"ITS creation failed" problem for IPSec VPN

Similar Questions

• Is availble for IPsec VPN FOS 6.3 support stateful failover

  Is availble for IPsec VPN FOS 6.3 support stateful failover

  SAJ

  Hello Saj,

  Unfortunately not... stateful failover replica information such as:

  Table of connection TCP, udp xlate table ports, h.323, PAT port allocation table...

  they replicate data such as:

  user authentication (uauth) table

  Table ISAKMP / IPSEC SA

  ARP table

  Routing information

  Therefore, in the case where the main breaks down, the IPSEC vpn will be reformed for the failover... Meanwhile, the user will not be able to access the applications...

  I hope this helps... all the best... the rate of responses if deemed useful...

  REDA

• Problem with IPSec VPN ISA500 & login questions (multiple devices)

  I have a Cisco ISA500, we use for connection with IPSEC VPN of some products apple (MacBook Pro and iPad). We can operate randomly once in a while, but it fails most of the time of negotiation. Someone at - it suggestions on what I can do to make this work?

  I did test it on my Linux machine and it does not when I had configured default settings. I had to change the NAT Traversal for UDP CISCO on the Linux machine for the connection to work.

  14/04/03 20:54:13 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: quick mode attempt fails, please check if IKE/transformation/PFS local are the same as remote site; (pluto)
  2014-04-03 20:54:13 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: max number of retransmissions (2) reached STATE_AGGR_R1. (pluto)
  2014-04-03 20:53:30 - warning - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: quick mode attempt fails, please check if IKE/transformation/PFS local are the same as remote site; (pluto)
  2014-04-03 20:53:30 - warning - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: max number of retransmissions (2) reached STATE_AGGR_R1. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: STATE_AGGR_R1: sent AR1, expected AI2.; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = 'groupname' [48] XXX.XXX.XXX.XXX #59: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received vendor ID payload [Dead Peer Detection]; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: regardless of the payload of unknown Vendor ID [16f6ca16e4a4066d83821a0f0aeaa862]; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received meth payload [draft-ietf-ipsec-nat-t-ike-02] Vendor ID = 107, but already using method 109; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received meth payload [draft-ietf-ipsec-nat-t-ike-02_n] Vendor ID = 106, but already using method 109; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received meth payload [draft-ietf-ipsec-nat-t-ike-03] Vendor ID = 108, but already using method 109; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received Vendor ID value = 109 payload [RFC 3947] method; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received vendor ID payload [Cisco-Unity]; (pluto)
  2014-04-03 20:53:03 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:43810 package: received vendor ID payload [XAUTH]; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: STATE_AGGR_R1: sent AR1, expected AI2.; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = 'groupname' [47] XXX.XXX.XXX.XXX #58: attribute OAKLEY_KEY_LENGTH not preceded by the OAKLEY_ENCRYPTION_ALGORITHM attribute.  Attribute OAKLEY_KEY_LENGTH. (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received vendor ID payload [Dead Peer Detection]; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: regardless of the payload of unknown Vendor ID [16f6ca16e4a4066d83821a0f0aeaa862]; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received meth payload [draft-ietf-ipsec-nat-t-ike-02] Vendor ID = 107, but already using method 109; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received meth payload [draft-ietf-ipsec-nat-t-ike-02_n] Vendor ID = 106, but already using method 109; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received meth payload [draft-ietf-ipsec-nat-t-ike-03] Vendor ID = 108, but already using method 109; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received Vendor ID value = 109 payload [RFC 3947] method; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received vendor ID payload [Cisco-Unity]; (pluto)
  2014-04-03 20:52:20 - WARNING - IPsec VPN: msg = XXX.XXX.XXX.XXX:58320 package: received vendor ID payload [XAUTH]; (pluto)

  Hi rich,

  What version of firmware you used before upgrade?  You upgrade to 1.2.19 and now this works?

  Thank you

  Brandon

• Problem with IPsec VPN between ASA and router Cisco - ping is not response

  Hello

  I don't know because the IPsec VPN does not work. This is my setup (IPsec VPN between ASA and R2):

  my network topology data:

  LAN 1 connect ASA - 1 (inside the LAN)

  PC - 10.0.1.3 255.255.255.0 10.0.1.1

  ASA - GigabitEthernet 1: 10.0.1.1 255.255.255.0

  -----------------------------------------------------------------

  ASA - 1 Connect (LAN outide) R1

  ASA - GigabitEthernet 0: 172.30.1.2 255.255.255.252

  R1 - FastEthernet 0/0: 172.30.1.1 255.255.255.252

  ---------------------------------------------------------------------

  R1 R2 to connect

  R1 - FastEthernet 0/1: 172.30.2.1 255.255.255.252

  R2 - FastEthernet 0/1: 172.30.2.2 255.255.255.252

  R2 for lan connection 2

  --------------------------------------------------------------------

  R2 to connect LAN2

  R2 - FastEthernet 0/0: 10.0.2.1 255.255.255.0

  PC - 10.0.2.3 255.255.255.0 10.0.2.1

  ASA configuration:

  1 GigabitEthernet interface
  nameif inside
  security-level 100
  IP 10.0.1.1 255.255.255.0
  no downtime
  interface GigabitEthernet 0
  nameif outside
  security-level 0
  IP 172.30.1.2 255.255.255.252
  no downtime
  Route outside 0.0.0.0 0.0.0.0 172.30.1.1

  ------------------------------------------------------------

  access-list scope LAN1 to LAN2 ip 10.0.1.0 allow 255.255.255.0 10.0.2.0 255.255.255.0
  object obj LAN
  subnet 10.0.1.0 255.255.255.0
  object obj remote network
  10.0.2.0 subnet 255.255.255.0
  NAT (inside, outside) 1 static source obj-local obj-local destination obj-remote control remote obj non-proxy-arp static

  -----------------------------------------------------------
  IKEv1 crypto policy 10
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 3600
  Crypto ikev1 allow outside
  crypto isakmp identity address

  ------------------------------------------------------------
  tunnel-group 172.30.2.2 type ipsec-l2l
  tunnel-group 172.30.2.2 ipsec-attributes
  IKEv1 pre-shared-key cisco123
  Crypto ipsec transform-set esp-aes-192 ASA1TS, esp-sha-hmac ikev1

  -------------------------------------------------------------
  card crypto ASA1VPN 10 is the LAN1 to LAN2 address
  card crypto ASA1VPN 10 set peer 172.30.2.2
  card crypto ASA1VPN 10 set transform-set ASA1TS ikev1
  card crypto ASA1VPN set 10 security-association life seconds 3600
  ASA1VPN interface card crypto outside

  R2 configuration:

  interface fastEthernet 0/0
  IP 10.0.2.1 255.255.255.0
  no downtime
  interface fastEthernet 0/1
  IP 172.30.2.2 255.255.255.252
  no downtime

  -----------------------------------------------------

  router RIP
  version 2
  Network 10.0.2.0
  network 172.30.2.0

  ------------------------------------------------------
  access-list 102 permit ahp 172.30.1.2 host 172.30.2.2
  access-list 102 permit esp 172.30.1.2 host 172.30.2.2
  access-list 102 permit udp host 172.30.1.2 host 172.30.2.2 eq isakmp
  interface fastEthernet 0/1
  IP access-group 102 to

  ------------------------------------------------------
  crypto ISAKMP policy 110
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 42300

  ------------------------------------------------------
  ISAKMP crypto key cisco123 address 172.30.1.2

  -----------------------------------------------------
  Crypto ipsec transform-set esp - aes 128 R2TS

  ------------------------------------------------------

  access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

  ------------------------------------------------------

  R2VPN 10 ipsec-isakmp crypto map
  match address 101
  defined by peer 172.30.1.2
  PFS Group1 Set
  R2TS transformation game
  86400 seconds, life of security association set
  interface fastEthernet 0/1
  card crypto R2VPN

  I don't know what the problem

  Thank you

  If the RIP is not absolutely necessary for you, try adding the default route to R2:

  IP route 0.0.0.0 0.0.0.0 172.16.2.1

  If you want to use RIP much, add permissions ACL 102:

  access-list 102 permit udp any any eq 520

• Certificates for IPSEC vpn in ASA 8.0 clients

  Hello!

  I have configured MS CA and I have setup client vpn and ASA 7.0 make tunnel with certificates.

  Same configuration does not work with ASA 8.0 I get the error

  CRYPTO_PKI: Check whether an identical cert is

  already in the database...

  CRYPTO_PKI: looking for cert = d4bb2888, digest = handle

  B8 74 97 f3 bf 25 1 c e5 2nd e5 21 3rd d1 93 15 d6 |... t...%...! >....

  CRYPTO_PKI: Recording of Cert not found, return E_NOT_FOUND

  CRYPTO_PKI: Cert not found in the database.

  CRYPTO_PKI: Looking for suitable trustpoints...

  CRYPTO_PKI: Found a suitable trustpoint authenticated A1.

  CRYPTO_PKI (make trustedCerts list) CRYPTO_PKI:check_key_usage: KeyUsage Incorrect

  (40)

  CRYPTO_PKI: Validation of certificate: State failure: 1873. Any attempt of recovery

  If necessary revocation status

  ERROR: Certificate validation failed. Peer certificate's key usage is not valid, ser

  Number of the IAL: 250F3ECE0000000009AF, name of the object: cn = xxxxx, unit of organization = xxxx, o = xxxxx, c =

  XX

  CRYPTO_PKI: Certificate not validated

  Why the use of the key is invalid? What model of certificate must be used in MS in order to get a regular use of the key?

  The schooling of CA's Terminal.

  Thank you!

  The cert needs to have defined Digital Signature key usage.

  Don't know what models are available on MS, but it should be something like "User Ipsec" I guess.

