Newbie Help Needed: Cisco 1941 router site to site VPN traffic routing issue

Similar Questions

• Cisco 850 routing issues

  I am trying to configure a cisco 850 router but I can't do a ping to the outside world of Vlan1. show running-configLooks follow

  Current configuration : 5563 bytes!! Last configuration change at 15:33:02 UTC Sat Aug 13 2016 by ciscoversion 15.2no service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname fw2.myfw.tld!boot-start-markerboot-end-marker!!logging buffered 51200 warnings!aaa new-model!!!!!!!aaa session-id commonwan mode ethernet!!!ip dhcp excluded-address 10.10.10.1ip dhcp excluded-address 192.168.1.1ip dhcp excluded-address 129.x.x.5!ip dhcp pool ccp-pool import all network 192.168.1.0 255.255.255.0 dns-server 8.8.8.8 8.8.4.4  default-router 192.168.1.1  lease 0 2!         !         !         ip domain name mydomain.tldip name-server 8.8.8.8ip name-server 8.8.4.4ip cef    no ipv6 cef!         !         !         !         crypto pki trustpoint TP-self-signed-1017650632 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1017650632 revocation-check none rsakeypair TP-self-signed-1017650632!         !         crypto pki certificate chain TP-self-signed-1017650632 certificate self-signed 01  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030   31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274   69666963 6174652D 31303137 36353036 3332301E 170D3135 30343037 31303536   30375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649   4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 30313736   35303633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281   81008B15 A50BCE53 C1A10611 78247737 97E31A5D 653AF401 024B244B F96B48E0   0A1B41EE 16FBFDD1 46F2E1E2 1329D2C6 EEFBCF5B 217DE650 7D2729B0 266008F3   AC4565EA 53D7FA5B 35761F14 6FBDCFAC 24994667 CB0311A9 7FE25580 7D9564C3   BFE10A4A F5F57C4F C4E18EC9 19874BCA 03127F56 252D04B8 9465A23F FBB9045B   D9EF0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603   551D2304 18301680 146EAE54 B0C95DC2 0561F596 BC47E94B EF80617E F9301D06   03551D0E 04160414 6EAE54B0 C95DC205 61F596BC 47E94BEF 80617EF9 300D0609   2A864886 F70D0101 05050003 81810014 F5B63E51 AD80D4A0 3230E94D 3D1BE457   5D7CF78D 3C911F32 C7238D24 4A8C84D5 D5D4F744 EA2FFD5C 4A40E7A1 A517BFE3   10CC6078 5F446A15 F60EA41E 08C688AF A7834485 0991C739 F3CA38FE CFAA31E2   C72031C1 BAEFA756 719E4903 705C98A7 E20CB004 6FC82D22 D4E62E0C DBA54481   F6A68B3D AA905352 DD76B19F CD4190        quit!         !         username cisco password 0 somepasswordusername admin privilege 15 secret 5 $1$JJZR$kw8yTTHkjUGKIfB8sQiyJ0!         !         controller VDSL 0 shutdown !         ip telnet source-interface Vlan1ip ssh port 2222 rotary 1ip ssh source-interface Vlan1ip ssh rsa keypair-name 1024!         !         !         !         !         !         !         !         !         !         !         !         interface ATM0 no ip address shutdown  no atm ilmi-keepalive!         interface Ethernet0 no ip address shutdown !         interface FastEthernet0 no ip address!         interface FastEthernet1 no ip address!         interface FastEthernet2 no ip address!         interface FastEthernet3 no ip address!         interface GigabitEthernet0 no ip address!         interface GigabitEthernet1 description PrimaryWANDesc_WAN interface ip address 129.x.x.5 255.255.255.0 duplex auto speed auto!         interface Vlan1 description $ETH_LAN$ ip address 192.168.1.1 255.255.255.0 ip helper-address 192.168.1.254 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1412!         ip forward-protocol ndip http serverip http access-class 23ip http authentication localip http secure-serverip http timeout-policy idle 60 life 86400 requests 10000!         !         ip dns serverip nat inside source list nat-list interface GigabitEthernet1 overloadip route 0.0.0.0 0.0.0.0 GigabitEthernet1!         mac-address-table aging-time 15no cdp run!         !         !         banner exec ^C% Password expiration warning.-----------------------------------------------------------------------
  
