FlexVPN vs DMVPN behavior. Advice?
So I test FlexVPN and I found, for me anyway, a pretty big deal breaker.
I ping, telnet, cannot connect to somehow (other than the routing protocol, which works very well), the network "directly attached".
What I mean by that is to say my Tunnel interface is 192.168.254.2 on one of my shelves, I can't connect to my hub to 192.168.254.1 or another spoke to 192.168.254.3.
Day to day, that this wouldn't be a problem, but sometimes in the case of a network failure, that I need to be able to get through my VPN backdoor. So I would go to 192.168.254.1 and telnet to 192.168.254.3 and wallah I am. DMVPN it has worked very well and saved my bacon several times. With FlexVPN this option is no longer available for me better than I can say.
Is this known behaviour? Is there a solution? I'm just doing something wrong?
Thank you
Hello
Routing for ikev2 that you have configured in your example that is on the hub and the spokes, if so make sure that the aaa authorization is also configured and mapped on the profile of ikev2, it comes to allowing the roads that are pushed between the hub and rays.
AAA new-model
AAA authorization network default local
Profile of ikev2 crypto FlexVPN
AAA - permission group psk DEFECT list
Then you have to close and without closing the tunnel interfaces to force new sessions of ikev2.
Tarik Admani
* Please note the useful messages *.
[changed to make my thoughts a lot easier to understand]
Tags: Cisco Security
Similar Questions
-
Satellite 100-049-engraver of DVD writes only a few files and then fails
My burner is Mat * a DVD RAM UJ850S ATA device and I am running Windows Vista. The problem is this: I start burning Burn option of Windows media player. I select the files to be burned, the fire starts. It breaks down after 3 or 2 files and then error occurs and the burning stops.
No error message appears. It is not possible to remove the burner CD without stopping the system. You can open the burner again during the restart. My burner is almost unused, it reads CDs and DVDs without problem I noticed.
Anyone who has experienced the same type of behavior - advice?
Hello
I didn t has experienced these problems, but a quick question: have you you tried to burn files not only with this media player to windows, and then also with a full program of burning (like nero, cdburnerXP, CloneCd, etc.) to see if the same error occurs with a program designed just for burning files?
It could be that the Windows Media player not fully supports the burner, so it would be interesting to try.
Appreciate some comments on your success with this issue, just to keep me in the loop. :)
Greetings
-
Blackmail crook - history, information, advice and assurance, please read
Yesterday, I was scammed of blacmail. I paid almost because I was afraid of what the person would have done if I didn't pay, but a friend help pass trought the hole thing.
https://support.Skype.com/en/FAQ/FA34447/what-should-i-do-if-i-see-abusive-behavior-on-Skype
TIME ZONE - US EAST. LOCATION - PHILADELPHIA, PA, USA.
I recommend that you always run the latest version of Skype: Windows & Mac
If my advice helped to solve your problem, please mark it as a solution to help others.
Please note that I usually do not respond to unsolicited private Messages. Thank you. -
How to change the behavior of the space bar
About this project being improved UI: http://forums.ni.com/t5/LabVIEW/keyboard-focus-on-indicators/m-p/3260505#M951052
I would use the space bar to "tab" in the control. Play with the UI, I quickly realized that the space bar is currently the key ENTER, i.e., alternate control if it is to the point. Implementation of the function of the tab for the space bar will prevent it from also serve as ENTRY? How could I set up in case the structure of the UI control?
Thank you
First: My advice is "don't do that!" Development of control tab is normal behavior in windows. Space bar is another thing that space is abnormal - in fact, those of us who don't use auto-outil selection are called 'Tabbers' not 'spacers' even if the space bar performs a function of scrolling simillar tool! Most 'Tabbers' don't even know that because the tab is more consistent with the 'Normal' applications Select a key and hold that is already filled in the desired control key navigation properties tab.
Now, after hearing this advice, you still feel you MUST redirect the bar of space you can hack the enum which fills the property drop-down editor. But I highly recommend. Best, talk to users and get their 'Story' on how they would have ideally to navigate the user interface with a frank discussion about their experiences with other applications and that this application can help.
-
PCI-6221 behavior off the power
Hello
A card PCI-6221, tension of the PC is out of snap-ins:
When I inject a voltage (5V) input ana on the map, this tension is copied on the other analogue channels.
Room I turn on the PC, and 6s after, injected tension is more copied on the other tracks of ana.
What is the normal behavior of the map?
Thank you pour your answers
Hello Cedric,
The behavior of the card when it is turned off is not defined. What is it you have a problem in your application?
When you area PC, this one seems to provide power to the bus PCI 6 seconds after it starts, which explains why the map then adopts its operation.
The best advice I can give you is to respect the configuration/connection of analog input (manual page 58 Chapter 4-14 M-series cards). About the card, if it works properly when the PC is turned on, and that the connection am well the guide, there is every reason to be reassured.
I wish you a good day,
Marc-Junior
-
Hi all
I'm new to the development of Blackberry and I'm writing a relatively simple application to run on 7.1.
So far the development was interesting, I managed to create my user interface using resources online (mainly this forum), but today I tried to implement some of the network classes that I need and now I just met constant problems.
I use Eclipse SDK 3.7.2 (the one that comes with the plugin RIM)
First question:
I'm not sure what I changed, but today I noticed that whenever I start the Simulator (by sim 9360) my application is started during the initial startup process. I don't think he did this before, but to be honest, I wasn't paying much attention. I think it starts at the start of the device is because I put a breakpoint in the constructor for my class from the main screen, which is hit before the Simulator happens even to the point where it is ready for user interaction. In addition, once it is ready, if I press the BB button, I see my registered application.
I don't have it set to automatic start in .xml descriptior enforcement.
