Key to GET VPN server

Similar Questions

• How can I get all the connections on a windows 2008 r2 through a VPN server?

  How can I route all internet connections on a Windows 2008 Standard r2 through a VPN server?

  When I try to run just on an account administrator through regular networking, it hits the vpn in offline mode when someone else that the administrator is trying to distance in.

  I have to use a vpn, because I'm on a school network and have permission to use the server, but I have to do my own static IP address.  My solution for the static IP address, he ran through a VPN with data unlimited which ended with a dedicated static IP address.

  Everything on the server works when comes the administrator will connect.  Site Internet/game/file Services/Ect.

  Post in the Windows Server Forums:
  http://social.technet.Microsoft.com/forums/en-us/category/WindowsServer/

• My vpn server

  I have a new router and try to get a connection to my ereader it show that I have a bar wireless that works but it says no internet service how to find my vpn server?

  If you try to connect your ereader to your home wireless network? If yes you know the wireless network SSID, encryption type (IE. WPA2 for example) and password/pass phrase/key encryption. In general you can get make your wireless router by connecting to its pages. admin also consult the user manual or manufacturers support web site for your ereader device.

• GMs in GDOI GET VPN

  I want to know that if a member of the (GM) group can be a member of multiple groups, if yes, a configuration or a link can pl be provided showing the configuration where a GM is configured as a member of several groups/policies.

  Thank you

  M.K.Gupta

   A key server can support multiple groups. A group member can be part of multiple groups. 

  http://www.Cisco.com/en/us/docs/iOS-XML/iOS/sec_conn_getvpn/configuration/15-2mt/sec-get-VPN.html

  The Setup is simple enough, you apply usually different cryptographic cards to different interfaces.

• IOS Easy VPN Server / Radius attributes

  Hello

  I made an easy VPN server installation with a running 12.2 2621XM router (15) output T5. VPN Clients/users are authenticated against Cisco ACS 3.2 by RADIUS.

  It works fine, but there is a problem that I can't solve. Each user must have the same VPN assigned IP address whenever it is authenticated.

  The ACS sends the right radius attribute (box-IP-Address) back to square of IOS, but this address is not assigned to the client. The customer always gets the next available IP address in the local set on the router.

  How can I solve this problem?

  You will find the relevant parts of the configuration and a RADIUS "deb" below.

  Kind regards

  Christian

  AAA - password password:

  AAA authentication calls username username:

  RADIUS AAA authentication login local users group

  RADIUS AAA authorization network default local group

  crypto ISAKMP policy 1

  Group 2

  !

  crypto ISAKMP policy 3

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto identity hostname

  !

  ISAKMP crypto client configuration group kh_vpn

  mypreshared key

  pool mypool

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac shades

  !

  mode crypto dynamic-map 1

  shades of transform-set Set

  !

  users list card crypto mode client authentication

  card crypto isakmp authorization list by default mode

  card crypto client mode configuration address respond

  dynamic mode 1-isakmp ipsec crypto map mode

  !

  interface FastEthernet0/1

  IP 192.168.100.41 255.255.255.248

  crypto map mode

  !

  IP local pool mypool 172.16.0.2 172.16.0.10!

  Server RADIUS attribute 8 include-in-access-req

  RADIUS-server host 192.168.100.13 key auth-port 1645 acct-port 1646 XXXXXXXXXXXXXXXX

  RADIUS server authorization allowed missing Type of service

  deb RADIUS #.

  00:03:28: RADIUS: Pick NAS IP for you = tableid 0x83547CDC = 0 cfg_addr = 0.0.0.0 best_a

  DDR = 192.168.100.26

  00:03:28: RADIUS: ustruct sharecount = 2

  00:03:28: RADIUS: success of radius_port_info() = 0 radius_nas_port = 1

  00:03:28: RADIUS (00000000): send request to access the id 192.168.100.13:1645 21645.

  4, len 73

  00:03:28: RADIUS: authenticator 89 EA 97 56 12 B1 C5 C2 - C0 66 59 47 F7 88 96

  68

  00:03:28: RADIUS: NAS-IP-Address [4] 6 192.168.100.26

  00:03:28: RADIUS: NAS-Port-Type [61] Async 6 [0]

  00:03:28: RADIUS: username [1] 10 "vpnuser1".

  00:03:28: RADIUS: Calling-Station-Id [31] 13 "10.1.14.150".

  00:03:28: RADIUS: User-Password [2] 18 *.

