IPSec VPN auto-timeout after 60 Minutes

Dear all,

I am facing a problem. When my clients are connecting remote VPN IPSec an hour it automatically disconnects the connection. Users need to be re - authenticate. I also changed the timekeepers of the IPSec Security Association and timer ISAKMP, but still the same problem persists.

According to my findings my user authentication becomes Cisco ACS/RADIUS server, which is running on the default settings and the policy is enforced by Cisco ACS. I have a suggestion how can I set the timer and to address this problem.

Any suggestion?

Waiting for your RESPONSE.

Concerning

Yasser

Yasir,

What version of ACS you run and very probably the attribute "session timeout" is probably sent, you can extend this attribute or remove it on the status of the authorization.

Let me know what version of ACS you run and I can walk you through it...

Thank you

Tarik Admani
* Please note the useful messages *.

Tags: Cisco Security

Similar Questions

  • Windows auto-serrures after 10 minutes of inactivity.

    Can someone help me solve this problem? Windows Vista sends me back the connection after 10 minutes of inactivity screen, which becomes inconvenient when there is 5 to 10 times a day. First of all, it is NOT related to the screen saver, I have the "on RESUME, display login" unchecked, as well as my screen saver is disabled. It is also not related to the option to sleep in the advanced power settings, I have my computer never sleep. Vista is not sleep, hibernation, Logging Off ot, it is blocking. Basically it's just to send me back the login screen after 10 minutes of inactivity, and when I log in all my stuff is still there. Web pages or applications I had open are all still there, but it's always a pain the the _ because if I have any program configured to run automatically (as virus scans etc.) in the middle of the night programs start if the system is locked.

    I searched online for a while and could not find any help. It seems that everyone who has this problem just gets told to check their settings to screen saver and power, but this problem is not related to those.

    Hey Nick,

    This is sometimes possible when you computer from the fan or the computer gets hot. Go to BIOS and enable two fans cause by default only one fan is turned on.

    Let me know it works...

    DOM.

  • Cisco 1841 ipsec tunnel protocol down after a minute

    I have a strange problem where im manages to get a tha cisco ipsec tunnel 1841 to a RV016 linksys/cisco for about a minute and ping/encrypt the packets through the linen for about a minute before it breaks down. I tried different configuration and it all results in the tunnel for a minute then descend to come. I don't know if im hitting a bug and decide to if im doing something wrong.

    any help is appreciated paul

    RV016 firmware 2.0.18

    Cisco 1841: C1841-ADVENTERPRISEK9-M), Version 12.4 (24) T

    my config

    no default isakmp crypto policy

    !

    crypto ISAKMP policy 1

    BA 3des

    md5 hash

    preshared authentication

    Group 2

    lifetime 28800

    ISAKMP crypto key address 0.0.0.0 eaton1234 0.0.0.0

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac ESSTS

    transport mode

    no default crypto ipsec transform-set

    !

    Crypto ipsec profile ipsec_profile1

    Description in the location main site to site VPN tunnel

    game of transformation-ESSTS

    PFS group2 Set

    !

    !

    !

    !

    !

    !

    !

    Tunnel1 interface

    Description of the location of the hand

    IP unnumbered Serial0/0/0

    source of tunnel Serial0/0/0

    destination 209.213.x.x tunnel

    ipv4 ipsec tunnel mode

    tunnel path-mtu-discovery

    protection of ipsec profile ipsec_profile1 tunnel

    !

    a debug output

    Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 the proposal

    Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 of the proposal

    (Eng. msg key.) Local INCOMING = 209.213.xx.46, distance = 209.213.xx.164,.

    local_proxy = 10.20.86.0/255.255.255.0/0/0 (type = 4),

    remote_proxy = 10.0.0.0/255.255.255.0/0/0 (type = 4),

    Protocol = ESP, transform = NONE (Tunnel),

    lifedur = 0 and 0kb in

    SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

    Apr 24 16:42:07: mapdb Crypto: proxy_match

    ADR SRC: 10.20.86.0

    ADR DST: 10.0.0.0

    Protocol: 0

    SRC port: 0

    DST port: 0

    Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

    Apr 24 16:42:07: mapdb Crypto: proxy_match

    ADR SRC: 10.20.86.0

    ADR DST: 10.0.0.0

    Protocol: 0

    SRC port: 0

    DST port: 0

    Apr 24 16:42:07: IPSEC (policy_db_add_ident): src dest 10.0.0.0, 10.20.86.0, dest_port

    0

    Apr 24 16:42:07: IPSEC (create_sa): its created.

    (his) sa_dest = 209.213.xx.46, sa_proto = 50,.

    sa_spi = 0x4CF51011 (1291128849).

    sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2045

    sa_lifetime(k/sec) = (4463729/3600)

    Apr 24 16:42:07: IPSEC (create_sa): its created.

    (his) sa_dest = 209.213.xx.164, sa_proto = 50,.

    sa_spi = 0x1EB77DAF (515341743).

    sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2046

    sa_lifetime(k/sec) = (4463729/3600)

    Apr 24 16:42:07: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

    you to

    Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

    Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP

    Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): select SA with spinnaker 515341743/50

    Apr 24 16:42:07: IPSEC (update_current_outbound_sa): update peer 209.213.xx.164 curre

    NT his outgoing to SPI 1EB77DAF

    Apr 24 16:42:12: IPSEC (key_engine): request timer shot: count = 1,.

    local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

    remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

    Apr 24 16:42:12: IPSEC (sa_request):,.

    (Eng. msg key.) Local OUTGOING = 209.213.xx.46, distance = 209.213.xx.164,.

    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

    remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

    Protocol = ESP, transform = esp-3des esp-sha-hmac (Tunnel),

    lifedur = 3600 s and KB 4608000,

    SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

    Apr 24 16:42:42: IPSEC (key_engine): request timer shot: count = 2,.

    local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

    remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

    Apr 24 16:42:42: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

    you all the downu

    All possible debugging has been disabled

    I would try to set up a VPN Interface virtual Tunnel on the IOS router base and the value of defined transformation in tunnel mode no transport.

    In history, I have had several issues with VPN between a router IOS and the series RV.

  • IPSec VPN with DynDNS host problems after change of address

    Hi guys,.

    I have a weird problem on an IOS router.

    I need to implement IPSec VPN L2L.

    Because of the security requirements of each site needed a clean pre-shared key. Sites dynamic IP and it's

    why I use dyndns.

    ISAKMP crypto key KEY hostname XXXXXXXXXXX.dyndns.org

    CMAP_1 1 ipsec-isakmp crypto map
    define peer dynamic XXXXXXXXX.dyndns.org

    First of all, it works fine, but after the change of IP address it no longer works.

    Debugging, I discovered that it resolves the new IP address but IPSec attempts to connect to the previous INVESTIGATION period.

    I tried this on two other IOS, 15.0 and 12.4

    This debugging output:

    01:02:39.735 Mar 1: IPSEC: addr of Peer Link70 (70.1.1.3) is out of date, triggering DNS
    * 01:02:39.735 Mar 1: IPSEC: Peer has the address 70.1.1.3 (DNS cache).                 New IP address
    * 1 Mar 01:02:41.731: IPSEC (sa_request):,.
    (Eng. msg key.) Local OUTGOING = 1.1.1.2, distance = 70.1.1.200, OLD IP
    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),
    remote_proxy = 10.254.70.0/255.255.255.0/0/0 (type = 4),
    Protocol = ESP, transform = esp-3des esp-sha-hmac (Tunnel),
    lifedur = 240 s and KB 4608000,
    SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
    * 1 Mar 01:02:41.739: ISAKMP: (0): profile of THE request is (NULL)
    * 01:02:41.739 Mar 1: ISAKMP: created a struct peer 70.1.1.200, peer port 500
    * 01:02:41.739 Mar 1: ISAKMP: new created position = 0x673FB268 peer_handle = 0 x 80000008
    * 01:02:41.739 Mar 1: ISAKMP: lock struct 0x673FB268, refcount 1 to peer isakmp_initiator
    * 01:02:41.743 Mar 1: ISAKMP: 500 local port, remote port 500
    * 01:02:41.743 Mar 1: ISAKMP: set new node 0 to QM_IDLE
    * 01:02:41.743 Mar 1: insert his with his 650AE400 = success
    * 01:02:41.747 Mar 1: ISAKMP: (0): cannot start aggressive mode, try the main mode.
    * 01:02:41.747 Mar 1: ISAKMP: (0): no pre-shared with 70.1.1.200!                     PROBLEM!
    * 1 Mar 01:02:41.747: ISAKMP: (0): pre-shared key or Cert No. address.                   PROBLEM!
    * 1 Mar 01:02:41.747: ISAKMP: (0): construct_initial_message: cannot start main mode
    * 01:02:41.751 Mar 1: ISAKMP: Unlocking counterpart struct 0x673FB268 for isadb_unlock_peer_delete_sa(), count 0
    * 01:02:41.751 Mar 1: ISAKMP: delete peer node by peer_reap for 70.1.1.200: 673FB268
    * 01:02:41.751 Mar 1: ISAKMP: (0): serving SA., his is 650AE400, delme is 650AE400
    * 01:02:41.755 Mar 1: ISAKMP: (0): purge the node-267512777
    * 01:02:41.755 Mar 1: ISAKMP: error during the processing of HIS application: failed to initialize SA
    * 01:02:41.755 Mar 1: ISAKMP: error while processing message KMI 0, error 2.
    * 1 Mar 01:02:41.759: IPSEC (key_engine): had an event of the queue with 1 KMI messages...
    Success rate is 0% (0/5)

    I'm building a lab to find a solution for this.