I started this application on the HelloBlackBerry sample, here is my main method for the entry of the application:
public static void main( String[] args ) { appSettings = AppSettings.fetch(); // Create a new instance of the application and make the currently // running thread the application's event dispatch thread. HelloBlackBerry theApp = new HelloBlackBerry(); theApp.enterEventDispatcher(); //openConnection(); }As far as I know, this is the only entry point for the application.
More code
public HelloBlackBerry() { // Push a screen onto the UI stack for rendering. mainScreen = new ScreenHelloBlackBerry(); pushScreen( mainScreen ); }Here is the method of. my class AppSettings fetch()
// Retrieves a copy of the effective properties set from storage. public static AppSettings fetch() { AppSettings savedSettings = (AppSettings) _store.getContents(); return new AppSettings(savedSettings); }Some of this code that I wrote myself, the persistence store cause the launch of my car?
I tried to reset the Simulator to the factory settings, no change.
All applications initialized during the startup of the device and then closed shortly after?
Part 2: Need advice for the implementation of functions of network in the application
I need to implement some methods that will retrieve data from a web service, and I also need to send data to this service. What I've read, the ConnectionFactory is the way to go. I want my application to make a request when the application is open and can check on a set interval. I didn't know exactly how to go about adding another thread for networking, I understand that network connections should not be created on the thread main event, so I tried to do this:
The constructor of my class that implements screen (ScreenHelloBlackBerry), I use the following to create a modal dialog box to prompt the user for a username, I also try networking wire in the same segment of spawning:
public ScreenHelloBlackBerry(){...initialize fields and managers, add it all together...then near the end //This will open the confirm dialog when the application is launched UiApplication.getUiApplication().invokeLater(new Runnable() { public void run() { openConfirmDialog(); //start connection - Possibly broken ConnectionThread ct = new ConnectionThread(); ct.start(); } });I don't know if it's somehow OK to do, but it seems to work for what I need. I want a user who launches the application at the prompt, and if a user switch applications, when they come back they wondered again (unless they close the app and reopen it).
Here is my ConnectionThread:
public class ConnectionThread extends Thread { public void run() { ConnectionFactory connFact = new ConnectionFactory(); ConnectionDescriptor connDesc; connDesc = connFact.getConnection("http://www.google.com"); if (connDesc != null) { HttpConnection httpConn; httpConn = (HttpConnection)connDesc.getConnection(); try { final int iResponseCode = httpConn.getResponseCode(); UiApplication.getUiApplication().invokeLater(new Runnable() { public void run() { Dialog.alert("Response code: " + Integer.toString(iResponseCode)); } }); httpConn.close(); } catch (IOException e) { System.err.println("Caught IOException: " + e.getMessage()); } } } }At the moment it has basically unmodified code from a sample that I found, I'll be retooling to meet my needs whenever I can make it work. I HAD this work to the point where, after the closed user confirm this dialog, a few moments later a an alert dialog appears with the 302 response code. I don't know what changed, but now it doesn't work at all, and if I try to scroll with the debugger, I can't past the httpCon.getResponseCode (). I've seen some mistakes earlier on "no record of service was set up", and I also had once a timeout exception.
I'm sure I'm doing this wrong, but at the same time as I said WAS working, and now it is not. If someone has done this far, thank you very much for your time and advice are much appreciated.
Also, should I try to start the thread of the network of the UIApplication class instead of the screen? There is currently very little happening in the class that extends UIApplication, do I spend most of my business logic out of the class of the screen and in the UIApplication class?
Thanks in advance!
Hi all
Just to conclude this topic for those who are interested, I found an excellent guide to the implementation of networks in applications of BB, click here for a link.
About my application being started at the start of the simulator of the device, I found that on a device real this behavior is not complied with, and in addition, the behaviour seems to have stopped after uninstallation and reinstallation of my Simulator.
See you soon,.
-
DMVPN, deny traffic to the satellite mission
Hello
Maybe it's a weird qeustion but im DMVPN test with several scenarios.
At the moment I have 1 Hub with 4 spoke, they all work properly. We test it because we have a lot of customers who do not have a fixed IP address to the outside, then an IP address changes each time, you have to configure VPN to our headquarters all over again. DMVPN appears as a perfect solution...
Now my goal is to configure the DMVPN of all customers (speaks) at our headquarters. But I don't want guests to have access to our local network and nor, I want to have access to the other satellite mission. The only one who has full access allowed to all LAN's headquarters (Hub).
What is the best way to achieve this? I started working with access lists or can I do it with EIGRP somehow? And make the ACL on the tunnels or the ethernet interfaces?
Or maybe DMVPN is not the best solution? All comments and advice ar worm appreciated!
Thanks already,
Bart
In this scenario, you use the better the VTI/DVTI tunnels. On the Hub, you can accept any peers with the DVTI-config VPN. The rays use traditional VTI-tunnels. The virtual model on the hub (which is used to build the-access-virtual interfaces by talk can be configured with a value by default-ACL (deny an ip) and CBAC firewall rule that inspects your outgoing traffic to allow packets back.) You can even use the zone based firewall, but this seems an exaggeration in this configuration.
Sent by Cisco Support technique iPad App
-
Hello
I dmvpn phase 1 with 2 hubs, 20 rays and eigrp, HUB1 is main and HUB2's backup. If HUB1 works any traffic from rays go to HUB2 immediately in a few seconds, but when HUB1 gets traffic from rays automatically goes back to the HUB1 after 20-30 minutes and it is too long, it's problem.
command 'Show dmvpn' on the screens of rays which tunnelle to HUB1 are PNDH, and if I use 'session claire encryption"command manually on any traffic spoke of this talk past immediately to HUB1.
A month ago I tested and it worked fine. but when I last tested time 2 days ago, this problem occurred.
What should be the reason and how to fix it?
Sorry for my English, I'm new to dmvpn :)
Thanks in advance.
Hi George,.
I see two possible event which would explain the behavior that you are experiencing.
(a) change of State DMVPN.
(b) change in the routing table.
You can troubleshoot each of the question above to identify that one is at the origin of the problem and then isolate him. To begin, you must make sure that the DMVPN stay in a stable 'up' State.
