Limitation with the number of entries in a Tunnel of Split ACL

Hey Cisco community!

I am facing a problem with a Cisco hub and spoke to the solution.

We have 2 Hubs (Cisco 7200-2 for redudancy). All clients have a RADIUS (Cisco 881). The rays are 24/24 reported the 2 hubs (2 dmvpn tunnel) to give us access to our monitoring and support equipment.

Each talk have a NAT table with a specific NAT range for each talk. That way, we can reach every devices with a single IP address within the VPN.

For example:

-Spoke_001 have a range of IP NAT 10.80.0.0 255.255.254.0

-Spoke_002 have a range of IP NAT 10.80.2.0 255.255.254.0

...

To connect to hubs with our mobile phones, we use the Cisco VPN client. We have different profiles created in the regional centres:

-Profile Admin with an ACL that allow connectivity with each talk

-Integrator profiles: which allow connectivity to an integrator to some defined rays.

So the integrating profile looks like this in the hub

Configuration group customer crypto isakmp [NAME]

Touch [password]

[domain]

pool [NAME]

ACL [NAME_VPN_Split]

!

Profile of crypto isakmp [NAME]

Profile of clients VPN Description Group [NAME]

identity group match [NAME]

list of authentication of client VPN_Client_AUTHEN

VPN_Client_AUTHOR of ISAKMP authorization list.

client configuration address respond

IP local pool [NAME]...

And the relationship of this group access list:

[NAME_VPN_Split] extended IP access list

IP 10.82.20.0 allow 0.0.1.255 all

IP 10.82.24.0 allow 0.0.1.255 all

IP 10.81.238.0 allow 0.0.1.255 all

IP 10.82.4.0 allow 0.0.1.255 all

IP 10.82.44.0 allow 0.0.1.255 all

IP 10.81.242.0 allow 0.0.1.255 all

...

In the access list, we can modify the subnets to reduce the number of entries, but some groups should have access to a spoke with the NAT IP range that we can summarize in 1 line (see example)

The question we have is: when we have more than 50 entries in the ACL, 51st entry does not work:

-Customer VPN does not receive the road to this network, the road is not added on the connected PC

-Even if the road is added manually on the PC, the 51st network ACL is not accessible.

Do you know why there is a limit of 50 entries in a tunnel "Split ACL?

Do you know if there is a solution to avoid this problem?

The problem is that if we can summarize an ACL in less than 50 lines, we will have to create a second profile and know wich one to use for the network that... Not really a good solution.

Thanks in advance!

Version:

ROM: System Bootstrap, T3 Version 12.3 (4r), RELEASE SOFTWARE (fc1)

BOOTLDR: 7200 (C7200-KBOOT-M), Version 12.3 software (15), VERSION of the SOFTWARE (fc3)

System image file is "disk2:c7200 - advsecurityk9 - mz.151 - 4.M2.bin.

Yes, there is a strict limit of 50 split tunnel ACL entries when you set it by using the old-fashioned way of VPN configuration (ie: card crypto).

If you use dynamic TIV to configure, then you have no limitation for ACL split tunnel.

Here is an example configuration for dynamic configuration of VTI:

http://www.Cisco.com/en/us/docs/iOS-XML/iOS/sec_conn_vpnips/configuration/15-Mt/sec-IPSec-virt-tunnl.html#GUID-E9EB4518-6269-42E8-908C-57BA5D6334A5

Hope that answers your question.

Tags: Cisco Security

Similar Questions

  • Tab automatically when you reach the end of a field with the number of limited characters

    Hello!

    Is it possible to activate an automatic tab behavior when the user reaches the end of a field with the number of limited characters?

    I'd like the cursor to move to the next field in tab order automatically.

    Possible?

    Thanks for the tips!