    The other side is a VPN Linksys router, I tried with an IOS router on both sites also, but I got same results.

    I tried with DPD, ISAKMP profiles don't... no help.

    Hi Smailmilak83,

    Configuration of a static encryption with a specific peer card creates a society of surveillance for the peer. Dns lookup he's now only the first time, he tries to connect, after which it's just going to be her generate a new key. If she would ideally use the value peer in the his and not the config or a dns lookup. So, it is wise to use a dynamic encryption card.

    Please try to use a dynamic encryption instead of a static map. Although there are some limitations including crypto being initiated only at the other end, we can work around keeping the tunnel directly.

    Hope that helps.

    Sent by Cisco Support technique iPhone App

    -Please note the solutions.

  • Unable to connect to the Internet, the error message "Cisco AnyConnect VPN agent service is not responding. Please restart this application after a minute"

    Original title: unable to connect to the internet

    Whenever I connect to my computer and get it on my desk, it goes on to say that Cisco AnyConnect VPN Service not available. How can I fix? I am not connected to the internet and I can't connect to the internet as well. He said also Cisco AnyConnect VPN service agent is not an answer. Please restart this application after a minute. Also, I can't use my firewall for some reason, if I try to allow its loading and the greenbar's going that far - then stops and says that there is an error. I forgot where I tried to activate.

    Oh thanks for the help but I fix it myself. I just did a system restore to a month before

  • ISA500 site by site ipsec VPN with Cisco IGR

    Hello

    I tried a VPN site by site work with Openswan and Cisco 2821 router configuration an Ipsec tunnel to site by site with Cisco 2821 and ISA550.

    But without success.

    my config for openswan, just FYI, maybe not importand for this problem

    installation of config

    protostack = netkey

    nat_traversal = yes

    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%4:!$RIGHT_SUBNET

    nhelpers = 0

    Conn rz1

    IKEv2 = no

    type = tunnel

    left = % all

    leftsubnet=192.168.5.0/24

    right =.

    rightsourceip = 192.168.1.2

    rightsubnet=192.168.1.0/24

    Keylife 28800 = s

    ikelifetime 28800 = s

    keyingtries = 3

    AUTH = esp

    ESP = aes128-sha1

    KeyExchange = ike

    authby secret =

    start = auto

    IKE = aes128-sha1; modp1536

    dpdaction = redΘmarrer

    dpddelay = 30

    dpdtimeout = 60

    PFS = No.

    aggrmode = no

    Config Cisco 2821 for dynamic dialin:

    crypto ISAKMP policy 1

    BA aes

    sha hash

    preshared authentication

    Group 5

    lifetime 28800

    !

    card crypto CMAP_1 1-isakmp dynamic ipsec DYNMAP_1

    !

    access-list 102 permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255

    !

    Crypto ipsec transform-set ESP-AES-SHA1 esp - aes esp-sha-hmac

    crypto dynamic-map DYNMAP_1 1

    game of transformation-ESP-AES-SHA1

    match address 102

    !

    ISAKMP crypto key address 0.0.0.0 0.0.0.0

    ISAKMP crypto keepalive 30 periodicals

    !

    life crypto ipsec security association seconds 28800

    !

    interface GigabitEthernet0/0.4002

    card crypto CMAP_1

    !

    I tried ISA550 a config with the same constelations, but without suggesting.

    Anyone has the same problem?

    And had anyone has a tip for me, or has someone expirense with a site-by-site with ISA550 and Cisco 2821 ipsec tunnel?

    I can successfully establish a tunnel between openswan linux server and the isa550.

    Patrick,

    as you can see on newspapers, the software behind ISA is also OpenSWAN

    I have a facility with a 892 SRI running which should be the same as your 29erxx.

    Use your IOS Config dynmap, penny, you are on the average nomad. If you don't have any RW customer you shoul go on IOS "No.-xauth" after the isakmp encryption key.

    Here is my setup, with roardwarrior AND 2, site 2 site.

    session of crypto consignment

    logging crypto ezvpn

    !

    crypto ISAKMP policy 1

    BA 3des

    preshared authentication

    Group 2

    lifetime 28800

    !

    crypto ISAKMP policy 2

    BA 3des

    md5 hash

    preshared authentication

    Group 2

    lifetime 28800

    !

    crypto ISAKMP policy 3

    BA 3des

    preshared authentication

    Group 2

    !

    crypto ISAKMP policy 4

    BA 3des

    md5 hash

    preshared authentication

    Group 2

    !

    crypto ISAKMP policy 5

    BA 3des

    preshared authentication

    Group 2

    life 7200

    ISAKMP crypto address XXXX XXXXX No.-xauth key

    XXXX XXXX No.-xauth address isakmp encryption key

    !

    ISAKMP crypto client configuration group by default

    key XXXX

    DNS XXXX

    default pool

    ACL easyvpn_client_routes

    PFS

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac FEAT

    !

    dynamic-map crypto VPN 20

    game of transformation-FEAT

    market arriere-route

    !

    !

    card crypto client VPN authentication list by default

    card crypto VPN isakmp authorization list by default

    crypto map VPN client configuration address respond

    10 VPN ipsec-isakmp crypto map

    Description of VPN - 1

    defined peer XXX

    game of transformation-FEAT

    match the address internal_networks_ipsec

    11 VPN ipsec-isakmp crypto map

    VPN-2 description

    defined peer XXX

    game of transformation-FEAT

    PFS group2 Set

    match the address internal_networks_ipsec2

    card crypto 20-isakmp dynamic VPN ipsec VPN

    !

    !

    Michael

    Please note all useful posts

  • Establish a IPsec VPN connection, but remote site can't ping main office

    Hi, I set up connection from site to site IPsec VPN between cisco 892 (main site) router and linksys router wrv210 (remote site). My problem is that I can ping network router wrv210 lan of my main office where is cisco 892 router, but I cannot ping the main site of linksys wrv210 lan (my remote site).

    My configuration on the cisco 892 router:

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-1

    game group-access 103

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-3

    game group-access 106

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-2

    game group-access 105

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-5

    game group-access 108

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-4

    game group-access 107

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-7

    group-access 110 match

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-6

    game group-access 109

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-9

    game group-access 112

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-8

    game group-access 111

    type of class-card inspect entire game SDM_AH

    match the name of group-access SDM_AH

    type of class-card inspect entire game SDM_ESP

    match the name of group-access SDM_ESP

    type of class-card inspect entire game SDM_VPN_TRAFFIC

    match Protocol isakmp

    match Protocol ipsec-msft

    corresponds to the SDM_AH class-map

    corresponds to the SDM_ESP class-map

    type of class-card inspect the correspondence SDM_VPN_PT

    game group-access 102

    corresponds to the SDM_VPN_TRAFFIC class-map

    type of class-card inspect entire game PAC-cls-insp-traffic

    match Protocol cuseeme

    dns protocol game

    ftp protocol game

    h323 Protocol game

    https protocol game

    match icmp Protocol

    match the imap Protocol

    pop3 Protocol game

    netshow Protocol game

    Protocol shell game

    match Protocol realmedia

    match rtsp Protocol

    smtp Protocol game

    sql-net Protocol game

    streamworks Protocol game

    tftp Protocol game

    vdolive Protocol game

    tcp protocol match

    udp Protocol game

    inspect the class-map match PAC-insp-traffic type

    corresponds to the class-map PAC-cls-insp-traffic

    type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-10

    game group-access 113

    type of class-card inspect all sdm-service-ccp-inspect-1 game

    http protocol game

    https protocol game

    type of class-card inspect entire game PAC-cls-icmp-access

    match icmp Protocol

    tcp protocol match

    udp Protocol game

    type of class-card inspect correspondence ccp-invalid-src

    game group-access 100

    type of class-card inspect correspondence ccp-icmp-access

    corresponds to the class-ccp-cls-icmp-access card

    type of class-card inspect correspondence ccp-Protocol-http

    match class-map sdm-service-ccp-inspect-1

    !