You mention "pokes displays tunnels to HUB1 in PNDH State"-this confirm DMVPN is 'stuck' and not fully operational.
I suggest to consult a few details of useful troubleshooting here:
http://www.Cisco.com/c/en/us/support/docs/security/dynamic-multipoint-VP...
Take a look at these details:
~~~
Interface: Tunnel100, IPv4 PNDH details
Type: talk, PNDH peers: 2,.# Ent Peer NBMA Peer Tunnel Addr add State UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
1 192.168.1.1 172.28.1.1 UP 1d21h S
1 192.168.1.2 172.28.1.2 UP 1d21h S~~~
You get output similar in your configuration, if you want to keep an eye on the time of "UpDn", as it will tell you how long the DMVPN has been upward.
If the DMVPN remains stable, while you experience the problem, then focus on the routing protocol that you use in the troubleshooting dmvpn tunnel.
If the DMVPN is unstable, check the connectivity between the spokes and hub NBMA Address and connectivity remain stable. "you can use ' debug crypto dmvpn error and debug error PNDH dmvpn" to help identify the problem, if it is associated with DMVPN.
There is a lot of support in my suggestions, because you have not posted the configuration :).
But it would be useful that you post the config. Good luck with your efforts.
Thank you
re775
-
DMVPN spoke of issues after migration double ISR2 3925 hub to ASR-1001 X
Hello world
After our hub solution migration DMVPN double ISR2 3925 to ASR - 1001 X (running asr1001x - universalk9.03.12.03.S.154 - 2.S3 - std.SPA.bin) we started to have some problems with tunnels rays beat (which goes up and down) and sometimes never came.
Running 'show dmvpn' speak it is stuck in State PNDH to our hub. To solve the problem, we run 'stop' and then 'non-stop' on the tunnel interface to actually speak that DMVPN Monte. Also runs "clear encryption session
" on the shelf often solves the problem. So, it seems that the question has something to do with IPSEC. When the problem occurred, and then debug crypto ipsec, crypto, crypto isakmp and crypto engine socket the following can be seen on the hub:
Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Sending NOTIFY DPD/R_U_THERE protocol 1 spi 140130067548488, message ID = 629121681 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): seq. no 0x64B2238C Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): sending packet to
my_port 500 peer_port 500 (I) QM_IDLE Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Sending an IKE IPv4 Packet. Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):purging node 629121681 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_IM_ALIVE Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Jun 25 10:01:41 SUMMERT: ISAKMP (46580): received packet from dport 500 sport 500 ISP1-DMVPN (I) QM_IDLE Jun 25 10:01:41 SUMMERT: ISAKMP: set new node 3442686097 to QM_IDLE Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): processing HASH payload. message ID = 3442686097 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): processing NOTIFY DPD/R_U_THERE_ACK protocol 1 spi 0, message ID = 3442686097, sa = 0x7F72986867D0 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): DPD/R_U_THERE_ACK received from peer , sequence 0x64B2238C Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):deleting node 3442686097 error FALSE reason "Informational (in) state 1" Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Jun 25 10:01:42 SUMMERT: IPSEC: delete incomplete sa: 0x7F729923A438 Jun 25 10:01:42 SUMMERT: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS Jun 25 10:01:42 SUMMERT: ISAKMP:(46580):purging node 1111296046 Jun 25 10:01:44 SUMMERT: ISAKMP (46580): received packet from dport 500 sport 500 ISP1-DMVPN (I) QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP: set new node 928225319 to QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing HASH payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing SA payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Checking IPSec proposal 1 Jun 25 10:01:44 SUMMERT: ISAKMP: transform 1, ESP_AES Jun 25 10:01:44 SUMMERT: ISAKMP: attributes in transform: Jun 25 10:01:44 SUMMERT: ISAKMP: encaps is 2 (Transport) Jun 25 10:01:44 SUMMERT: ISAKMP: SA life type in seconds Jun 25 10:01:44 SUMMERT: ISAKMP: SA life duration (basic) of 3600 Jun 25 10:01:44 SUMMERT: ISAKMP: SA life type in kilobytes Jun 25 10:01:44 SUMMERT: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 Jun 25 10:01:44 SUMMERT: ISAKMP: authenticator is HMAC-SHA Jun 25 10:01:44 SUMMERT: ISAKMP: key length is 256 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):atts are acceptable. Jun 25 10:01:44 SUMMERT: CRYPTO_SS(TUNNEL SEC): Active open, socket info: local /255.255.255.255/0, remote /255.255.255.255/0, prot 47, ifc Tu3300 Jun 25 10:01:44 SUMMERT: IPSEC(recalculate_mtu): reset sadb_root 7F7292E64990 mtu to 1500 Jun 25 10:01:44 SUMMERT: CRYPTO_SS(TUNNEL SEC): Sending Socket Ready message Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing NONCE payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing ID payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing ID payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):QM Responder gets spi Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Node 928225319, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Node 928225319, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_QM_SPI_STARVE New State = IKE_QM_IPSEC_INSTALL_AWAIT Jun 25 10:01:44 SUMMERT: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer Jun 25 10:01:44 SUMMERT: IPSEC(crypto_ipsec_update_ident_tunnel_decap_oce): updating profile-shared Tunnel3300 ident 7F7298B2BF80 with lookup_oce 7F7296BF5440 Jun 25 10:01:44 SUMMERT: IPSEC(create_sa): sa created, (sa) sa_dest= , sa_proto= 50, sa_spi= 0x14F40C56(351538262), sa_trans= esp-aes 256 esp-sha-hmac , sa_conn_id= 27873 sa_lifetime(k/sec)= (4608000/3600), (identity) local= :0, remote= :0, local_proxy= /255.255.255.255/47/0, remote_proxy= /255.255.255.255/47/0 Jun 25 10:01:44 SUMMERT: IPSEC(create_sa): sa created, (sa) sa_dest= , sa_proto= 50, sa_spi= 0x3B4731D7(994521559), sa_trans= esp-aes 256 esp-sha-hmac , sa_conn_id= 27874 sa_lifetime(k/sec)= (4608000/3600), (identity) local= :0, remote= :0, local_proxy= /255.255.255.255/47/0, remote_proxy= /255.255.255.255/47/0 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Received IPSec Install callback... proceeding with the negotiation Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Successfully installed IPSEC SA (SPI:0x14F40C56) on Tunnel3300 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): sending packet to my_port 500 peer_port 500 (I) QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Sending an IKE IPv4 Packet. Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Node 928225319, Input = IKE_MESG_FROM_IPSEC, IPSEC_INSTALL_DONE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_QM_IPSEC_INSTALL_AWAIT New State = IKE_QM_R_QM2 Jun 25 10:01:44 SUMMERT: ISAKMP (46580): received packet from dport 500 sport 500 ISP1-DMVPN (I) QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP: set new node 1979798297 to QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing HASH payload. message ID = 1979798297 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 351538262, message ID = 1979798297, sa = 0x7F72986867D0 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): deleting spi 351538262 message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):deleting node 928225319 error TRUE reason "Delete Larval" Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):peer does not do paranoid keepalives. Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Enqueued KEY_MGR_DELETE_SAS for IPSEC SA (SPI:0x3B4731D7) Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):deleting node 1979798297 error FALSE reason "Informational (in) state 1" Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Jun 25 10:01:44 SUMMERT: IPSEC: delete incomplete sa: 0x7F729923A340 Jun 25 10:01:44 SUMMERT: IPSEC(key_engine_delete_sas): delete SA with spi 0x3B4731D7 proto 50 for Jun 25 10:01:44 SUMMERT: IPSEC(update_current_outbound_sa): updated peer current outbound sa to SPI 0 Jun 25 10:01:44 SUMMERT: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS Jun 25 10:01:44 SUMMERT: CRYPTO_SS(TUNNEL SEC): Sending request for CRYPTO SS CLOSE SOCKET #sh pl ha qf ac fe ipsec data drop ------------------------------------------------------------------------ Drop Type Name Packets ------------------------------------------------------------------------ 3 IN_US_V4_PKT_FOUND_IPSEC_NOT_ENABLED 127672 19 IN_OCT_ANTI_REPLAY_FAIL 13346 20 IN_UNEXP_OCT_EXCEPTION 4224 33 OUT_V4_PKT_HIT_IKE_START_SP 1930 62 IN_OCT_MAC_EXCEPTION 9 #sh plat hard qfp act stat drop | e _0_ ------------------------------------------------------------------------- Global Drop Stats Packets Octets ------------------------------------------------------------------------- Disabled 1 82 IpFragErr 170536 246635169 IpTtlExceeded 4072 343853 IpsecIkeIndicate 1930 269694 IpsecInput 145256 30071488 Ipv4Acl 2251965 215240194 Ipv4Martian 6248 692010 Ipv4NoAdj 43188 7627131 Ipv4NoRoute 278 27913 Ipv4Unclassified 6 378 MplsNoRoute 790 69130 MplsUnclassified 1 60 ReassTimeout 63 10156 ServiceWireHdrErr 2684 585112
In addition, after you run "logging dmvpn rate-limit 20' on the hub
%DMVPN-3-DMVPN_NHRP_ERROR: Tunnel292: NHRP Encap Error for Resolution Request , Reason: protocol generic error (7) on (Tunnel:
NBMA: ) On the talks both the following can be seen debugging as well:
*Jun 25 09:17:26.884: ISAKMP:(1032): sitting IDLE. Starting QM immediately (QM_IDLE ) *Jun 25 09:17:26.884: ISAKMP:(1032):beginning Quick Mode exchange, M-ID of 1599359281 *Jun 25 09:17:26.884: ISAKMP:(1032):QM Initiator gets spi *Jun 25 09:17:26.884: ISAKMP:(1032): sending packet to
my_port 500 peer_port 500 (R) QM_IDLE *Jun 25 09:17:26.884: ISAKMP:(1032):Sending an IKE IPv4 Packet. *Jun 25 09:17:26.884: ISAKMP:(1032):Node 1599359281, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Jun 25 09:17:26.884: ISAKMP:(1032):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Jun 25 09:17:26.940: ISAKMP (1032): received packet from dport 500 sport 500 Global (R) QM_IDLE *Jun 25 09:17:26.940: ISAKMP:(1032): processing HASH payload. message ID = 1599359281 *Jun 25 09:17:26.940: ISAKMP:(1032): processing SA payload. message ID = 1599359281 *Jun 25 09:17:26.940: ISAKMP:(1032):Checking IPSec proposal 1 *Jun 25 09:17:26.940: ISAKMP: transform 1, ESP_AES *Jun 25 09:17:26.940: ISAKMP: attributes in transform: *Jun 25 09:17:26.940: ISAKMP: encaps is 2 (Transport) *Jun 25 09:17:26.940: ISAKMP: SA life type in seconds *Jun 25 09:17:26.940: ISAKMP: SA life duration (basic) of 3600 *Jun 25 09:17:26.940: ISAKMP: SA life type in kilobytes *Jun 25 09:17:26.940: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 *Jun 25 09:17:26.940: ISAKMP: authenticator is HMAC-SHA *Jun 25 09:17:26.940: ISAKMP: key length is 256 *Jun 