Firewall VPN, VMs and VLAN

Similar Questions

• VPN and VLAN

  We have a site divided into 2 IEE802.1Q VLAN, using no switches Cisco. They have a PIX515 for Internet access. It is also configured to provide inbound VPN access for management and general purpose of access.

  In principle it is possible to set up a new VPN connection which is reflected by its interior traffic be tagged with a specific VLAN ID while all other traffic (including other VPN connections) remain without a label?

  If the PIX ends your VPN from the outside that the answer is no. If the VPN is coming from outside, and ending at the PIX she never travels a VLAN. VLAN tagging is used to identify what VLAN came from a source image and what VLAN it is intended for a current switch vlan can 'route' frame through the appropriate VIRTUAL LAN. Why you want to tag from outside VPN traffic? If it's to control access, you can specify 2 VLANS and VLAN 3 on the PIX (as long as it has code 6.3) and control what VLAN, you want that each group VPN access to through the use of the ACL. Each VLAN on a PIX is treated as a physical interface. It has its own security prefs (0-100) and can have ACL applied to them as well as the physical interfaces.

• Conflicts with native Firewall VPN

  I use OS X El Capitan 10.11.4

  I have subscribed to a VPN connection provided by PIA (private Internet access) and noticed that the client VPN of PIA disables native firewall protection for OS X El Capitan.  This isn't really a concern as long as the duration of the VPN connection and the computer is protected via the VPN and its own firewall.  However, when the VPN connection drops and I'm not around to immediately re-engage the OS X Firewall, there is a period of time when the computer is not protected by a firewall.  Support to PIA could not provide me with a conclusive answer to this subject, and it seems unsure as to if there is a viable solution to this any time soon.

  First question: is there a work around to avoid the defusing of the OS X Firewall?

  Second question: is there a way to force an instant VPN reconnect as soon as the VPN connection is lost?

  Hello dubwisedude,

  Don't worry the Firewall of OS X. It's a waste of time. If you are concerned about these things, don't turn on all sharing services. Firewalls is misunderstood. They are tools for network administrators. They don't have much use for end users. The Application OS X Firewall is particularly useless. Its default behavior is to allow about anything, sometimes without tell you about it.

• Access VPN ASA and cisco ISE Admin

  Hello

  Currently I'm deployment anyconnect VPN Solution for my client on ASA 9.2 (3). We use the ISE 1.3 to authenticate remote users.

  In the policy stipulates the conditions, I put the condition as below.

  Policy name: Anyconnect

  Condition: DEVICE: Device Type Device Type #All Device Types #Dial - in access EQUALS AND
  RADIUS: NAS-Port-Type is equal to virtual

  I'm authenticating users against the AD.

  I am also restrict users based on group membership in authorization policies by using the OU attributes.

  This works as expected for remote users.

  We also use the ISE to authenticate administrators to connect to the firewall. Now what happens is, Cisco ASA valid also against policy, administrators and their default name Anyconnect.

  Now the question is, how to set up different political requirement for access network admin and users the same Firewall VPN.

  Any suggestions on this would be a great help.

  See you soon,.

  Sri

  You can get some ideas from this article of mine:

  http://ltlnetworker.WordPress.com/2014/08/31/using-Cisco-ISE-as-a-generic-RADIUS-server/

• Cisco VPN Client and Windows XP VPN Client IPSec to ASA

  I configured ASA for IPSec VPN via Cisco VPN Client and XP VPN client communications. I can connect successfully with Cisco VPN Client, but I get an error when connecting with the XP client. Debugging said "misconfigured groups and transport/tunneling mode" I know, they use different methods of transport and tunneling, and I think that I have configured both. Take a look at the config.

  PS a funny thing - when I connect with client VPN in Windows Server 2003, I have no error. The only difference is that client XP is behind an ADSL router and client server is directly connected to the Internet on one of its public IP of interfaces. NAT in the case of XP can cause problems?

  Config is:

  !

  interface GigabitEthernet0/2.30

  Description remote access

  VLAN 30

  nameif remote access

  security-level 0

  IP 85.*. *. 1 255.255.255.0

  !

  access-list 110 scope ip allow a whole

  NAT list extended access permit tcp any host 10.254.17.10 eq ssh

  NAT list extended access permit tcp any host 10.254.17.26 eq ssh

  access-list extended ip allowed any one sheep

  access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh

  sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0

  tunnel of splitting allowed access list standard 192.168.121.0 255.255.255.0

  flow-export destination inside-Bct 192.168.1.27 9996

  IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0

  ARP timeout 14400

  global (outside-Baku) 1 interface

  global (outside-Ganja) interface 2

  NAT (inside-Bct) 0 access-list sheep-vpn

  NAT (inside-Bct) 1 access list nat

  NAT (inside-Bct) 2-nat-ganja access list

  Access-group rdp on interface outside-Ganja

  !