  Cisco Configuration Professional (Cisco CP) is installed on this device and it provides the default username "cisco" for  one-time use. If you have already used the username "cisco" to login to the router and your IOS image supports the "one-time" user option, then this username has already expired. You will not be able to login to the router with this username after you exit this session.
  
  It is strongly suggested that you create a new username with a privilege level of 15 using the following command.
  
  username <myuser> privilege 15 secret 0 <mypassword>
  
  Replace <myuser> and <mypassword> with the username and password you want to use.
  
  -----------------------------------------------------------------------^C        banner login ^C-----------------------------------------------------------------------Cisco Configuration Professional (Cisco CP) is installed on this device. This feature requires the one-time use of the username "cisco" with the password "cisco". These default credentials have a privilege level of 15.
  
  YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE  PUBLICLY-KNOWN CREDENTIALS
  
  Here are the Cisco IOS commands.
  
  username <myuser>  privilege 15 secret 0 <mypassword>no username cisco
  
  Replace <myuser> and <mypassword> with the username and password you want to use.   
  
  IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
  
  For more information about Cisco CP please follow the instructions in the QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp -----------------------------------------------------------------------^C        !         line con 0 no modem enableline aux 0line vty 0 4 access-class 23 in privilege level 15 transport input telnet ssh!         scheduler allocate 60000 1000!         end   

  I am connected via the port console of the router and can ping the outside world only from port GigaEthernet1 whose IP address129.x.x.5

  Clients that connect on VLan1 get IP addresses in the range of 192.168.1.0/24 and these clients can ping each other, the gateway that is 192.168.1.1 and the GigaEthernet1 that has the intellectual property129.x.x.5

  What's not in this case?  Any suggestion is appreciated the most.

  @[email protected] / * /;

  Thanks for your post. I had a look at your configuration, and it is great that you are a few short steps on your NAT is why it does not work. Please follow the steps below in order to get this work properly.

  1. first of all, let us remove the old configuration NAT then back to a clean slate with the following commands.

  no ip nat inside source list nat-list interface GigabitEthernet1 overloadclear ip nat translation *

  2. now, we will create a list of access control allows for NAT traffic and create the new NAT statement for that tie together. * NOTE: If the version of IOS, you are running requires mask rather than generic then change 0.0.0.255 to 255.255.255.0.

  access-list 100 permit ip 192.168.1.0 0.0.0.255 anyip nat inside source list 100 interface GigabitEthernet1 overload

  3. the next step is to specify the logical role of the interfaces in question, whether they are 'inside' or ' outside'.

  interface vlan1 ip nat inside exitinterface GigabitEthernet1 ip nat outside exit

  4. Finally, save us the configuration and reload.

  copy run startreload

  After the unit is returned as a result of charging, please try again. In some cases - depending on the version of the IOS, you have to ping the outside world from a computer on the local network rather than just sourcing of the interface VLAN. Try this back and forth, and let me know how get you there. I can't wait to hear back.

  Kind regards

  Luke Oxley

  Please evaluate the useful messages and mark the correct answers.

• Using Cisco Client to site VPN on a behind a NAT ASA 5520

  I apologize if this has been asked and we answered in the forums.  I looked, and while I found a large number of entries that were dancing all around this question, I never found nothing which addressed this specific issue.   We currently use an ASA 5520 as the head end of a relatively large customer to site IPSEC VPN (approximately 240 users, not consecutively).   This ASA is currently sitting behind a Checkpoint firewall with a real publicly addressable IP address on its public interface.  All of our customers use the legacy Cisco VPN (not the one anyconnect) client.  We plan to a few controllers F5 link set up between ISPS and firewalls.   For VPN connectivity F5 recommends that we NAT IP address (called a broad IP) to point back to a private IP address on the ASA and F5.  My question is, will this work?   I've always heard say that the head of line needed to have a public IP address on this subject because this is what will be placed in packages for the client to respond to.