25 09:17:26.940: ISAKMP:(1032):atts are acceptable. *Jun 25 09:17:26.940: IPSEC(ipsec_process_proposal): proxy identities not supported *Jun 25 09:17:26.940: ISAKMP:(1032): IPSec policy invalidated proposal with error 32 *Jun 25 09:17:26.940: ISAKMP:(1032): phase 2 SA policy not acceptable! (local remote ) *Jun 25 09:17:26.940: ISAKMP: set new node -1745931191 to QM_IDLE *Jun 25 09:17:26.940: ISAKMP:(1032):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 834718720, message ID = 2549036105 *Jun 25 09:17:26.940: ISAKMP:(1032): sending packet to my_port 500 peer_port 500 (R) QM_IDLE *Jun 25 09:17:26.940: ISAKMP:(1032):Sending an IKE IPv4 Packet. *Jun 25 09:17:26.940: ISAKMP:(1032):purging node -1745931191 *Jun 25 09:17:26.940: ISAKMP:(1032):deleting node 1599359281 error TRUE reason "QM rejected" *Jun 25 09:17:26.940: ISAKMP:(1032):Node 1599359281, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Jun 25 09:17:26.940: ISAKMP:(1032):Old State = IKE_QM_I_QM1 New State = IKE_QM_I_QM1 *Jun 25 09:17:34.068: ISAKMP (1032): received packet from dport 500 sport 500 Global (R) QM_IDLE *Jun 25 09:17:34.068: ISAKMP: set new node 1021264821 to QM_IDLE *Jun 25 09:17:34.072: ISAKMP:(1032): processing HASH payload. message ID = 1021264821 *Jun 25 09:17:34.072: ISAKMP:(1032): processing NOTIFY DPD/R_U_THERE protocol 1 spi 0, message ID = 1021264821, sa = 0x32741028 *Jun 25 09:17:34.072: ISAKMP:(1032):deleting node 1021264821 error FALSE reason "Informational (in) state 1" *Jun 25 09:17:34.072: ISAKMP:(1032):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Jun 25 09:17:34.072: ISAKMP:(1032):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Jun 25 09:17:34.072: ISAKMP:(1032):DPD/R_U_THERE received from peer , sequence 0x64B2279D *Jun 25 09:17:34.072: ISAKMP: set new node 716440334 to QM_IDLE *Jun 25 09:17:34.072: ISAKMP:(1032):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1 spi 834719464, message ID = 716440334 *Jun 25 09:17:34.072: ISAKMP:(1032): seq. no 0x64B2279D *Jun 25 09:17:34.072: ISAKMP:(1032): sending packet to my_port 500 peer_port 500 (R) QM_IDLE *Jun 25 09:17:34.072: ISAKMP:(1032):Sending an IKE IPv4 Packet. *Jun 25 09:17:34.072: ISAKMP:(1032):purging node 716440334 *Jun 25 09:17:34.072: ISAKMP:(1032):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE *Jun 25 09:17:34.072: ISAKMP:(1032):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Jun 25 09:17:35.356: ISAKMP:(1032):purging node 206299144 Obviously something seems to be wrong Phase 2 not to come. But why is it going up after having erased the session encryption or close the tunnel interface and activate the interface of tunnel has spoken?
Very weird. Also, in looking at att the hub debugging messages it seems that Cryptography is associated with evil Tu3300 tunnel interface when it is Tu2010. Normal or Bug?
The configuration of the hub looks like this:
crypto keyring ISP1-DMVPN vrf ISP1-DMVPN pre-shared-key address 0.0.0.0 0.0.0.0 key
crypto isakmp policy 10 encr aes authentication pre-share crypto isakmp keepalive 10 3 periodic crypto isakmp nat keepalive 10 crypto isakmp profile ISP1-DMVPN keyring ISP1-DMVPN match identity address 0.0.0.0 ISP1-DMVPN keepalive 10 retry 3 crypto ipsec transform-set AES256-MD5 esp-aes 256 esp-md5-hmac mode tunnel crypto ipsec transform-set AES256-SHA-TRANSPORT esp-aes 256 esp-sha-hmac mode transport crypto ipsec profile ISP1-DMVPN set transform-set AES256-SHA AES256-SHA-TRANSPORT set isakmp-profile ISP1-DMVPN vrf definition ISP1-DMVPN description DMVPN-Outside-ISP1 rd 65527:10 ! address-family ipv4 exit-address-family ! ! interface TenGigabitEthernet0/0/0 no ip address ! interface TenGigabitEthernet0/0/0.71 description VPN;ISP1-DMVPN;Outside;VLAN71 encapsulation dot1Q 71 vrf forwarding ISP1-DMVPN ip address 255.255.255.128 no ip proxy-arp ip access-group acl_ISP1-DMVPN_IN in ! ip route vrf ISP1-DMVPN 0.0.0.0 0.0.0.0 name ISP1;Default ip access-list extended acl_ISP1-DMVPN_IN permit icmp any any permit esp any host permit gre any host permit udp any host eq isakmp permit udp any host eq non500-isakmp deny ip any any vrf definition 2010 description CUSTA - Customer A rd 65527:2010 route-target export 65527:2010 route-target import 65527:2010 ! address-family ipv4 exit-address-family ! ! interface Tunnel2010 description CUSTA;DMVPN;Failover-secondary vrf forwarding 2010 ip address 10.97.0.34 255.255.255.240 no ip redirects ip mtu 1380 ip nhrp map multicast dynamic ip nhrp network-id 2010 ip nhrp holdtime 120 ip nhrp server-only ip nhrp max-send 1000 every 10 ip tcp adjust-mss 1340 tunnel source TenGigabitEthernet0/0/0.71 tunnel mode gre multipoint tunnel key 2010 tunnel vrf ISP1-DMVPN tunnel protection ipsec profile ISP1-DMVPN shared router bgp 65527 ! address-family ipv4 vrf 2010 redistribute connected metric 10 redistribute static metric 15 neighbor 10.97.0.39 remote-as 65028 neighbor 10.97.0.39 description spokerouter;Tunnel1 neighbor 10.97.0.39 update-source Tunnel2010 neighbor 10.97.0.39 activate neighbor 10.97.0.39 soft-reconfiguration inbound neighbor 10.97.0.39 prefix-list EXPORT-IVPN-VRF2010 out neighbor 10.97.0.39 route-map AllVRF-LocalPref-80 in neighbor 10.97.0.39 maximum-prefix 5000 80 default-information originate exit-address-family Configuring spoke:
crypto keyring DMVPN01 pre-shared-key address 0.0.0.0 0.0.0.0 key
