nat VPN question.

Similar Questions

• Cisco AnyConnect VPN question

  I am ASA 5505 that I am of is running correctly by using the AnyConnect client. The question is, can I connect to the fine external interface, but cannot ping or attach them to any host on the inside. When I connect, it accepts the user name and password, and I can run the ASDM or SSH to the firewall very well, but not further. In the control, after I log in, I get an IP address inside, of the order of 10.7.30.x as expected.

  Following configuration:

  : Saved
  :
  ASA Version 8.2 (5)
  !
  asa5505 hostname
  domain BLA
  activate the password * encrypted
  passwd * encrypted
  no names

  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  switchport access vlan 150
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 10.7.30.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP EXTERNAL IP 255.255.255.128
  !
  interface Vlan150
  nameif WLAN_GUESTS
  security-level 50
  IP 10.7.150.1 255.255.255.0
  !
  boot system Disk0: / asa825 - k8.bin
  config to boot Disk0: / running-config
  passive FTP mode
  clock timezone STD - 7
  DNS server-group DefaultDNS
  domain BLA
  permit same-security-traffic intra-interface
  object-group service tcp Webaccess
  port-object eq www
  EQ object of the https port
  object-group network McAfee
  network-object 208.65.144.0 255.255.248.0
  network-object 208.81.64.0 255.255.248.0
  access extensive list ip 10.7.30.0 outside_1_cryptomap allow 255.255.255.0 192.168.24.0 255.255.252.0
  access extensive list ip 10.7.30.0 inside_nat0_outbound allow 255.255.255.0 192.168.24.0 255.255.252.0
  access extensive list ip 10.7.30.0 inside_nat0_outbound allow 255.255.255.0 172.16.10.0 255.255.255.0
  outside_access_in list extended access permit tcp any host 159.87.30.252 eq smtp
  outside_access_in list extended access permit tcp any host 159.87.30.136 Webaccess object-group
  outside_access_in list extended access permit tcp any host 159.87.30.243 Webaccess object-group
  access-list extended outside_access_in permit tcp host 159.87.70.66 host 159.87.30.251 eq lpd
  outside_access_in list extended access permit tcp any host 159.87.30.252 Webaccess object-group
  outside_access_in list extended access permit tcp any host 159.87.30.245 Webaccess object-group
  outside_access_in list extended access permitted tcp object-group McAfee any eq smtp
  permit access list extended ip 172.16.10.0 outside_access_in 255.255.255.0 10.7.30.0 255.255.255.0
  outside_access_in list extended access permit ip host 159.87.64.30 all
  standard access list vpn_users_splitTunnelAcl allow 10.7.30.0 255.255.255.0
  IPS_TRAFFIC of access allowed any ip an extended list
  access extensive list ip 10.7.30.0 outside_nat0_outbound allow 255.255.255.0 any
  inside_access_in list extended access permit udp 10.7.30.0 255.255.255.0 any eq snmp
  access extensive list ip 10.7.30.0 outside_cryptomap allow 255.255.255.0 172.16.10.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  host of logging inside the 10.7.30.37
  Debugging trace record
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 WLAN_GUESTS
  local pool VPN_POOL 10.7.30.190 - 10.7.30.200 255.255.255.0 IP mask
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm-645 - 206.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_nat0_outbound
  NAT (inside) 1 0.0.0.0 0.0.0.0
  NAT (outside) 0-list of access outside_nat0_outbound
  NAT (WLAN_GUESTS) 1 0.0.0.0 0.0.0.0
  public static 159.87.30.251 (Interior, exterior) 10.7.30.50 netmask 255.255.255.255
  public static 159.87.30.245 (Interior, exterior) 10.7.30.53 netmask 255.255.255.255
  public static 159.87.30.252 (Interior, exterior) 10.7.30.30 netmask 255.255.255.255
  public static 159.87.30.243 (Interior, exterior) 10.7.30.19 netmask 255.255.255.255
  public static 159.87.30.136 (Interior, exterior) 10.7.30.43 netmask 255.255.255.255
  Access-group inside_access_in in interface inside the control plan
  Access-group outside_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 159.87.30.254 1
  Route inside 172.16.1.0 255.255.255.0 10.7.30.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  AAA-server ADWM-FPS-02 nt Protocol
  AAA-server ADWM-FPS-02 (inside) host 10.7.30.32
  Timeout 5
  auth-domain NT ADWM-FPS-02 controller
  AAA-server ADWM-FPS-02 (inside) host 10.7.30.49
  auth-DC NT ADWM-DC02
  AAA authentication http LOCAL console
  AAA authentication LOCAL telnet console
  the ssh LOCAL console AAA authentication
  Enable http server
  http 206.169.55.66 255.255.255.255 outside
  http 206.169.50.171 255.255.255.255 outside
  http 10.7.30.0 255.255.255.0 inside
  http 206.169.51.32 255.255.255.240 outside
  http 159.87.35.84 255.255.255.255 outside
  SNMP-server host within the 10.7.30.37 community * version 2 c
  location of the SNMP server *.
  contact SNMP Server
  Community SNMP-server
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic outside_dyn_map pfs set 20 Group1
  card crypto outside_map 1 match address outside_1_cryptomap
  peer set card crypto outside_map 1 206.169.55.66
  map outside_map 1 set of transformation-ESP-3DES-MD5 crypto
  card crypto outside_map 2 match address outside_cryptomap
  peer set card crypto outside_map 2 159.87.64.30
  card crypto outside_map 2 game of transformation-ESP-AES-192-SHA
  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
  outside_map interface card crypto outside
  Crypto ca trustpoint *.
  Terminal registration
  full domain name *.
  name of the object *.
  MYKEY keypairs
  Configure CRL
  Crypto ca trustpoint A1
  Terminal registration
  fqdn ***************
  name of the object *.
  MYKEY keypairs
  Configure CRL
  Crypto ca trustpoint INTERMEDIARY
  Terminal registration
  no client-type
  Configure CRL
  Crypto ca trustpoint _SmartCallHome_ServerCA
  Configure CRL
  Crypto ca trustpoint ASDM_TrustPoint0
  Configure CRL
  Crypto ca trustpoint ASDM_TrustPoint1
  Configure CRL
  ca encryption certificate chain *.
  certificate ca 0301
  BUNCH OF STUFF
  quit smoking
  A1 crypto ca certificate chain
  OTHER LOTS of certificate
  quit smoking
  encryption ca INTERMEDIATE certificate chain
  YET ANOTHER certificate
  quit smoking
  Crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca LAST BOUQUET
  quit smoking
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  Telnet 10.7.30.0 255.255.255.0 inside
  Telnet timeout 30
  SSH 206.169.55.66 255.255.255.255 outside