  Access remote 0.0.0.0 0.0.0.0 85.*. *. 1 2

  Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1

  Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1

  Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1

  Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1

  Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1

  Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1

  Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1

  Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1

  dynamic-access-policy-registration DfltAccessPolicy

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  Crypto ipsec transform-set newset aes - esp esp-md5-hmac

  Crypto ipsec transform-set esp-3des esp-md5-hmac vpnclienttrans

  Crypto ipsec transform-set vpnclienttrans transport mode

  Crypto ipsec transform-set esp-3des esp-md5-hmac raccess

  life crypto ipsec security association seconds 214748364

  Crypto ipsec kilobytes of life security-association 214748364

  raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

  vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1

  card crypto interface for remote access vpnclientmap

  crypto isakmp identity address

  ISAKMP crypto enable vpntest

  ISAKMP crypto enable outside-Baku

  ISAKMP crypto enable outside-Ganja

  crypto ISAKMP enable remote access

  ISAKMP crypto enable Interior-Bct

  crypto ISAKMP policy 30

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  No encryption isakmp nat-traversal

  No vpn-addr-assign aaa

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.192 outside Baku

  SSH 10.254.17.26 255.255.255.255 outside Baku

  SSH 10.254.17.18 255.255.255.255 outside Baku

  SSH 10.254.17.10 255.255.255.255 outside Baku

  SSH 10.254.17.26 255.255.255.255 outside-Ganja

  SSH 10.254.17.18 255.255.255.255 outside-Ganja

  SSH 10.254.17.10 255.255.255.255 outside-Ganja

  SSH 192.168.1.0 255.255.255.192 Interior-Bct

  internal vpn group policy

  attributes of vpn group policy

  value of DNS-server 192.168.1.3

  Protocol-tunnel-VPN IPSec l2tp ipsec

  Split-tunnel-policy tunnelspecified

  Split-tunnel-network-list value split tunnel

  BCT.AZ value by default-field

  attributes global-tunnel-group DefaultRAGroup

  raccess address pool

  Group-RADIUS authentication server

  Group Policy - by default-vpn

  IPSec-attributes tunnel-group DefaultRAGroup

  pre-shared-key *.

  Hello

  For the Cisco VPN client, you would need a tunnel-group name configured on the ASA with a pre-shared key.

  Please see configuration below:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  or

  http://tinyurl.com/5t67hd

  Please see the section of tunnel-group config of the SAA.

  There is a tunnel-group called "rtptacvpn" and a pre-shared key associated with it. This group name is used by the VPN Client Group name.

  So, you would need a specific tunnel-group name configured with a pre-shared key and use it on the Cisco VPN Client.

  Secondly, because you are behind a router ADSL, I'm sure that's configured for NAT. can you please activate NAT - T on your ASA.

  "crypto isakmp nat-traversal.

  Thirdly, change the transformation of the value

  raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

  Let me know the result.

  Thank you

  Gilbert

• cannot ping remote ip on ASA no firewall (VPN site to site on SAA) configired no proxy, icmp not inspect, no chance

  some help me

  (Q) ping remote ip unable on ASA is not Firewall not on pc (VPN site to site on SAA) configired no proxy, icmp not inspect, no chance

  Note - I can ping PC but not the same subnet ip on ASA2 L3

  PC---> > ASA1 - ASA2<>

  Hi Matt,

  Let me answer your question in two points:

  • You cannot ping an ASA on another interface other than the one where you are connected to the ASA of.

  For example, ASA1 and ASA2 are connected through their interfaces 'outside '. ASA1 (or any other device on the external interface) can not ping/access ASA2 on his (ASA2) within the interface. The only time wherever this can be substituted is a tunnel VPN with the command "access management" configured for other interface, for example management-access inside

  • Traffic ASA1 ping to a remote client behind ASA2 won't over the VPN tunnel and as such is not encrypted. That's because ASA1 will forward traffic based on its routing table that probably this way through its 'outside' interface Except that traffic is allowed with the ASA2 (using the ACL), it will fail.

  We can do on the routers of sourcing our ping to another interface, but it will not work on the SAA.