  00:03:28: RADIUS: receipt of 192.168.100.13:1645, Access-Accept, id 21645/4 l

  in 108

  00:03:28: RADIUS: authenticator C1 7 29 56 50 89 35 B7 - 92 7 b 1 has 32 87 15 6

  A4

  00:03:28: RADIUS: Type of Service [6] 6 leavers [5]

  00:03:28: RADIUS: connection-ip-addr-host [14] 6 255.255.255.255

  00:03:28: RADIUS: Tunnel-Type [64] 6 01:ESP [9]

  00:03:28: RADIUS: Tunnel-Password [69] 21 *.

  00:03:28: RAY: box-IP-Netmask [9] 6 255.255.255.0

  00:03:28: RADIUS: Framed-IP-Address [8] 6 172.16.0.5

  00:03:28: RADIUS: [25] the class 37

  00:03:28: RADIUS: 43 49 53 43 4F 41 43 53 3 A 30 30 30 30 30 31 30 [CISCOACS:0

  000010]

  00:03:28: RADIUS: 2F 33 63 30 61 38 36 34 31 61 76 70 75 73 [3/c0a8641a 6F 2F

  /vpnus]

  00:03:28: RADIUS: 65 72 31 [1]

  00:03:28: RADIUS: saved the authorization for user 83547CDC to 83548430 data

  00:03:29: RADIUS: authentication for data of the author

  00:03:29: RADIUS: Pick NAS IP for you = tableid 0x82A279FC = 0 cfg_addr = 0.0.0.0 best_a

  DDR = 192.168.100.26

  00:03:29: RADIUS: ustruct sharecount = 3

  00:03:29: RADIUS: success of radius_port_info() = 0 radius_nas_port = 1

  00:03:29: RADIUS (00000000): send request to access the id 192.168.100.13:1645 21645.

  5, len 77

  00:03:29: RADIUS: authenticator 13 B2 A6 CE BF B5 DA 7th - 7B F0 F6 0b A2 35 60

  E3

  00:03:29: RADIUS: NAS-IP-Address [4] 6 192.168.100.26

  00:03:29: RADIUS: NAS-Port-Type [61] Async 6 [0]

  00:03:29: RADIUS: username [1] 8 'kh_vpn '.

  00:03:29: RADIUS: Calling-Station-Id [31] 13 "10.1.14.150".

  00:03:29: RADIUS: User-Password [2] 18 *.

  00:03:29: RADIUS: Type of Service [6] 6 leavers [5]

  00:03:29: RADIUS: receipt of 192.168.100.13:1645, Access-Accept, id 21645/5 l

  in 94

  00:03:29: RADIUS: authenticator C4 F5 2F C3 EE 56 DA C9 - 05 D6 F5 5 d EF 74 23

  AF

  00:03:29: RADIUS: Type of Service [6] 6 leavers [5]

  00:03:29: RADIUS: connection-ip-addr-host [14] 6 255.255.255.255

  00:03:29: RADIUS: Tunnel-Type [64] 6 01:ESP [9]

  00:03:29: RADIUS: Tunnel-Password [69] 21 *.

  00:03:29: RADIUS: [25] class 35

  00:03:29: RADIUS: 43 49 53 43 4F 41 43 53 3 A 30 30 30 30 30 31 30 [CISCOACS:0

  000010]

  00:03:29: RADIUS: 2F 34 63 30 61 38 36 34 31 61 2F 6 b 5F 68 76 70 [4/c0a8641a

  [/ kh_vp]

  00:03:29: RADIUS: 6 [n]

  00:03:29: RADIUS: saved the authorization for user 82A279FC to 82A27D3C data

  Assignment of an IP address via a server Raidus is currently not supported, even if your Radius Server is through an IP address, the router will ignore it and just assign an IP address from the pool locla. In fact, the pool room is the only way to assign IP addresses currently.

  On the only way to do what you want right now is to create different groups VPN, each reference to a local IP pool with an address in it. Then ask each user connect to the appropriate by their VPN client group.

  Yes, messy, but just try to provide a solution for you.

• Need help with attention not approved VPN server certificates.

  I've been on the many other posts about it, and they all seem a bit different, so I started my own thread.

  I was sent to my users via the ASA AnyConnect 3.1.02026, and we all get the warning of the Cert of untrusted when connecting VPN server.

  When the ASA deploys the client, it puts the external IP of the SAA as the host name, which causes the error.