  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd 4.2.2.2 dns 8.8.8.8
  !
  dhcpd address 10.7.150.10 - 10.7.150.30 WLAN_GUESTS
  enable WLAN_GUESTS dhcpd
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL encryption rc4 - md5 of sha1
  SSL-trust A1 out point
  WebVPN
  allow outside
  AnyConnect essentials
  SVC disk0:/anyconnect-dart-win-2.5.2019-k9.pkg 1 image
  enable SVC
  attributes of Group Policy DfltGrpPolicy
  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
  internal VPNUsers group strategy
  Group Policy VPNUsers attributes
  value of server DNS 10.7.30.20
  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list vpn_users_splitTunnelAcl
  dwm2000.WM.State.AZ.us value by default-field
  Split-dns value dwm2000.wm.state.az.us
  username HCadmin password * encrypted privilege 15
  attributes global-tunnel-group DefaultWEBVPNGroup
  address VPN_POOL pool
  authentication-server-group ADWM-FPS-02
  strategy - by default-VPNUsers group
  tunnel-group 206.169.55.66 type ipsec-l2l
  IPSec-attributes tunnel-group 206.169.55.66
  pre-shared key *.
  tunnel-group 159.87.64.30 type ipsec-l2l
  IPSec-attributes tunnel-group 159.87.64.30
  pre-shared key *.
  !
  class-map IPS_TRAFFIC
  corresponds to the IPS_TRAFFIC access list
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  inspect the icmp
  Review the ip options
  class IPS_TRAFFIC
  IPS inline help
  !
  global service-policy global_policy
  field of context fast hostname
  anonymous reporting remote call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:e70de424cf976e0a62b5668dc2284587
  : end
  ASDM image disk0: / asdm-645 - 206.bin
  ASDM location 159.87.70.66 255.255.255.255 inside
  ASDM location 208.65.144.0 255.255.248.0 inside
  ASDM location 208.81.64.0 255.255.248.0 inside
  ASDM location 172.16.10.0 255.255.255.0 inside
  ASDM location 159.87.64.30 255.255.255.255 inside
  don't allow no asdm history

  Anyone have any ideas?

  Hello

  Please, add this line in your configuration and let me know if it works:

  access extensive list ip 10.7.30.0 inside_nat0_outbound allow 255.255.255.0 10.7.30.0 255.255.255.0

  I ask you to add that it is because you have not specified any exceptions for the return shipping. Once you add to it, will allow you to go through the tunnel VPN, packets back. When this command is not there, you will be able to access everything on the SAA but nothing behind it.

  Let me know if it helps.

  Thank you

  Vishnu

• VPN question: ISP assigned a private ip address

  Hi all

  Internet-online-online headquarters VPN 3015 concentrator

  Users remote VPN Client connected to the internet using a private ip address provided by the ISP (cable) is to establish a VPN tunnel, but they can not ping our private network.

  The only way to get the VPN works is when remote users use a public ip.