    !

    type of policy-card inspect PCB-permits-icmpreply

    class type inspect PCB-icmp-access

    inspect

    class class by default

    Pass

    type of policy-card inspect sdm-pol-VPNOutsideToInside-1

    class type inspect sdm-cls-VPNOutsideToInside-1

    inspect

    class type inspect sdm-cls-VPNOutsideToInside-2

    Pass

    class type inspect sdm-cls-VPNOutsideToInside-3

    Pass

    class type inspect sdm-cls-VPNOutsideToInside-4

    Pass

    class type inspect sdm-cls-VPNOutsideToInside-5

    Pass

    class type inspect sdm-cls-VPNOutsideToInside-6

    inspect

    class type inspect sdm-cls-VPNOutsideToInside-7

    Pass

    class type inspect sdm-cls-VPNOutsideToInside-8

    Pass

    class type inspect sdm-cls-VPNOutsideToInside-9

    inspect

    class type inspect sdm-cls-VPNOutsideToInside-10

    Pass

    class class by default

    drop

    type of policy-map inspect PCB - inspect

    class type inspect PCB-invalid-src

    Drop newspaper

    class type inspect PCB-Protocol-http

    inspect

    class type inspect PCB-insp-traffic

    inspect

    class class by default

    drop

    type of policy-card inspect PCB-enabled

    class type inspect SDM_VPN_PT

    Pass

    class class by default

    drop

    !

    security of the area outside the area

    safety zone-to-zone

    zone-pair security PAC-zp-self-out source destination outside zone auto

    type of service-strategy inspect PCB-permits-icmpreply

    zone-pair security PAC-zp-in-out source in the area of destination outside the area

    type of service-strategy inspect PCB - inspect

    source of PAC-zp-out-auto security area outside zone destination auto pair

    type of service-strategy inspect PCB-enabled

    sdm-zp-VPNOutsideToInside-1 zone-pair security source outside the area of destination in the area

    type of service-strategy inspect sdm-pol-VPNOutsideToInside-1

    !

    !

    crypto ISAKMP policy 1

    BA 3des

    md5 hash

    preshared authentication

    Group 2

    lifetime 28800

    ISAKMP crypto key address 83.xx.xx.50 xxxxxxxxxxx

    !

    !

    Crypto ipsec transform-set ESP-3DES esp-3des esp-md5-hmac

    !

    map SDM_CMAP_1 1 ipsec-isakmp crypto

    Description NY_NJ

    the value of 83.xx.xx.50 peer

    game of transformation-ESP-3DES

    match address 101

    !

    !

    !

    !

    !

    interface BRI0

    no ip address

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    penetration of the IP stream

    encapsulation hdlc

    Shutdown

    Multidrop ISDN endpoint

    !

    !

    interface FastEthernet0

    !

    !

    interface FastEthernet1

    !

    !

    interface FastEthernet2

    !

    !

    interface FastEthernet3

    !

    !

    interface FastEthernet4

    !

    !

    interface FastEthernet5

    !

    !

    FastEthernet6 interface

    !

    !

    interface FastEthernet7

    !

    !

    interface FastEthernet8

    no ip address

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    penetration of the IP stream

    automatic duplex

    automatic speed

    !

    !

    interface GigabitEthernet0

    Description $ES_WAN$ $FW_OUTSIDE$

    IP address 89.xx.xx.4 255.255.255.xx

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    penetration of the IP stream

    NAT outside IP

    IP virtual-reassembly

    outside the area of security of Member's area

    automatic duplex

    automatic speed

    map SDM_CMAP_1 crypto

    !

    !

    interface Vlan1

    Description $ETH - SW - LAUNCH INTF-INFO-FE 1 to $$$ $ES_LAN$ $FW_INSIDE$

    IP 192.168.0.253 255.255.255.0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    penetration of the IP stream

    IP nat inside

    IP virtual-reassembly

    Security members in the box area

    IP tcp adjust-mss 1452

    !

    !

    IP forward-Protocol ND

    IP http server

    local IP http authentication

    IP http secure server

    IP http timeout policy slowed down 60 life 86400 request 10000

    !

    !

    IP nat inside source overload map route SDM_RMAP_1 interface GigabitEthernet0

    IP route 0.0.0.0 0.0.0.0 89.xx.xx.1

    !

    SDM_AH extended IP access list

    Note the category CCP_ACL = 1

    allow a whole ahp

    SDM_ESP extended IP access list

    Note the category CCP_ACL = 1

    allow an esp

    !

    recording of debug trap

    Note access-list 1 INSIDE_IF = Vlan1

    Note category of access list 1 = 2 CCP_ACL

    access-list 1 permit 192.168.0.0 0.0.0.255

    Access-list 100 category CCP_ACL = 128 note

    access-list 100 permit ip 255.255.255.255 host everything

    access-list 100 permit ip 127.0.0.0 0.255.255.255 everything

    access-list 100 permit ip 89.xx.xx.0 0.0.0.7 everything

    Note access-list 101 category CCP_ACL = 4

    Note access-list 101 IPSec rule

    access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.7.0 0.0.0.255

    Note access-list 102 CCP_ACL category = 128

    access-list 102 permit ip host 83.xx.xx.50 all

    Note access-list 103 CCP_ACL category = 0

    Note access-list 103 IPSec rule

    access-list 103 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 104 CCP_ACL category = 2

    Note access-list 104 IPSec rule

    access-list 104 deny ip 192.168.0.0 0.0.0.255 192.168.7.0 0.0.0.255

    access-list 104. allow ip 192.168.0.0 0.0.0.255 any

    Note access-list 105 CCP_ACL category = 0

    Note access-list 105 IPSec rule

    access-list 105 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 106 CCP_ACL category = 0

    Note access-list 106 IPSec rule

    access-list 106 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 107 CCP_ACL category = 0

    Note access-list 107 IPSec rule

    access-list 107 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 108 CCP_ACL category = 0

    Note access-list 108 IPSec rule

    access-list 108 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 109 CCP_ACL category = 0

    Note access-list 109 IPSec rule

    access-list 109 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 110 CCP_ACL category = 0

    Note access-list 110 IPSec rule

    access-list 110 permit ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 111 CCP_ACL category = 0

    Note access-list 111 IPSec rule

    access-list 111 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 112 CCP_ACL category = 0

    Note access-list 112 IPSec rule

    access-list 112 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    Note access-list 113 CCP_ACL category = 0

    Note access-list 113 IPSec rule

    access-list 113 allow ip 192.168.7.0 0.0.0.255 192.168.0.0 0.0.0.255

    not run cdp

    !

    !

    !

    !

    allowed SDM_RMAP_1 1 route map

    corresponds to the IP 104

    --------------------------------------------------------

    I only give your router cisco 892 because there is nothnig much to change on linksys wrv210 router.

    Hope someone can help me. See you soon

    You can run a "ip inspect log drop-pkt" and see if get you any what FW-DROP session corresponding to the traffic you send Linksys to the main site. Zone based firewall could be blocking traffic initiated from outside to inside.

  • IPSEC VPN with Dynamics to dynamic IP

    Hello

    I tried IPSEC VPN with dynamic IP to dynamic (router to router) for some time. But still can not auto-établir the tunnel.

    Is someone can you please tell me if it is possible to do?

    If so, please share with me the secret to do work.

    Thank you!

    Best regards

    Rather than the Crypto map, I would use the profile of Crypto.  Then, establish you an IPSEC tunnel.  The beauty of the profile, is that you can run through it routing protocols, and you do not have to change constantly the cards whenever you change the topology of the network.  The "* * *" in the timer event is "minute hour day week month" so "* * *" is updated every minute.  In Tunnel destination, it's an IP address, not a hostname that is stored, but when you set it, you can put in a HOST name and it converts to the moment where you configure it to an IP address.

