L2l Tunnel between 2POIGNEES: general query on ACL sheep/crypto
Hi all
For the L2L tunnel between 2POIGNEES work very well, we configure normally same network to network - sheep & cryptos ACL on both ends of the SAA. My question is...
It will work without any problem, if on one end of the ASA, the ACL sheep & crypto are combined to form the group object (to limit the ASA configs) and on the other end address net net address ACL sheep & crypto still exists (not consolidated in the Group of objects)... ? If it works, it works even if the tunnel is between ASA--> router.
Thanks in advance
MS
MS, it will work if the other side does not use the same scenario of acl consolidated using groups of objects. ACLs and groups of objects are significant locally on the device.
You can consolidate the ACLs on the ASA/PIX using TCP or UDP-groups of objects or groups of objects network and that your acl to the respective object-group, they always have the same effect as when they have been configured individually line by line.
This works even if the tunnel is between ASA--> router
Yes
HTH
Jorge
Tags: Cisco Security
Similar Questions
-
L2l Tunnel upward, without traffic transits
Two 5505 ASA s for the main site of a customer and a local office. I have the tunnel upward. But I am unable to pass traffic through it. I thought I got it, but it turns out I was wrong so I'll let the pros have to him. Thank you!
Main site:
ASA Version 7.2 (4)
!
City of hostname
activate iNbSyJZ1ffmb9kn1 encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.100.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address 24.x.x.97 255.255.255.248
!
interface Vlan3
prior to interface Vlan1
nameif dmz
security-level 50
no ip address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS server-group DefaultDNS
outside_in list extended access permit tcp any host 24.x.x.98 eq 3389
outside_in list extended access permit udp any host 24.x.x.98 eq 1194
outside_in list extended access permit tcp any host 24.x.x.98 eq www
extended vpn 192.168.100.0 ip access list allow 255.255.255.0 192.168.199.0 255.255.255.0
extended vpn 192.168.100.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0
outside_1_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
Enable logging
timestamp of the record
exploitation forest-size of the buffer of 100000
recording of debug console
debug logging in buffered memory
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
MTU 1500 dmz
IP local pool vpnpool 192.168.199.10 - 192.168.199.20
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 524.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access vpn
NAT (inside) 1 192.168.100.0 255.255.255.0
public static 24.x.x.98 (Interior, exterior) 192.168.100.3 netmask 255.255.255.255
Access-group outside_in in external interface
Route outside 0.0.0.0 0.0.0.0 24.x.x.102 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
AAA authentication enable LOCAL console
AAA authentication http LOCAL console
the ssh LOCAL console AAA authentication
Enable http server
http 192.168.100.0 255.255.255.0 inside
http 192.168.100.50 255.255.255.255 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
card crypto outside_map 1 match address outside_1_cryptomap
card crypto outside_map 1 set pfs
card crypto outside_map 1 set 24.x.x.54 counterpart
map outside_map 1 set of transformation-ESP-3DES-MD5 crypto
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 20
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
3des encryption
md5 hash
Group 1
life 86400
Telnet 0.0.0.0 0.0.0.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 inside
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 60
Console timeout 0
attributes of Group Policy DfltGrpPolicy
No banner
WINS server no
DNS server no
DHCP-network-scope no
VPN-access-hour no
VPN - connections 3
VPN-idle-timeout 30
VPN-session-timeout no
VPN-filter no
Protocol-tunnel-VPN IPSec l2tp ipsec webvpn
disable the password-storage
disable the IP-comp
Re-xauth disable
Group-lock no
enable PFS
IPSec-udp disable
IPSec-udp-port 10000
Split-tunnel-policy tunnelall
Split-tunnel-network-list no
by default no
Split-dns no
Disable dhcp Intercept 255.255.255.255
disable secure authentication unit
disable authentication of the user
user-authentication-idle-timeout 30
disable the IP-phone-bypass
disable the leap-bypass
disable the NEM
Dungeon-client-config backup servers
MSIE proxy server no
MSIE-proxy method non - change
Internet Explorer proxy except list - no
Disable Internet Explorer-proxy local-bypass
disable the NAC
NAC-sq-period 300
NAC-reval-period 36000
NAC-by default-acl no
address pools no
enable Smartcard-Removal-disconnect
the firewall client no
