L2L pix 501 and remote access VPN

Hi, I'm working on an old 501 PIX w / Software 6.3 (5), he already have access to remote VPN configuration and works very well, but now he needs a L2L implemented. One thing I try to do all the work remotely via VPN or ssh to the machine. I don't know what's on the other end, but they swear that it is set up and maybe my problem is when I start putting in orders for the other VPN it breaks the remote VPN access. One thing that I have to do is NAT a host on the inside to appear as another host on the end. I use these commands and I think it works cannot be said.

access-list 101 permit ip remote_network 255.255.255.0 local_server host

public static 10.1.0.203 (inside, outside) - access list 101

then

access-list 102 permit ip host 10.1.0.203 192.168.50.83
access-list 102 permit ip host 10.1.0.203 192.168.50.86
access-list 102 permit ip host 10.1.0.203 192.168.50.50
access-list 102 permit ip host 10.1.0.203 192.168.50.85

and use it to match against

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
EMDs-map 10 ipsec-isakmp crypto map
correspondence address card crypto emds-map 10 102
card crypto emds-map 10 peers set remote_vpn_server
card crypto emds-card 10 set of transformation-ESP-3DES-SHA

then

ISAKMP key magic_key address remote_vpn_server netmask 255.255.255.255
ISAKMP identity hostname
part of pre authentication ISAKMP policy 10
ISAKMP policy 10 3des encryption
ISAKMP policy 10 sha hash
10 1 ISAKMP policy group
ISAKMP life duration strategy 10 86400

and that is where it usually breaks the VPN, I don't know if the other VPN works due to not being not able to get to this server to try to ping, I don't really like to try this stuff remotely but I don't have a lot of choice at the moment.

Any thoughts?

Thank you

Jarrid Graham

Yes, just use the number of different sequence with 1 name of the crypto map. Please also ensure that your dynamic crypto map, which is your vpn client has the sequence down the crypto map (more), because you want to make sure that the static crypto map (for lan-to-lan tunnel has higher sequence number (lower number)).

The political isakmp sequence number does not match, it is processed from top to bottom (number less than the high number) and also long 1 set of isakmp policy corresponds to the remote peer, it will be negotiated properly.

Hope that answers your question and please note useful post. Thank you.

Tags: Cisco Security

Similar Questions

  • PIX 515E and remote access VPN

    I use a PIX 515E with: ASDM Version: 5,0000 51 PIX Version: 8.0 (4) and configure it with remote access VPN.

    I would like to get an email every time that a user login (and or disconnection) to the VPN. Remote clients use the Cisco VPN Client.

    Any help is appreciated,

    Hello

    Here is a link to the email configuration when you log in to the ASA/PIX: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc7

    Then you can create a list of message to send the logs only for the connection/disconnection of the VPN user: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc18

    There is a wire that is linked here: https://supportforums.cisco.com/discussion/10798976/asa-email-logging-issue

  • L2l VPN and remote access VPN

    Hello

    I have 2 Cisco Pix (Pix1, Pix2) 515E (8.0.4). Between these devices exist VPN L2L, which are configured on the external interfaces. On Pix2 I configured remote access VPN on the external interface, too.

    Is it possible to achieve LAN behind Pix1, by using remote access VPN on Pix2 then VPN L2L?

    I don't want to set up remote access on Pix1.

    Thank you very much.

    Kind regards

    Vladislav

    NAT (outside) 1 140.40.30.0 255.255.255.0 (PAT for RA vpn to access the internet if you complete tunnel)

    It is simply because I have configured tunnel RA as complete tunnel instead of split, nat (outside) 1 at the RA 140.40.30.0 pool have internet access through your firewall ASA_SITE_B and translate with global ID 1 who is your external interface of the firewall SA_SITE_B. This has nothing to do with what you are trying to accomplish, but I posted it because it was part of the very common scenario. There are some example PIX 6.3 cases where you will need split tunnel so that RA users have internet access not passing not through the encrypted tunnel code 6.0 does not feature of intra-interface support but 7.x above is of the code. Other examples are that some people configure split RA RA user tunnel will have access to their local resources in their homes as the printers network etc...