    So, if you type:

    config t

    interface tunnel100
    destination remote.dyndns.com tunnel

    output

    See the race int tunnel100

    It shows:

    interface Tunnel100
    tunnel destination 75.67.43.79

    That's why the event handler goes and becomes the destination of tunnel every minute what ever the DDNS says that is the new IP address.

    I have seen that two of your routers running DDNS.  They will have to do this.

    Local router:

    crypto ISAKMP policy 1
    BA aes 256
    preshared authentication
    Group 2
    ISAKMP crypto key XXXXXXX address 0.0.0.0 0.0.0.0 no.-xauth
    !
    !
    Crypto ipsec transform-set ESP-AES-SHA esp - aes 256 esp-sha-hmac
    !
    Profile of crypto ipsec CRYPTOPROFILE
    game of transformation-ESP-AES-SHA
    !
    interface Tunnel100
    Description of remote.dyndns.org
    IP 10.254.220.10 255.255.255.252
    IP virtual-reassembly
    IP tcp adjust-mss 1400
    source of Dialer0 tunnel
    tunnel destination 75.67.43.79
    ipv4 ipsec tunnel mode
    Tunnel CRYPTOPROFILE ipsec protection profile

    IP route 192.168.2.0 255.255.255.0 10.254.220.9

    Change-tunnel-dest applet event handler
    cron-event entry timer cron name "CHRON" * * *"
    command action 1.0 cli 'enable '.
    action 1.1 cli command "configures terminal.
    Action 1.2 command cli "interface tunnel100".
    Action 1.3 cli command "destination remote.dyndns.org tunnel".
    !

    --------

    Remote router:

    crypto ISAKMP policy 1
    BA aes 256
    preshared authentication
    Group 2
    ISAKMP crypto key XXXXXXX address 0.0.0.0 0.0.0.0 no.-xauth
    !
    !
    Crypto ipsec transform-set ESP-AES-SHA esp - aes 256 esp-sha-hmac
    !
    Profile of crypto ipsec CRYPTOPROFILE
    game of transformation-ESP-AES-SHA
    !
    interface Tunnel100
    Description of local.dyndns.org
    IP 10.254.220.9 255.255.255.252
    IP virtual-reassembly
    IP tcp adjust-mss 1400
    source of Dialer0 tunnel
    tunnel destination 93.219.58.191
    ipv4 ipsec tunnel mode
    Tunnel CRYPTOPROFILE ipsec protection profile

    IP route 192.168.1.0 255.255.255.0 10.254.220.10

    Change-tunnel-dest applet event handler
    cron-event entry timer cron name "CHRON" * * *"
    command action 1.0 cli 'enable '.
    action 1.1 cli command "configures terminal.
    Action 1.2 command cli "interface tunnel100".
    Action 1.3 cli command "destination local.dyndns.org tunnel".

    Thank you

    Bert

  • IPSec VPN pix 501 no LAN access

    I'm trying to set up an IPSec VPN in a basic small business scenario. I am able to connect to my pix 501 via IPSec VPN and browse the internet, but I am unable to ping or you connect to all devices in the Remote LAN. Here is my config:

    : Saved

    :

    6.3 (3) version PIX

    interface ethernet0 car

    interface ethernet1 100full

    nameif ethernet0 WAN security0

    nameif ethernet1 LAN security99

    enable encrypted password xxxxxxxxxxxxx

    xxxxxxxxxxxxxxxxx encrypted passwd

    host name snowball

    domain xxxxxxxxxxxx.local

    clock timezone PST - 8

    fixup protocol dns-length maximum 512

    fixup protocol ftp 21

    fixup protocol h323 h225 1720

    fixup protocol h323 ras 1718-1719

    fixup protocol http 80

    fixup protocol pptp 1723

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol sip 5060

    fixup protocol sip udp 5060

    fixup protocol 2000 skinny

    No fixup not protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol tftp 69

    names of

    acl_in list of access permit udp any any eq field

    acl_in list of access permit udp any eq field all

    acl_in list access permit tcp any any eq field

    acl_in tcp allowed access list any domain eq everything

    acl_in list access permit icmp any any echo response

    access-list acl_in allow icmp all once exceed

    acl_in list all permitted access all unreachable icmp

    acl_in list access permit tcp any any eq ssh

    acl_in list access permit tcp any any eq www

    acl_in tcp allowed access list everything all https eq

    acl_in list access permit tcp any host 192.168.5.30 eq 81

    acl_in list access permit tcp any host 192.168.5.30 eq 8081

    acl_in list access permit tcp any host 192.168.5.22 eq 8081

    acl_in list access permit icmp any any echo

    access-list acl_in permit tcp host 76.248.x.x a

    access-list acl_in permit tcp host 76.248.x.x a

    allow udp host 76.248.x.x one Access-list acl_in

    access-list acl_out permit icmp any one

    ip access list acl_out permit a whole

    acl_out list access permit icmp any any echo response

    acl_out list access permit icmp any any source-quench

    allowed any access list acl_out all unreachable icmp

    access-list acl_out permit icmp any once exceed

    acl_out list access permit icmp any any echo

    Allow Access-list no. - nat icmp a whole

    access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

    access-list no. - nat ip 172.16.0.0 allow 255.255.0.0 any

    access-list no. - nat permit icmp any any echo response

    access-list no. - nat permit icmp any any source-quench

    access-list no. - nat icmp permitted all all inaccessible

    access-list no. - nat allow icmp all once exceed

    access-list no. - nat permit icmp any any echo

    pager lines 24

    MTU 1500 WAN

    MTU 1500 LAN

    IP address WAN 65.74.x.x 255.255.255.240

    address 192.168.5.1 LAN IP 255.255.255.0

    alarm action IP verification of information

    alarm action attack IP audit

    IP local pool pptppool 172.16.0.2 - 172.16.0.13

    PDM logging 100 information

    history of PDM activate

    ARP timeout 14400

    Global (WAN) 1 interface

    NAT (LAN) - access list 0 no - nat

    NAT (LAN) 1 0.0.0.0 0.0.0.0 0 0

    static (LAN, WAN) 65.x.x.37 192.168.5.10 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.36 192.168.5.20 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.38 192.168.5.30 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.39 192.168.5.40 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.42 192.168.5.22 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.43 192.168.5.45 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.44 192.168.5.41 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.45 192.168.5.42 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.46 192.168.5.44 netmask 255.255.255.255 0 0

    static (LAN, WAN) 65.x.x.41 192.168.5.21 netmask 255.255.255.255 0 0

    acl_in access to the WAN interface group

    access to the LAN interface group acl_out

    Route WAN 0.0.0.0 0.0.0.0 65.x.x.34 1

    Timeout xlate 0:05:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

    H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    RADIUS Protocol RADIUS AAA server

    AAA-server local LOCAL Protocol

    NTP server 72.14.188.195 source WAN

    survey of 76.248.x.x WAN host SNMP Server

    location of Server SNMP Sacramento

    SNMP Server contact [email protected] / * /

    SNMP-Server Community xxxxxxxxxxxxx

    SNMP-Server enable traps

    enable floodguard

    the string 1 WAN fragment

    Permitted connection ipsec sysopt

    Sysopt connection permit-pptp

    Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

    Crypto-map dynamic dynmap 10 transform-set RIGHT

    map mymap 10-isakmp ipsec crypto dynamic dynmap

    client configuration address map mymap crypto initiate

    client configuration address map mymap crypto answer

    card crypto mymap WAN interface

    ISAKMP enable WAN

    ISAKMP nat-traversal 20

    part of pre authentication ISAKMP policy 10

    encryption of ISAKMP policy 10

    ISAKMP policy 10 md5 hash

    10 2 ISAKMP policy group

    ISAKMP life duration strategy 10 86400

    vpngroup myvpn address pptppool pool

    vpngroup myvpn Server dns 192.168.5.44

    vpngroup myvpn by default-field xxxxxxxxx.local

    vpngroup split myvpn No. - nat tunnel

    vpngroup idle 1800 myvpn-time

    vpngroup myvpn password *.