    Marcos

    Hello

    What happens if you tried something like the following example? This works using formCalc on the change event for the user's domain is currently typing in:

    fullCount var = 3
    var currentString = xfa.event.newText
    If (Len (currentString) > = fullCount) then
    xfa.host.setFocus ("TextField2")
    endif

    Or, if you prefer javaScript:

    fullCount var = 3;
    var currentString = xfa.event.newText;
    If (currentString.length > = fullCount) {}
    xfa.host.setFocus ("TextField2");
    }

    These work very well.

    I hope this helps!

    Stephen

  • The number of entries plist should be in/var/db/dslocal/nodes/Default/users?

    The number of entries plist should be in/var/db/dslocal/nodes/Default/users?

    I was checking the files of password on several windows and machines unix to work but decided to check my Mac at home.  When I checked for password files, I found 4 entries in/var/db/dslocal/nodes/Default/users:

    1 daemon.plist - I guess that's for the process system since 'realname' = > [0 = > "System Services"]

    2 nobody.plist - set in the plist as a 'realname' = > [0 = > "Unprivileged user"]

    3 root.plist - defined in the plist as a 'realname' = > [0 = > "System administrator"]

    -It worries me because it has a very small password

    4 #user # .plist - This is the actual user of the file systems

    The problems are that I do not see the other users of the system, and these files can be manipulated to provide a negative person back privileges on my system.

    Thank you

    What you see is correct. There was also about 85 other users whose names begin with an underscore. The short passwd in the root.plist must be ' *', which does not allow the connection.

    C.

  • How does one increase the number of entries in the drop-down list of the address bar?

    It seems that the number of entries in the drop-down list of the address bar is limited to twelve URLS. I would find it convenient that more than twelve years can be shown, but do not know how to increase the number.

    Increase or decrease browser.urlbar.maxRichResults using Subject: config

    NOTE: The FasterFox extension may affect the number of items displayed if you have it installed (addons > Extensions).

    If this answer solved your problem, please click 'Solved It' next to this response when connected to the forum.

  • Limitation on the number of components adf on a jsp page?

    I am currently working on a page that includes a number of components of af: table with the underlying components of af: column for each table. The page also contains other components of the adf. My question is as stated above, is there a limitation on the number of adf components that are allowed on a page and if so what is it?

    I found that I had page errors can be solved by reducing the number of components. For example, deleting components of af: objectspacer I'm able to include components of af: column that caused the page to fail.

    Any information would be appreciated.

    Thank you.

    What version are you on?

    We faced a similar problem in 10g. The project does not compile after that jspx exceeds a certain size.

    It is due to the restriction of code_length java class file, it cannot be greater than 64 k.

    Check this thread for detailed explanation and workaround {: identifier of the thread = 361086}

    We have been working around the issue by breaking large page in multi-page and that refer to using the home page:



    Mitesh.

  • How can I find the number of entries on a Web site when you use 'find '?

    I press Ctrl + F, the "Find" option appears. I type in a text, the 'Search' tab does not show the number of entries. For Firefox 25.0.1, is it possible to find the number of entries using 'find '? This is really essential.

    Thanks for your help!

    Can I afford too, for future versions of FF, the number of entries found in a web page by using the Find must be indicated.

    I'm sure that you need an add-on for that. Maybe:

    https://addons.Mozilla.org/en-us/Firefox/addon/findbar-tweak/

  • HP Z600: What processors am I limited with the hpz600 workstation?

    Hi, I have a HP Z600 that I bought refurbished. The vehicle currently has 2 x Xeon X 5560 2.8 cpus.

    I am struck with this configuration cpu load limit (I run the intensive 3d modeling software), and I want to improve.

    Am I limited with the motherboard on these workstations?

    Which processors that you would recommend? (I looking for a quite intensive help and have a few hundred dollars to spend).

    Thank you!

    anti1, older versions of the Z600 support microprocessors Intel 55xx only, later versions support as 55xx 56xx CPUs.  The best way to determine this is to boot the system, enter the BIOS F10 setup and look at the date of starting block.

    If the boot block date is 03/01/2009, the system supports the 55xx only processors.