    It is therefore, I need to translate 172.27.1.0/24 RA pool?

    No there is no address translation in place in this scenario to work and you don't need to translate something too long, there is no of networks that overlap in one of the SITES u do not need to translate, this scenario is completely free sheep as you access lists free of nat in two firewalls for networks involved in communication in tunnels ASA_SITE_B.

    Because I want to see IP addresses from PIX_SITE_A to 172.27.1.0/24, not 140.40.30.0/24. Is it possible to do it this way?

    Im not clear on this issue, but if I think what it means, it's possible but you need to have political NATing but I think this will make complicated setup, I would say to make this as simple as possible.

    Concerning

    All helpful PLS rate valid if it helped

  • PIX 501 and pcAnywhere access rules

    Hello

    I'm having a problem with the implementation of pcANywhere remote access Access 2 servers on the inside network. I created 2 static rules and access lists 2 to start, but I can't get thru to the server. These are the settings

    static (inside, outside) 7x.x.x.x 5631 172.16.x.x tcp 5631 255.255.255.255

    static (inside, outside) udp 7x.x.x.x 172.16.x.x 5632 5632 255.255.255.255

    list of allowed inbound tcp access any host 172.16.x.x eq 5631

    list of allowed inbound udp access any host 172.16.x.x eq 5632

    Access-group interface incoming outside

    Version 6.3 of the PIX using

    I also tried access server list terminal server because another method of access, but not go either.

    There are no other rules.

    Any ideas why this would not work?

    TIA

    Vince

    your external ACL must mention the public IP address of your server:

    list of allowed inbound tcp access any host 7x.x.x.x eq 5631

    list of allowed inbound udp access any host 7x.x.x.x eq 5632

  • Remote access VPN pix version 8.0 (3)

    Hi all

    First of all, I would like to thank to all members of the forum who got help in several messages on the configuration of the pix 515.

    I am now configuring remote VPN access with radius authentication to my network, but I can't connect.

    I use the cisco vpn client 5.0.03.0560, I have also tested my pix radius (inside) server authentication and works very well.

    I already tried to retype the key of the cli, but I still can't remote access vpn to work.

    I also tried to create another remote vpn with another name and local authentication, but I have the same problem.

    I use 8.0 (3) version pix.

    Can someone help me

    I attach the log file of the cisco vpn client to help solve the problem, as well a configuration of the pix folder.

    Thank you very much in advance and I seek prior information.

    http://www.Cisco.com/en/us/docs/security/ASA/asa72/configuration/guide/vpnadd.html#wp999516

    [Pls RATE if HELP]

  • Remote access VPN group name and password

    Hi guys,.

    Can someone tell me please the command to display a remote access VPN group name and the password on a firewall version 8.0 of ASA? Any help will be greatly appreciated.

    Thank you

    Lake

    Remote VPN IPsec IKEv1 access are listed as groups of tunnel. If you enter

    more system:running-config | b tunnel-group

    You can see the config sections (starting with the first mention of the tunnel-group) as well as the pre-shared key ikev1 plaintext String.

  • authentication of remote access, vpn and ldap

    I have a test environment with 2 hours fireval 5505: the first firewall is remote access VPN server and the Interior of this firewall is a network of domain with a domain controller, DNS server and a workstation. DHCP is disabled and the PC have a static address.outside of the VPN server is attached outside the other ASA 5505 firewall. on the inside of the firewall, there is a workstation.the workstation would be to connect via vpn for remote access on the domain network. I have configured the VPN server for remote access through a wizard and his

    configuration is the following

    Result of the command: "show running-config"

    : Saved

    :

    ASA Version 8.2(1)

    !

    hostname ciscoasa

    domain-name dri.local

    enable password 8Ry2YjIyt7RRXU24 encrypted

    passwd 2KFQnbNIdI.2KYOU encrypted

    names

    !

    interface Vlan1

    nameif inside

    security-level 100

    ip address 10.13.74.5 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    ip address 192.168.30.1 255.255.255.0