  It is a question of Cisco VPN Client? Or it has a solution...

  Thanks in advance,

  Kind regards

  Carlos Welhous

  Network engineer

  Hi Carlos,

  If your ISP gave you a private address, they must use NAT - in which case you will have to enable NAT - T on the VPN concentrator.

  To configure the NAT - T in the world, go to Configuration | System | Tunnelling protocols. IPSec | Screen of transparent NAT and check on NAT - T IPSec case.

• Public static political static NAT in conflict with NAT VPN

  I have a situation where I need to create a VPN site-to site between an ASA 5505 using IOS 7.2 and a Sonicwall NSA4500. The problem arises where the LAN behind the Cisco ASA has the same subnet an existing VPN currently created on the Sonicwall. Since the Sonicwall cannot have two VPN both run on the same subnet, the solution is to use policy NAT on the SAA as well as for the Sonicwall, the new VPN seems to have a different subnet.

  The current subnet behind the ASA is 192.168.10.0/24 (The Sonicwall already has a private network virtual created for another customer with the same subnet). I try to translate it to 192.168.24.0/24. The peer LAN (behind the Sonicwall) is 10.159.0.0/24. The ASA relevant configuration is:

  interface Vlan1

  IP 192.168.10.1 255.255.255.0

  access extensive list ip 192.168.24.0 outside_1_cryptomap allow 255.255.255.0 10.159.0.0 255.255.255.0

  list of access VPN extended permit ip 192.168.10.0 255.255.255.0 10.159.0.0 255.255.255.0

  public static 192.168.24.0 (inside, outside) - list of VPN access

  card crypto outside_map 1 match address outside_1_cryptomap

  In addition, there are other static NAT instructions and their associated ACLs that allow certain traffic through the firewall on the server, for example:

  public static tcp (indoor, outdoor) interface smtp SERVER smtp netmask 255.255.255.255

  The problem is this: when I enter the static strategy statement NAT, I get the message ' WARNING: real-address conflict with existing static "and then it refers to each of the static NAT statements reflecting the external address to the server. I've thought about it, and it seemed to me that the problem was that policy NAT statement must be the first statement of NAT (it is the last one) so that it is run first and all traffic destined to the VPN to the Sonicwall (destination 10.159.0.0/24) tunnel would be properly treated. If I left him as the last statement, then the other static NAT statements would prevent a part of the 10.159.0.0/24 network-bound traffic to be correctly routed through the VPN.

  So, I tried first to my stated policy NAT upward in the ASDM GUI interface. However, moving the declaration was not allowed. Then I tried to delete the five static NAT statements that point to the server (an example is above) and then recreate them, hoping that would then move up the policy statement NAT. This also failed.

  What Miss me?

  Hello

  I assumed that we could have changed the order of the 'static' , the original orders, but as it did not work for some reason any then it seems to me that you suggested or change, that I proposed should work.

  I guess that your purpose was to set up static political PAT for the VPN for some these services, then static PAT of public network access, then static NAT to policy for the rest of the network in-house.

  I guess you could choose any way seems best for you.

  Let me know if get you it working. I always find it strange that the original configuration did not work.

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• 8.4 ASA using NAT VPN issue.

  Hello

  I'm working on a customer site and they have a problem with one of their VPN (we have other works well), but it is a major issue and I think it's because we use manual NAT and NAT of the object on the same server for different things.

  Traffic between indoors and outdoors:

  It works with a specific manual NAT rule of source from the server 10.10.10.10 object

  Inside

  SRC-> DST

  10.10.10.10-> 1.1.2.10 1.1.1.10-> 1.1.2.10 SNAT = VPN =-> 1.1.2.10 1.1.1.10 1.1.1.10-> 1.1.2.10 <3rd party="" fw="">

  It works with a specific using the NAT on the server of 10.10.10.10 object

  Remote

  SRC-> DST

  1.1.1.10-> 1.1.2.10 1.1.1.10-> 1.1.2.10 <3rd party="" fw="">= VPN =-> 1.1.2.10 1.1.1.10 1.1.1.10-> DNAT 10.10.10.10

  If we have the manual NAT and NAT object it does anyway.

  So the question is (as I am new to zip code 8.3 ASA) should not mix the 2 types of NAt and look at configuring it all with manual NAT or NAT object?

  With the NAT object out it does not work as it is taken in ouside NAT inside all:

  Dynamic NAT (inside, outside) source no matter what interface (this NAT to 1.1.1.1 then does not match the card encryption for VPN)

  and I tried a no - nat above that, but that does not work either.

  Straws and hugging come to mind try to configure a different config. Any pointers in the right direction would be great.

  Kind regards

  Z

  Hello

  I'm not sure that installing even with the explanation. Each NAT configuration I did for VPN used Section 1 Manual / NAT twice.