    If the block start date is 07/01/2010, the system supports processors 55xx both 56xx.

    -C' is the block of start date, not the date of the version of the BIOS.

    -There is no way to update the boot block.  (There are several discussions in this forum about this)

    If your system has the block to start later, upgrade to a 6 core CPU 56xx will give best performance.  I think that the frequency of the processor 6 c is 3.47 GHz, although there is a 4 processor 3.6 GHz.  Your application supports multiple cores?

    To get an idea of any increase in performance, look at the reference site of CPU of the pass mark for the top processors of range, here.

    Based on these landmarks (I know, they are markers without real object numbers), you could get about 70% performance increase by using a X 5690 6 3.47 GHz CPU core.  Is it enough for your application?

  • How to vary the number of entries?

    I have to design a system that reads the data from sensors and the Treaty. Is it possible to change the number of entries without any changes to the program? As by specifying the number of entries and the program adapts. I use labview 2009.

    Also is it possible to multiplex multiple entries?

    Thank you

    Mathew

    Then, the tables are the answer. You can change the number of channels simply by specifying a different channel Liist. If you are using arrays as controls, the table can be fed to a for loop and it automatically indexes the table - element by element. Which could be "demultiplexing" selections.

  • When I type some letters on the keyboard type numbers with the number lock.

    Original title: change keyboard type.

    have a Hp laptop, I have managed to change the keyboard accidentally and now when I type with the number lock some letters on keyboard etc not the letter that is the letter lkj type numbers become 123 of the normal keyboard. HELP have what setting I changed it looked cant find any info. I have enabled the language setting and have defined as UK can not see anything that would affect the settings. My laptop has a normal qwerty keyboard with a locket key number on the baord. Can anyone suggest how I do for this comes back to normal please.

    [Moved from comments]

    Hi Martin,

    Thanks for the reply.

    He would be grateful if you can answer these questions to help you further.

    1. What is the exact model of the laptop HP number?

    2. you receive error messages when you install the software download?

    You can try to uninstall and reinstall the keyboard software

    Step 1: Uninstall the keyboard software.

    a. click Start, type device in the search box, and then click on device in the list manager programs.

    b. double-click keyboard, right-click on the keyboard you are using, and then click Uninstall.
    c. restart the computer.

    Step 2: Reinstall the keyboard software.

    a. first of all, turn on the device, if you have to and then connect the device to the computer. Your computer detects the device and then reinstall the drivers for the device.

    If please reply and let us know if you need help to solve the problem and we will be happy to help you.

  • So I recently found my game Age of Mythology. The disc is very good and works, but I have not the case with the number of products to this topic. What should I do?

    So I recently found my game Age of Mythology. The disc is very good and works, but I have not the case with the number of products to this topic. What should I do?

    Hi GuyT6,

    ·         What version of the operating system is installed on the computer?

    I suggest you contact the customer assistance form help and more information.

    How and when to contact Microsoft and support Customer Service

    http://support.Microsoft.com/kb/295539

  • There is a small icon resembling a padlock with the number 1 in it its mix letters and numbers on the keyboard when I type

    How can I get rid of the icon of the lock with the number 1 inside which causes numbers and letters when you type simultainsly

    You probably have a laptop.  This symbol tells you that the 'NumLocks' are currently enabled.  On a standard keyboard, this will change the keypad type numbers to type arrows (more, end House, PG. prev, PAGE down, etc.).  On a laptop computer, this causes the keys with numbers above/below them (j, k, l, etc.) for typing numbers instead of letters.

    Simply tap the NumLock key to change this setting.

    HTH,
    JW

  • How to increase the number of entries in MAC

    Hi everyone, I have a WRT 1900AC and I've reached the limit of 32 entries of MAC for filtering options, we have many more users who must be saved from MAC, anyone know how to increase the number of entries please?

    Tanks a lot, im going to read the info in the links, then ill try
    Tanks for help!

