (a 506) and another router C827H which gave access to the Net. Both sites have access to the net without problems. But when I have what it takes to establish a VPN (Ipsec) tunnel between the two sites, across the Net, I can t make the connection. The ADSL router has their public IP is negotiated with the provider. In my lab, I simulate this two connections put two PIX (a 520 and a 506) back to back with a crossover cable. I used the same configuration. The thing worked. But in my two sites that does not work. Why?

  I see, in this case. I suggest that change you the name of the ACL defined in crypto card, try not to use the same ACL you used for nat0, it poses problems sometimes.

  Try and see if it works for you.

  -Jimmy

• The GRE Tunnel descends?

  So here's my setup:

  Internal router (2821) > Cluster internal DMZ ASA > router DMZ (2821) > external DMZ Checkpoint Cluster > Branch Office router (877)

  Internal Cluster ASA a configured PAT production internal then all the VLANS.

  The router in the DMZ has an interior interface configured on the internal DMZ and an external interface configured on the external DMZ. The DMZ router has two interfaces configured loopback.

  The external control point is configured with NAT for the incoming and outgoing traffic.

  The branch is a DSL router with a static IP address.

  The first requirement is to configure a GRE IPSec tunnel between the DMZ router and the branch office router.

  The second condition is to configure a GRE IPSec tunnel between the internal router and the router in the DMZ.

  The third requirement is to allow routing between the internal router and the branch through the router in the DMZ, because it is ultimately the connection between the head office and branch of live backup.

  I configured a Contract by the IPSec Tunnel between the router in the DMZ and routers of Management Office successfully.

  I can also set up a GRE Tunnel (without IPSec) between the internal router and the router in the DMZ.

  However, whenever the GRE Tunnel establishes between internal and DMZ routers and a neighbouring forms EIGRP, EIGRP neighborhood between the router in the DMZ and the branch drops! See following the DMZ router log file:

  1 = to branch tunnel

  Tunnel of 100 = internal

  002885:. 3 Mar 22:32:57.013: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed State to
  002886:. 3 Mar 22:33:06.029: % DUAL-5-NBRCHANGE: IPv4 EIGRP 1: neighbor 172.17.205.61 (Tunnel1) is on the rise: new adjacency
  002889:. 3 Mar 22:33:58.434: % LINK-3-UPDOWN: Interface Tunnel100, changed State to
  002890.: 3 Mar 22:33:58.438: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel100, changed State to
  002891:. 3 Mar 22:34:15.370: % DUAL-5-NBRCHANGE: IPv4 EIGRP 1: neighbor 192.168.5.66 (Tunnel100) is on the rise: new adjacency
  002892:. 22:34:30.551 3 Mar: % DUAL-5-NBRCHANGE: 1 IPv4 EIGRP: neighbour 172.17.205.61 (Tunnel1) is falling: expiry of hold time
  002893:. 3 Mar 22:34:47.015: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, state change downstairs

  The IPSec tunnel, for the branch remains in place throughout.

  Can anyone help!?

  The problem was that whenever the GRE Tunnel established between internal and DMZ routers and a forms of EIGRP neighbor branch was learning the next hop to the destination of tunnel from a different device.

  This is how the branch was to learn the route to the tunnel destination:

  Tunnel1 interface

  Tandragee Sub Station router VPN Tunnel description

  bandwidth 64

  IP 172.17.205.62 255.255.255.252

  no ip-cache cef route

  delay of 20000

  KeepAlive 10 3

  source of tunnel Loopback1

  tunnel destination 172.17.255.23

  be-idz-vpn-01 #sh ip route 172.17.255.23

  Routing for 172.17.255.23/32 entry

  Through the 'static', the metric distance 1 0 known

  Routing descriptor blocks:

  * 172.17.252.129

  Path metric is 0, number of shares of traffic 1

  be-idz-vpn-01 #sh ip route 172.17.252.129

  Routing for 172.17.252.128/25 entry

  Known via 'connected', distance 0, metric 0 (connected, via the interface)

  Routing descriptor blocks:

  * directly connected by GigabitEthernet0/1

  Path metric is 0, number of shares of traffic 1

  be-idz-vpn-01 #.