rule of access-client-none
WebVPN
url-entry functions
HTML-content-filter none
Home page no
4 Keep-alive-ignore
gzip http-comp
no filter
list of URLS no
value of customization DfltCustomization
port - forward, no
port-forward-name value access to applications
SSO-Server no
value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information
SVC no
SVC Dungeon-Installer installed
SVC keepalive no
generate a new key SVC time no
method to generate a new key of SVC no
client of dpd-interval SVC no
dpd-interval SVC bridge no
deflate compression of SVC
tunnel-group 24.x.x.54 type ipsec-l2l
24.x.x.54 group of tunnel ipsec-attributes
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:5180fc35fcb77dbf007b34bc2159c21b
: end
# Sh crypto isa city its
ITS enabled: 1
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 1
1 peer IKE: 24.x.x.54
Type: L2L role: initiator
Generate a new key: no State: MM_ACTIVE
# Sh crypto ipsec city its
Interface: outside
Tag crypto map: outside_map, seq num: 1, local addr: 24.x.x.97
outside_1_cryptomap 192.168.100.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.100.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 24.x.x.54
#pkts program: 56, #pkts encrypt: 56, #pkts digest: 56
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 56, #pkts comp failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0
local crypto endpt. : 24.x.x.97, remote Start crypto. : 24.x.x.54
Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
current outbound SPI: 16409623
SAS of the esp on arrival:
SPI: 0xFC3F0652 (4231988818)
transform: esp-3des esp-md5-hmac no
running parameters = {L2L, Tunnel, PFS 2 group}
slot: 0, id_conn: 21, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (4275000/28514)
Size IV: 8 bytes
support for replay detection: Y
outgoing esp sas:
SPI: 0 x 16409623 (373331491)
transform: esp-3des esp-md5-hmac no
running parameters = {L2L, Tunnel, PFS 2 group}
slot: 0, id_conn: 21, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (4274996/28514)
Size IV: 8 bytes
support for replay detection: Y
Remote Desktop:
ASA Version 8.2 (5)
!
water host name
activate rAAeK7vz0gtMeIgU encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
name 192.168.100.0 City City LAN description
DNS-guard
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.2 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address 24.x.x.54 255.255.255.248
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS server-group DefaultDNS
outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 255.255.255.0 city
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 255.255.255.0 city
pager lines 24
Enable logging
timestamp of the record
exploitation forest-size of the buffer of 32768
logging asdm-buffer-size 512
Monitor logging notifications
debug logging in buffered memory
logging trap notifications
notifications of logging asdm
Within 1500 MTU
Outside 1500 MTU
IP local pool water 192.168.1.15 - 192.168.1.20 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
NAT (inside) 0-list of access inside_nat0_outbound
Route outside 0.0.0.0 0.0.0.0 24.x.x.49 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
AAA authentication LOCAL telnet console
the ssh LOCAL console AAA authentication
AAA authentication enable LOCAL console
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
card crypto outside_map 1 match address outside_1_cryptomap
card crypto outside_map 1 set pfs
card crypto outside_map 1 set 24.x.x.97 counterpart
map outside_map 1 set of transformation-ESP-3DES-MD5 crypto
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
Crypto ca trustpoint _SmartCallHome_ServerCA
Configure CRL
Crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018
481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
6c2527b9 deb78458 c61f381e a4c4cb66
quit smoking
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 20
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
3des encryption
md5 hash
Group 1
life 86400
No encryption isakmp nat-traversal
Telnet 192.168.1.0 255.255.255.0 inside
Telnet timeout 60
SSH 192.168.1.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
dhcpd outside auto_config
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
attributes of Group Policy DfltGrpPolicy
Group internal water policy
attributes of group water policy
value of 192.168.1.1 DNS server
VPN-idle-timeout no
VPN-session-timeout no
Protocol-tunnel-VPN IPSec
attributes of Registrar username
VPN-group-policy DfltGrpPolicy
type water tunnel-group remote access
water General attributes tunnel-group
water of the pool address
Group Policy - by default-water
DHCP server 192.168.1.1
water ipsec-attributes tunnel-group
pre-shared key *.