  Make 8 ASA behave like ASA 7 (i.e. disable th control on the use of the key of the cert), configure:

  Crypto ca trustpoint

  ignore-ipsec-keyusage

• Ask/dissemination of certificates for IPSEC VPN user

  Hi all

  I have therefore an ASA established the connection to an LDAP, an SSL certificate signed for the cert of the device and use IPSEC IKEv2 VPN connections that are authenticated by the LDAP username and password and X.509 certificates.

  I have a CA server root of Microsoft Windows server 2012 (State in offline mode) and a Windows server 2012 subordinate certification authority server. Both are 10-year Certification authorities.

  To generate certificates VPN I'm going to the AC Sub, go to certificates (local computer) > personal > right click on the white space > all tasks > advanced operations > ask personalized.

  I have set up my cert accordingly and enable private key export.

  I submit new request to the CERT service. authority on the CA of Sub (same machine as before). I issue the certificate, and then export the certificate with the private key. I send this to my user, then they install this certificate in the personal certificates store and access the VPN access using this cert more username and password they have been assigned (no there is no possibility for them to ask their own PC)

  Question 1: Is there an easier way to do this? Command line? Script? preconfigured with the certificate settings .ini file?

  Question 2: These certificates are only 1 year. How can I generate certificates that are longer than that. I'm jumping for 3 years.

  Thank you!

  BROKEN

  Well it's quite simple setup-wise when you chose to go down the path of the client certificate. It is generally easier to use SCEP (Simple Certificate Enrollment Protocol) Protocol to manually deploy certificates. There is an example of a configuration Definition here.

  There is also a good presentation (or several) of Cisco Live. I recommend that you take a look at this one from 2012: Practice of PKI for VPN.

  In this presentation, he you (slide 39) specifically shows how to create a new certificate template and set the validity period for the value by default 1 years.

• Need help for IPSEC VPN configuration.

  Hello

  I'm trying to implement a VPN IPSEC connection in my GNS3 lab and all show commands and debugs does not seem to give me clues of what is wrong or missing... can someone please help me in my troubleshooting VPN config. Here is the config for Router 1

  R1 #sh run

  crypto ISAKMP policy 1

  preshared authentication

  Group 2

  ISAKMP crypto key 6 cisco123 address 200.20.1.1

  !

  !

  Crypto ipsec transform-set esp - esp-sha-hmac CISCO_SET

  !

  map VPN_map 10 ipsec-isakmp crypto

  ! Incomplete

  defined by peer 200.20.1.1

  Set security-association second life 190

  game of transformation-CISCO_SET

  match address INT_TRAFFIC

  !

  !

  interface Loopback1

  IP 172.16.1.1 255.255.255.255

  !

  interface Loopback2

  172.16.1.2 IP address 255.255.255.255

  !

  interface FastEthernet0/0

  IP 200.11.1.1 255.255.255.252

  IP ospf 1 zone 0

  automatic duplex

  automatic speed

  card crypto VPN_map

  !

  router ospf 1

  Log-adjacency-changes

  network 172.16.0.0 0.0.255.255 area 0

  !

  router bgp 65001

  no synchronization

  The log-neighbor BGP-changes

  200.11.1.0 netmask 255.255.255.252

  neighbour 200.11.1.2 distance - as 65030

  No Auto-resume

  !

  IP forward-Protocol ND

  !

  !

  IP http server

  no ip http secure server

  !

  INT_TRAFFFIC extended IP access list

  IP address 172.16.0.0 allow 0.0.255.255 192.168.0.0 0.0.255.255

  IP address 172.16.0.0 allow 0.0.255.255 192.168.0.0 0.0.255.255 connect

  end

  R1 #sh crypto isakmp his

  IPv4 Crypto ISAKMP Security Association

  status of DST CBC State conn-id slot

  IPv6 Crypto ISAKMP Security Association

  R1 ipsec crypto #show her

  Nill...

  R1 #sh debugging

  Encryption subsystem:

  Crypto ISAKMP debug is on

  Engine debug crypto is on

  Crypto IPSEC debugging is on

  Regulation:

  memory tracking is enabled

  R1 #sh ip route

  Gateway of last resort is not set

  200.20.1.0/30 is divided into subnets, subnets 1

  B 200.20.1.0 [20/0] via 200.11.1.2, 01:28:21

  200.11.1.0/30 is divided into subnets, subnets 1

  C 200.11.1.0 is directly connected, FastEthernet0/0

  172.16.0.0/32 is divided into subnets, 2 subnets

  C 172.16.1.1 is directly connected, Loopback1

  C 172.16.1.2 is directly connected, Loopback2

  R1 #ping 200.20.1.1

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 200.20.1.1, wait time is 2 seconds:

  !!!!!

  See you soon,.

  Fabio

  Nice Catch. The key word 'Incomplete!' should have reported it.

  Please close the issue as resolved - user error

  Thank you
  Brian

• ASA static IP Addressing for IPSec VPN Client

  Hello guys.

  I use a Cisco ASA 5540 with version 8.4.
  I need to assign a static IP address to a VPN client. I saw in the documentation Cisco that this can be done to validate the user against the local ASA and in the user account database, you assign a dedicated IP address, or using the vpn-framed-ip-address CLI command.
  The problem is that the customer never gets this address and it always gets one of the pool in the political group. If I delete this pool, the client can't get any address.
  No idea on how to fix this or how can I give this static IP address to a specific VPN client?
  Thank you.