  This is how the next hop as learned GRE Tunnel between internal and DMZ routers

  be-idz-vpn-01 #sh ip route 172.17.252.129

  Routing for 172.17.252.128/27 entry

  By the intermediary of "eigrp 1", the known distance 170, metric 40258816, type external

  Redistribution via eigrp 1

  Last updated on Tunnel100 192.168.5.66, ago 00:07:25

  Routing descriptor blocks:

  * 192.168.5.66, 192.168.5.66, there is, through Tunnel100 00:07:25

  Path metric is 40258816, 1/number of shares of traffic is

  Time total is 10110 microseconds, minimum bandwidth 64 Kbps

  Reliability 255/255, MTU minimum 1476 bytes

  Loading 1/255, 2 hops

  We can see how the next hop to the destination of tunnel 172.17.255.23 changed from known via 'connected' via GigabitEthernet0/1 known via "eigrp 1" through Tunnel100.

  This case causes the Tunnel 1 drops.

  The reason for this behavior was because the road to reach the next hop was acquired with a longest match through tunnel interface so that he won the race to the routing table.

  The solution we applied:

  Created a list of distribution on the branch office router in order to remove this specific route Tunnel 100 updates.

  Router eigrp 1

  distribute-list 1

  Network 10.10.10.0 0.0.0.3

  network 172.17.203.56 0.0.0.3

  network 172.17.203.60 0.0.0.3

  network 172.17.205.60 0.0.0.3

  network 172.19.98.18 0.0.0.0

  network 192.168.5.64 0.0.0.3

  passive-interface Loopback1

  be-idz-vpn-01 #sh access-list 1

  IP access list standard 1

  10 deny 172.17.252.128, wildcard bits 0.0.0.127 (1 match)

  20 permit (1230 matches)

  be-idz-vpn-01 #.

  Once this has been applied, we could have the GRE Tunnel established between internal and DMZ routers with the tunneld ACCORD between the branch and the router in the DMZ.

• Using Loopback Interface as Source GRE/IPSec tunnel

  Hi all:

  I need one to spend a working router to router VPN tunnel using an IP WAN IP interface loopback as a source.  I am able to ping the loopback from the other router.  As soon as I change the source of tunnel to use the loopback IP address, change the encryption ACL map, and move the cryptographic card of the WAN interface to the loopback interface, the tunnel will not come to the top.  If I remove all the crypto config, the tunnel comes up fine as just a GRE tunnel.  On the other router, I see the message that says that's not encrypting the traffic below.

  * 00:10:33.515 Mar 1: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet. (ip) vrf/adr_dest = 192.168.0.1, src_addr = 192.168.1.2, prot = 47

  What Miss me?  Is there something else that needs to be done to use the closure of a GRE/IPSec tunnel?

  I have install below config in the laboratory to see if I can get it even work in a non-production environment.

  R1 WAN IP: 192.168.0.1

  R2 WAN IP: 192.168.0.2

  R2 Closure: 192.168.1.2

  hostname R2

  !

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key abc123 address 192.168.0.1

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac T1

  transport mode

  !

  crypto map 1 VPN ipsec-isakmp

  Description remote control

  defined peer 192.168.0.1

  game of transformation-T1

  match address VPN1

  !

  interface Loopback0

  IP 192.168.1.2 255.255.255.255

  VPN crypto card

  !

  Tunnel1 interface

  IP 172.30.240.2 255.255.255.252

  IP mtu 1440

  KeepAlive 10 3

  tunnel source 192.168.1.2

  tunnel destination 192.168.0.1

  VPN crypto card

  !

  interface FastEthernet0

  IP 192.168.0.2 255.255.255.0

  !

  VPN1 extended IP access list

  allow ACCORD 192.168.1.2 host 192.168.0.1

  you have tried to add "card crypto VPN 1 - address Loopback0".

• verification of IPSec on IOS / router

  is there a way to check Cisco router syslogs an IPSec tunnel is established with another Cisco router / peer? I've been looking at manuals system (DRY, events Crypto) Message and sees that things that would indicate problems - would be able to verify syslogs to validate that a tunnel came without a problem, or if a tunnel down, etc. but not sure what these messages look like.

  Thank you

  -randy

  Randy, now I understand!