  You have configured the rule by default PAT that you use as Section 1 NAT rule. NAT rules in the new software are divided into 3 sections

  • Section 1: Manual / twice by NAT
  • Section 2: Purpose NAT
  • Section 3: Manual / double NAT (moved to section 3 using the setting "auto after")
  • The Sections are passed by from 1 to 2 and 3 in order to find a match.

  You should also notice that the Section 1 and Section 3 NAT has "line number" similar to the ACL parameter type. So if you have a default existing PAT rule configured for Section 1 and just add another Section 1 NAT rule without line/order number (VPN NAT) then it will just fall under the existing rule, making the new useless rule.

  I would advice against the use of the rule by default PAT as Section 1 NAT rule. Finally, this means that you be constantly watch and edit its configuration when you try to configure more specific rules.

  As a general rule 3 of the Section the PAT above default configuration would be the following

  NAT (inside, outside) after the automatic termination of dynamic source no matter what interface

  This would mean that you need to remove the old. That would mean as naturally as the change would temporarily dismantling all the current connections through "inside", "Outside" while you change the NAT rule format.

  If after this configure a NAT twice to the VPN (wihtout the setting "auto after"), it will be the rule in article 1 while the default PAT will be Section 3. Of course, Section 1 will be matched first.

  I'm not quite sure of what your setup of the foregoing have understood.

  You're just source NAT?

  I guess that the configuration you do is something like this?

  network of the LAN-REAL object

  10.10.10.0 subnet 255.255.255.0

  purpose of the MAPPED in LAN network

  1.1.1.0 subnet 255.255.255.0

  being REMOTE-LAN network

  1.1.2.0 subnet 255.255.255.0

  NAT static destination of LAN LAN-REAL-MAPPED Shared source (indoor, outdoor) REMOTE - LAN LAN

  If the network 1.1.1.0/24 is supposed to be one that is connected directly to your "external" to the format interface may need to be anything else.

  -Jouni

• NAT/VPN Cisco ASA

  Hello

  I have a question on a Cisco ASA.

  We strive to set up a VPN connection with a provider of our using the 172.16.1.0/24 subnet now that they already have another customer using 172.16.1.0/24, then NAT traffic on a different subnet before connecting to the provider. Is this possible? If yes how can I configure something like this?

  172.16.1.0/24 is also used to access the internet.

  That's what I have right now:

  !

  internet_cryptomap_2 to access ip 192.168.0.0 scope list allow 255.255.252.0 (subnet provider)

  !

  card crypto internet_map1 3 match address internet_cryptomap_2

  internet_map1 crypto map peer set 3 (IP address of provider)

  internet_map1 crypto map 3 the value transform-set tubis-transformset

  internet_map1 crypto map 3 the value reverse-road

  !

  This VPN works, but only for the subnet listed in the cryptomap_2 unfortunately, I can't use 172.16.1.0/24 for this.

  Anyone has any ideas how to solve this problem?

  Kind regards

  Tom

  Yes, you can...

  Assuming you want to 172.16.1.0/24 NAT to 10.16.1.0/24 when accessing the provider subnet 192.168.0.0

  access list static-nat-to-vendor permit ip 172.16.1.0 255.255.255.0 192.168.0.0 255.255.252.0

  public static 10.16.1.0 (inside, outside) access static-nat-to-provider list

  access extensive list ip 10.16.1.0 internet_cryptomap_2 allow 255.255.255.0 192.168.0.0 255.255.252.0

  Assuming you have ASA 8.2 or lower.

  Otherwise, ASA 8.3 or higher:

  network object obj - 172.16.1.0

  subnet 172.16.1.0 255.255.255.0

  network object obj - 10.16.1.0

  10.16.1.0 subnet 255.255.255.0

  network object obj - 192.168.0.0

  Subnet 192.168.0.0 255.255.252.0

  NAT (inside, outside) source static obj - 172.16.1.0 obj - 10.16.1.0 destination static obj - 192.168.0.0 obj - 192.168.0.0

• Bizzare vShield Edge-NAT/VPN problem Post - 5.1 upgrade

  Hoping someone can shed some light on this issue for us - the TLDR is that NAT rules seem to be causing unexpected behavior on the VPN traffic after a vCloud 1.5 to 5.1 upgrade.