tunnel-group 24.x.x.97 type ipsec-l2l
24.x.x.97 group of tunnel ipsec-attributes
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname
anonymous reporting remote call
Cryptochecksum:06bda38461d2419b3e5c4904333b62e7
: end
# sh crypto isa water his
ITS enabled: 1
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 1
1 peer IKE: 24.x.x.97
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE
water # sh crypto ipsec his
Interface: outside
Tag crypto map: outside_map, seq num: 1, local addr: 24.x.x.54
outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.100.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (Town/255.255.255.0/0/0)
current_peer: 24.x.x.97
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 78, #pkts decrypt: 78, #pkts check: 78
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0
local crypto endpt. : 24.x.x.54, remote Start crypto. : 24.x.x.97
Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
current outbound SPI: FC3F0652
current inbound SPI: 16409623
SAS of the esp on arrival:
SPI: 0 x 16409623 (373331491)
transform: esp-3des esp-md5-hmac no compression
running parameters = {L2L, Tunnel, PFS 2 group}
slot: 0, id_conn: 126976, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3914995/28408)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0xFC3F0652 (4231988818)
transform: esp-3des esp-md5-hmac no compression
running parameters = {L2L, Tunnel, PFS 2 group}
slot: 0, id_conn: 126976, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3915000/28408)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
Thanks again!
In addition,
Now that I actually think...
The original ICMP you did would go as follows
- 192.168.100.x send ICMP messages to echo
- Happens on ASA local
- Gets sent through the VPN L2L connection
- Arrives on the ASA remote
- ASA forwards traffic on the LAN Host 192.168.1.x
- LAN forward host to respond to its default gateway 192.168.1.1 (NOT ASA)
- ICMP Echo traffic gets lost because of no real route for the return traffic
- Therefore, you see no encapsulated traffic to destination, ASA, decapsules only traffic that origin of the host that sends the ICMP messages to echo through the VPN L2L
-Jouni
-
VPN tunnel between the concentrator 3005 and router Cisco 827
I am trying to establish a VPN tunnel between the Central Office with VPN 3005 and controller branch Cisco 827 router.
There is a router of perimeter with access set up in front of the 3005 list.
I quote the ACLs on the Central perimeter router instructionsuivante to allow traffic to permit ip 3005 - acl 101 all 193.188.X.X (address of the hub)
I get the following message appears when I try to ping a local host in the Central site.
Can Anyoune give me the correct steps to 827 and 3005.
Thank you
CCNP Ansar.
------------------------------------------------------------------------------------------------------
Debug crypto ISAKMP
encryption of debugging engine
Debug crypto his
debug output
------------------
1d20h: IPSEC (sa_request):,.
(Eng. msg key.) Local OUTGOING = 172.22.113.41, distance = 193.188.108.165.
local_proxy = 202.71.244.160/255.255.255.240/0/0 (type = 4),
remote_proxy = 128.128.1.78/255.255.255.255/0/0 (type = 1),
Protocol = ESP, transform = esp - esp-md5-hmac.
lifedur = 3600 s and KB 4608000,
SPI = 0x83B8AC1B (2209917979), id_conn = 0, keysize = 0, flags = 0x400D
1d20h: ISAKMP: ke received message (1/1)
1d20h: ISAKMP: 500 local port, remote port 500
1d20h: ISAKMP (0:1): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
Former State = new State IKE_READY = IKE_I_MM1
1d20h: ISAKMP (0:1): early changes of Main Mode
1d20h: ISAKMP (0:1): lot of 193.188.108.165 sending (I) MM_NO_STATE
1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE...
1d20h: ISAKMP (0:1): will increment the error counter on his: retransmit the phase 1
1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE
1d20h: ISAKMP (0:1): lot of 193.188.108.165 sending (I) MM_NO_STATE
1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE...