• block access to the local asa firewall vpn accounts

  I'm looking for the local accounts on the firewall and would like to make sure that users who have local accounts for vpn do not have for the firewall itself through asdm, telnet, ssh to the management.

  Is the only aaa on the firewall command

  the ssh LOCAL console AAA authentication

  With this command, if I change the local account setting to 'NO ASDM, SSH, Telnet or access Console' (see attached screenshot) will that still allow users to vpn in and access the network because they have to take off but any what potential access to the firewall?

  Thank you

  Hello

  Yes, if you select the option "No., ASDM, SSH, TELNET or Console access" allows to block only the admin access to the firewall. Here's the equivalent CLI for this option:

  myASA(config-username) # type of service?

  the user mode options/controls:
  Admin user is authorized to access the configuration prompt.
  NAS-prompt user is allowed access to the exec prompt.
  remote user has access to the network.

  If you use this option you will be on the third option in the above list that is remote access. Users will have the option of VPN in but no admin (asdm, ssh, telnet or console)

  Thank you

  Waris Hussain.

• 8.3 (1) ASA Cisco VPN Client and IP Communicator - one-way communication

  Community salvation.

  I have a strange problem with my setup and I'm sure it's either some type of routing (or NAT) or just missing one rule allows traffic. But I'm now at a point where I would like to ask your help.

  I have a few users remote access that have the Cisco IP Communicator (CICC) application installed on their laptops. So:

  The VPN with CPIC user <> ASA Firewall <> router voice <> MAC <> IP phone

  The VPN works fine for all other traffic. The connection of basis for the IP Communicator works well. He get is connected to the CallManager, is shown as registered and you can even call an internal phone and also external phones. BUT: while you can hear the called party (if the phone internal) it does not work for the other direction. There is no sound from the remote/appellant.

  I already understood that it is also not possible to ping from the phone VPN to the internal subnet IP phone. While the VPN user can ping any other device in the network internal, he cannot do for Cisco IP phones. But if the VPN phone calls a phone no-internal (mobile...) - it works!

  My thought is that the call cannot be build up properly between the VPN phone and the internal phone.

  I found similar situations with google, but they are all for the reverse: call for internal works, but not for VPN.

  What do you think?

  Hello

  Usually ASA lists specific to the customer networks VPN Split Tunnel runs.

  This would mean that there is a Split Tunnel ACL used in configurations of the SAA for this VPN connection that needs to have the missing network added to the VPN connection traffic.

  -Jouni

• Client VPN Cisco and Cisco Secure

  Cisco VPN client and the VPN from Cisco Secure client free to use with pix firewall software?

  Thank you.

  Hello

  If you have a valid contract to Cisco and you can get the following link:

  http://www.Cisco.com/Kobayashi/SW-Center/SW-VPN.shtml

  with your CCO login, then you should be able to use these customers at no cost because they are already covered by the contract.

  Thank you and best regards,

  Abdelouahed

  -=-=-

• VPN list and access

  Hello

  I have a router Cisco SOHO 97 and I set up VPN to access through VPN client.

  There is no problem: VPN Client Connection--> OK, access to my network--> OK

  If I activate the IOS with CRTS Firewall: VPN Client Connection--> OK, but I can't access my network.

  This line is added when I activate the firewall:

  inspect the name myfw cuseeme timeout IP 3600

  inspect the IP name myfw ftp queue time 3600

  inspect the name myfw rcmd timeout IP 3600

  inspect the name myfw realaudio timeout IP 3600

  inspect the name myfw smtp timeout IP 3600

  inspect the IP name myfw tftp timeout 30

  inspect the IP name myfw udp timeout 15

  inspect the name myfw timeout tcp IP 3600

  inspect the name myfw timeout h323 IP 3600

  ------

  interface Dialer1

  .....

  IP access-group 111 to

  inspect the myfw over IP

  ...

  --------------------------

  access-list 111 allow a whole icmp administratively prohibited

  access-list 111 permit icmp any any echo

  access-list 111 permit icmp any any echo response

  access-list 111 permit icmp any a package-too-big

  access-list 111 permit icmp any one time exceed

  access-list 111 allow all unreachable icmp

  access-list 111 permit udp any eq bootps any eq bootpc

  access-list 111 permit udp any eq bootps any eq bootps

  access-list 111 permit udp any eq field all

  access-list 111 allow esp a whole

  access-list 111 permit udp any any eq isakmp

  access-list 111 permit udp any any eq 10000

  access list 111 permit tcp any any eq 1723

  access list 111 permit tcp any any eq 139

  access-list 111 permit udp any any eq netbios-ns

  access-list 111 permit udp any any eq netbios-dgm

  access-list 111 allow accord a

  111 refuse a whole ip access-list

  (1) when I use ip only inspect there is no problem, the VPN connection working well.