  Background: We work with a hosting provider to manage our vCloud environment. Quite simple - 2 ESXi hosts, a few NFS data stores. They have recently updated us of 1.5 and 5.1. For most of our committees, we have just one network of vSE/Routed that connects a subnet to a network of "WAN" and pulls a public IP address from a pool. Send us (NAT network address) and leave (firewall) ports (for example port 3389 for RDP) to the virtual machines selected. Most of these networks also have a VPN tunnel from site to site with a physical Firewall through the internet. After the upgrade, we went and converted our rules to match the period of initial and active INVESTIGATION "multiple interfaces" - effectively subtracts to compatibility mode. Everything was going well (even for devices of vSE always in compatibility mode)

  Question: We first noticed this, when a customer reported that they are unable to access a virtual machine via RDP using it is internal (protected VSE) IP through a VPN tunnel but could access the virtual machine via RDP using its public hostname/IP address. Allow us all traffic between the VPN (firewall has a whole: a rule for VPN traffic). When we connected to troubleshoot (just thinking that the VPN was down), we found that we could connect to any port on the computer through the VPN tunnel except 3389remote virtual. I can ping from the local subnet to the VM troubled on the VAPP network without problem. I was able to connect to other ports that have been opened on the remote virtual machine without problem. I couldn't connect to 3389 through the VPN.

  We thought he could be isolated, but found the question on each VSE we have: If there were a the DNAT rule to translate the inbound for a particular port, this port would be insensitive when traffic through the VPN tunnel that is meant to be the target of the DNAT rule.

  Someone has an idea what could be the cause?

  Looks like it is a problem experienced during the upgrade. These hidden firewall rules will not disappear until the firewall configuration is updated in some way. So go as - upgrade

  (1) upgrade VCD

  (2) update VSM

  (3) to redeploy the entry door to upgrade the edge of the gateway to version 5.1

  (4) convert the firewall rules to the new format (where firewall rules have no management interface or traffic)

  (5) to change the properties of the bridge and the multiple interface mode

  (6) change the specification of the firewall somehow, that is to add a dummy firewall and remove it, turn off, then turn on the firewall, etc..

  Which should cause the deny rule go away

• VPN question

  Hi, I use the windows Server 2003 and. When I access my server at home I connect the VPN but I not have access to the shared private folder when I try to open the system crashes but the other file I can open without blocking. Please help me solve this problem...

  Hi Patchamuthu,

  Your question of Windows is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for support on Windows server. Please post your question in the below link:http://social.technet.microsoft.com/Forums/en/itproxpsp/threads

  With regard to:

  Samhrutha G S - Microsoft technical support.

  Visit our Microsoft answers feedback Forum and let us know what you think.

• ACL VPN question

  I have two questions that regarding ACL is used in the instructions on the Card Crypto:

  1. the two devices VPN should have the same ACE in the ACL? I know that without the second ACE site B below will not see as interesting udp traffic, but the will of the vpn tunnel fails because the ACL is not the same ACE?

  That is to say...

  Site has

  Access-list 110 permit tcp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

  Access-list 110 permit udp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

  Site B

  Access-list 110 permit tcp 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0

  2. once a tunnel is established it will send ANY/ALL traffic destined to the remote network through this tunnel. If the first ACE in the ACL 110 to Site A list is used to bring up the tunnel, only tcp from to 10.0.2.0/24 10.0.1.0/24 traffic will use the tunnel or all traffic from 10.0.1.0/24 intended for the remote network to cross the tunnel?

  I guess my thought is this. The ACL is only used to determine valuable traffic and once the tunnel is up it is a free for all. Or the ACL only allows traffic that meets the criteria specified in the ACL list to flow once the tunnel is established?

  Thank you

  Brian

  Brian,

  Your statement

  'Or the ACL allows only traffic that meets the criteria specified in the ACL list to flow after the tunnel is established'

  Is correct, only the traffic that meets the ACL crypto will go through the vpn tunnel and all other traffic will be denied. If you need UDP traffic to travel through the tunnel, you need crypto ACL on both sides and not only on one side, that is, SITE A.

  Hope this helps,

  Jay

• A connection VPN Question

  Dear,

  I have configured anyconnect on my asa and it works fine, but I can't manage the ASA it free VPN, all ideas session

  BR

  Hazem

  It is possible with the help of the command "access management". Please refer to the following documentation: -.

  http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa82/configuration/guide/config/access_management.html#wp1064497

  Make sure you have good split tunnel and free of nat-access list for traffic destined for the interface of the ASA.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• By PAT and NAT VPN

  We have a place where you want to set up a tunnel VPN to our headquarters.

  In this place, there is a router that PAT (NAT overloading), and then a few jumps more, there is a firewall that makes the NAT.

  Is this could pose a problem for the VPN tunnel?

  Here's a "pattern" of what looks like the connection.

  Customer--> PAT - router-->--> Internet--> CVPN3005 NAT firewall

  I hope you can provide me with an answer.

  VPN tunnel will not work in your scenario. NAT second change address and the ports you want to use for the vpn tunnel. So the port 500 wil be translated to top port and will be rejected at HQ.