1d20h: ISAKMP (0:1): will increment the error counter on his: retransmit the phase 1
1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE
1d20h: ISAKMP (0:1): lot of 193.188.108.165 sending (I) MM_NO_STATE
1d20h: IPSEC (key_engine): request timer shot: count = 1,.
You must also allow the esp Protocol in your ACL.
access-list 101 permit esp any host x.x.x.x (address of the hub)
Hope this helps,
-Nairi
-
Making the NAT for VPN through L2L tunnel clients
Hi.I has the following situation in my network. We need for users who log on our site with the VPN clients to connect to another site via a tunnel L2L. The problem is that I need NAT addresses from the pool of VPN client in another beach before going on the L2L tunnel because on the other side, we have duplication of networks.
I tried to do NAT with little success as follows:
ACL for pool NAT of VPN:
Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.0.0 255.255.255.0
Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.5.0 255.255.255.0
NAT:
Global 172.20.105.1 - 172.20.105.254 15 (outdoor)
NAT (inside) 15 TEST access-list
CRYPTO ACL:
allowed ro access list extended LAN ip 255.255.0.0 192.168.0.0 255.255.255.0
allowed ro access list extended LAN ip 255.255.0.0 192.168.5.0 255.255.255.0
IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.0.0 255.255.255.0
IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.5.0 255.255.255.0
permit same-security-traffic intra-interface
Am I missing something here? Something like this is possible at all?
Thanks in advance for any help.
We use the ASA 5510 with software version 8.0 (3) 6.
You need nat to the outside, not the inside.
NAT (outside) 15 TEST access-list
-
VPN-> ASA1 < - l2l Tunnel - > client-> Service ASA2 will not work?
Hello
I have spent a lot of time with this problem, but I have not found a working configuration. I sound so simple, but nothing seems to work.
We have a Site 2 Site tunnel established between two ASA 5505, in the network 'ASA2, 192.168.33.0/24' a terminal server server is located.
A warrior of the road the VPN user connects to the network 'ASA1, 192.168.0.0/24' using the Cisco VPN Client. It is able to connect to its network services, but not the services that are found in the ASA2 network. The log file is clean, without drops.
The client shows stats both networks secure routes.
I'm blind for the solution, or is this not possible?
Someone has an int for me?
Best regards
Markus
Looks like you need to configure 192.168.0.0/24 within the field of encryption for the tunnel between ASA 1 with the ASA2 L2L.
You must configure the user of warrior to also encrypt the traffic to the ASA2 network.
You must activate the same communication intra-interface security, so that traffic can enter ASA 1, then let ASA 1 ASA 2 on the same outside the interface.
HTH >
-
How to set up a one-way IPSec-L2L tunnel
This may be a silly question, since VPN for communications between the parties of confidence and that most people would try to correct a unidirectional tunnel.
But I'm interested to transform a regular one-way only, tunnel that traffic to my side can initiate the tunnel.
Recently, we built this tunnel between our ASA5510 and ASA5510 of our biz partner to run critical applications on their web servers not connected to the Internet. I want to tie down so that they cannot launch the VPN. I have the crypto ACL set to limit to a port address, so they can only come from this port once the tunnel is established. We also have a personal firewall installed on each host.
Any idea on how to make the one-way tunnel and protect also us better once the tunnel is mounted?
Hello
You can use the following command:
defined card crypto seq - num connection-type name {only answer | only | two-way}
This command defines whether the tunnel is come only or single answer. If you set the tunnel on your side to come alone, the asa will never accept the installation of tunnel from your business partner. However, you can still start the configuration of the vpn tunnel.
Check:
http://www.Cisco.com/en/us/partner/docs/security/ASA/asa80/command/reference/C5.html#wp2152576
Even if the reference is to ASA8.0 I know it works for 7.2.x so
Hope this helps
Kind regards
Pieter-Jan
-
Help with a VPN tunnel between ASA 5510 and Juniper SSG20
Hello
We have a customer wanting to configure a VPN Site to Site tunnel between a new purchased 5510 of ASA located in his direction with its Juniper SSG20 Office, located in the main office. We contacted HP and they send us a Cisco professional to do the job.