  So I have two questions: 1. How can I get the ASA to make host name "vpn.cfo.com" when a user installs the client and 2. How can I change my cert so that it does not show the internal name of the ASA and use 'vpn.cfo.com' instead?

  Here are all the news that everyone should not (I) help to think

  SSL-trust ASDM_TrustPoint0 OUTSIDE_PRIMARY point

  Certificate

  Status: available

  Of the certificate number:

  Use of certificates: Signature

  Public key type: RSA (1024 bits)

  Signature algorithm: SHA1 with RSA encryption

  Name of the issuer:

  hostname = ambossfw01.cfopub .net

  CN = ambossfw01

  Name of the object:

  hostname = ambossfw01.cfopub .net

  CN = ambossfw01

  Validity date:

  start date: 15:17:42 EDT June 2, 2011

  end date: 15:17:42 EDT May 30, 2021

  Trustpoints Associates: ASDM_TrustPoint0

  CA

  Status: available

  Of the certificate number:

  Certificate use: general use

  Public Key Type: RSA (2048 bits)

  Signature algorithm: SHA1 with RSA encryption

  Name of the issuer:

  CN = VeriSign Class 3 Public Primary Certification Authority - G5

  or = (c) 2006 VeriSign\, Inc. - authorized only use

  OU = VeriSign Trust Network

  o = VeriSign\, Inc.

  c = US

  Name of the object:

  CN = VeriSign Class 3 Secure Server CA - G3

  OU = terms of use at https://www.verisign.com/rpa (c) 10

  OU = VeriSign Trust Network

  o = VeriSign\, Inc.

  c = US

  OCSP AIA:

  URL: http://ocsp.verisign.com

  CRL Distribution points:

  [1] http://crl.verisign.com/pca3-g5.crl

  Validity date:

  start date: 19:00:00 EST February 7, 2010

  end date: 18:59:59 EST February 7, 2020

  Trustpoints Associates: _SmartCallHome_ServerCA

  Any help would be greatly appreciated.

  Hello

  Cisco has made a strict checking of KU and EKU in recent versions of AnyConnect, which leads to the warning you got.

  To my knowledge, if you go to 3.1.00495, you will not get this warning, if not, you need to get the valid KU and EKU fields in your certificate of ASA.

  To use specific trustpoint, please check the 'truspoint ssl' command in global configuration mode.

  Mashal

• GET VPN on 6500

  Hello

  I was wondering if anyone has come across information about using a 6500 as a key server in an environment GET VPN?

  Hi Jason,

  The 6500 is not support for GETVPN KS

  Table 2 of the following link describes devices that are able to KS.

  http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps7180/product_data_sheet0900aecd80582067.html

• Unable to connect to the VPN server

  Hello

  I'm on Sierra, iOS macOS 10 and Mac OS Server 5.2 (on a Mac mini).  (All dated September 21, 2016)

  Because PPTP is no longer supported, I am trying to create L2TP.  Unfortunately, when I try to connect to the server, I get the error "the VPN server has failed. Please check the server address and try to reconnect. »

  I do not think it is a problem of networking: back to my Mac is not enabled, the appropriate ports are transmission (UDP 500, 1701, 4500) and server says that the service is accessible.

  When I check the logs from the server after a connection attempt, I find:

  21/09/16 21:08:09.994 raccoon [75993]: can't find configuration.

  21/09/16 21:08:13.285 raccoon [75993]: can't find configuration.

  21/09/16 21:08:16.578 raccoon [75993]: can't find configuration.

  21/09/16 21:08:19.884 raccoon [75993]: can't find configuration.

  Any suggestions?

  Does anyone know where the configuration file is supposed to be on the server, so I can look at?

  Thanks for your help!

  Hi Rick,

  -Check that the folder/etc/racoon exist and the folder contains psk.txt and racoon.conf.

  -Installed with the operating system.

  Cheers, dwbrecovery

• 2651xm (IOS 12.4(9T) VPN server - default route

  When my clients connect to the VPN server, their default route prepared to go through the VPN. If they resemble the State of the connection, it shows "0.0.0.0 0.0.0.0" under the secure routes. I want to do so that one class C subnet is in the list. How can I do this?

  Thank you!

  This is called "split tunneling". For maximum security, you should not use it.

  Never done on IOS myself, but this would contribute to the code snippet:

  access-list 150 permit ip 30.30.30.0 0.0.0.255 any

  ISAKMP crypto group of hw-client-name client configuration.