    Telnet 192.168.5.0 255.255.255.0 LAN

    Telnet timeout 5

    SSH 192.168.5.0 255.255.255.0 LAN

    SSH timeout 30

    Console timeout 0

    VPDN group pptpusers accept dialin pptp

    VPDN group ppp authentication pap pptpusers

    VPDN group ppp authentication chap pptpusers

    VPDN group ppp mschap authentication pptpusers

    VPDN group ppp encryption mppe 128 pptpusers

    VPDN group pptpusers client configuration address local pptppool

    VPDN group pptpusers customer 192.168.5.44 dns configuration

    VPDN group pptpusers pptp echo 60

    VPDN group customer pptpusers of local authentication

    VPDN username password xxx *.

    VPDN username password xxx *.

    VPDN enable WAN

    dhcpd address 192.168.5.200 - 192.168.5.220 LAN

    dhcpd 192.168.5.44 dns 8.8.8.8

    dhcpd lease 3600

    dhcpd ping_timeout 750

    dhcpd enable LAN

    username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

    username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

    Terminal width 80

    Cryptochecksum:xxxxxxxxxxxxxxxxxx

    : end

    I'm sure it has something to do with NAT or an access list, but I can't understand it at all. I know it's a basic question, but I would really appreaciate help!
    Thank you very much
    Trevor

    "No. - nat' ACL doesn't seem correct, please make sure you want to remove the following text:

    do not allow any No. - nat icmp access list a whole

    No No. - nat ip 172.16.0.0 access list allow 255.255.0.0 any

    No No. - nat access list permit icmp any any echo response

    No No. - nat access list permit icmp any any source-quench

    No No. - nat access list permit all all unreachable icmp

    No No. - nat access list do not allow icmp all once exceed

    No No. - nat access list only allowed icmp no echo

    You must have 1 line as follows:

    access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

    Please 'clear xlate' after the changes described above.

    In addition, if you have a personal firewall enabled on the host you are trying to connect from the Client VPN, please turn it off and try again. Personal firewall of Windows normally blocks the traffic of different subnets.

    Hope that helps.

  • IPSec VPN to asa 5520

    Hello

    First I must admit that I am not very versed in Cisco equipment or in general IPSEC connections so my apologies if I'm doing something really good obviously stupid, but I checked through any kind of things that I could find on the internet on the configuration of IPSEC VPN.

    The setup I have is an asa 5520 (o/s 8.2) firewall which, for now, is connected to a temporary connection beautiful style home broadband for testing purposes. The netopia router is configured to allow ipsec passthrough and redirect 62515 UDP, TCP 10000, 4500 UDP, UDP 500 ports in the asa 5520.

    I'm trying to connein out of a laptop with disabled windows firewall and vpn cisco 5.0.02.0090 client version.

    I ran several attempts through the ipsec configuration wizard options. most of the time that nothing comes in the newspaper to show that a connection was attempted, but there is a way I can set up product options the following on the firewall log:

    4. Sep 24 2010 | 13: 54:29 | 713903 | Group = VPNtest9, IP = 86.44.x.x, error: cannot delete PeerTblEntry

    5: Sep 24 2010 | 13: 54:29 | 713902 | Group = VPNtest9, IP = 86.44.x.x, drop table homologous counterpart does not, no match!

    6. Sep 24 2010 | 13: 54:21 | 713905 | Group VPNtest9, IP = 86.44.x.x, P1 = relay msg sent to AM WSF

    3: Sep 24 2010 | 13: 54:21 | 713201 | Group = VPNtest9, IP = 86.44.x.x, double-Phase 1 detected package. Retransmit the last packet.

    6. Sep 24 2010 | 13: 54:16 | 713905 | Group VPNtest9, IP = 86.44.x.x, P1 = relay msg sent to AM WSF

    3: Sep 24 2010 | 13: 54:16 | 713201 | Group = VPNtest9, IP = 86.44.x.x, double-Phase 1 detected package. Retransmit the last packet.

    6. Sep 24 2010 | 13: 54:11 | 713905 | Group VPNtest9, IP = 86.44.x.x, P1 = relay msg sent to AM WSF

    3: Sep 24 2010 | 13: 54:11 | 713201 | Group = VPNtest9, IP = 86.44.x.x, double-Phase 1 detected package. Retransmit the last packet.

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    3: Sep 24 2010 | 13: 54:06 | 713257 | 1 failure to phase: incompatibility of types of attributes of class Group Description: RRs would be: Group 2 FCMS would: Group 1

    6. Sep 24 2010 | 13: 54:06 | 302015 | 86.44.x.x | 51905 | 192.168.0.27 | 500 | Built UDP inbound connection 7487 for Internet:86.44.x.x/51905 (86.44.x.x/51905) at identity:192.168.0.27/500 (192.168.0.27/500)

    and this, in the journal of customer:

    Cisco Systems VPN Client Version 5.0.02.0090

    Copyright (C) 1998-2007 Cisco Systems, Inc.. All rights reserved.

    Customer type: Windows, Windows NT

    Running: 5.1.2600 Service Pack 3

    24 13:54:08.250 24/09/10 Sev = Info/4 CM / 0 x 63100002

    Start the login process

    25 13:54:08.265 24/09/10 Sev = Info/4 CM / 0 x 63100004

    Establish a secure connection

    26 13:54:08.265 24/09/10 Sev = Info/4 CM / 0 x 63100024

    Attempt to connect with the server "213.94.x.x".

    27 13:54:08.437 24/09/10 Sev = Info/6 IKE/0x6300003B

    Attempts to establish a connection with 213.94.x.x.

    28 13:54:08.437 24/09/10 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) at 213.94.x.x

    29 13:54:08.484 24/09/10 Sev = Info/4 IPSEC / 0 x 63700008

    IPSec driver started successfully

    30 13:54:08.484 24/09/10 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    31 13:54:13.484 24/09/10 Sev = Info/4 IKE / 0 x 63000021

    Retransmit the last package!

    32 13:54:13.484 24/09/10 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK AG (Retransmission) to 213.94.x.x

    33 13:54:18.484 24/09/10 Sev = Info/4 IKE / 0 x 63000021

    Retransmit the last package!

    34 13:54:18.484 24/09/10 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK AG (Retransmission) to 213.94.x.x

    35 13:54:23.484 24/09/10 Sev = Info/4 IKE / 0 x 63000021

    Retransmit the last package!

    36 13:54:23.484 24/09/10 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK AG (Retransmission) to 213.94.x.x

    37 13:54:28.484 24/09/10 Sev = Info/4 IKE / 0 x 63000017

    Marking of IKE SA delete (I_Cookie = 36C50ACCE984B0B0 R_Cookie = 0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING

    38 13:54:28.984 24/09/10 Sev = Info/4 IKE/0x6300004B

    IKE negotiation to throw HIS (I_Cookie = 36C50ACCE984B0B0 R_Cookie = 0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING

    39 13:54:28.984 24/09/10 Sev = Info/4 CM / 0 x 63100014

    Could not establish the Phase 1 SA with the server '213.94.x.x' due to the 'DEL_REASON_PEER_NOT_RESPONDING '.

    40 13:54:28.984 24/09/10 Sev = Info/5 CM / 0 x 63100025

    Initializing CVPNDrv

    41 13:54:28.984 24/09/10 Sev = Info/6 CM / 0 x 63100046

    Set indicator established tunnel to register to 0.

    42 13:54:28.984 24/09/10 Sev = Info/4 IKE / 0 x 63000001

    Signal received IKE to complete the VPN connection

    43 13:54:29.187 24/09/10 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    44 13:54:29.187 24/09/10 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    45 13:54:29.187 24/09/10 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    46 13:54:29.187 24/09/10 Sev = Info/4 IPSEC/0x6370000A

    IPSec driver successfully stopped

    I have connectivity full http from the internet to a machine inside the asa 5520 so I think that the static routing and NAT'ing should be ok, but I am pleased to provide you with all the details.

    Can you see what I'm doing wrong?

    Thank you

    Sam

    Pls add the following policy:

    crypto ISAKMP policy 10

    preshared authentication

    the Encryption

    md5 hash

    Group 2

    You can also run debug on the ASA:

    debugging cry isa

    debugging ipsec cry

    and retrieve debug output after trying to connect.

  • Monitor sleep after 5 minutes

    Hello

    My monitor has all of a sudden going to sleep after 5 minutes, even if I set it to "never" in my power management. I can't find anywhere where it says go to sleep in 5 minutes. If anyone can help?

    Kind regards

    KK

    In addition to power management, check the settings of the screen saver.  Right click on the desktop and choose personalize, then click screensaver at the bottom right.  Make sure it is set to "none" instead of something like 'black screen '.