  For further information, here's what we have now and what we are invited to attend.

  Current

  ISP - router - firewall-fire - ASA (public IP address as endpoint)

  Proposed

  ISP - router - F5 (public IP address as endpoint using a NAT to ASA) - Firewall - ASA (10.X.X.X as its external interface)

  Proposed alternative

  ISP - router - F5 (public IP address as endpoint using a NAT to ASA) - ASA (10.X.X.X as its external interface)

  All thoughts at this moment would be greatly appreciated.   Thank you!

  Hello

  If there is a static NAT one by one on F5 to the external interface of the ASA, then I don't think they would be any problems.
  Because when the client will attempt to connect to IKE to the translated public IP, F5 will redirect the request to ASA outside interface that is configured for the VPN.

  In addition, to ensure the udp500, 4500 and esp is allowed and then you should be good to go.

  HTH

  Concerning
  Mohit

• Does site to Site VPN traffic.

  Hello

  I had a problem with my connection to my supplier, and we can't figure it out for the life of us. We have the tunnel upward, we simply cannot ping either side of it. (as you can tell from the moment where the position, I am at a loss).

  The goal is for our site to pass all traffic via the seller, so they can go out route to the internet for the rest of their network.

  As I said, the tunnel is just, does not seem to be passsing no matter what traffic, or at least real traffic, I think the keep alives pass.

  Hello

  Some comments on configurations

  Your configurations of sites on a quick glance seems fine. You have configured NAT0 for all traffic and you have set up all the traffic on the local network to connect VPN L2L.

  The seller site configurations seems a little weird. Lets start with the routing. It has a route for network 10.0.0.0/8 and 10.4.0.0/16 pointing to the IP address 10.4.250.49 behind the interface 'inner' that CANNOT be the right gateway IP address as the IP 'internal' interfaces is 10.4.253.66/30, so the roads to my knowledge are useless. (IP address of the next hop must be from a directly connected network)

  These are the roads

  Route inside 10.0.0.0 255.0.0.0 10.4.250.49 1

  Route inside 10.4.0.0 255.255.0.0 10.4.250.49 1

  It's the 'inside' interface

  interface GigabitEthernet0/1

  No tap

  Speed 1000

  full duplex

  nameif inside

  security-level 100

  IP 10.4.253.66 255.255.255.252

  So with the configuration above it needs impossible even for traffic to the front between the local networks of the two sites.

  If your goal is also to have passed your site outside of the site and outside traffic to the Internet through the ASA of the seller then its lack of certain configurations.

  You should be at least

  Global 1 interface (outside)

  Since there are only "nat" statement currently sets the addresses of source for translations, but there is no "global" setting the actual address of the NAT/PAT.

  The ASA of the Site of the seller is also the command lack

  permit same-security-traffic intra-interface

  That would allow the traffic coming through the "outside" interface (from your site through the VPN) and go through the 'outside' (your topic traffic to Internet)

  -Jouni

• Help to configure the router Cisco 1941

  Help!

  I just bought a router cisco 1941, I understand, it came with the Cisco CP, but I don't know how get you to the part where I can use it.

  Also, how can I connect to the router directly without using the HyperTerminal console, all I want to be able to do is configure the address IP of the ISP and my IP address so I can use it for surfing the internet.

  Help, please.

  Hello

  Thanks for the screenshots and show the output! You will need a few lines of command for CCP to work:

  Configure the terminal

  username username privilege 15 secret PASSWORD

  IP http server

  local IP authentication

  Sent by Cisco Support technique iPad App

• Help to activate SSL VPN router Cisco 1941

  Hello.