  Your welcome please check the response as correct and mark.

  See you soon

• ASA - 5540 used for IPSec VPN only - I can do away with Nat 0?

  I'll use an ASA 5540 as our head of VPN endpoint only - and not as a firewall.

  Also, we have a class for our company internal address space routable B address, so we don't need NAT. I would like to disable the function NAT 0 if I can so I always add NAT 0 to ensure that the 5540 does not NAT.

  Y at - it an easy way to disable the need using NAT 0?

  Are there any of the draw to do that?

  You can disable the use of nat 0 disabling the nat control.

  To achieve this, go to the global configuration mode and use this command:

  no nat control

  To check whether you have it turned on, you can check it with:

  SH run nat-control

  See you soon!

  -Butterfly

• Unique remote IP for IPSec VPN router to router

  Hi, I am setting up a virtual private network to another company, and they provided a routable IP address to be peers and their local internal system we need access to.  Can I use the address of the remote peer in the crypto ACL?  I think that they need to provide a second IP NAT for their internal system, if not for their peers IPSec traffic will hit the ACL crypto.  What do you think?  Thank you!

  As long as only 1 end of the peer uses the peer IPSec (destination ip address) in the ACL crypto, it's OK. You can't have two ends as being the ACL crypto.

• Router configuration Cisco for the IPSec VPN with VPN in Windows 7 builtin client

  Where can I find an example config for IPSec VPN where Windows 7 native client to connect to the Cisco routers. I use the cisco 881w, in this case.

  Thomas McLeod

  Native Client Windows supports only L2TP over IPSec. Example at the end of this doc may be enough for you:

  http://www.Cisco.com/en/us/docs/security/vpn_modules/6342/configuration/guide/6342vpn4.html#wp1036111

  I've not personally configured L2TP/IPSec on IOS, only on ASA, so cannot be 100% sure that the config in the link works, but the general idea should be ok.

• ASA5505: Configure the ASA for IPSec and SSL VPN?

  Hello-

  I currently have my 5505 for SSL AnyConnect VPN connections Setup.  Is it possible to set up also the 5505 for IPSec VPN connections?

  So, basically my ASA will be able to perform SSL and IPSec VPN tunnels, at the same time.

  Thank you!

  Kim,

  Yes, you can configure your ASA to support the AnyConnect VPN IPSec connections and at the same time.  In short, for the configuration of IPSec, you should configure at least a strategy ISAKMP, a set of IPSEC, encryption, tunnel group card processing and associated group policy.

  Matt

• ASA 9.2 IPSEC VPN

  I have ASA version 9.2 (2) 4 - model 5515

  I need to configure IPSEC VPN site-to-site.

  Can anyone share with me the example of ASA 9.2 CLI for IPSEC VPN configuration?

  Congratulations to find a solution to your problem. Thank you for posting on the Board to indicate that the issue is resolved and to share the solution. This can help other readers in the forum.

  HTH

  Rick

• IPSec VPN with compression

  Hi all

  I find this compression of supporting IPPCP 2600XM for IPSec VPN. It seems that it is supported only with a VPN module, is it?

  What would you say if I don't have module VPN, but the IPSec VPN configuration and compression for a connection low speed?

  BTW, the IPSec VPN and "compress stac" can co-exist?

  Also, what kind of compression support in 28xx with IPSec VPN?

  Thank you very much.

  MAK

  MAK,

  It depends on the installed vpn module. The previous support compression, but the compression is performed in software, not on the card, which offers only encryption. For this to work, you must run IOS 12.2 (13) T or later.

  If your previous IOS running, you cannot use compression alongside encryption PURPOSE cards at all.

  The latest maps AIM-VPN /? P II IPPC support in hardware.

  More information is here:

  http://www.Cisco.com/en/us/products/HW/routers/ps259/products_data_sheet09186a0080088750.html

  This link displays information related to the release of functionality of software compression of 12.2 (13) T

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps1839/products_feature_guide09186a0080110c00.html#1027177

  Thus, the options you have depend on the IOS and the card BUT you have.

  Beginning IOS and card without compression

  12.2 (13) T and IOS beginning, hardware encryption software compression

  Last map and supporting encryption and hardware compression IOS.

  I'm unsure of the 2800 series, I expected that they support the latest novelty of compression and hardware encryption.