• ASA to AWS VPN question

  I have problems with our VPN to AWS. The configuration of the firewall is below:

  Firewall 1

  !
  hostname FW
  activate the password
  names of

  !
  interface GigabitEthernet0/0
  Description Inside_To_SW-DISTRIBUTION-01_Gi1/0/2
  nameif LAN
  security-level 100
  IP address 172.16.x.1 255.255.252.0
  !
  interface GigabitEthernet0/1
  Description Outside_To_SW-DISTRIBUTION-01_Gi1/0/1
  nameif WAN
  security-level 0
  IP address 212.x.x.201 255.255.255.248 watch 212.x.x.202
  !
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP address 10.x.x.x 255.255.255.0
  !
  boot system Disk0: / asa913-smp - k8.bin
  passive FTP mode
  clock timezone GMT/UTC 0
  summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00
  DNS domain-lookup LAN
  DNS server-group DefaultDNS
  Name-Server 8.8.8.8
  4.4.4.4 server name
  permit same-security-traffic intra-interface
  network of the object OBJ-LAN-SUB-NETWORK
  subnet 172.x.128.0 255.255.252.0
  object OBJ-POOL-A network
  range 212.x.x.195 212.x.x.196
  object obj-SrcNet network
  subnet 0.0.0.0 0.0.0.0
  network of object obj-amzn
  10.32.0.0 subnet 255.255.0.0

  gamma of network object
  subnet 88.215.48.0 255.255.240.0
  tinet network object
  subnet 89.149.128.0 255.255.192.0

  object-group service DM_INLINE_SERVICE_1
  ICMP service object
  the purpose of the echo icmp message service
  response to echo icmp service object
  object-group service DM_INLINE_SERVICE_2
  ICMP service object
  the purpose of the echo icmp message service
  response to echo icmp service object
  object-group service DM_INLINE_SERVICE_3
  ICMP service object
  the purpose of the echo icmp message service
  response to echo icmp service object
  object-group service DM_INLINE_SERVICE_4
  ICMP service object
  the purpose of the echo icmp message service
  response to echo icmp service object
  DM_INLINE_TCP_1 tcp service object-group
  port-object eq www
  EQ object of the https port
  object-group Protocol TCPUDP
  object-protocol udp
  object-tcp protocol
  object-group service DM_INLINE_SERVICE_5
  SIP service-purpose tcp - udp destination eq
  the purpose of the service tcp destination eq www
  the purpose of the tcp destination eq https service
  the purpose of the tcp destination eq ldap service
  area of service-object udp destination eq
  the purpose of the udp destination eq ntp service
  object-group service tcp imp
  EQ object Port 5222
  rtp udp service object-group
  60000 10000 port-object range
  object-group service tcp sip1
  port-object eq 8011
  object-group service sip2 tcp
  port-object eq 5080
  DM_INLINE_TCP_2 tcp service object-group
  port-object eq ftp
  port-object eq ftp - data
  EQ port ssh object
  object-group service DHCP udp
  port-object eq bootps
  DHCPrange udp service object-group
  ports of DHCP Description
  Beach of port-object bootps bootpc

  object-group grp-voip network
  gamma of network-object object
  network-object object tinet

  LAN_access_in list extended access allowed object-group DM_INLINE_SERVICE_3 object OBJ-LAN-SUB-NETWORK any4
  LAN_access_in list extended access allowed object-group TCPUDP object OBJ-LAN-SUB-NETWORK any eq field
  LAN_access_in list extended access allowed object OBJ-LAN-SUB-NETWORK ip everything
  LAN_access_in list extended access permitted ip 10.x.x.x 255.255.255.0 everything
  LAN_access_in list extended access udp allowed any any DHCP object-group
  list of access TUNNEL of SPLIT standard allowed 172.16.x.0 255.255.252.0

  extended access list acl-amzn allow any4 ip 10.32.0.0 255.255.0.0
  extended access list acl-amzn allow icmp any4 10.32.0.0 255.255.0.0

  global_access deny ip extended access list a whole

  10.32.0.0 IP Access-list extended filter amzn 255.255.0.0 allow 172.16.128.0 255.255.252.0
  refuse the access-list extended ip a whole amzn-filter

  WAN_access_out list extended access allowed object-group DM_INLINE_SERVICE_4 object OBJ-LAN-SUB-NETWORK any4
  WAN_access_out list extended access allowed object-group DM_INLINE_SERVICE_5 object OBJ-SUB-LAN-NETWORK-object-group grp-voip
  WAN_access_out list extended access permitted udp object OBJ-SUB-LAN-NETWORK-object-group grp-voip-group of objects rtp
  permit WAN_access_out to access extensive ip list object OBJ-LAN-SUB-NETWORK object obj-amzn
  WAN_access_out list extended access allowed object-group TCPUDP object OBJ-LAN-SUB-NETWORK any eq field
  WAN_access_out list extended access permitted tcp object OBJ-LAN-SUB-NETWORK any4 object-group DM_INLINE_TCP_1
  WAN_access_out list extended access permit tcp any any DM_INLINE_TCP_2 object-group
  WAN_access_out of access allowed any ip an extended list
  permit access list extended ip host 52.17.201.49 WAN_access_in 212.84.183.201
  permit access list extended ip host 52.18.197.187 WAN_access_in 212.84.183.201

  pager lines 24
  Enable logging
  emergency logging console
  emergency logging monitor
  exploitation forest asdm warnings
  MTU 1500 LAN
  MTU 1500 WAN
  management of MTU 1500