After 2 days from 16:00 to 22:00 and error and countless hours of research online and nunerous calls, we are still unable to get traffic from the network of agencies to enter the tunnel.
Main branch
1.1.1.2 1.1.1.1
----- -----------
192.168.8.0/24 | ASA|-----------------------------------| Juniper | 192.168.1.0/24
----- -----------
192.168.8.254 192.168.1.254According to Cisco professionals, the tunnel is now in place but no traffic through. We are unable to ping anything on the network on the other side (192.168.1.0/24). We receive timeout ping all the time. The Cisco professional told us it's a routing or NAT problem and he's working on a solution!
Through research, I came across a post on Experts-Exchange (here) [the 1st comment on the original post] which States "...". that both sides of the VPN must have a different class of LAN for the VPN to work... " Would that be our problem?
It has become a critical issue to the point that he had to replace the Cisco ASA with a temporary Juniper SSG5 on another subnet (192.168.7.0/24) to get the tunnel upward and through traffic until the ASA VPN issue is resolved and I didn't need to say that the client is killing us!
Help is very appreciated.
Thank you
1. Yes, ping package from the interface of the ASA is considered valuable traffic to the LAN of Juniper.
SAA, need you traffic from the interface source ASA's private, because interesting to determine by crypto ACL MYLIST traffic between 192.168.8.0/24 and 192.168.1.0/24.
You will also need to add the following configuration to be able to get the ping of the interface of the ASA:
management-private access
To initiate the ping of the private interface ASA:
ping 192.168.1.254 private
2. the default time before the next generation of new key is normally 28800 seconds, and if there is no interesting traffic flowing between 2 subnets, he'll tear the VPN tunnel down. As soon as there is interesting traffic, the VPN tunnel will be built automatically into the next generation of new key. However, if there is traffic before generating a new key, the new tunnel will be established, and VPN tunnel will remain standing and continue encrypt and decrypt traffic.
Currently, your configuration has been defined with ITS lifetime of 3600 seconds GOLD / 4608000 kilobytes of traffic before the next generate a new key (it will be either 3600 seconds, or 4608000 kilobytes period expires first). You can certainly change it by default to 28800 seconds without configuring kilobytes. SA life is negotiated between the ASA and Juniper, and whatever is the lowest value will be used.
Hope that helps.
-
In preferences, search option is missing between the general and the content.
I use Firefox 40.0.3 on OSX and I tried to set the search parameters. When I go into Preferences, I don't see the search catgergory. If I remember correctly there used to be between the general and the content, but it just disappeared. I was wondering if there is a way to recover or if these options have been moved to another location in the new version.
I restarted Firefox in safe mode to disable all addons. It is not yet here.
You have disabled browser.search.showOneOffButtons [set this pref to false] in Subject: config?
Enter about: config in the URL bar and press ENTER. then use the search box at top.Options > Search "tab" disappears when this pref is toggled to false. Search preferences back to the old system where the 'controls' are in the search bar - manage search... engines such as those used before Firefox 34.
-
IPSec tunnel between a client connection mobility and WRV200
Someone has set up an IPSec tunnel between a client connection mobility and WRV200? I can't get the right configuration.
Agitation, these products are treated by the Cisco Small Business support community. Please refer to the URL: https://supportforums.cisco.com/community/netpro/small-business
-
Expertise of expensive
Recently we hava configured vpn tunnel between two locations. Want to create a tunnel vpn on a third location. What configuration will be valid on the version of firewall cisco PIX 501 6.3.4.
Please see thr existing pix config at two location.
Please post the latest config?
-
Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers
Hello world
I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).
I created a tunnel interfaces on both routers as follows.
2620XM
interface Tunnel0
IP 10.1.5.2 255.255.255.252
tunnel source x.x.x.x
tunnel destination y.y.y.y
end
836
interface Tunnel0
IP 10.1.5.1 255.255.255.252
tunnel source y.y.y.y
tunnel destination x.x.x.x
end
and configuration of isakmp/ipsec as follows,
2620XM
crypto ISAKMP policy 10
md5 hash
preshared authentication
ISAKMP crypto key {keys} address y.y.y.y no.-xauth
!