crypto isakmp policy 10 encr aes authentication pre-share crypto isakmp invalid-spi-recovery crypto isakmp profile DMVPN01 keyring DMVPN01 match identity address 0.0.0.0 keepalive 10 retry 3 crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac mode tunnel crypto ipsec transform-set AES256-SHA-TRANSPORT esp-aes 256 esp-sha-hmac mode transport crypto ipsec profile DMVPN01 set transform-set AES256-SHA-TRANSPORT set isakmp-profile DMVPN01 vrf definition inside rd 65028:1 route-target export 65028:1 route-target import 65028:1 ! address-family ipv4 exit-address-family ! interface Tunnel1 description DMVPN to HUB vrf forwarding inside ip address 10.97.0.39 255.255.255.240 no ip redirects ip mtu 1380 ip nhrp map 10.97.0.33 ip nhrp map multicast ip nhrp map 10.97.0.34 ip nhrp map multicast ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.97.0.33 ip nhrp nhs 10.97.0.34 ip nhrp registration no-unique ip nhrp registration timeout 60 ip tcp adjust-mss 1340 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 2010 tunnel protection ipsec profile DMVPN01 shared router bgp 65028 ! address-family ipv4 vrf inside bgp router-id 172.28.5.137 network 10.97.20.128 mask 255.255.255.128 network 10.97.21.0 mask 255.255.255.0 network 10.97.22.0 mask 255.255.255.0 network 10.97.23.0 mask 255.255.255.0 network 172.28.5.137 mask 255.255.255.255 neighbor 10.97.0.33 remote-as 65527 neighbor 10.97.0.33 description HUB1;Tunnel2010 neighbor 10.97.0.33 update-source Tunnel1 neighbor 10.97.0.33 timers 10 30 neighbor 10.97.0.33 activate neighbor 10.97.0.33 send-community both neighbor 10.97.0.33 soft-reconfiguration inbound neighbor 10.97.0.33 prefix-list IROUTE-EXPORT out neighbor 10.97.0.33 maximum-prefix 5000 80 neighbor 10.97.0.34 remote-as 65527 neighbor 10.97.0.34 description HUB2;tunnel2010 neighbor 10.97.0.34 update-source Tunnel1 neighbor 10.97.0.34 timers 10 30 neighbor 10.97.0.34 activate neighbor 10.97.0.34 send-community both neighbor 10.97.0.34 soft-reconfiguration inbound neighbor 10.97.0.34 prefix-list IROUTE-EXPORT out neighbor 10.97.0.34 route-map AllVRF-LocalPref-80 in neighbor 10.97.0.34 maximum-prefix 5000 80 exit-address-family If more information is needed, please say so.
Any help or advice would be greatly appreciated!
Thank you!
It is possible that you touch it--the failure of negotiations of phase 2:
https://Tools.Cisco.com/bugsearch/bug/CSCup72039/?reffering_site=dumpcr
[Too little detail to say with certainty:]
M.
-
Hello
It looks like one of our customers were buying SRI is to connect to the Microsoft via DMVPN cloud azure, because Cisco ASA does not (yet) support.
ASA will support this in a future release nearby?
Finally, anyone have any suggestions? (Apart from not using azure ;-)
Based on the comments of the representatives of Cisco in sessions DMVPN/FlexVPN to Cisco Live!, there is no plan to support DMVPN/FlexVPN on SAA. This may have changed since then, but I doubt it.
VPN infrastructure evolve slowly but surely based simply on strategies IPSec VPN that supports the ASA to the more modern and more flexible based on the VPN as DMVPN and FlexVPN road. The key here sentence is "road", which puts the technology firmly within the scope of routers rather than safety devices.
The ASA units are very good in what they do, but modern VPN infrastructure are a bit beyond their reach.
-
Load the DMVPN Balance several tunnels
Try to balance 2 DMVPN tunnel to a remote router to our Central Administration site. The remote router is a 2811 12.4.24 running. It has two connections DSL and I built two tunnels DMVPN to my seat with each tunnel will a separate router. I am running EIGRP across the WAN and LAN. Please see attached drawing.
When I put two routes by default equal and just let EIGRP to balance between router 180.7.250.1 to favour road and very little traffic crosses the 180.7.249.1 road.
The reason why I try it is because this site is in kind of a remote and I can't get a 500KB to the top and 1.5 MB DSL circuit. So to boost performance a bit I wanted to try running both circuits.
I am open to suggestions or advice on how to get a little more bandwidth of this site.
Thanks in advance.
EIGRP metric are determined by the delay, bandwidth, reliability and support. You have the same router, the same tunnel interface. All the interfaces involved in eigrp must match exactly the same if you want to balance the load across it. See how composites represent different below. If you can make them match your traffic balance the load.
-
Hello!
I'm totally newbie with FlexVPN (and never used DMVPN also), so I want to ask a general question.
We need to connect to FlexVPN hub, but we have two (well, really 3) providers of Internet services and we do not have our own address space, so we use the addresses of the pools of the IPSs.
I need to use an ISP as primary and the other as backup, with automatic switching.
BTW, we have that with ASA and the railway and it works pretty well.
Back to FlexVPN: as I see source Tunnel must be an external interface, so I need to change the config to move to another ISP, i.e. it is not solvable by track.
Could you tell me recommended provided automatic switching for two or more ISP configuration?
BTW, we plan to use CSR1000v...
Thank you!
Hello
Here you need to create two interfaces tunnel pointing two different tunnel say isps1 tunnel 1 and isp2 on the tunnels2 sources... After this thr routing protocol / ip sla monitoring will do the rest as usual.
http://www.virtadept.com/?p=184
Concerning
Knockaert
-
DMVPN and INTERNET VIA HUB RENTAL ISSUES
Hello everyone,
I really wish you can help me with the problem I have.