  Andy

• Coming out of the IPSec VPN connection behind Pix535 problem: narrowed down for NAT-Associates

  Hello world

  Previously, I've seen a similar thread and posted my troubles with the outbound VPN connections inside that thread:

  https://supportforums.Cisco.com/message/3688980#3688980

  I had the great help but unfortunatedly my problem is a little different and connection problem.  Here, I summarize once again our configurations:

  hostname pix535 8.0 (4)

  all PC here use IP private such as 10.1.0.0/16 by dynamic NAT, we cannot initiate an OUTBOUND IPSec VPN (for example QuickVPN) at our offices, but the reverse (inbound) is very well (we have IPsec working long server /PP2P). I did a few tests of new yesterday which showed that if the PC a static NAT (mapped to a real public IP), outgoing connection VPN is fine; If the same PC has no static NAT (he hides behind the dynamic NAT firewall), outgoing VPN is a no-go (same IP to the same PC), so roughly, I have narrowed down our connection problem VPN is related to NAT, here are a few commands for NAT of our PIX:

  interface GigabitEthernet0
  Description to cable-modem
  nameif outside
  security-level 0
  IP 70.169.X.X 255.255.255.0
  OSPF cost 10
  !
  interface GigabitEthernet1
  Description inside 10/16
  nameif inside
  security-level 100
  IP 10.1.1.254 255.255.0.0
  OSPF cost 10
  !
  !
  interface Ethernet2
  Vlan30 description
  nameif dmz2
  security-level 50
  IP 30.30.30.30 255.255.255.0
  OSPF cost 10
  !
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface

  ......

  Global interface 10 (external)
  Global (dmz2) interface 10
  NAT (inside) 0-list of access inside_nat0_outbound
  NAT (inside) 10 inside8 255.255.255.0
  NAT (inside) 10 Vlan10 255.255.255.0
  NAT (inside) 10 vlan50 255.255.255.0
  NAT (inside) 10 192.168.0.0 255.255.255.0
  NAT (inside) 10 192.168.1.0 255.255.255.0
  NAT (inside) 10 192.168.10.0 255.255.255.0
  NAT (inside) 10 pix-inside 255.255.0.0

  Crypto isakmp nat-traversal 3600

  -------

  Results of packet capture are listed here for the same PC for the same traffic to Server VPN brach, the main difference is UDP 4500 (PC with static NAT has good traffic UDP 4500, does not have the same PC with dynamic NAT):

  #1: when the PC uses static NAT, it is good of outgoing VPN:

  54 packets captured
  1: 15:43:51.112054 10.1.1.82.1608 > 76.196.10.57.443: S 1763806634:1763806634 (0) win 64240
  2: 15:43:54.143028 10.1.1.82.1608 > 76.196.10.57.443: S 1763806634:1763806634 (0) win 64240
  3: 15:44:00.217273 10.1.1.82.1608 > 76.196.10.57.443: S 1763806634:1763806634 (0) win 64240
  4: 15:44:01.724938 10.1.1.82.1609 > 76.196.10.57.60443: S 2904546955:2904546955 (0) win 64240
  5: 15:44:01.784642 76.196.10.57.60443 > 10.1.1.82.1609: S 2323205974:2323205974 (0) ack 2904546956 win 5808
  6: 15:44:01.784886 10.1.1.82.1609 > 76.196.10.57.60443:. ACK 2323205975 win 64240
  7: 15:44:01.785527 10.1.1.82.1609 > 76.196.10.57.60443: P 2904546956:2904547080 (124) ack 2323205975 win 64240
  8: 15:44:01.856462 76.196.10.57.60443 > 10.1.1.82.1609:. ACK 2904547080 win 5808
  9: 15:44:01.899596 76.196.10.57.60443 > 10.1.1.82.1609: P 2323205975:2323206638 (663) ack 2904547080 win 5808
  10: 15:44:02.056897 10.1.1.82.1609 > 76.196.10.57.60443:. ACK 2323206638 win 63577
  11: 15:44:03.495030 10.1.1.82.1609 > 76.196.10.57.60443: P 2904547080:2904547278 (198) ack 2323206638 win 63577
  12: 15:44:03.667095 76.196.10.57.60443 > 10.1.1.82.1609:. ACK 2904547278 win 6432
  13: 15:44:03.740592 76.196.10.57.60443 > 10.1.1.82.1609: P 2323206638:2323206697 (59) ack 2904547278 win 6432
  14: 15:44:03.741264 10.1.1.82.1609 > 76.196.10.57.60443: P 2904547278:2904547576 (298) ack 2323206697 win 63518
  15: 15:44:03.814029 76.196.10.57.60443 > 10.1.1.82.1609:. ACK 2904547576 win 7504
  16: 15:44:06.989008 76.196.10.57.60443 > 10.1.1.82.1609: P 2323206697:2323207075 (378) ack 2904547576 win 7504
  17: 15:44:06.990228 76.196.10.57.60443 > 10.1.1.82.1609: 2323207075:2323207075 F (0) ack 2904547576 win 7504
  18: 15:44:06.990564 10.1.1.82.1609 > 76.196.10.57.60443:. ACK 2323207076 win 63140
  19: 15:44:06.990656 10.1.1.82.1609 > 76.196.10.57.60443: P 2904547576:2904547613 (37) ack 2323207076 win 63140
  20: 15:44:06.990854 10.1.1.82.1609 > 76.196.10.57.60443: 2904547613:2904547613 F (0) ack 2323207076 win 63140
  21: 15:44:07.049359 76.196.10.57.60443 > 10.1.1.82.1609: R 2323207076:2323207076 (0) win 0
  22: 15:44:17.055417 10.1.1.82.500 > 76.196.10.57.500: udp 276
  23: 15:44:17.137657 76.196.10.57.500 > 10.1.1.82.500: udp 140
  24: 15:44:17.161475 10.1.1.82.500 > 76.196.10.57.500: udp 224
  25: 15:44:17.309066 76.196.10.57.500 > 10.1.1.82.500: udp 220
  26: 15:44:17.478780 10.1.1.82.4500 > 76.196.10.57.4500: udp 80
  27: 15:44:17.550356 76.196.10.57.4500 > 10.1.1.82.4500: 64 udp
  28: 15:44:17.595214 10.1.1.82.4500 > 76.196.10.57.4500: udp 304
  29: 15:44:17.753470 76.196.10.57.4500 > 10.1.1.82.4500: udp 304
  30: 15:44:17.763037 10.1.1.82.4500 > 76.196.10.57.4500: udp 68
  31: 15:44:17.763540 10.1.1.82.4500 > 76.196.10.57.4500: udp 56
  32: 15:44:18.054516 10.1.1.82.4500 > 76.196.10.57.4500: udp 68
  33: 15:44:18.124840 76.196.10.57.4500 > 10.1.1.82.4500: udp 68
  34: 15:44:21.835390 10.1.1.82.4500 > 76.196.10.57.4500: udp 72
  35: 15:44:21.850831 10.1.1.82.4500 > 76.196.10.57.4500: udp 80
  36: 15:44:21.901183 76.196.10.57.4500 > 10.1.1.82.4500: udp 72
  37: 15:44:22.063747 10.1.1.82.1610 > 76.196.10.57.60443: S 938188365:938188365 (0) win 64240
  38: 15:44:22.104746 76.196.10.57.4500 > 10.1.1.82.4500: udp 80
  39: 15:44:22.122277 76.196.10.57.60443 > 10.1.1.82.1610: S 1440820945:1440820945 (0) ack 938188366 win 5808
  40: 15:44:22.122536 10.1.1.82.1610 > 76.196.10.57.60443:. ACK 1440820946 win 64240
  41: 15:44:22.123269 10.1.1.82.1610 > 76.196.10.57.60443: P 938188366:938188490 (124) ack 1440820946 win 64240
  42: 15:44:22.187108 76.196.10.57.60443 > 10.1.1.82.1610:. ACK 938188490 win 5808
  43: 15:44:22.400675 76.196.10.57.60443 > 10.1.1.82.1610: P 1440820946:1440821609 (663) ack 938188490 win 5808
  44: 15:44:22.474600 10.1.1.82.1610 > 76.196.10.57.60443: P 938188490:938188688 (198) ack 1440821609 win 63577
  45: 15:44:22.533648 76.196.10.57.60443 > 10.1.1.82.1610:. ACK 938188688 win 6432
  46: 15:44:22.742286 76.196.10.57.60443 > 10.1.1.82.1610: P 1440821609:1440821668 (59) ack 938188688 win 6432
  47: 15:44:22.742927 10.1.1.82.1610 > 76.196.10.57.60443: P 938188688:938189002 (314) ack 1440821668 win 63518
  48: 15:44:22.802570 76.196.10.57.60443 > 10.1.1.82.1610:. ACK 938189002 win 7504
  49: 15:44:25.180486 76.196.10.57.60443 > 10.1.1.82.1610: P 1440821668:1440821934 (266) ack 938189002 win 7504
  50: 15:44:25.181753 76.196.10.57.60443 > 10.1.1.82.1610: 1440821934:1440821934 F (0) ack 938189002 win 7504
  51: 15:44:25.181997 10.1.1.82.1610 > 76.196.10.57.60443:. ACK 1440821935 win 63252
  52: 15:44:25.182134 10.1.1.82.1610 > 76.196.10.57.60443: P 938189002:938189039 (37) ack 1440821935 win 63252
  53: 15:44:25.182333 10.1.1.82.1610 > 76.196.10.57.60443: 938189039:938189039 F (0) ack 1440821935 win 63252
  54: 15:44:25.241869 76.196.10.57.60443 > 10.1.1.82.1610: R 1440821935:1440821935 (0) win 0

  #2: same PC with Dynamic NAT, VPN connection fails:

  70 packets captured
  1: 14:08:31.758261 10.1.1.82.1073 > 76.196.10.57.443: S 820187495:820187495 (0) win 64240
  2: 14:08:34.876907 10.1.1.82.1073 > 76.196.10.57.443: S 820187495:820187495 (0) win 64240
  3: 14:08:40.746055 10.1.1.82.1073 > 76.196.10.57.443: S 820187495:820187495 (0) win 64240
  4: 14:08:42.048627 10.1.1.82.1074 > 76.196.10.57.60443: S 3309127022:3309127022 (0) win 64240
  5: 14:08:42.120248 76.196.10.57.60443 > 10.1.1.82.1074: S 1715577781:1715577781 (0) ack 3309127023 win 5808
  6: 14:08:42.120568 10.1.1.82.1074 > 76.196.10.57.60443:. ACK 1715577782 win 64240
  7: 14:08:42.121102 10.1.1.82.1074 > 76.196.10.57.60443: P 3309127023:3309127147 (124) ack 1715577782 win 64240
  8: 14:08:42.183553 76.196.10.57.60443 > 10.1.1.82.1074:. ACK 3309127147 win 5808
  9: 14:08:42.232867 76.196.10.57.60443 > 10.1.1.82.1074: P 1715577782:1715578445 (663) ack 3309127147 win 5808
  10: 14:08:42.405145 10.1.1.82.1074 > 76.196.10.57.60443:. ACK 1715578445 win 63577
  11: 14:08:43.791340 10.1.1.82.1074 > 76.196.10.57.60443: P 3309127147:3309127345 (198) ack 1715578445 win 63577
  12: 14:08:43.850450 76.196.10.57.60443 > 10.1.1.82.1074:. ACK 3309127345 win 6432
  13: 14:08:44.028196 76.196.10.57.60443 > 10.1.1.82.1074: P 1715578445:1715578504 (59) ack 3309127345 win 6432
  14: 14:08:44.058544 10.1.1.82.1074 > 76.196.10.57.60443: P 3309127345:3309127643 (298) ack 1715578504 win 63518
  15: 14:08:44.116403 76.196.10.57.60443 > 10.1.1.82.1074:. ACK 3309127643 win 7504
  16: 14:08:47.384654 76.196.10.57.60443 > 10.1.1.82.1074: P 1715578504:1715578882 (378) ack 3309127643 win 7504
  17: 14:08:47.385417 76.196.10.57.60443 > 10.1.1.82.1074: 1715578882:1715578882 F (0) ack 3309127643 win 7504
  18: 14:08:47.394068 10.1.1.82.1074 > 76.196.10.57.60443:. ACK 1715578883 win 63140
  19: 14:08:47.394922 10.1.1.82.1074 > 76.196.10.57.60443: P 3309127643:3309127680 (37) ack 1715578883 win 63140
  20: 14:08:47.395151 10.1.1.82.1074 > 76.196.10.57.60443: 3309127680:3309127680 F (0) ack 1715578883 win 63140
  21: 14:08:47.457633 76.196.10.57.60443 > 10.1.1.82.1074: R 1715578883:1715578883 (0) win 0
  22: 14:08:57.258073 10.1.1.82.500 > 76.196.10.57.500: udp 276
  23: 14:08:57.336255 76.196.10.57.500 > 10.1.1.82.500: udp 40
  24: 14:08:58.334211 10.1.1.82.500 > 76.196.10.57.500: udp 276
  25: 14:08:58.412850 76.196.10.57.500 > 10.1.1.82.500: udp 40
  26: 14:09:00.333311 10.1.1.82.500 > 76.196.10.57.500: udp 276
  27: 14:09:00.410730 76.196.10.57.500 > 10.1.1.82.500: udp 40
  28: 14:09:02.412561 10.1.1.82.1075 > 76.196.10.57.443: S 968016865:968016865 (0) win 64240
  29: 14:09:04.349164 10.1.1.82.500 > 76.196.10.57.500: udp 276
  30: 14:09:04.431648 76.196.10.57.500 > 10.1.1.82.500: udp 40
  31: 14:09:05.442710 10.1.1.82.1075 > 76.196.10.57.443: S 968016865:968016865 (0) win 64240
  32: 14:09:11.380427 10.1.1.82.1075 > 76.196.10.57.443: S 968016865:968016865 (0) win 64240
  33: 14:09:12.349926 10.1.1.82.500 > 76.196.10.57.500: udp 276
  34: 14:09:12.421502 10.1.1.82.1076 > 76.196.10.57.60443: S 3856215672:3856215672 (0) win 64240
  35: 14:09:12.430794 76.196.10.57.500 > 10.1.1.82.500: udp 40
  36: 14:09:12.481832 76.196.10.57.60443 > 10.1.1.82.1076: S 248909856:248909856 (0) ack 3856215673 win 5808
  37: 14:09:12.527972 10.1.1.82.1076 > 76.196.10.57.60443:. ACK 248909857 win 64240
  38: 14:09:12.529238 10.1.1.82.1076 > 76.196.10.57.60443: P 3856215673:3856215797 (124) ack 248909857 win 64240
  39: 14:09:12.608275 76.196.10.57.60443 > 10.1.1.82.1076:. ACK 3856215797 win 5808
  40: 14:09:12.658581 76.196.10.57.60443 > 10.1.1.82.1076: P 248909857:248910520 (663) ack 3856215797 win 5808
  41: 14:09:12.664531 10.1.1.82.1076 > 76.196.10.57.60443: P 3856215797:3856215995 (198) ack 248910520 win 63577
  42: 14:09:12.725533 76.196.10.57.60443 > 10.1.1.82.1076:. ACK 3856215995 win 6432