  HW-client-password key

  DNS 30.30.30.10 30.30.30.11

  WINS 30.30.30.12 30.30.30.13

  domain cisco.com

  pool dynpool

  ACL 150

  Of http://www.cisco.com/application/pdf/en/us/guest/products/ps6659/c1650/cdccont_0900aecd80313bd6.pdf

• Access to the internal mail (Exchange) by centimeters remote VPN server

  Hi all

  I have a problem in the configuration of ASA 5510 to access my internal mail (Exchange) through remote access VPN server

  one... I have set up my D-Link ADSL router to port before the SMPTP (25) & POP3 (110) to the external interface of ASA 5510 (192.168.5.101 255.255.255.0)

  b. How can I configure ASA 5510 (using ASDM) to portforward (SMTP POP3 110 25) to my internal mail server with IP 192.168.50.2 255.255.255.0

  c. my internal LAN network (192.168.50.0 255.255.255.0) is coordinated at 10.1.1.0 255.255.255.224 for vpn clients

  d. my IP of mail server (192.168.50.2 255.255.255.0) will also be translated while clients are accessing content through remote VPN access

  e.What IP (Exchange of IP of the server (192.168.50.2) do I have to set up in Microsoft Outlook (incoming & outgoing mail server), vpn clients receive using a NAT IP 10.1.1.10

  Here's my configuration details of access remote vpn

  : Saved

  : Written by enable_15 at 13:42:51.243 UTC Thursday, November 27, 2008

  !

  ASA Version 7.0 (6)

  !

  hostname xxxx

  domain xxxx

  enable the encrypted password xxxxx

  XXXXX encrypted passwd

  names of

  DNS-guard

  !

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP 192.168.5.101 255.255.255.0

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  IP 192.168.50.101 255.255.255.0

  !

  interface Ethernet0/2

  Shutdown

  No nameif

  no level of security

  !

  interface Management0/0

  nameif management

  security-level 100

  management only

  IP 192.168.1.1 255.255.255.0

  !

  passive FTP mode

  list of access inside the _nat0_outbound extended permits all ip 10.1.1.0 255.255.255.224

  allow a standard vpn access list

  outside_cryptomap_dyn_20 list of allowed ip extended access any 10.1.1.0 255.255.255.224

  vpn-ip-pool 10.1.1.10 mask - 255.255.255.0 IP local pool 10.1.1.25

  Global interface 10 (external)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 10 0.0.0.0 0.0.0.0

  Route outside 0.0.0.0 0.0.0.0 192.168.5.1 (D-Link ADSL router LAN IP) 1

  internal vpn group policy

  attributes of vpn group policy

  Split-tunnel-policy excludespecified

  Split-tunnel-network-list value vpn

  WebVPN

  xxxxx xxxx of encrypted password privilege 0 username

  attributes of username xxxxx

  Strategy-Group-VPN vpn

  WebVPN

  ASDM image disk0: / asdm - 508.bin

  don't allow no asdm history

  ARP timeout 14400

  Enable http server

  http 192.168.1.0 255.255.255.0 management

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set ESP-3DES-SHA edes-esp esp-sha-hmac

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  card outside_map 655535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  ISAKMP allows outside

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 sha hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  tunnel vpn ipsec-ra group type

  VPN tunnel-group general attributes

  ip vpn-pool address pool

  Group Policy - by default-vpn

  Tunnel vpn ipsec-attributes group

  pre-shared-key *.

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  management of 192.168.1.2 - dhcpd address 192.168.1.254

  dhcpd lease 3600

  dhcpd ping_timeout 50

  enable dhcpd management

  !

  Policy-map global_policy

  class inspection_default

  inspect the dns-length maximum 512

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  !

  global service-policy global_policy

  : end

  So can someone help me, how can I configure these tasks

  You can without problem

• How to Setup Cisco 1841 as a site to site VPN VPN server, with watch guard

  I would like to implement a cisco 1841 as a VPN server to establish s IP VPN (site to another) of a watch guard firewall,.

  I have looked through some examples of cisco config, but can't seem to get a lot.

  Can you please send me sample config steps I need o perform on the cisco router? and what credentials must be awarded to watch keeps establishing a permanent VPN?

  emergency assistance will be greatly appreciated.