  • How to get the number of entries in the navigation menu?

    boc.bmp

    How to get the number of entries in the navigation menu? Check the image. What it shows 8 number of customers and 10 products and 10 orders in the list. How to get it?

    --

    Thank you

    Hello

    Create items of the request saying, "CUSTOMERS", "PRODUCTS" and "ORDERS".

    Create the application process that defines these items when loading the page for example

    C1 in select count (*) NTC (of customer_table)

    loop

    : CUSTOMERS: = c1.cnt;

    end loop;

    C1 in select count (*) NTC (of products_table)

    loop

    PRODUCTS: = c1.cnt;

    end loop;

    C1 in select count (*) NTC (of orders_table)

    loop

    : ORDERS: = c1.cnt;

    end loop;

    Components shared Open-> Navigation bar and change:

    In the entry list Label-> customers & CLIENTS.]

  • JUnit Test Suite Limitations on the number of test classes can be included in the suite

    I run JUnit tests on my ADF Model picardalice in an application. I'm getting an instance of a request through the class of the device module and it helps in my test classes. It was created using all the Test Suite of Business components in JDeveloper 12.1.3.

    I'm running a JUnit test suite and it has several test classes in its operation. It runs successfully some and others fail. If I run those who fail by themselves, they are successful. If I remove the test classes in the suite they work (even those who have failed when the test classes were listed as a result of tests).

    Here is my code for the test method.

    @Test

    public void testAccess() {}

    See ViewObject = fixture1.getApplicationModule () .findViewObject ("ProjEstimateDtlVO");

    assertNotNull (view);

    }

    the ViewObject perspective comes return null for the execution of the test suite during all test classes are ran. It's successful return if I run one test case. It's successful return if I remove test classes in the following before running the suite.

    There are 70 + test classes in the suite. Is there a limitation on the number of test classes that must be executed in a test suite? Is it because it is repeatedly using an instance of the application module? Is this other thing?

    Everyone ran through this?

    Thank you.

    The problem in my case was because in one of the test cases I was releasing the module of the application in the method of disassembly. Since the application module was created once again, when I ran after tests and he ran this test scenario, anything after this would fail due to no application being created module.

    Thanks, Timo

  • Hello, im a student in England, student of architecture. I have the pack student for 12 months and I really need to know my limits with the use, (copyright licensing). I am allowed, except by using my home application to show works that i already have)

    Hello, im a student in England, student of architecture. I have the pack student for 12 months and I really need to know my limits with the use, (copyright licensing). I am allowed, except by using my home application to show works which I have already done (as portfolios) to architectural firms, I intend to request a placement to? also can I post my stuff (already did the work) on my blog or tumblr? I intend not to use for profit/money at all well (if I was I wouldn't ask you this lol). Thank you.

    Hi,

    Please see Licensing FAQ: where can I find the terms of membership and the terms of use?

    Hope that helps!

    Kind regards

    Sheena

Maybe you are looking for

  • The problem of Apple software update has stopped working

    The Apple software update program does not work after update to iOS 9.3 as seems. Apple software update server error message cannot be found. Check your internet settings and try again. My settings are fine Thank you

  • Error in the printer "document in the ADF.

    Original title: Canon injet 310 series All of a sudden, my printer shows this error when I try to print "document in the ADF.  When I press ok to delete it, the same message appears.  What is an ADF?  How can I fix?  Help, please.  Thank you.

  • cDAQ-9172

    Hello I am using a cdaq-9172 with a NI 9421 pass. I want to watch the first 4 bits as an integer and see in the shared variable engine. Any thoghts on how I could do this? I have tried to make a new global virtual channel but can select entry or entr

  • Need help aligning the SSD to install Windows XP Pro (32 bit)

    OK, I scoured the internet for help on this one - I'm a newbie to SSD - so having to manually align the partitions and find FITTINGS utilities to take care of the "Crusher" is all new to me - so the answers I found on the net were to "over my head" f

  • I can not all PDFs of my computer, when I try IE shuts down

    need help, either download or fix so that I can see PDF files