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    ftp mode passive

    dns server-group DefaultDNS

    domain-name dri.local

    access-list inside_nat0_outbound extended permit ip any 192.168.50.0 255.255.255.240

    access-list outside_access_in extended permit tcp 192.168.50.0 255.255.255.240 10.13.74.0 255.255.255.0

    pager lines 24

    logging asdm informational

    mtu inside 1500

    mtu outside 1500

    ip local pool vpnpool 192.168.50.1-192.168.50.10 mask 255.255.255.0

    icmp unreachable rate-limit 1 burst-size 1

    no asdm history enable

    arp timeout 14400

    global (outside) 1 interface

    nat (inside) 0 access-list inside_nat0_outbound

    nat (inside) 1 0.0.0.0 0.0.0.0

    access-group outside_access_in in interface outside

    route outside 0.0.0.0 0.0.0.0 192.168.30.2 1

    timeout xlate 3:00:00

    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-record DfltAccessPolicy

    action terminate

    dynamic-access-policy-record vpnldap

    network-acl inside_nat0_outbound

    aaa-server vpn protocol ldap

    aaa-server vpn (inside) host 10.13.74.20

    ldap-base-dn DC=DRI,DC=LOCAL

    ldap-group-base-dn cn=test,cn=users,dc=dri,dc=local

    ldap-scope subtree

    ldap-naming-attribute sAMAccountName

    ldap-login-password *

    ldap-login-dn cn=test,cn=users,dc=dri,dc=local

    server-type microsoft

    http server enable

    http 10.13.74.0 255.255.255.0 inside

    no snmp-server location

    no snmp-server contact

    snmp-server enable traps snmp authentication linkup linkdown coldstart

    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

    crypto ipsec security-association lifetime seconds 28800

    crypto ipsec security-association lifetime kilobytes 4608000

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

    crypto map outside_map interface outside

    crypto isakmp enable outside

    crypto isakmp policy 10

    authentication pre-share

    encryption 3des

    hash sha

    group 2

    lifetime 86400

    telnet timeout 5

    ssh timeout 5

    console timeout 0

    dhcpd auto_config outside

    !

    dhcpd address 10.13.74.9-10.13.74.40 inside

    !

    threat-detection basic-threat

    threat-detection statistics access-list

    no threat-detection statistics tcp-intercept

    webvpn

    group-policy drivpn internal

    group-policy drivpn attributes

    dns-server value 10.13.74.20 10.8.2.5

    vpn-tunnel-protocol IPSec l2tp-ipsec

    default-domain value dri.local

    tunnel-group drivpn type remote-access

    tunnel-group drivpn general-attributes

    address-pool vpnpool

    authentication-server-group vpn

    default-group-policy drivpn

    tunnel-group drivpn ipsec-attributes

    pre-shared-key *

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    policy-map type inspect dns preset_dns_map

    parameters

    message-length maximum 512

    policy-map global_policy

    class inspection_default

    inspect dns preset_dns_map

    inspect ftp

    inspect h323 h225

    inspect h323 ras

    inspect rsh

    inspect rtsp

    inspect esmtp

    inspect sqlnet

    inspect skinny

    inspect sunrpc

    inspect xdmcp

    inspect sip

    inspect netbios

    inspect tftp

    !

    service-policy global_policy global

    prompt hostname context

    Cryptochecksum:1fc23fb20a74f208b3cde5711633ad3d

    : end

    When I tried to workstation on the internal part of the second firewall (no remote access vpn server) to connect to the vpn, everything is ok. I used the cisco vpn client, but I can't ping domain controller, workstation, I can't use the shared folder on them. Why?

    Please help me

    Thank you

    Thanks for letting me know! Can you please give the station "answered"? Thank you!