  (2) if I use the access list, the network is inaccessible by VPN

  I have enabled ipsec with this list of access permit udp any any eq isakmp

  Access list who should I add?

  Thanks for your help

  You must allow the form encypted traffic (which you did with the ESP and lists access UDP/500) and the unencrypted form of traffic (Yes, really).

  This is because the access list turned twice to the IPsec packets. The arives package in the interface as an IPsec packet, pass the LCD and is decrypted in the router. At this point, the router it back on the incoming interface to be treated accordingly. This means however that the decrypted packet is then run through the ACL check again.

  For VPN clients, add a line to ACL111 that says:

  > allow ip access-list 111

  It is the way that routers have always worked. There was a bug to change this behavior for quite a while now, but unfortunately would require a major change in the way in which the IPSec packets are handled internally in the router, so it's quite a difficult solution. Bug ID is CSCdz54626 (regular incoming ACL is treated twice for IPSec traffic).

  If you fear that it is a security risk, then don't be. If someone spoofs a bunch to look like it came from your VPN address pool, the first thing that would make the router is to recognize that this package have been encrypted. Because it is not, the router will drop the packet immediately.

• The remote VPN Clients and Internet access

  I apologize in advance if this question has already been addressed. I am currently using a PIX Firewall Version 6.1 520 (2) running. I have several remote users that VPN for the PIX. Once the VPN tunnel is started, they are more able to connect to internet from their local computers. Is there a configuation on the PIX that allows remote users to have access to the internet when you are connected to the PIX.

  TIA,

  Jeff Gulick

  The Pix does not allow traffic enter and exit on the same interface. Therefore, a VPN user cannot access the Internet through the tunnel. If you use the Cisco client, enable tunneling split so that all traffic through the tunnel.

  If you use PPTP, you can turn off the option that makes the remote network, the default gateway. However, local routes should be added to these clients when they connect.

  Or you can use an additional interface on the firewall. One that puts an end to VPN tunnels and another providing for Internet connectivity. In this way the traffic is not enter/leave on the same interface.

  Of course, it is preferable if the customer Internet traffic does not go through the tunnel. It wastes your bandwidth and has security problems as well. I suggest you use the client to Cisco and the split tunneling.

• Client VPN access to VLAN native only

  I have a router 2811 (config below) with VPN set up.  I can connect through the VPN devices and access on the VLAN native but I can't access the 10.77.5.0 (VLAN 5) network (I do not access the 10.77.10.0 - network VLAN 10).  This question has been plagueing me for quite a while.  I think it's a NAT device or ACL problem, but if someone could help me I would be grateful.  Client VPN IP pool is 192.168.77.1 - 192.168.77.10.  Thanks for the research!

  Current configuration: 5490 bytes

  !

  version 12.4

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  encryption password service

  !

  2811-Edge host name

  !

  boot-start-marker

  boot-end-marker

  !

  enable secret 5 XXXX

  !

  AAA new-model

  !

  AAA authentication login userauthen local

  AAA authorization groupauthor LAN

  !

  AAA - the id of the joint session

  !

  IP cef

  No dhcp use connected vrf ip

  DHCP excluded-address IP 10.77.5.1 10.77.5.49

  DHCP excluded-address IP 10.77.10.1 10.77.10.49

  !

  dhcp Lab-network IP pool

  import all

  Network 10.77.5.0 255.255.255.0

  router by default - 10.77.5.1

  !

  pool IP dhcp comments

  import all

  Network 10.77.10.0 255.255.255.0

  router by default - 10.77.10.1

  !

  domain IP HoogyNet.net

  inspect the IP router-traffic tcp name FW

  inspect the IP router traffic udp name FW

  inspect the IP router traffic icmp name FW

  inspect the IP dns name FW

  inspect the name FW ftp IP

  inspect the name FW tftp IP

  !

  Authenticated MultiLink bundle-name Panel

  !

  voice-card 0

  No dspfarm

  !

  session of crypto consignment

  !

  crypto ISAKMP policy 1

  BA aes 256

  preshared authentication

  Group 2

  life 7200

  !