    In addition, even if you have the timeout set to never monitor in power management, also check the setting "change when the computer sleeps" on the left side.

  • Router Cisco 1941 - crypto isakmp policy command missing - IPSEC VPN

    Hi all

    I was looking around and I can't find the command 'crypto isakmp policy' on this router Cisco 1941.  I wanted to just a regular Lan IPSEC to surprise and Lan installation tunnel, the command isn't here.  Have I not IOS bad? I thought that a picture of K9 would do the trick.

    Any suggestions are appreciated

    That's what I get:

    Router (config) #crypto?
    CA Certification Authority
    main activities key long-term
    public key PKI components

    SEE THE WORM

    Cisco IOS software, software C1900 (C1900-UNIVERSALK9-M), Version 15.0 (1) M2, VERSION of the SOFTWARE (fc2)
    Technical support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2010 by Cisco Systems, Inc.
    Updated Thursday, March 10, 10 22:27 by prod_rel_team

    ROM: System Bootstrap, Version 15.0 M6 (1r), RELEASE SOFTWARE (fc1)

    The availability of router is 52 minutes
    System returned to ROM by reload at 02:43:40 UTC Thursday, April 21, 2011
    System image file is "flash0:c1900 - universalk9-mz.» Spa. 150 - 1.M2.bin.
    Last reload type: normal charging
    Reload last reason: reload command

    This product contains cryptographic features...

    Cisco CISCO1941/K9 (revision 1.0) with 487424K / 36864K bytes of memory.
    Card processor ID FTX142281F4
    2 gigabit Ethernet interfaces
    2 interfaces Serial (sync/async)
    Configuration of DRAM is 64 bits wide with disabled parity.
    255K bytes of non-volatile configuration memory.
    254464K bytes of system CompactFlash ATA 0 (read/write)

    License info:

    License IDU:

    -------------------------------------------------
    Device SN # PID
    -------------------------------------------------
    * 0 FTX142281F4 CISCO1941/K9

    Technology for the Module package license information: "c1900".

    ----------------------------------------------------------------
    Technology-technology-package technology
    Course Type next reboot
    -----------------------------------------------------------------
    IPBase ipbasek9 ipbasek9 Permanent
    security, none none none
    given none none none

    Configuration register is 0 x 2102

    You need get the license of security feature to configure the IPSec VPN.

    Currently, you have 'none' for the security feature:

    ----------------------------------------------------------------
    Technology-technology-package technology
    Course Type next reboot
    -----------------------------------------------------------------
    IPBase ipbasek9 ipbasek9 Permanent
    security, none none none
    given none none none

    Here is the information about the licenses on router 1900 series:

    http://www.Cisco.com/en/us/partner/docs/routers/access/1900/hardware/installation/guide/Software_Licenses.html

  • Problem Cisco 2811 with L2TP IPsec VPN

    Hello. Sorry for my English. Help me please. I have problem with L2TP over IPsec VPN when I connect with Android phones. Even if I connect with laptop computers. I have Cisco 2811 - Cisco IOS software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4 (2) T2, (fc3) SOFTWARE VERSION. I configured on L2TP over IPsec VPN with Radius Authentication

    My config:

    !
    AAA new-model
    !
    !
    AAA authentication login default local
    Ray of AAA for authentication ppp default local group
    AAA authorization network default authenticated if
    start-stop radius group AAA accounting network L2TP_RADIUS

    !
    dhcp L2tp IP pool
    network 192.168.100.0 255.255.255.0
    default router 192.168.100.1
    domain.local domain name
    192.168.101.12 DNS server
    18c0.a865.c0a8.6401 hexagonal option 121
    18c0.a865.c0a8.6401 hexagonal option 249

    VPDN enable
    !
    VPDN-group sec_groupe
    ! Default L2TP VPDN group
    accept-dialin
    L2tp Protocol
    virtual-model 1
    no authentication of l2tp tunnel

    session of crypto consignment
    !
    crypto ISAKMP policy 5
    BA 3des
    preshared authentication
    Group 2
    !
    crypto ISAKMP policy 55
    BA 3des
    md5 hash
    preshared authentication
    Group 2

    ISAKMP crypto key... address 0.0.0.0 0.0.0.0
    invalid-spi-recovery crypto ISAKMP
    ISAKMP crypto keepalive 10 periodicals
    !
    life crypto ipsec security association seconds 28000
    !
    Crypto ipsec transform-set esp-3des esp-sha-hmac L2TP
    transport mode
    Crypto ipsec transform-set esp-3des esp-md5-hmac 3DESMD5
    need transport mode
    !

    !
    !
    crypto dynamic-map DYN - map 10
    Set nat demux
    game of transformation-L2TP
    !
    !
    Crypto map 10 L2TP-VPN ipsec-isakmp dynamic DYN-map

    interface Loopback1
    Description * L2TP GateWay *.
    IP 192.168.100.1 address 255.255.255.255

    interface FastEthernet0/0
    Description * Internet *.
    address IP 95.6... 255.255.255.248
    IP access-group allow-in-of-wan in
    IP access-group allows-off-of-wan on
    no ip redirection
    no ip unreachable
    no ip proxy-arp
    NAT outside IP
    IP virtual-reassembly
    IP route cache policy
    automatic duplex
    automatic speed
    L2TP-VPN crypto card
    !

    interface virtual-Template1
    Description * PPTP *.
    IP unnumbered Loopback1
    IP access-group L2TP_VPN_IN in
    AutoDetect encapsulation ppp
    default IP address dhcp-pool L2tp peer
    No keepalive
    PPP mtu Adaptive
    PPP encryption mppe auto
    PPP authentication ms-chap-v2 callin
    PPP accounting L2TP_RADIUS

    L2TP_VPN_IN extended IP access list
    permit any any icmp echo
    IP 192.168.100.0 allow 0.0.0.255 192.168.101.0 0.0.0.255
    IP 192.168.100.0 allow 0.0.0.255 192.168.3.0 0.0.0.255
    allow udp any any eq bootps
    allow udp any any eq bootpc
    deny ip any any journal entry

    RADIUS-server host 192.168.101.15 auth-port 1812 acct-port 1813
    RADIUS server retry method reorganize
    RADIUS server retransmit 2
    Server RADIUS 7 key...

    Debugging shows me

    234195: * 3 Feb 18:53:38: ISAKMP (0:0): received 93.73.161.229 packet dport 500 sport 500 SA NEW Global (N)
    234196: * 3 Feb 18:53:38: ISAKMP: created a struct peer 93.73.161.229, peer port 500
    234197: * 3 Feb 18:53:38: ISAKMP: new position created post = 0x47D305BC peer_handle = 0x80007C5F
    234198: * 3 Feb 18:53:38: ISAKMP: lock struct 0x47D305BC, refcount 1 to peer crypto_isakmp_process_block
    234199: * 3 Feb 18:53:38: ISAKMP: 500 local port, remote port 500
    234200: * 3 Feb 18:53:38: insert his with his 480CFF64 = success
    234201: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    234202: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_READY = IKE_R_MM1
    234203: * 3 Feb 18:53:38: ISAKMP: (0): treatment ITS payload. Message ID = 0
    234204: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234205: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    234206: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234207: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 164
    234208: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234209: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    234210: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is NAT - T v2
    234211: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234212: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 221
    234213: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234214: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
    234215: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234216: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is DPD
    234217: * 3 Feb 18:53:38: ISAKMP: (0): looking for a key corresponding to 93.73.161.229 in default
    234218: * 3 Feb 18:53:38: ISAKMP: (0): success
    234219: * 3 Feb 18:53:38: ISAKMP: (0): pair found pre-shared key matching 93.73.161.229
    234220: * 3 Feb 18:53:38: ISAKMP: (0): pre-shared key local found
    234221: * 3 Feb 18:53:38: ISAKMP: analysis of the profiles for xauth...
    234222: * 3 Feb 18:53:38: ISAKMP: (0): audit ISAKMP transform 1 against policy priority 5
    234223: * 3 Feb 18:53:38: ISAKMP: type of life in seconds
    234224: * 3 Feb 18:53:38: ISAKMP: life (basic) of 28800
    234225: * 3 Feb 18:53:38: ISAKMP: 3DES-CBC encryption
    234226: * 3 Feb 18:53:38: ISAKMP: pre-shared key auth
    234227: * 3 Feb 18:53:38: ISAKMP: SHA hash
    234228: * 3 Feb 18:53:38: ISAKMP: group by default 2
    234229: * 3 Feb 18:53:38: ISAKMP: (0): atts are acceptable. Next payload is 3
    234230: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234231: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    234232: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234233: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 164
    234234: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234235: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    234236: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is NAT - T v2
    234237: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234238: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 221
    234239: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234240: * 3 Feb 18:53:38: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
    234241: * 3 Feb 18:53:38: ISAKMP: (0): load useful vendor id of treatment
    234242: * 3 Feb 18:53:38: ISAKMP: (0): provider ID is DPD
    234243: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    234244: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM1