  • Cisco Asa 5505 and level 3 with remote access VPN switch

    Today I had a new CISCO LAYER 3 switch... So here's my scenrio

    Cisco Asa 5505

    I have

    Outside of the == 155.155.155.x

    Inside = 192.168.7.1

    Address POOL VPN = 10.10.10.1 - 10.10.10.20

    3 layer switch configuration

    VLAN 2

    ip address of the interface = 192.168.1.1

    VLAN 2

    ip address of the interface = 192.168.2.1

    VLAN 2

    ip address of 192.168.3.1 = interface

    VLAN 2

    ip address of the interface = 192.168.4.1

    VLAN 2

    ip address of the interface = 192.168.5.1

    IP Routing

    So I want the customers of my remote access VPN to access all that these networks. So please can you give me a useful tip or a link to set up the rest of my trip

    Thanks to you all

    Al ready has responded

    Sent by Cisco Support technique iPad App

  • Remote access VPN with ASA 5510 by using the DHCP server

    Hello

    Can someone please share your knowledge to help me find out why I'm not able to receive an IP address on the remote access VPN connection so that I can get an IP local pool DHCP?

    I'm trying to set up remote access VPN with ASA 5510. It works with dhcp local pool but does not seem to work when I tried to use an existing DHCP server. It is tested in an internal network as follows:

    !

    ASA Version 8.2 (5)

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    IP 10.6.0.12 255.255.254.0

    !

    IP local pool testpool 10.6.240.150 - 10.6.240.159 a mask of 255.255.248.0. (worked with it)

    !

    Route inside 0.0.0.0 0.0.0.0 10.6.0.1 1

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Crypto-map dynamic dyn1 1jeu transform-set FirstSet

    dynamic mymap 1 dyn1 ipsec-isakmp crypto map

    mymap map crypto inside interface

    crypto ISAKMP allow inside

    crypto ISAKMP policy 1

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 43200

    !

    VPN-addr-assign aaa

    VPN-addr-assign dhcp

    !

    internal group testgroup strategy

    testgroup group policy attributes

    DHCP-network-scope 10.6.192.1

    enable IPSec-udp

    IPSec-udp-port 10000

    !

    username testlay password * encrypted

    !

    tunnel-group testgroup type remote access

    tunnel-group testgroup General attributes

    strategy-group-by default testgroup

    DHCP-server 10.6.20.3

    testgroup group tunnel ipsec-attributes

    pre-shared key *.

    !

    I got following output when I test connect to the ASA with Cisco VPN client 5.0

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: (4) SA (1) + KE + NUNCIO (10) + ID (5), HDR + VENDO

    4024 bytesR copied in 3,41 0 seconds (1341 by(tes/sec) 13) of the SELLER (13) seller (13) + the SELLER (13), as well as the SELLER (13) ++ (0) NONE total length: 853

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, SA payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ISA_KE

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, nonce payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received xauth V6 VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, DPD received VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received Fragmentation VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received NAT-Traversal worm 02 VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, the customer has received Cisco Unity VID

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, connection landed on tunnel_group testgroup

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA proposal # 1, turn # 9 entry overall IKE acceptable matches # 1

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build the payloads of ISAKMP security

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building ke payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building nonce payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for answering machine...

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of payload ID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of Cisco Unity VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing payload V6 VID xauth

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building dpd vid payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing the payload of the NAT-Traversal VID ver 02

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of Fragmentation VID + load useful functionality

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, send Altiga/Cisco VPN3000/Cisco ASA GW VID

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR SA (1) KE (4) NUNCIO (10) + ID (5) + HASH (8) + SELLER (13) + the SELLER (13) + the SELLER (13) + the SELLER (13) NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) total length: 440

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + HASH (8) + NOTIFY (11) + NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) overall length: 168

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, useful treatment IOS/PIX Vendor ID (version: 1.0.0 capabilities: 00000408)

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, the customer has received Cisco Unity VID

    Jan 16 15:39:21 [IKEv1]: Group = testgroup, I

    [OK]

    KenS-mgmt-012 # P = 10.15.200.108, status of automatic NAT detection: remote end is NOT behind a NAT device this end is NOT behind a NAT device

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 72

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 87

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, transformation MODE_CFG response attributes.

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = authorized

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = authorized

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized primary WINS

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized secondary WINS

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Compression IP = disabled

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling political = disabled

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: setting Proxy browser = no - modify

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: browser Local Proxy bypass = disable

    Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, (testlay) the authenticated user.