  The cisco router is configured as a lan to lan normal IPSEC tunnel, there is no difference when configuration to create a tunnel to a watchguard/sonicwall or all that peer will use, you can use this link as a guide:

  http://www.Cisco.com/en/us/products/HW/routers/ps221/products_configuration_example09186a008073e078.shtml

  If you have problems make me know.

• Easy VPN server

  Hello

  I configured easy VPN server on Cisco 1841 & got a form of address IP VPN hen but unfortunately not able to access private or servers on the local network, address maybe because I can NATing.

  Please advice?

  I have attached the file of Configuration of the router.

  Kind regards

  Alain R.Aljabi

  Hello

  Need to get around the NAT for VPN IP address Pool. Please follow it below URL that explains how to work around NAT (static) with route map. This configuration should get your VPN works.

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094634.shtml

  Kind regards

  Arul

  * Please note the useful messages *.

• Cannot connect to the easy VPN server

  Hi *.

  I have a stupid problem with my easy VPN server. I took the following configuration to configure the VPN: click on

  Successfully, I can ping 192.168.99.1 but when I start AnyConnect (enter this IP address as serveraddress) on my IPhone, it first says that the server certificate is not valid (I ignore because it is self-signed..) and when I press continue it says that no link could be established.

  What can be the problem?

  It is very likely that you have a configured PAT-pool and simply use the Word key "overload" when from your external interface. In this command, you reference an ACL (or an ACL in a road map) where we need to ensure that your VPN-pool in included in the traffic using a NAT.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Get VPN client to connect, but request timed out when ping

  Hi, I use the router Cisco 837 as my VPN server. I am connected using Cisco VPN Client Version 5. But when I ping the ip of the router, I have request timed out. Here is my configuration:

  Building configuration... Current configuration : 3704 bytes ! version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname michael ! boot-start-marker boot-end-marker ! memory-size iomem 5 no logging console enable secret 5 $1$pZLW$9RZ8afI8QdGRq0ssaEJVu0 ! aaa new-model ! ! aaa authentication login default local aaa authentication login sdm_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network sdm_vpn_group_ml_1 local ! aaa session-id common ! resource policy ! ip subnet-zero no ip dhcp use vrf connected ip dhcp excluded-address 192.168.1.1 ! ip dhcp pool michael    network 192.168.1.0 255.255.255.0    default-router 192.168.1.1    dns-server 202.134.0.155 ! ip dhcp pool excluded-address    host 192.168.1.4 255.255.255.0    hardware-address 01c8.d719.957a.b9 ! ! ip cef ip name-server 202.134.0.155 ip name-server 203.130.193.74 vpdn enable ! ! ! ! username michael privilege 15 secret 5 $1$ZJQu$KDigCvYWKkzuzdYHBEY7f. username danny privilege 10 secret 5 $1$BDs.$Ez0u9wY7ywiBzVd1ECX0N/ ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp xauth timeout 15 ! crypto isakmp client configuration group michaelvpn key vpnpassword pool SDM_POOL_1 acl 199 netmask 255.255.255.0 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto dynamic-map SDM_DYNMAP_1 1 set transform-set ESP-3DES-SHA ! ! crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1 crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto map SDM_CMAP_1 client configuration address respond crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1 ! ! ! interface Ethernet0 description $FW_INSIDE$ ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 hold-queue 100 out ! interface Ethernet2 no ip address shutdown hold-queue 100 out ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto pvc 0/35   pppoe-client dial-pool-number 1 ! ! interface FastEthernet1 duplex auto speed auto ! interface FastEthernet2 duplex auto speed auto ! interface FastEthernet3 duplex auto speed auto ! interface FastEthernet4 duplex auto speed auto ! interface Virtual-PPP1 no ip address ! interface Dialer1 description $FW_OUTSIDE$ mtu 1492 ip address negotiated ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 ppp chap hostname ispusername ppp chap password 0 isppassword ppp pap sent-username ispusername password 0 isppassword crypto map SDM_CMAP_1 ! ip local pool SDM_POOL_1 192.168.2.1 192.168.2.5 ip classless ip route 0.0.0.0 0.0.0.0 Dialer1 ip http server no ip http secure-server ! ip nat inside source static udp 192.168.1.0 1723 interface Dialer1 1723 ip nat inside source static tcp 192.168.1.4 21 interface Dialer1 21 ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload ! access-list 1 remark SDM_ACL Category=16 access-list 1 permit 192.0.0.0 0.255.255.255 access-list 102 remark SDM_ACL Category=2 access-list 102 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 access-list 102 permit ip 192.168.1.0 0.0.0.255 any access-list 199 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 route-map SDM_RMAP_1 permit 1 match ip address 102 ! ! control-plane ! banner motd ^C Authorized Access Only UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED You must have explicit permission to access this device. All activities performed on this device are logged. Any violations of access policy will result in disciplinary action. ^C ! line con 0 no modem enable line aux 0 line vty 0 4 ! scheduler max-task-time 5000 end
  
  Thank you, anny help will be appreciated.
  			 