  Configuration group customer isakmp crypto HomeVPN

  key XXXX

  HoogyNet.net field

  pool VPN_Pool

  ACL vpn

  Save-password

  Max-users 2

  Max-Connections 2

  Crypto isakmp HomeVPN profile

  match of group identity HomeVPN

  client authentication list userauthen

  ISAKMP authorization list groupauthor

  client configuration address respond

  !

  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac vpn

  !

  Crypto-map dynamic vpnclient 10

  Set transform-set vpn

  HomeVPN Set isakmp-profile

  market arriere-route

  !

  dynamic vpn 65535 vpnclient ipsec-isakmp crypto map

  !

  username secret privilege 15 5 XXXX XXXX

  username secret privilege 15 5 XXXX XXXX

  Archives

  The config log

  hidekeys

  !

  IP port ssh XXXX 1 rotary

  !

  interface Loopback0

  IP 172.17.1.10 255.255.255.248

  !

  interface FastEthernet0/0

  DHCP IP address

  IP access-group ENTERING

  NAT outside IP

  inspect the FW on IP

  no ip virtual-reassembly

  automatic duplex

  automatic speed

  No cdp enable

  vpn crypto card

  !

  interface FastEthernet0/1

  no ip address

  automatic duplex

  automatic speed

  No cdp enable

  !

  interface FastEthernet0/1.1

  encapsulation dot1Q 1 native

  IP 10.77.1.1 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  !

  interface FastEthernet0/1.5

  encapsulation dot1Q 5

  IP 10.77.5.1 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  !

  interface FastEthernet0/1.10

  encapsulation dot1Q 10

  IP 10.77.10.1 255.255.255.0

  IP access-group 100 to

  IP nat inside

  IP virtual-reassembly

  !

  interface FastEthernet0/0/0

  no ip address

  Shutdown

  automatic duplex

  automatic speed

  !

  interface FastEthernet0/1/0

  no ip address

  Shutdown

  automatic duplex

  automatic speed

  !

  router RIP

  version 2

  10.0.0.0 network

  network 172.17.0.0

  network 192.168.77.0

  No Auto-resume

  !

  IP pool local VPN_Pool 192.168.77.1 192.168.77.10

  no ip forward-Protocol nd

  !

  IP http server

  no ip http secure server

  overload of IP nat inside source list NAT interface FastEthernet0/0

  !

  IP extended INBOUND access list

  permit tcp any any eq 2277 newspaper

  permit any any icmp echo response

  allow all all unreachable icmp

  allow icmp all once exceed

  allow tcp any a Workbench

  allow udp any any eq isakmp

  permit any any eq non500-isakmp udp

  allow an esp

  allowed UDP any eq field all

  allow udp any eq bootps any eq bootpc

  NAT extended IP access list

  IP 10.77.5.0 allow 0.0.0.255 any

  IP 10.77.10.0 allow 0.0.0.255 any

  IP 192.168.77.0 allow 0.0.0.255 any

  list of IP - vpn access scope

  IP 10.77.1.0 allow 0.0.0.255 192.168.77.0 0.0.0.255

  IP 10.77.5.0 allow 0.0.0.255 192.168.77.0 0.0.0.255

  !

  access-list 100 permit udp any eq bootpc host 255.255.255.255 eq bootps

  access-list 100 permit udp host 0.0.0.0 eq bootpc host 10.77.5.1 eq bootps

  access-list 100 permit udp 10.77.10.0 0.0.0.255 eq bootpc host 10.77.5.1 eq bootps

  access-list 100 deny tcp 10.77.10.0 0.0.0.255 any eq telnet

  access-list 100 deny ip 10.77.10.0 0.0.0.255 10.77.5.0 0.0.0.255

  access-list 100 deny ip 10.77.10.0 0.0.0.255 10.77.1.0 0.0.0.255

  access ip-list 100 permit a whole

  !

  control plan

  !

  Line con 0

  session-timeout 30

  password 7 XXXX

  line to 0

  line vty 0 4

  Rotary 1

  transport input telnet ssh

  line vty 5 15

  Rotary 1

  transport input telnet ssh

  !

  Scheduler allocate 20000 1000

  !

  WebVPN cef

  !

  end

  If you want to say, that after the way nat rules which I have proposed, you lost the connection to the VLAN native, so yes, it's because the subnet VLANs native has not been included in this acl with Deny statement. So that the ACL should look like this:

  NAT extended IP access list

  deny ip 10.77.5.0 0.0.0.255 192.168.77.0 0.0.0.255

  deny ip 10.77.1.0 0.0.0.255 192.168.77.0 0.0.0.255 //This is not respected

  allow an ip

  In addition, if you want to go throug the other tunnel inside the subnet not listed above, then you should include that subnet to the NAT exemption rule with Deny statement.