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 64

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + NONE (0) overall length: 60

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cfg ACK processing attributes

    Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 49ae1bb8) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 182

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, treatment cfg request attributes

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 address!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 network mask!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for DNS server address.

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the address of the WINS server.

    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, transaction mode attribute unhandled received: 5

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the banner!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting save PW!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: receipt of request for default domain name!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for Split-Tunnel list!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for split DNS!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for PFS setting!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Proxy Client browser setting!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the list of backup peer ip - sec!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting disconnect from the Client Smartcard Removal!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Version of the Application.

    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Type of Client: Windows NT Client Application Version: 5.0.07.0440

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for FWTYPE!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: request received for the DHCP for DDNS hostname is: DEC20128!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the UDP Port!

    Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

    Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = b04e830f) with payloads: HDR + HASH (8) + NOTIFY (11) + (0) NONE total length: 84

    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload

    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload

    Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE has received the response from type [] at the request of the utility of IP address

    Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cannot get an IP address for the remote peer

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE TM V6 WSF (struct & 0xd8030048) , : TM_DONE, EV_ERROR--> TM_BLD_REPLY, EV_IP_FAIL--> TM_BLD_REPLY NullEvent--> TM_BLD_REPLY, EV_GET_IP--> TM_BLD_REPLY, EV_NEED_IP--> TM_WAIT_REQ, EV_PROC_MSG--> TM_WAIT_REQ, EV_HASH_OK--> TM_WAIT_REQ, NullEvent

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE AM Responder WSF (struct & 0xd82b6740) , : AM_DONE, EV_ERROR--> AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL--> AM_TM_INIT_MODECFG_V6H NullEvent--> AM_TM_INIT_MODECFG, EV_WAIT--> AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG--> AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK--> AM_TM_INIT_XAUTH_V6H NullEvent--> AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b ending: 0x0945c001, refcnt flags 0, tuncnt 0

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending clear/delete with the message of reason

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing the payload to delete IKE

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 9de30522) with payloads: HDR HASH (8) + DELETE (12) + (0) NONE total length: 80

    Kind regards

    Lay

    For the RADIUS, you need a definition of server-aaa:

    Protocol AAA - NPS RADIUS server RADIUS

    AAA-server RADIUS NPS (inside) host 10.10.18.12

    key *.

    authentication port 1812

    accounting-port 1813

    and tell your tunnel-group for this server:

    General-attributes of VPN Tunnel-group

    Group-NPS LOCAL RADIUS authentication server

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • ODA IP ASA when you browse the web via remote access vpn

    Hi all

    I was wondering if it is possible to configure an ASA5510 in a way to allow users remote access VPN use external IP of the ASA when browsing the web. So what I'm looking for is a solution to hide my IP address and use the IP address of the ASA, when browsing.

    The firmware version of the ASA is 9.1 (6)

    Thanks in advance

    Hello

    What you want to achieve is calles u-turn.

    You must enable the feature allowed same-security-traffic intra-interface

    For the configuration of the asa, here's the Cisco documentation (I don't copy paste on the post):

    http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

    Thank you

    PS: Please do not forget to rate and score as good response if this solves your problem

  • remote access VPN not connected - no access inside

    Hi, I have successfully configured remote access VPN router, it is connected, but no access to the inside, none of my ip addresses. I do not know SPLIT_ACL is ok and I've denied NATting them. For me, everything is ok. I did a lot in ASA, without anyproblem. Thanks for the comments.

    enable secret 5 $1$ y0AJ$ rhrjbrpe5NDiAyHGlfeNi.

    !

    AAA new-model

    !

    !

    AAA authentication login bcc_users local

    AAA authorization bcc_group LAN

    !

    crypto ISAKMP policy 10

    BA aes

    preshared authentication

    Group 2

    !

    ISAKMP crypto client configuration group ra_vpn_bcc

    key *.

    DNS 8.8.8.8

    bcc.local field

    pool vpn_pool

    ACL SPLIT_ACL

    Max-users 7

    netmask 255.255.255.0

    !

    !

    Crypto ipsec transform-set RIGHT aes - esp esp-sha-hmac

    tunnel mode

    !