  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any WAN

  ARP timeout 14400
  no permit-nonconnected arp
  NAT (LAN, WAN) source static obj-SrcNet obj-SrcNet destination static obj-amzn obj-amzn
  NAT (LAN, WAN) static source any any destination static OBJ ANYCONNECT-SUB-NETWORK-OBJ-ANYCONNECT-UNDER-NETWORK non-proxy-arp-search directions
  !
  network of the object OBJ-LAN-SUB-NETWORK
  OBJ-POOL-A dynamic pool pat flat interface include the NAT (LAN, WAN) reserves
  !
  OBJ-ANYCONNECT-SUB-NETWORK dynamic interface source NAT (all, WAN) after the automatic termination
  LAN_access_in access to the LAN by-user-override interface group
  WAN_access_in access to the WAN interface group
  Access-group WAN_access_out WAN interface
  Access-Group global global_access
  Route WAN 0.0.0.0 0.0.0.0 212.x.x.x 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Sysopt connection tcpmss 1387
  SLA 1 monitor
  type echo protocol ipIcmpEcho 10.x.x.x WAN interface
  frequency 5
  SLA monitor Appendix 1 point of life to always start-time now

  Crypto ipsec transform-set transform-amzn ikev1 aes - esp esp-sha-hmac
  replay window-size 128 ipsec encryption security association
  Crypto ipsec pmtu aging infinite - the security association
  Crypto ipsec WAN clear-df df - bit

  card crypto amzn_vpn_map 1 match address acl-amzn
  card crypto amzn_vpn_map 1 set pfs
  amzn_vpn_map card crypto peer 52.17.201.x 52.18.197.x 1jeu
  amzn_vpn_map 1 set transform-set transform-amzn ikev1 crypto card
  amzn_vpn_map card crypto 1 lifetime of security set association, 3600 seconds
  card crypto amzn_vpn_map WAN interface
  Crypto ca trustpoint ASDM_TrustPoint0
  Terminal registration
  name of the object CN = FW-INTERNET-LON
  Configure CRL
  trustpool crypto ca policy
  crypto isakmp identity address
  Crypto ikev2 enable port 443 of the WAN-customer service
  Crypto ikev1 enable WAN
  IKEv1 crypto policy 201
  preshared authentication
  aes encryption
  sha hash
  Group 2
  lifetime 28800
  Telnet timeout 5
  SSH 0.0.0.0 0.0.0.0 WAN
  SSH timeout 5
  SSH version 2
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  source of x.x.x.x server NTP WAN
  WebVPN
  Select the WAN
  AnyConnect enable
  tunnel-group-list activate
  GroupPolicy_ANYCONNECT-group-policy PROFILE internal
  attributes of Group Policy GroupPolicy_ANYCONNECT-PROFILE
  value of server DNS 8.8.8.8 4.4.4.4
  client ssl-VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  IPv6-split-tunnel-policy excludespecified
  crowdmix.me value by default-field
  activate dns split-tunnel-all
  internal filter group policy
  attributes to filter group policy
  VPN-value amzn-filter

  tunnel-group ANYCONNECT-PROFILE type remote access
  tunnel-group ANYCONNECT-PROFILE general-attributes
  ANYCONNECT-POOL address pool
  GroupPolicy_ANYCONNECT-PROFILE of default-group-strategy
  tunnel-group ANYCONNECT-PROFILE webvpn-attributes
  enable ANYCONNECT-PROFILE Group-alias
  tunnel-group 52.17.201.x type ipsec-l2l
  tunnel-group 52.17.201.x General-attributes
  filter by default-group-policy
  52.17.201.x group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  ISAKMP keepalive retry threshold 10 3
  tunnel-group 52.18.197.x type ipsec-l2l
  tunnel-group 52.18.197.x General-attributes
  filter by default-group-policy
  52.18.197.x group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  ISAKMP keepalive retry threshold 10 3
  tunnel-group 52.30.177.x type ipsec-l2l
  tunnel-group 52.31.131.x type ipsec-l2l
  !
  ICMP-class class-map
  match default-inspection-traffic
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map icmp_policy
  icmp category
  inspect the icmp
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  icmp_policy service-policy interface WAN
  context of prompt hostname
  !
  Booking Jumbo-image
  !
  no remote anonymous reporting call
  Cryptochecksum:ff493f0ff375e83710e6bc9d19476e0e
  : end

  When I add a second VPN connection by using the commands below:

  object obj-amzn2 network

  10.34.0.0 subnet 255.255.0.0

  NAT (LAN, WAN) source static obj-SrcNet obj-SrcNet destination static obj-amzn2 obj-amzn2

  I see the tunnels going up, however, we immediately begin to see the Voip system lose the SIP traffic with its servers, and even if you can still use internet if you have an open socket you can not create a new session. It looks like a problem of routing for me, but I can't seem to find the place where

  Any help greatly appreciated

  So, you want to have two virtual private networks from Amazon to blocks of different destinations, 10.32.0.0/16, and 10.34.0.0/16, correct?