  Hi Michael,
  I have been through the newspapers, they are not conclusive and only detrmine that Phase 1 is coming. However according to this error message % SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr = 81B50AD8, count = 0 we are hiiting a bug on ios. The id of the bug is CSCsl24693 and the solution is to switch to 12.4 (11) XJ.
  Can you re-execute him debugs and send me the detailed results.
  Kind regards
  Aman
  		   

• SDM & easy VPN server problem

  I'm having a problem setting up an easy VPN server using Cisco Security

  Device Manager Version 2. 0a on a router in 1711 with IOS 12.3 (7) XR3.

  I have reset the router to the factory defects since the opening screen of SDM.

  Connect to 10.10.10.1

  User: cisco

  Password: Cisco

  Start SDM for the initial router configuration dialog box.

  Don't use CNS

  On basic configuration screen:

  Hostname set to router

  Domain: test.com

  Synchronize time with local PC

  Change the user name

  New user name: root

  password: xyzzy123

  password: xyzzy1234

  The LAN Interface Setup screen

  IP address set to 10.1.1.1

  Subnet: 255.255.255.0

  Active DHCP server

  Start IP: 10.1.1.50

  End IP: 10.1.1.70

  DNS Configuration screen

  Primary: 45.45.45.45

  Secondary: 45.45.45.46

  Use for DHCP Clients

  WAN Configuration screen

  Ethernet selected without Encapsulation PPOE

  No dynamic (DHCP Client) host name

  Advanced options screen

  Selected for VLAN1 port address translation

  After reading the summary, I chose the FINISH. Asked if dialog box I have

  you want to set up a basic firewall, I selected YES. I left all the

  secure by default items selected. I clicked FINISH. SDM detected that the

  DHCP client on the untrusted external interface and asked if I wanted to

  allow DHCP traffic through the firewall. I selected YES. The configuration

  has been delivered.

  Save the running-config startup-config and reloaded the router.

  Released and renewed my ip address and then reconnected in 1711 from new

  user name and password. SDM restarted.

  Has begun the task of configuration and choose to set up an easy VPN server.

  The opening screen had a command prompt to enable AAA. I launched the selected task

  After that the AAA commands have been delivered to the router.

  I chose the interface FastEthernet0 menu drop-down

  IKE proposals - selected default all the

  Transform set - selected default all the

  Group authorization / policy research - Selected Local only

  Add the user name: User1

  Password: local1

  Encrypt with MD5

  Privilege: 2

  Group permission/User Group Policies

  Add political group: tunnel

  Preshared key: sharedkey

  Selected new address Pool: 10.1.1.80 to 10.1.1.90

  Test after you have configured the selected button.

  Exit this screen, there was a warning SDM on the NAT with ACL rules

  have to be converted into NAT rules with course maps. I clicked YES to let

  SDM convert rules.

  Tests successful Easy VPN Server and client screen displays a warning

  on the "crypto ipsec df - bit clear' needing to be defined." He was not a

  way to put it in SDM and the search function had no success.

  I copied the running-config to the startup-config and tested the router from a

  connect remotely using a different ISP.

  The results:

  The SDM monitor shows the client connection, but the client cannot ping

  any host on the LAN of the router. No one on the LAN can easy ping of VPN client

  Assigned IP of VPN, but they can ping the client using the asigned IP ISP

  address.

  It seems that SDM not correctly configures the 1711 to route of the

  VPN interface to the local network.

  I enclose my 1711 Running Configuration generated by SDM.

  Hello

  I think that the reason why the ping is not successful is that your LAN IP address (connected to the VLAN interface) and the pool of IP addresses assigned to the client are in the same network.

  You can try assigning a pool of IP addresses for VPn clients that is in another subnet (say 10.1.2.80 to 10.1.2.90) and then try to ping?

  You can change the pool by means of configure-> additional tasks-> local swimming pools.

  You can then disconnect the client on the Monitoring page and connect again.

  Kind regards

  Ravikumar