    !

    !

    Crypto-map dynamic dynmap 10

    Set transform-set RIGHT

    market arriere-route

    !

    !

    card crypto client CRYPTO_VPN of authentication list bcc_users

    card crypto isakmp authorization list bcc_group CRYPTO_VPN

    crypto card for the CRYPTO_VPN client configuration address respond

    map CRYPTO_VPN 10-isakmp ipsec crypto dynamic dynmap

    !

    !

    interface GigabitEthernet0/0/4

    IP address %.

    NAT outside IP

    auto negotiation

    BFD interval 50 50 5 min_rx multiplier

    card crypto CRYPTO_VPN

    !

    !

    IP local pool vpn_pool 172.31.255.0 172.31.255.250

    NAT extended IP access list

    deny ip 10.0.0.0 0.255.255.255 172.31.255.0 0.0.0.255

    deny ip 172.16.0.0 0.0.255.255 172.31.255.0 0.0.0.255

    deny ip 192.168.0.0 0.0.255.255 172.31.255.0 0.0.0.255

    IP address 172.16.0.0 allow 0.15.255.255 all

    IP 192.168.0.0 allow 0.0.255.255 everything

    IP 10.0.0.0 allow 0.255.255.255 everything

     

    SPLIT_ACL extended IP access list

    IP 10.0.0.0 allow 0.255.255.255 172.31.255.0 0.0.0.255

    IP address 172.16.0.0 allow 0.0.255.255 172.31.255.0 0.0.0.255

    IP 192.168.0.0 allow 0.0.255.255 172.31.255.0 0.0.0.255

    Take a look at the delivery.

    You do not have a route to the VPN pool on a nearby device.

  • Remote access VPN user permission

    Hi support them.

    It is a way for a remote access VPN to allow some users access to "Host A, B, C" and other users to access hosts D, E, F? Basically, we want to have some users have access at home to a few servers and other users have access only to some other servers. Is this possible without a GANYMEDE or some other device? Thank you guys!

    Hi John,.

    Yes, you can configure split tunneling to allow a specific group of users access to specific hosts.
    How this is achieved, it is that you create a connection profile different for different users, associate a policy group and the title of each group policy, you have a split tunnelling access-list defined with entries of different hosts.

    You must create 2 profiles of connection here and match them with 2-group policy allowing access to 2 differernt resources (they can be multiple as well)

    Here is a reference document: -.

    http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/100936-asa8x-split-tunnel-AnyConnect-config.html

    Kind regards
    Dinesh Moudgil

    PS Please rate helpful messages.

  • Configuring remote access VPN

    Hi all

    I need help with remote access vpn configuration. I want to some remote users who have access to the internet on their system to connect and access an application server in my seat social cisco vpn client user. I use Cisco 881. I am unable to use the SDM configuration because it seems that SDM is not supported by the router so I'm using command line. I'd appreciate any help I can get. Thank you.

    This is the configuration I have:

    VPNROUT #sho run
    Building configuration...