I explain. I test a double Hub - double DMVPN Layout for a client before we set it up in actual production.
The client has sites where routers are behind some ISP routers who do NAT.
How things are configured:
-All rays traffic must go through the location of the hub if no local internet traffic on the rays.
-Hub 1 and 2 hub sends a default route to rays through EIGRP. But only Hub 1 is used.
-Hub 1 is the main router to DMVPN. In case of connection / hardware failure of the Internet Hub 2 become active for DMVPN and Internet.
-Hub 1 and 2 hub are both connected to an ISP and Internet gateway for rays.
-Hub 1 and 2 hub are configured with IOS Firewall.
-On the shelves I used VRF for separate DMVPN routning Global routning table so I could receive a default route of 1 Hub and Hub 2 to carry the traffic of rays to the Internet via the location of the hubWhat works:
-All rays can have access to the local network to the location of the hub.
-All the rays can do talk of talk
-Working for DMVPN failover
-Rais NOT behind the router NAT ISP (i.e. the public IP address) directly related to their external interface can go Internet via hub location and all packages are inspected properly by the IOS and Nat firewall properly
What does not work:-Rays behind the NAT ISP router can not access Internet via Hub location. They can reach a local network to the location of the hub and talk of talks.
IOS Firewall Router hub shows packages from rays of theses (behind a NAT) with a source IP address that is the router og PSI of public IP address outside the interface. Not the private address LAN IP back spoke.
In addition, the packets are never natted. If I do some captge on an Internet Server, the private source IP is the IP LAN to the LAN behind the rays. This means that the hub, router nat never these packages.How to solve this problem?
/ * Style definitions * / table. MsoNormalTable {mso-style-name : « Tabel - Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}
Well I don't know that's why I need your help/advice :-)
I don't know that if I have to configure a VRF on the location of the hub gets also like things might mess upward.
The problem seems to be NAT - T the rays that are not behind a NAT, among which go over the Internet through a Hub and inspection of Cisco IOS and NAT are trying to find.
I tested today with the customer at the start them talking behind nat could ping different server on the Internet but not open an HTTP session. DNS was to find work. The IOS Firewall has been actually
inspection of packages with private real IP address. Then I thought it was a MTU issue, so I decided to do a ping on the Internet with the largest MTU size and suddenly the pings were no more.
I could see on the router Hub1 IOS Firewall was inspecting the public IP of the ISP NAT router again alongside with rays and not more than the actual IP address private. Really strange!
Attached files:
I attach the following files: a drawing of configuration called drawing-Lab - Setup.jpeg | All files for HUB1, BRANCH1 and BRANCH2 ISP-ROUTER configs, named respectively: HUB1.txt, BRANCH1.txt, BRANCH2.txt and ISP - ROUTER .txt
Hub1 newspapers when ping host 200.200.200.200 on the Internet of Branch2 (behind the NAT ISP router):
Branch2 #ping vrf DMVPN-VRF 200.200.200.200 source vlan 100
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 200.200.200.200, time-out is 2 seconds:
Packet sent with a source address of 192.168.110.1
.....
Success rate is 0% (0/5)* 06:04:51.017 Jul 15 UTC: % FW-6-SESS_AUDIT_TRAIL_START: start session icmp: initiator (110.10.10.2:8) - answering machine (200.200.200.200:0)
If the IOS Firewall does not inspect the true private source IP address that can be, in this case: 192.168.110.2. He sess on the public IP address.
HUB1 #sh ip nat translations
Inside global internal local outside global local outdoor Pro
ICMP 80.10.10.2:1 80.10.10.2:1 100.10.10.2:1 100.10.10.2:1
ICMP 80.10.10.2:2 80.10.10.2:2 110.10.10.2:2 110.10.10.2:2
UDP 80.10.10.2:4500 80.10.10.2:4500 110.10.10.2:4500 110.10.10.2:4500There is no entry for packets of teas present NAT
Captge on Tunnel 1 on Hub1 interface (incoming packets in):
7 7.355997 192.168.110.1 200.200.200.200 request ICMP (ping) echo
So that the firewall controllable IOS to the 110.10.10.2:8 public IP sniffing capture said that the package come from private real IP addressInhalation of vapours on the server (200.200.200.200) with wireshark:
114 14.123552 192.168.110.1 200.200.200.200 request ICMP (ping) echo
If the private IP address of source between local network of BRANCH2 is never natted by HUB1
If the server sees the address source IP private not natted although firewall IOS Hub1 inspect the public IP address 110.10.10.2:8
Hub1 newspapers when ping host 200.200.200.200 on the Internet of Branch1 (not behind the NAT ISP router):
Branch1 #ping vrf DMVPN-VRF 200.200.200.200 source vlan 100
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 200.200.200.200, time-out is 2 seconds:
Packet sent with a source 192.168.100.1 address
!!!!!* 06:05:18.217 Jul 15 UTC: % FW-6-SESS_AUDIT_TRAIL_START: start session icmp: initiator (192.168.100.1:8) - answering machine (200.200.200.200:0)
This is so the firewall sees the actual private IP which is 192.168.100.1
HUB1 #sh ip nat translations
Inside global internal local outside global local outdoor Pro
ICMP 80.10.10.2:1 80.10.10.2:1 100.10.10.2:1 100.10.10.2:1
ICMP 80.10.10.2:2 80.10.10.2:2 110.10.10.2:2 110.10.10.2:2
UDP 80.10.10.2:4500 80.10.10.2:4500 110.10.10.2:4500 110.10.10.2:4500
ICMP 80.10.10.2:22 192.168.100.1:22 200.200.200.200:22 200.200.200.200:22The real private source IP address is also find natted 1 Hub outside the public IP address
Captge on Tunnel 1 on Hub1 interface (incoming packets in):
8 7.379997 192.168.100.1 200.200.200.200 request ICMP (ping) echo
Real same as inspected by IOS Firewall so all private IP address is y find.