  43: 14:09:12.880813 76.196.10.57.60443 > 10.1.1.82.1076: P 248910520:248910579 (59) ack 3856215995 win 6432
  44: 14:09:12.892272 10.1.1.82.1076 > 76.196.10.57.60443: P 3856215995:3856216293 (298) ack 248910579 win 63518
  45: 14:09:12.953029 76.196.10.57.60443 > 10.1.1.82.1076:. ACK 3856216293 win 7504
  46: 14:09:12.955043 76.196.10.57.60443 > 10.1.1.82.1076: 248910579:248910579 F (0) ack 3856216293 win 7504
  47: 14:09:12.955242 10.1.1.82.1076 > 76.196.10.57.60443:. ACK 248910580 win 63518
  48: 14:09:12.955516 10.1.1.82.1076 > 76.196.10.57.60443: P 3856216293:3856216330 (37) ack 248910580 win 63518
  49: 14:09:12.955730 10.1.1.82.1076 > 76.196.10.57.60443: 3856216330:3856216330 F (0) ack 248910580 win 63518
  50: 14:09:13.019743 76.196.10.57.60443 > 10.1.1.82.1076: R 248910580:248910580 (0) win 0
  51: 14:09:16.068691 10.1.1.82.500 > 76.196.10.57.500: udp 56
  52: 14:09:16.227588 10.1.1.82.1077 > 76.196.10.57.60443: S 3657181617:3657181617 (0) win 64240
  53: 14:09:16.283783 76.196.10.57.60443 > 10.1.1.82.1077: S 908773751:908773751 (0) ack 3657181618 win 5808
  54: 14:09:16.306823 10.1.1.82.1077 > 76.196.10.57.60443:. ACK 908773752 win 64240
  55: 14:09:16.307692 10.1.1.82.1077 > 76.196.10.57.60443: P 3657181618:3657181742 (124) ack 908773752 win 64240
  56: 14:09:16.370998 76.196.10.57.60443 > 10.1.1.82.1077:. ACK 3657181742 win 5808
  57: 14:09:16.411935 76.196.10.57.60443 > 10.1.1.82.1077: P 908773752:908774415 (663) ack 3657181742 win 5808
  58: 14:09:16.417870 10.1.1.82.1077 > 76.196.10.57.60443: P 3657181742:3657181940 (198) ack 908774415 win 63577
  59: 14:09:16.509388 76.196.10.57.60443 > 10.1.1.82.1077:. ACK 3657181940 win 6432
  60: 14:09:16.708413 76.196.10.57.60443 > 10.1.1.82.1077: P 908774415:908774474 (59) ack 3657181940 win 6432
  61: 14:09:16.887100 10.1.1.82.1077 > 76.196.10.57.60443: P 3657181940:3657182254 (314) ack 908774474 win 63518
  62: 14:09:16.948193 76.196.10.57.60443 > 10.1.1.82.1077:. ACK 3657182254 win 7504
  63: 14:09:19.698465 76.196.10.57.60443 > 10.1.1.82.1077: P 908774474:908774740 (266) ack 3657182254 win 7504
  64: 14:09:19.699426 76.196.10.57.60443 > 10.1.1.82.1077: 908774740:908774740 F (0) ack 3657182254 win 7504
  65: 14:09:20.060162 10.1.1.82.1077 > 76.196.10.57.60443:. ACK 908774741 win 63252
  66: 14:09:20.062191 76.196.10.57.60443 > 10.1.1.82.1077: P 908774474:908774740 (266) ack 3657182254 win 7504
  67: 14:09:20.063732 10.1.1.82.1077 > 76.196.10.57.60443:. ACK 908774741 win 63252
  68: 14:09:20.063900 10.1.1.82.1077 > 76.196.10.57.60443: P 3657182254:3657182291 (37) ack 908774741 win 63252
  69: 14:09:20.064098 10.1.1.82.1077 > 76.196.10.57.60443: 3657182291:3657182291 F (0) ack 908774741 win 63252
  70: 14:09:20.127694 76.196.10.57.60443 > 10.1.1.82.1077: R 908774741:908774741 (0) win 0
  70 packages shown

  We had this problem of connection VPN IPsec from the years (I first thought it is restriction access problem, but it does not work or if I disable all access lists, experience of yesterday for the same restriction of the access-list shows longer than PC is not the cause). All suggestions and tips are greatly appreciated.

  Sean

  Hi Sean, please remove th lines highlighted in your pix and try and let me know, that these lines are not the default configuration of the PIX.

  VPN-udp-class of the class-map

  corresponds to the list of access vpn-udp-acl

  vpn-udp-policy policy-map

  VPN-udp-class

  inspect the amp-ipsec

  type of policy-card inspect dns migrated_dns_map_1

  parameters

  message-length maximum 768

  Policy-map global_policy

  class inspection_default

  inspect the migrated_dns_map_1 dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the http

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  inspect the pptp

  inspect the amp-ipsec

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  IP verify reverse path to the outside interface

  Thank you

  Rizwan James