    Current configuration: 6832 bytes
    !
    ! Last configuration change at 10:50:45 UTC Saturday, May 30, 2015, by thomas
    version 15.2
    no service button
    horodateurs service debug datetime msec
    Log service timestamps datetime msec
    no password encryption service
    !
    hostname VPNROUT
    !
    boot-start-marker
    boot-end-marker
    !
    !
    logging buffered 51200 warnings
    !
    AAA new-model
    !
    !
    AAA authentication login default local
    AAA authentication login userauthen1 local
    AAA authorization groupauthor1 LAN
    !
    !
    !
    !
    !
    AAA - the id of the joint session
    iomem 10 memory size
    !
    Crypto pki trustpoint TP-self-signed-1632305899
    enrollment selfsigned
    name of the object cn = IOS - Self - signed - certificate - 1632305899
    revocation checking no
    rsakeypair TP-self-signed-1632305899
    !
    !
    TP-self-signed-1632305899 crypto pki certificate chain
    certificate self-signed 01
    3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
    2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
    69666963 31363332 33303538 6174652D 3939301E 170 3134 30313233 31323132
    33325A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
    4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 36333233 65642D
    30353839 3930819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
    8100BC0C 341CD79B A38572CE 1F0F9A91 F96B133C A889B564 E8352034 1CF5EE4B
    B505616B 6014041B EC498C0A F6C5CD2B F5BF62DA BD6E1C44 0C7B9089 1FD0C6E5
    299CEB40 28CD3F3B ADE3468A B07AAA9F AC42F0A7 4087172A 33C4013D 9A50884D
    5778727E 53A4940E 6E622460 560C F597DD53 3B 261584 E45E8776 A848B73D 5252
    92 50203 010001A 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355 D
    551 2304 18301680 14E85AD0 DEF133D8 E09516FD 0AA5FDAD E10EAB1A FA301D06
    03551D0E E85AD0DE 04160414 F133D8E0 9516FD0A A5FDADE1 0EAB1AFA 300 D 0609
    2A 864886 818100A 5 05050003 5B23ED5B 9A380E1F 467ABB03 BAB1070B F70D0101
    7A 218377 73089DC1 D32DA585 C5FD7ECE 0D000F96 7F3AB6CC 71509E8F 3F1C55AE
    E37536A3 1008FBF9 A29329D5 6F76DDC0 AA1C70AE 958AAE5D 32388BE4 2C1C6839
    0369 D 533 027B612C 8D199C35 C008FE00 F7E1DF62 9C73E603 85C3240A 63611D 93
    854A61E2 794F8EF5 DA535DCC B209DA
    quit smoking
    !
    !
    !
    no record of conflict ip dhcp
    DHCP excluded-address IP 10.10.10.1
    DHCP excluded-address IP 172.20.0.1 172.20.0.50
    !
    DHCP IP CCP-pool
    import all
    Network 10.10.10.0 255.255.255.248
    default router 10.10.10.1
    Rental 2 0
    !
    IP dhcp pool 1
    network 172.20.0.0 255.255.240.0
    domain meogl.net
    router by default - 172.20.0.1
    172.20.0.4 DNS server 41.79.4.11 4.2.2.2 8.8.8.8
    8 rental
    !
    !
    !
    no ip domain search
    IP domain name meogl.net
    name of the IP-server 172.20.0.4
    name of the IP-server 41.79.4.11
    IP-server names 4.2.2.2
    8.8.8.8 IP name-server
    IP cef
    No ipv6 cef
    !
    !
    license udi pid CISCO881-K9 sn FCZ1804C3SL
    !
    !
    username secret privilege 15 thomas 4 JXSizd1r/hMqPpGz94vKBb5somtpZLy03k50rJvHO6c
    username privilege 15 secret 4 mowe hlfv/rdDRCAeTUzRXbOIfdaKhJCl1onoGdaQeaQsAnw
    !
    !
    !
    !
    !
    !
    !
    crypto ISAKMP policy 1
    BA 3des
    preshared authentication
    Group 2
    !
    ISAKMP crypto client configuration group moweclients
    XXXXXXX key
    DNS 172.20.0.4
    meogl.net field
    pool mowepool
    !
    !
    Crypto ipsec transform-set esp-3des esp-sha-hmac moweset
    tunnel mode
    !
    !
    !
    Dynmap crypto dynamic-map 1
    Set transform-set moweset
    market arriere-route
    !
    !
    card crypto client mowemap of authentication list userauthen1
    card crypto isakmp authorization list groupauthor1 mowemap
    client configuration address card crypto mowemap answer
    mowemap 1 card crypto ipsec-isakmp dynamic dynmap
    !
    !
    !
    !
    !
    interface Loopback0
    IP 172.30.30.1 255.255.255.0
    IP nat inside
    IP virtual-reassembly in
    !
    interface FastEthernet0
    no ip address
    !
    interface FastEthernet1
    no ip address
    !
    interface FastEthernet2
    switchport access vlan 100
    no ip address
    !
    interface FastEthernet3
    no ip address
    !
    interface FastEthernet4
    IP 41.7.8.13 255.255.255.252
    NAT outside IP
    IP virtual-reassembly in
    intellectual property policy map route VPN-CLIENT
    Shutdown
    automatic duplex
    automatic speed
    mowemap card crypto
    !
    interface Vlan1
    Description $ETH_LAN$
    IP 10.10.10.1 255.255.255.248
    IP tcp adjust-mss 1452
    !
    interface Vlan100
    IP 172.20.0.1 255.255.240.0
    IP nat inside
    IP virtual-reassembly in
    !
    local pool IP 192.168.1.1 mowepool 192.168.1.100
    IP forward-Protocol ND
    IP http server
    23 class IP http access
    local IP http authentication
    IP http secure server
    IP http timeout policy slowed down 60 life 86400 request 10000
    !
    IP nat inside source overload map route interface FastEthernet4 LAT
    IP route 0.0.0.0 0.0.0.0 41.7.8.12
    !
    access-list 23 allow 10.10.10.0 0.0.0.7
    access-list 23 allow 172.20.0.0 0.0.15.255
    access-list 100 permit ip 172.20.0.0 0.0.15.255 everything
    access-list 144 allow ip 192.168.1.0 0.0.0.255 any
    not run cdp
    !
    LAT route map permit 1
    corresponds to the IP 100
    IP 41.7.8.12 jump according to the value
    !
    route VPN-CLIENT map permit 1
    corresponds to the IP 144
    !
    Line con 0
    no activation of the modem
    line to 0
    line vty 0 4
    access-class 23 in
    privilege level 15
    transport input telnet ssh
    line vty 5 15
    access-class 23 in
    privilege level 15
    transport input telnet ssh
    !
    !
    end