!
Crypto ipsec transform-set esp - esp-md5-hmac to_melissia
!
myvpn 9 ipsec-isakmp crypto map
defined peer y.y.y.y
Set transform-set to_melissia
match address 101
2620XM-router #sh ip access list 101
Expand the access IP 101 list
10 permit host x.x.x.x y.y.y.y host will
836
crypto ISAKMP policy 10
md5 hash
preshared authentication
ISAKMP crypto key {keys} address x.x.x.x No.-xauth
!
!
Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi
!
myvpn 10 ipsec-isakmp crypto map
defined peer x.x.x.x
Set transform-set to_metamorfosi
match address 101
836-router #sh access list 101
Expand the access IP 101 list
10 licences will host host x.x.x.x y.y.y.y
Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.
CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.
Any ideas why I get this result? Any help will be a great help
Thank you!!!
I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.
As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:
card crypto-address
so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.
HTH
Rick
-
IPSEC tunnel between 2 7606 PE
I am creating an IPSec tunnel between two 7606 PE routers... get this error when I ping everywhere and if I start using the path descends LDP.
12 Nov 16:32:22.801 IS: IPSEC (key_engine): request timer shot: count = 1,.
local (identity) = 10.10.135.1, distance = 10.10.135.2.
local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),
remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)
12 Nov 16:32:22.801 IS: IPSEC (sa_request):,.
(Eng. msg key.) Local OUTGOING = 10.10.135.1, distance = 10.10.135.2.
local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),
remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),
Protocol = ESP, transform = NONE (Tunnel),
lifedur = 190 s and 4608000 Ko,.
SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0
12 Nov 16:32:22.801 IS: ISAKMP: (0): profile of ITS application is test
12 Nov 16:32:22.801 IS: ISAKMP: created a struct peer 10.10.135.2, peer port 500
12 Nov 16:32:22.801 IS: ISAKMP: new position created post = 0x5326A08C peer_handle = 0x8000001A
12 Nov 16:32:22.801 IS: ISAKMP: lock struct 0x5326A08C, refcount 1 to peer isakmp_initiator
12 Nov 16:32:22.801 IS: ISAKMP: 500 local port, remote port 500
12 Nov 16:32:22.801 IS: ISAKMP: impossible to allocate IKE SA
12 Nov 16:32:22.801 IS: ISAKMP: Unlocking counterpart struct 0x5326A08C for isadb_unlock_peer_delete_sa(), count 0
12 Nov 16:32:22.801 IS: ISAKMP: delete peer node by peer_reap for 10.10.135.2: 5326A08C
12 Nov 16:32:22.801 IS: ISAKMP: (0): purge SA., his = 0, delme = 532E8364
PE2 #.
12 Nov 16:32:22.801 IS: ISAKMP: error during the processing of HIS application: failed to initialize SA
12 Nov 16:32:22.801 IS: ISAKMP: error while processing message KMI 0, error 2.
12 Nov 16:32:22.801 IS: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
PE2 #.
12 Nov 16:32:52.801 IS: IPSEC (key_engine): request timer shot: count = 2,.
local (identity) = 10.10.135.1, distance = 10.10.135.2.
local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),
remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)
IPsec only is not supported on the 6500 and 7600 without module series IPsec (IPsec-SPA or VPNSM), sorry.
-
I get the error message on debugging ipsec-l2l tunnel
Hello
Can someone help me understand the debug message?
I get the error message on debugging ipsec-l2l tunnelI tried to configure an ASA5520 with an ipsec-l2l to ios router 1721
= 1721 router =.
Cisco 1721 (flash: c1700-k9o3sy7 - mz.123 - 2.XC2.bin)
80.89.47.102 outside
inside 10.100.110.1 255.255.255.0Debug crypto ipsec
Debug crypto ISAKMP-config-
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
0 1234567890 128.39.189.10 crypto isakmp key address
!
!
Crypto ipsec transform-set esp-3des pix-series
!
ASA 10 ipsec-isakmp crypto map
defined by peer 128.39.189.10
transform-set pix - Set
match address 101
!