Inhalation of vapours on the server (200.200.200.200) with wireshark:
/ * Style definitions * / table. MsoNormalTable {mso-style-name : « Tabel - Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}
67 10.441153 80.10.10.2 200.200.200.200 request ICMP (ping) echo
So, here's all right. The address is natted correctly.
__________________________________________________________________________________________
Best regards
Laurent
Hello
Just saw your message, I hope this isn't too late.
I don't know what your exact problem, but I think we can work through it to understand it.
One thing I noticed was that your NAT ACL is too general. You need to make it more
specific. In particular, you want to make sure that it does not match the coming of VPN traffic
in to / out of the router.
For example you should not really have one of these entries in your NAT translation table.
HUB1 #sh ip nat translations
Inside global internal local outside global local outdoor Pro
ICMP 80.10.10.2:1 80.10.10.2:1 100.10.10.2:1 100.10.10.2:1
ICMP 80.10.10.2:2 80.10.10.2:2 110.10.10.2:2 110.10.10.2:2
UDP 80.10.10.2:4500 80.10.10.2:4500 110.10.10.2:4500 110.10.10.2:4500Instead use:
Nat extended IP access list
deny ip any 192.168.0.0 0.0.255.255 connect
allow an ip
deny ip any any newspaperIf you can use:
Nat extended IP access list
deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 connect
IP 192.168.0.0 allow 0.0.255.255 everything
deny ip any any newspaperAlso, I would be very careful with the help of the "log" keyword in an ACL, NAT.
I saw problems.
What are the IOS versions do you use?
Try to make changes to the NAT so that you no longer see the entries of translation NAT
for packages of NAT - T (UDP 4500) in the table of translation NAT on the hub. It may be
This puts a flag on the package structure, that IOS Firewall and NAT is
pick up on and then do the wrong thing in this case.
If this does not work then let me know.
Maybe it's something for which you will need to open a TAC case so that we can
This debug directly on your installation.
Mike.
-
DMVPN and active directory (logon)
Hi all
We have a DMVPN configuration between a few sites and everything seems fine, except that the logons through the VPN for a new domain active directory are very slow (10-15 minutes). I believe that the problem may be with the fragmentation of tunnel and packages such as AD is configured correctly.
I am looking for some recommendations or advice on the MTU and TCP MSS settings see if it solves the problem.
both the hub and the spokes are currently with the following settings MTU and MSS (ive removed some irrelevant information) Tunnel0 was originally a mtu of 1440 but if whatever it is 1400 is even worse.
Thank you
interface Tunnel0
IP 1400 MTU
IP nat inside
authentication of the PNDH IP SP1
dynamic multicast of IP PNDH map
PNDH network IP-1 id
IP virtual-reassembly in
No cutting of the ip horizon
source of Dialer0 tunnel
multipoint gre tunnel mode
0 button on tunnel
Profile of ipsec protection tunnel 1
interface Dialer0
MTU 1492
the negotiated IP address
NAT outside IP
IP virtual-reassembly in
encapsulation ppp
IP tcp adjust-mss 1452
Dialer pool 1
Dialer-Group 1
Darren,
In general the prolem is due to Kerberos on UDP traffic.
There are several ways you can solve the problem:
(1) transition to Kerberos over TCP. (suggested)
(2) setting the MSS on the interface of tunnel not on telephone transmitter (recommended)
(3) allowing the PMTUD tunnel (strongly recommended).
M.
-
ASA VPN Site to site: mesh DMVPN or full?
Hi all
I'm a new man in the cisco environment, please help me
Currently I am working on a project that requires to set up the VPN for security at the site of mutiple with diffirent ISP (no decided static or dynamic IP yet)
I can also ask router Cisco for L3 routing devices and ASA appliance
My goal is: all sites can communicate with each other.
Now I am considering all DMVPN or Full mesh topology
If you guys please answer my questions:
1. static IP from ISP is straight? Can I use a dynamic IP? (I know ASA have a kind of dynamic - static VPN)
2 DMVPN:
+ ASA can't, but I've heard that, somehow, ASA can config like speaks of talking about VPN. Is - this match my target?
+ Please refer me documents to set it up if you have
3 - full mesh VPN:
+ How to set up, am I have to config VPN L2L each of the sites for the rest?
4 - DMVPN vs Full Mesh - what is the best? which is less config work, less administration tasks?
5 - the last of them: Please consult me the device necessary for my target
Thanks to you all!
You are right that an ASA will not support DMVPN. It should be that configure you individual VPN LAN-to-LAN tunnels at each site (total n x (n - 1) tunnels).
FlexVPN with ISR G2 routers would be the least amount of configuration work and more flexible setting for your requirements. It has the advantages of EZVPN and DMVPN together.
There are a number of examples of configuration of FlexVPN here.
Maybe you are looking for
-
I'm constantly locked out of my account. Why it can't get Apple as well as several accounts? Whatever you do, never having accounts families or several user names. Information in addition to 60 Days (?) to connect with another Apple ID pending?
-
I've updated the plan of 250 GB. I am about to transition about 60 GB in front of another cloud provider, who will be my total storage to 100 GB. ICloud Drive on my iphone 64 GB and ipad automatically try and synchronize all of these files? Is it pos
-
Toshiba BT stack steals the puppetmaster COM port
Hello I'm trying to connect my phone with the party program on my computer (master of puppets or perplexed) and 3D for who built a new server com port com3When my phone connects to his departure from the transition of data but not with the puppetmast
-
2000-2106TU HP: upgrade of the system for Hp 2000-2106TU
I want to update my laptop. Please help me with the following information from Hp 2000-2106TU: (1) SATA version Frequency of the RAM 2)
-
How do you coneet a printer to your xp computer
IM aaaaaaaaaaaaaaaaaaaa