    Please the configuration above, give me the desired output.

    Thank you.

    Hello Thomas,.

    I'm glad to hear that you have found useful in the example configuration.

    I checked your configuration and everything seems ok with him, especially the statements of nat.

     ip local pool mowepool 192.168.1.1 192.168.1.100 access-list 100 deny ip 172.20.0.0 0.0.15.255 192.168.1.0 0.0.0.255 access-list 100 permit ip 172.20.0.0 0.0.15.255 any route-map LAT permit 1 match ip address 100 ip nat inside source route-map LAT interface FastEthernet4 overload interface Vlan100 ip address 172.20.0.1 255.255.240.0 ip nat inside ip virtual-reassembly in 

    Try to generate ICMP traffic behind your 100 VLANS to the client VPN in order to answer the following questions:

    -The router receives this traffic between VLAN100 unit?

    -The router is encrypt this traffic, after receiving the ICMP packet?

    #show crypto ipsec router its can help you with this question. Look for the program/decaps counters.

    -The same, but the other way around (from VPN client to device behind VLAN100) try to locate the problem.

    The following document explains more this crypto commands and debugs if necessary.

    http://www.Cisco.com/c/en/us/support/docs/security-VPN/IPSec-negotiation-IKE-protocols/5409-IPSec-debug-00.html#iosdbgs

  • ASA remote access VPN cleaning

    Experts,

    I have about three or four remote access VPN that must be removed from my ASA. What is the best way to ensure that I remove all configurations of the ASA? Thank you. Best.

    Hi Thomas,

    You can run the command "clear configure vpn" to clear some vpn commands, if you do not have all the certificates or site to site, you can run the command "claire configure crypto" and remove any command associated crypto.

    Rate if helps.

    -Randy-

  • Remote access VPN fails after upgrading to 8.04

    Hello:

    Sorry if this has been posted, but I couldn't find it anywhere.

    After the upgrade of my 2 of my 5510 s to 8.04, my remote access VPN does not work. I can connect via Radius without problem. Once connected, I can't do anything on the network. When I try to telnet to any device, I get a white screen with no response. As it is to find the device but it does not. E-mail, intranet, nothing works. Seems to be time. I tried to upgrade to the latest version of Windows Client, still no go.

    Everyone knows this at all? Any help appreciated.

    TIA,

    Brad

    I saw the same problem after upgrading to 8.0.4. And it is caused by the "IP Compression" option enabled in group policy. After deactivation, it works. Cisco has just completed this bug recently:

    http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsu26649

    Zhenning

Maybe you are looking for