    234245: * 3 Feb 18:53:38: ISAKMP: (0): built the seller-02 ID NAT - t
    234246: * 3 Feb 18:53:38: ISAKMP: (0): lot of 93.73.161.229 sending my_port 500 peer_port 500 (R) MM_SA_SETUP
    234247: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    234248: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM2

    234249: * 3 Feb 18:53:38: ISAKMP (0:0): received 93.73.161.229 packet 500 Global 500 (R) sport dport MM_SA_SETUP
    234250: * 3 Feb 18:53:38: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    234251: * 3 Feb 18:53:38: ISAKMP: (0): former State = new State IKE_R_MM2 = IKE_R_MM3

    234252: * 3 Feb 18:53:38: ISAKMP: (0): processing KE payload. Message ID = 0
    234253: * 3 Feb 18:53:38: crypto_engine: create DH shared secret
    234254: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_DH_SHARE_SECRET (hw) (ipsec)
    234255: * 3 Feb 18:53:38: ISAKMP: (0): processing NONCE payload. Message ID = 0
    234256: * 3 Feb 18:53:38: ISAKMP: (0): looking for a key corresponding to 93.73.161.229 in default
    234257: * 3 Feb 18:53:38: ISAKMP: (0): success
    234258: * 3 Feb 18:53:38: ISAKMP: (0): pair found pre-shared key matching 93.73.161.229
    234259: * 3 Feb 18:53:38: crypto_engine: create IKE SA
    234260: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_SA_CREATE (hw) (ipsec)
    234261: * 3 Feb 18:53:38: ISAKMP: receives the payload type 20
    234262: * 3 Feb 18:53:38: ISAKMP: receives the payload type 20
    234263: * 3 Feb 18:53:38: ISAKMP (0:5912): NAT found, the node outside NAT
    234264: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    234265: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM3 = IKE_R_MM3

    234266: * 3 Feb 18:53:38: ISAKMP: (5912): lot of 93.73.161.229 sending my_port 500 peer_port 500 (R) MM_KEY_EXCH
    234267: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    234268: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM3 = IKE_R_MM4

    234269: * 3 Feb 18:53:38: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) MM_KEY_EXCH sport
    234270: * 3 Feb 18:53:38: crypto_engine: package to decipher IKE
    234271: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
    234272: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    234273: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM4 = IKE_R_MM5

    234274: * 3 Feb 18:53:38: ISAKMP: (5912): payload ID for treatment. Message ID = 0
    234275: * 3 Feb 18:53:38: ISAKMP (0:5912): payload ID
    next payload: 8
    type: 1
    address: 192.168.1.218
    Protocol: 17
    Port: 500
    Length: 12
    234276: * 3 Feb 18:53:38: ISAKMP: (5912): peer games * no * profiles
    234277: * 3 Feb 18:53:38: ISAKMP: (5912): HASH payload processing. Message ID = 0
    234278: * 3 Feb 18:53:38: crypto_engine: hash generate IKE
    234279: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
    234280: * 3 Feb 18:53:38: ISAKMP: (5912): SA authentication status:
    authenticated
    234281: * 3 Feb 18:53:38: ISAKMP: (5912): SA has been authenticated with 93.73.161.229
    234282: * 3 Feb 18:53:38: ISAKMP: (5912): port detected floating port = 4500
    234283: * 3 Feb 18:53:38: ISAKMP: attempts to insert a peer and inserted 95.6.../93.73.161.229/4500/ 47D305BC successfully.
    234284: * 3 Feb 18:53:38: ISAKMP: (5912): IKE_DPD is enabled, the initialization of timers
    234285: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    234286: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM5 = IKE_R_MM5

    234287: * 3 Feb 18:53:38: ISAKMP: (5912): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
    234288: * 3 Feb 18:53:38: ISAKMP (0:5912): payload ID
    next payload: 8
    type: 1
    address: 95.6...
    Protocol: 17
    Port: 0
    Length: 12
    234289: * 3 Feb 18:53:38: ISAKMP: (5912): the total payload length: 12
    234290: * 3 Feb 18:53:38: crypto_engine: hash generate IKE
    234291: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
    234292: * 3 Feb 18:53:38: crypto_engine: package to encrypt IKE
    routerindc #.
    234293: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT (hw) (ipsec)
    234294: * 3 Feb 18:53:38: ISAKMP: (5912): lot of 93.73.161.229 sending peer_port my_port 4500 4500 (R) MM_KEY_EXCH
    234295: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    234296: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

    234297: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    234298: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    234299: * 3 Feb 18:53:38: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) QM_IDLE sport
    234300: * 3 Feb 18:53:38: ISAKMP: node set-893966165 to QM_IDLE
    234301: * 3 Feb 18:53:38: crypto_engine: package to decipher IKE
    234302: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
    234303: * 3 Feb 18:53:38: crypto_engine: hash generate IKE
    234304: * 3 Feb 18:53:38: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
    234305: * 3 Feb 18:53:38: ISAKMP: (5912): HASH payload processing. Message ID =-893966165
    234306: * 3 Feb 18:53:38: ISAKMP: (5912): treatment protocol NOTIFIER INITIAL_CONTACT 1
    SPI 0, message ID =-893966165, his 480CFF64 =
    234307: * 3 Feb 18:53:38: ISAKMP: (5912): SA authentication status:
    authenticated
    234308: * 3 Feb 18:53:38: ISAKMP: (5912): process of first contact.
    dropping existing phase 1 and 2 with 95.6 local... 93.73.161.229 remote remote port 4500
    234309: * 3 Feb 18:53:38: ISAKMP: (5912): node-893966165 error suppression FALSE reason 'informational (en) State 1.
    234310: * 3 Feb 18:53:38: ISAKMP: (5912): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    234311: * 3 Feb 18:53:38: ISAKMP: (5912): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    234312: * 3 Feb 18:53:38: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
    234313: * 3 Feb 18:53:39: % s-6-IPACCESSLOGRL: registration of limited or missed rates 150 packages of access list
    234314: * 3 Feb 18:53:39: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) QM_IDLE sport
    234315: * 3 Feb 18:53:39: ISAKMP: node set-1224389198 to QM_IDLE
    234316: * 3 Feb 18:53:39: crypto_engine: package to decipher IKE
    234317: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
    234318: * 3 Feb 18:53:39: crypto_engine: hash generate IKE
    234319: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
    234320: * 3 Feb 18:53:39: ISAKMP: (5912): HASH payload processing. Message ID =-1224389198
    234321: * 3 Feb 18:53:39: ISAKMP: (5912): treatment ITS payload. Message ID =-1224389198
    234322: * 3 Feb 18:53:39: ISAKMP: (5912): proposal of IPSec checking 1
    234323: * 3 Feb 18:53:39: ISAKMP: turn 1, ESP_3DES
    234324: * 3 Feb 18:53:39: ISAKMP: attributes of transformation:
    234325: * 3 Feb 18:53:39: ISAKMP: type of life in seconds
    234326: * 3 Feb 18:53:39: ISAKMP: life of HIS (basic) of 28800
    234327: * 3 Feb 18:53:39: ISAKMP: program is 61444 (Transport-UDP)
    234328: * 3 Feb 18:53:39: ISAKMP: authenticator is HMAC-SHA
    234329: * 3 Feb 18:53:39: CryptoEngine0: validate the proposal
    234330: * 3 Feb 18:53:39: ISAKMP: (5912): atts are acceptable.
    234331: * 3 Feb 18:53:39: IPSEC (validate_proposal_request): part #1 of the proposal
    (Eng. msg key.) Local INCOMING = 95.6..., distance = 93.73.161.229,.
    local_proxy = 95.6.../255.255.255.255/17/1701 (type = 1),
    remote_proxy = 93.73.161.229/255.255.255.255/17/0 (type = 1),
    Protocol = ESP, transform = esp-3des esp-sha-hmac (UDP Transport),
    lifedur = 0 and 0kb in
    SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
    234332: * 3 Feb 18:53:39: map_db_find_best found no corresponding card
    234333: * 3 Feb 18:53:39: ISAKMP: (5912): processing NONCE payload. Message ID =-1224389198
    234334: * 3 Feb 18:53:39: ISAKMP: (5912): payload ID for treatment. Message ID =-1224389198
    234335: * 3 Feb 18:53:39: ISAKMP: (5912): payload ID for treatment. Message ID =-1224389198
    234336: * 3 Feb 18:53:39: ISAKMP: (5912): ask 1 spis of ipsec
    234337: * 3 Feb 18:53:39: ISAKMP: (5912): entrance, node-1224389198 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    234338: * 3 Feb 18:53:39: ISAKMP: (5912): former State = new State IKE_QM_READY = IKE_QM_SPI_STARVE
    234339: * 3 Feb 18:53:39: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
    234340: * 3 Feb 18:53:39: IPSEC (spi_response): spi getting 834762579 for SA
    of 95.6... to 93.73.161.229 for prot 3
    234341: * 3 Feb 18:53:39: crypto_engine: hash generate IKE
    234342: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
    234343: * 3 Feb 18:53:39: crypto_engine: create Security Association IPSec (by QM)
    routerindc #.
    234344: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IPSEC_KEY_CREATE (hw) (ipsec)
    234345: * 3 Feb 18:53:39: crypto_engine: create Security Association IPSec (by QM)
    234346: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IPSEC_KEY_CREATE (hw) (ipsec)
    234347: * 3 Feb 18:53:39: ISAKMP: (5912): establishing IPSec security associations
    234348: * 3 Feb 18:53:39: from 93.73.161.229 to 95.6 SA... (f / i) 0 / 0
    (93.73.161.229 to 95.6 proxy...)
    234349: * 3 Feb 18:53:39: spi 0x31C17753 and id_conn a 0
    234350: * 3 Feb 18:53:39: life of 28800 seconds
    234351: * 3 Feb 18:53:39: ITS 95.6 outgoing... to 93.73.161.229 (f / i) 0/0
    (proxy 95.6... to 93.73.161.229)
    234352: * 3 Feb 18:53:39: spi 0x495A4BD and id_conn a 0
    234353: * 3 Feb 18:53:39: life of 28800 seconds
    234354: * 3 Feb 18:53:39: crypto_engine: package to encrypt IKE
    234355: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT (hw) (ipsec)
    234356: * 3 Feb 18:53:39: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
    234357: * 3 Feb 18:53:39: map_db_find_best found no corresponding card
    234358: * 3 Feb 18:53:39: IPSec: rate allocated for brother 80000273 Flow_switching
    234359: * 3 Feb 18:53:39: IPSEC (policy_db_add_ident): 95.6..., src dest 93.73.161.229, dest_port 4500