• With NAT VPN tunnels

  I have read on several posts on the topic and still think I'm missing something, I'm looking for help.

  Basically, I'm now implementing multiple VPN tunnels for external connections. We strive to keep the external "private addresses" our basic using NAT network.

  I can get the Tunnel to work without problems using the ACL SHEEP; However, this technique requires that our internal network is aware of their external addresses "private." Our goal is to enter an address on the inside that is NAT to the external address 'private' and then shipped via the VPN tunnel. Basically to hide the external address 'private' of our internal systems that they would appear as thought the connection was one of our own networks.

  The reverse is true coming from their external 'private' network. Any information of "their" private network external origin would result in our 'private' on arrival address space.

  Is this possible? I am attaching a schema, which could help.

  Hello

  Yes, this should be possible. Lets say you allocate 10.112.2.250 as the address that you use to present the external server 192.168.10.10.

  On your ASA device

  public static 10.112.2.250 (exterior, Interior) 192.168.10.10 netmask 255.255.255.255

  You will need to make sure that when the system tries to connect to 10.112.2.250 it is routed to the device of the SAA.

  HTH

  Jon

• Pool of dhcp NAT VPN to the LAN on router 2911

  I need nat the ips assigned by dhcp vpn to my LAN pool. My problem is that I do not know which interface to set my nat statement on since there is no interface that is in the same subnet as my dhcp pool. Any help would be appreciated.

  For remote client ipsec, you must have DVTI according to configuration described here:

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gtIPSctm...

  'use ip nat inside' on the virtual model and 'ip nat outside' on the inside of the interface.

  HTH

  Averroès.

• NAT VPN tunnel and still access Internet traffic

  Hello

  Thank you in advance for any help you can provide.

  I have a server with the IP 192.168.1.9 that needs to access a subnet remote from 192.168.50.0/24, through the Internet.  However, before the server can access the remote subnet, the server IP must be NAT'ed to 10.1.0.1 because the VPN gateway remote (which is not under my control) allows access to other customers who have the same subnet address that we do on our local network.

  We have a 2801 Cisco (running c2801-advsecurityk9 - mz.124 - 15.T9.bin) set up to make the NAT.  It is the only gateway on our network.

  I have configured the Cisco 2801 with the following statements of NAT and the relevant access lists:

  access-list 106 allow host ip 192.168.1.9 192.168.50.0 0.0.0.255

  NAT extended IP access list
  refuse the host ip 192.168.1.9 192.168.50.0 0.0.0.255
  deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
  ip permit 192.168.1.0 0.0.0.255 any

  route allowed ISP 10 map
  corresponds to the IP NAT

  IP nat EMDVPN 10.1.0.1 pool 10.1.0.1 netmask 255.255.255.0
  IP nat inside source list 106 pool EMDVPN
  IP nat inside source map route ISP interface FastEthernet0/1 overload

  When the server (192.168.1.9) attempts to ping on the subnet of 192.168.50.0/24 devices, the VPN tunnel is established successfully.  However, after that, the server is no longer able to access the Internet because the NAT translation for 192.168.1.9 has changed since the external IP address of the router (FastEthernet0/1) at 10.1.0.1.

  The documentation I've seen on the site of Cisco says that this type of Setup allows only host subnet communication.  Internet access is not possible.  However, maybe I missed something, or one of you experts can help me.  Is it possible to configure the NAT router traffic destined to the VPN tunnel and still access the Internet by using the dynamic NAT on FastEthernet0/1?

  Once again, thank you for any help you can give.

  Alex

  Hello

  Rather than use a pool for NAT

  192.168.1.9 - 10.1.0.1 > 192.168.50.x

  ACL 102 permit ip 192.168.1.9 host 192.168.50.0 0.0.0.255

  RM-STATIC-NAT route map permit 10
  corresponds to the IP 102

  IP nat inside source static 192.168.1.9 10.1.0.1 card expandable RM-STATIC-NAT route

  ACL 101 deny host ip 192.168.1.9 192.168.50.0 0.0.0.255
  ACL 101 by ip 192.168.1.0 0.0.0.255 any
  overload of IP nat inside source list 101 interface FastEthernet0/1

  VPN access list will use the source as 10.1.0.1... *.

  Let me know if it works.

  Concerning

  M