!
interface FastEthernet0Outside-interface description
IP 80.89.47.102 255.255.255.252
NAT outside IP
card crypto asa
!
interface Vlan10
Inside description
IP 10.100.110.1 255.255.255.0
IP nat inside!
!
IP nat inside source overload map route interface FastEthernet0 sheep
!
access-list 101 permit ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255
!
access-list 110 deny ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255
access-list 110 permit ip 10.100.110.0 0.0.0.255 any
!
sheep allowed 10 route map
corresponds to the IP 110
!= Config ASA =.
Cisco 5520 ASA Version 8.2 (1)
128.39.189.10 outside
inside 10.100.4.255 255.255.252.0Debug crypto ipsec
Debug crypto ISAKMP-Config-
!
Allow Access-list extended sheep 255.255.252.0 IP 10.100.4.0 10.100.110.0 255.255.255.0
!
access extensive list ip 10.100.4.0 outside110 allow 255.255.252.0 10.100.110.0 255.255.255.0
!Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
86400 seconds, duration of life crypto ipsec security association
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto outside_map 11 match address outside110
peer set card crypto outside_map 11 80.89.47.102
card crypto outside_map 11 game of transformation-ESP-3DES-MD5
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400!
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
Protocol-tunnel-VPN IPSec!
tunnel-group 80.89.47.102 type ipsec-l2l
IPSec-attributes tunnel-group 80.89.47.102
pre-shared key 1234567890Concerning
TorYou have a transformation defined on the SAA named ESP-3DES-MD5? Your crypto card refers to that but I don't see it listed in the config you have posted. I don't have much experience with routers, but is MD5 hashing algoritm (and why it is not)?
James
-
1 single MPLS tunnel between routers directly connected. Traffic routes and others not?
Hello
I have a unusual problem, I can not explain.
I have a simple scenario
LAN1 = 4500 = OSPF = R1_6500 = OSPF = R2_6500 = tunnel mpls TE with Highway = R3_2900 = 1900 = LAN2
1 enable MPLS TE tunnel between the Router R2 6500 and 2900 router
2. everything is ok until I have activate the router R3 2900 highway. LAN1 can reach the printers in Lan2 via the web. ŒUVRES of ICMP in all CASES!, however, (172 bytes) ICMP packets generated by the Solarwinds network browser find only 30% of the Lan2 network...
Once you turn off highway on 2900, it works normally...
3. I have the implicit null label on 2900 and R2 6500 (if I activate highway on two tunnels), CEF seems to be ok, OSPF routes are present, however, some of the traffic simply does not pass through
4. I have it fixed construction of a second tunnel of 2900 to 6500 R1 and it works well, but I don't understand what in fact behave this way?
Hello Vadym,
Perfect :)
Why should I activate targeted Hello
[Akash]
Connected nondirectly MPLS LDP sessions
The DSL is more than one bond of his neighbor, if non-connected directly to his neighbor. For these nondirectly neighbors connected, DSL text Hello targeted as a UDP packet, but as a message specifically addressed to this DSL unicast. DSL connected nondirectly meets the Hello message and the two routers are starting to establish an LDP session. This is the so-called scope of discovery.
The default behavior of an LSR is to ignore the other DSL applications that send targeted messages to Hello. You can configure a DSL to meet the demands of targeted Hello messages by publishing the discovery ldp targeted Hello mpls accept small order.
Why do you think that the LSP is broken, if we do not use the LDP
[Akash] If LDP is not enabled on the tunnel, R2 will not any label R3 on the tunnel interface broadcast and R3 sends the traffic untagged to R2 [only rsvp label which is implicit null], and ip lookup will happen on R2, so this is not end-to-end LSP. If ip loopup happening on the router of the base, I would say that LSP is broken here. But if LDP is enabled on the tunnel, R2 will announce a local label R3 more targeted LDP session. L3 will send labeled package [implicit null for RSVP, label IGP announced by R2] R2 and R2 will make label swapping and send traffic to R1. All the way labels switching and LSP is intact.