• problem with windows 2003 vpn servers. and xp pro clients vpn using bridge nic

  I have installed 2 guests windows 2003 on 2 laptops. both are configured with 1 CC of backend and frontend 1 nat/vpn server that has 2 interfaces, a bridge and one configured for host only.

  I configure nat on both servers windows 2003 rras and vpn services and have them connected to my local network. they are able to access internet, ping between them and other computers on the network, as well as the host systems on which they run.

  the problem is that I am not able to connect to the vpn servers remotely from inside a guest virtual machine. I wanted to try a vpn site-to site between the guests 2 windows 2003, but the operation failed.

  I then tested customer to type of a guest virtual computer pro xp vpn server. It is also a failure.

  but I discovered that if I initiate a VPN from any one of the host computer system laptop or another computer on the physical network I am able to connect to the vpn servers I have set up.

  I wish I could have these laptops to operate normally and

  time to time be able to turn on virtual machines with vpn

  servers and test as dfs things and replication active directory as if

  they were running 2 separate real-world offices. the two laptops have invited Setup for 192.168.0.0 networks with subnet mask 255.255.255.192. each host that it supposed to be running a 1 subnet for the popular virtual machine with the servers vpn/nat connect together the 2 sites.

  laptop computers are running xp pro and vista ultimate as the host systems. I'm only using the windows firewall but also tested with them disabled vpn connections. also launches the service ipsec on laptops to secure internal lan traffic, I have also tested with two guests with disabled ipsec.

  is there something I'm missing here with the installation of the vmware bridge network?

  Oh I forgot to mention, I test using pptp and ms-chap v2

  I managed to do work by unchecking the tcp/ip settings and the microsoft file sharing on the bridged NIC resaeau.

  now it works very well but who explain to me why it cannot work when you are using the same network as the host card. they all have two different ip addresses and mac addresses. but something seems to be in conflict

• I will still have my firewall turned on and off I do not know why but I tried another firewall, and it seems to work ok

  I had some trobele with my computer and had to take it when I got it. The firewall was working fine. I do not know

  If you date something on it so that it remains not.

  I will still have my firewall turned on and off I do not know why but I tried another firewall, and it seems to work ok

  Hey Roscoe,

  If you're still using MSE, I doubt there's this problem.  This made a few changes to the Windows Firewall during installation (if necessary), but certainly nothing that would cause it to turn on and off like that.  It could be malware (malware can cause anything), but frankly more sounds like a file systems or corruption or some type of problem with your Windows Firewall or security setting or your operating system in a more general sense rather than the malicious software.  I will refer you to experts who specialize in this kind of thing, but if they tell you it's a malware problem, then come back here and we will be happy to help you solve it.

  For that matter as described, please post here to get the best advice from specialists in this: http://answers.microsoft.com/en-us/windows/forum/security?tab=all which will be more than happy to help you.  You will probably need to uninstall the other firewall you have installed so they can diagnose the problem properly and without hindrance (not just disable it, but completely uninstall to be sure) - but they can tell you more on this subject.  Don't forget up next to the Windows Version to use the dropmenu to choose your version if you find yourself in the most appropriate forum for your system.

  I hope this helps.

  Good luck!

• Question of firewall Web sites and Https. Help me please.

  I am trying to connect to an Https site and I get the message "internet explore cannot display the webpage."  When I run a diagnostic check, he returned with the message "unable to connect to the Internet via HTTP, FTP and HTTPS.  This is probably caused by the settings of firewall on this computer.  Check the firewall settings for HTTP port 80, 443 HTTPS port and port 21 FTP".  I use Windows XP and a dell computer.  I tried to change my firewall settings and disabled my firewall even temporarily, and I can always log on the site.  I have already connected to this site by the same internet provider on another computer (which unfortunately is no longer available for use at that time).  I need to use this site for work purposes.  Can you help me?

  Hello

  · What version of internet explore are you working on?

  · Were there any changes made on the computer before the show?

  I suggest you try the steps listed in the links below: how to manually open ports in Internet Connection Firewall in Windows XP: http://support.microsoft.com/kb/308127

  "Internet Explorer cannot display the webpage" error when you view a Web site in Internet Explorer: http://support.microsoft.com/kb/956196

  Troubleshooting settings of Windows Firewall in Windows XP Service Pack 2 for advanced users: http://support.microsoft.com/kb/875357