  What I would do in this case is a number of things, but it must again some minor configuration on the router, it depends on the managed router provider, but... you should be able to ask the provider know that you want to get traps syslog from the router to your syslog server and they should be able to provide this and they should provide that After all, you pay for the services, even if is a router that is handled by the provider.

  On the router thye should set up a secondary server logging.

  e.i

  say that your syslog server is 20.20.20.20

  Router (config) #logging 20.20.20.20

  trap to Router (config) #logging of information

  the foregoing information is facilitated #6 on the 7 levels of ease, 0 being emergency 1 critical alerts 2 and so on... I think with this # info tunnel facility appears in the syslog.

  In addition, on the access lists on the tunnel Ipsec-L2L add the log keyword at the end of each of its access-list, with the journal of Keywork, the router will send traps related to the access list to your syslog, providing you with as well as the connection is stablihed or not.

  Rgds

  -Jorge

• EA4500 + ADSL router: networking noob question

  Then... I'm not sure of the right words to use, but this is the case I would appreciate the help. I tried to figure out how to survive myself, but I find it a little confusing - however, if you think I just need a networking 101 do not hesitate to send me to appropriate information sources (I've tried a few, as I say, but I have not yet found a place where my situation fits!).

  Quick back story: I have a cheap TalkTalk ADSl router (D-Link 3680) where the Wireless does not properly in the House. So I just got a DSL EA4500 router for better strength/speed/compliance wireless - you'll just have to forgive me for not having an ADSL router, which I realize may have been a simpler solution!

  First of all, I put the (D-Link of TalkTalk 3680) ADSL router in Bridge mode and got this and the EA4500 work together which was great as it goes. However, I would be hard...

  I have a tower PC and wish to receive wired ethernet network. While I know in the set - up above I can run a cable from the 3680 to the EA4500 and then another cable to the PC because the PC is closer to the telephone (with the ADSL router) Jack, physically it seems wiser, if I take the PC of the 3680 ethernet connection (along with a second cable 3680 to EA4500 connection for the wireless). It may or may not be relevant that the 3680 is a Fast Ethernet output, as is the network PC card (i.e. are not Gigabit).

  I don't know (a) whether the above configuration is possible and if yes, how, or (b) the question whether in terms of networking, it is best to cable to the EA4500 computer (even if this will create a longer path to the PC and the wiring more).

  Meaning, and if yes maybe someone could give me also a term for what I'm doing?

  Help gratefully received! Garreth

  3680 port LAN (bridge) => EA4500 Port WAN (router)-online PC peripherals and wireless

  It's the best configuration and nothing should be connected to the 3680 other than the EA4500.

  The physical location of the electronics is not important, unless you can not run cable or wireless signal is low.

• Connect the 2 locations using RV016 router to fill 2 different networks.

  I have a RV016 connected to a comcast cable modem to slot 1 with IP 192.168.6.1

  I have a RV016 connected to a comcast cable modem at the 2 with 192.168.10.1 IP location

  I installed a VPN tunnel from gateway to gateway between 2 routers RV016.

  I have a LAN in slot 1 with the IP 192.168.1.1, which connects to the internet through an Adtran router with 4 lines of T1 servile.

  I have a LAN with IP 192.168.5.1 2 location that connects to the internet through an Adtran router with 3 T1 lines servile.

  I like a computer to location 2 to connect to the RV016 in the local Comcast modem to the Comcast modem at location 1 in the RV016 to slot 1 then go out to the local network at location 1 and communicate with an application server on LAN 1.

  Help, please.

  You can't do that with a RV016. The RV016 only supports layer 3 tunnel. This means that the two ends are different networks with different subnets. The traffic between them is not filled.

  If you want to really two bridged networks, i.e. join in a single LAN with a single IP subnet and a single broadcast domain you need a layer 2 tunnel, for example a tunnel L2TPv3. That works on layer 2, which is on the MAC addresses inside your networks. In this way, you can use the same IP subnet at both ends and on each side, it seems that the other side is connected to the same ethernet network.

  The RV016 does not support the tunneling of layer 2. You can create an IPSec tunnel, which is layer 3. If there is really a need for a tunnel layer 2, you get different devices. I recommend that you evaluate if a layer 2 connection is really necessary or not.