    234360: * 3 Feb 18:53:39: IPSEC (create_sa): its created.
    (his) sa_dest = 95.6..., sa_proto = 50.
    sa_spi = 0x31C17753 (834762579).
    sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 1165
    234361: * 3 Feb 18:53:39: IPSEC (create_sa): its created.
    (his) sa_dest = 93.73.161.229, sa_proto = 50,.
    sa_spi = 0x495A4BD (76915901).
    sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 1166
    234362: * 3 Feb 18:53:39: ISAKMP: (5912): lot of 93.73.161.229 sending peer_port my_port 4500 4500 (R) QM_IDLE
    234363: * 3 Feb 18:53:39: ISAKMP: (5912): entrance, node-1224389198 = IKE_MESG_FROM_IPSEC, IKE_SPI_REPLY
    234364: * 3 Feb 18:53:39: ISAKMP: (5912): former State = new State IKE_QM_SPI_STARVE = IKE_QM_R_QM2
    234365: * 3 Feb 18:53:39: ISAKMP (0:5912): received 93.73.161.229 packet dport 4500 4500 Global (R) QM_IDLE sport
    234366: * 3 Feb 18:53:39: crypto_engine: package to decipher IKE
    234367: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT (hw) (ipsec)
    234368: * 3 Feb 18:53:39: crypto_engine: hash generate IKE
    234369: * 3 Feb 18:53:39: CryptoEngine0: CRYPTO_ISA_IKE_HMAC (hw) (ipsec)
    routerindc #.
    234370: * 3 Feb 18:53:39: ISAKMP: (5912): node-1224389198 error suppression FALSE reason 'QM (wait).
    234371: * 3 Feb 18:53:39: ISAKMP: (5912): entrance, node-1224389198 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    234372: * 3 Feb 18:53:39: ISAKMP: (5912): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
    234373: * 3 Feb 18:53:39: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
    234374: * 3 Feb 18:53:39: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP
    234375: * 3 Feb 18:53:39: IPSEC (key_engine_enable_outbound): select SA with spinnaker 76915901/50
    234376: * 3 Feb 18:53:40: IPSEC (epa_des_crypt): decrypted packet has no control of her identity
    routerindc #.
    234377: * 3 Feb 18:53:42: IPSEC (epa_des_crypt): decrypted packet has no control of her identity
    routerindc #.
    234378: * 3 Feb 18:53:44: IPSEC (epa_des_crypt): decrypted packet has no control of her identity

    Also when I connect with the phone, I see HIS Active and IPsec tunnel is mounted, but the wire of time tunnel is down and phone connects.

    I hope that you will help me. Thank you.

    Hi dvecherkin1,

    Who IOS you're running, you could hit the next default.

    https://Tools.Cisco.com/bugsearch/bug/CSCsg34166/?reffering_site=dumpcr

    It may be useful

    -Randy-

    Evaluate the ticket to help others find the answer quickly.

  • IPSEC VPN on ASA5505

    Hello, hope you can help me:

    I need to configure an IPSEC VPN on an ASA5505, with one. PFX certificate to authenticate with the VPN endpoint. I can install the certificate as a certificate authority, but when I use the VPN Site - to - Site Wizard, I put the IP address peer, afterI try to select the certificate that is downloaded, but when I click on the name of the certificate, there is no certificate

    I don't I can solve this problem?

    Thanks to all in advance

    Hello

    Do you see the certificate imported as cert ID? If so, you can follow this guide

    http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

    HTH

    Averroès.

  • Function of automatic update for the IPsec VPN Client

    Hello.

    Do you have anyone ever tried the PIX / ASA ' feature IPsec VPN Client Auto-Update?

    (see also Document ID: 105606).

    He wants to make sure that I understand this right.

    The user will receive a popup of information telling him to download the latest version of the client? And then there start the update itself?

    If so, this would mean that the user must have the rights of full adminsitative using a laptop.

    From my point of view, full administrator rights on a laptop are prohibited - 100% and therefore the functionality would be totally useless.

    Anyone who can tell me whether I am good or bad?

    Best

    Frank

    Frank,

    You are right, if the computer desktop or labtop is completely locked regarding the installation of the software the customer won't be able to install it, they may be able to download from the link that you configured in ASA, once they connect to your server ASA RA but with regard to the installation user's machine needs rights profile appropriate to be able to install it.

    HTH

    -Jorge

Maybe you are looking for

  • This installation package could not be opened get access denied

    I tried this and it says: "System 5 error has occurred.Access denied. "I'm having problems with OpenOffice.zetuskid Separated from this thread that the original thread was resolved. http://answers.Microsoft.com/en-us/Windows/Forum/windows_vista-windo

  • Trying to second drive hard partition...

    I have two hard drives and you want to remove 1 disk of the computer to use as the single disc on another computer: screenshot: http://i43.tinypic.com/4huxxw.jpg Disk 0 is the operating system for that computer, and must remain as it is. I can't try

  • Oracle of the MAF 2.2: pull down to refresh

    Hi allI use jdev 12.1.3Recently, I have updates the MAF Oracle at new 2.2 release.I'm exploring the new in version.When you use 'Pull down to Refresh', using amx: refreshContainer, I'm not able to map the required properties for the component.I don't

  • How can I transfer creative cloud to a new computer?

    It doesn't seem to be any obvious information on the transfer of the CC last over to a new computer/mac. Used the wizard of migration of Apple with disastrous results. Reformatted a clean install of Yosemite to use and leave...

  • Liaison

    JavaFX 1.3 version            text = Text {                 translateX: bind (scene.width - text.layoutBounds.width) / 2                 translateY: bind (scene.height - text.layoutBounds.height) / 2                 font: Font { size: 24 }