If it would have been scenario L3vpn, traffic would have been blackholed on router core cases get end of tunnel. In your case all core routers have routes with destination so accessibility is there but LSP divided again.
Kind regards
Assani
-
Public static IPsec tunnel between two routers cisco [VRF aware]
Hi all
I am trying to configure static IPsec tunnel between two routers. Router R1 has [no VRF] only global routing table.
Router R2 has two routing tables:
* vrf INET - used for internet connectivity
* global routing table - used for VPN connections
Here are the basic configs:
R1
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
ISAKMP crypto key 7V7u841k2D3Q7v98d6Y4z0zF address 203.0.0.3
invalid-spi-recovery crypto ISAKMP
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
transport mode
!
Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
game of transformation-TRSET_AES-256_SHA
!
interface Loopback0
10.0.1.1 IP address 255.255.255.255
IP ospf 1 zone 0
!
interface Tunnel0
IP 192.168.255.34 255.255.255.252
IP ospf 1 zone 0
source of tunnel FastEthernet0/0
tunnel destination 203.0.0.3
ipv4 ipsec tunnel mode
Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
!
interface FastEthernet0/0
IP 102.0.0.1 255.255.255.0!
IP route 203.0.0.3 255.255.255.255 FastEthernet0/0 102.0.0.2
#######################################################
R2
IP vrf INET
RD 1:1
!
Keyring cryptographic test vrf INET
address of pre-shared-key 102.0.0.1 key 7V7u841k2D3Q7v98d6Y4z0zF
!
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
invalid-spi-recovery crypto ISAKMP
crypto isakmp profile test
door-key test
function identity address 102.0.0.1 255.255.255.255
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
transport mode
!
Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
game of transformation-TRSET_AES-256_SHA
Test Set isakmp-profile
!
interface Loopback0
IP 10.0.2.2 255.255.255.255
IP ospf 1 zone 0
!
interface Tunnel0
IP 192.168.255.33 255.255.255.252
IP ospf 1 zone 0
source of tunnel FastEthernet0/0
tunnel destination 102.0.0.1
ipv4 ipsec tunnel mode
tunnel vrf INET
Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
!
interface FastEthernet0/0
IP vrf forwarding INET
IP 203.0.0.3 255.255.255.0!
IP route 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2
#######################################################
There is a router between R1 and R2, it is used only for connectivity:
interface FastEthernet0/0
IP 102.0.0.2 255.255.255.0
!
interface FastEthernet0/1
IP 203.0.0.2 255.255.255.0The problem that the tunnel is not coming, I can't pass through phase I.
The IPsec VPN are not my strength. So if someone could show me what mistake I make, I'd appreciate it really.
I joined ouptup #debug R2 crypto isakmp
Source and destination Tunnel0 is belong to VRF INET, the static route need to be updated.
IP route vrf INET 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2
crypto isakmp profile test
VRF INET
door-key test
function identity address 102.0.0.1 255.255.255.255
Maybe you are looking for
-
Firefox not sites load. The charging symbol still turns but nothing happens. No problem with Safari
Since one day Firefox cannot load Web sites. It takes about 5 minutes to load a site.But I don't have the patience, so I use Safari, which works well. but I prefer to use Firefox
-
Bad Partition on external hard drive: format the bad Partition or format the entire disk?
I am confused how to proceed. I have an external hard drive 3 TB with partitions (3). One of the parititons cannot be verified. I saved the partition and tried to repair disk. Repair disk failed and invited me to reformat the hard drive. How can I re
-
Re: Battery of short duration on Portege Z30-A-1E1
Hello I bought the Z30 A 1e1 Portege in December, but the battery's performance seem to be reduced in just two months. Indeed, now the battery saving mode life is about 4 hours from 6: 00 to about a month ago (toshiba says until 10: 00 but 4 h mode e
-
Can I use my 600-1050 as a monitor for a desktop PC?
If I had to buy a desktop computer, it would be possible to use my TouchSmart 600-1050 as his monitor? How would I do that? Thank you! Howard
-
I can not get an automatic update to market.
I ran malware and registry programs, but nothing has solved the problem.