  I have a router Cisco 1941 and want to activate my SSL VPN license on it. How can I go about it?

  Best regards Tommy Svensson

  Hi Tommy,.

  Please try and download the PDF of the same link.

  I hope this helps.

  Kind regards

  Anisha

  P.S.: Please mark this message as answered if you feel that your request is answered. Note the useful messages.

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Cisco 1941: no risk in "ip Routing" or "ip cef" for NetFlow when bypass

  Hello

  It's on a router Cisco 1941.  version 15.1 ipv4 only.

  I would like to enable Netflow v9 for use with PRTG bandwidth monitoring.

  I tried the instructions at http://kb.paessler.com/en/topic/563-do-you-have-any-configuration-tips-for-cisco-routers-and-prtg and the first step fails because I

  no ip Routing
  No cef

  in my running-config.  More precisely, this

   interface GigabitEthernet 0/1 ip route-cache flow exit 

  fails with the error message "ip Routing not enabled."

  I have read conflicting information on the question if I need to change one or both of these lines.  And I have enough to http://www.cisco.com/c/en/us/td/docs/ios/15_1/release/notes/15_1m_and_t/151-4MCAVS.html afraid to try just scanned.

  I hope that's enough of my config for someone to give some useful information.  Note the BYPASS.

  interface GigabitEthernet0/0
 no ip address
 no ip redirects
 no ip unreachables
 no ip route-cache
 load-interval 30
 duplex auto
 speed auto
 no cdp enable
 no mop enabled
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface GigabitEthernet0/1
 bandwidth 10000
 ip address 201.201.201.51 255.255.255.0
 ip access-group 110 in
 ip access-group 120 out
 no ip redirects
 no ip unreachables
 no ip route-cache
 load-interval 30
 duplex auto
 speed 10
 no cdp enable
 bridge-group 1
 bridge-group 1 spanning-disabled
!
ip default-gateway 201.201.201.1
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip flow-export version 9
ip flow-export destination 201.201.201.89 9991

  Looking forward to comments from a person with experience, do something similar.

  Thank you.

  We do not know anything about your environment or why you decided to activate ip Routing and fill. But there is probably a reason why you did that.

  The importance of this is that NetFlow data are generated as part of the routing decisions. And you prevent your router to make routing decisions as you have disabled ip Routing. So I don't see anyway that you can get this router NetFlow, as long you have disabled ip Routing.

  HTH

  Rick

• Router Cisco 1941 - crypto isakmp policy command missing - IPSEC VPN

  Hi all

  I was looking around and I can't find the command 'crypto isakmp policy' on this router Cisco 1941.  I wanted to just a regular Lan IPSEC to surprise and Lan installation tunnel, the command isn't here.  Have I not IOS bad? I thought that a picture of K9 would do the trick.

  Any suggestions are appreciated

  That's what I get:

  Router (config) #crypto?
  CA Certification Authority
  main activities key long-term
  public key PKI components

  SEE THE WORM

  Cisco IOS software, software C1900 (C1900-UNIVERSALK9-M), Version 15.0 (1) M2, VERSION of the SOFTWARE (fc2)
  Technical support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2010 by Cisco Systems, Inc.
  Updated Thursday, March 10, 10 22:27 by prod_rel_team

  ROM: System Bootstrap, Version 15.0 M6 (1r), RELEASE SOFTWARE (fc1)

  The availability of router is 52 minutes
  System returned to ROM by reload at 02:43:40 UTC Thursday, April 21, 2011
  System image file is "flash0:c1900 - universalk9-mz.» Spa. 150 - 1.M2.bin.
  Last reload type: normal charging
  Reload last reason: reload command

  This product contains cryptographic features...

  Cisco CISCO1941/K9 (revision 1.0) with 487424K / 36864K bytes of memory.
  Card processor ID FTX142281F4
  2 gigabit Ethernet interfaces
  2 interfaces Serial (sync/async)
  Configuration of DRAM is 64 bits wide with disabled parity.
  255K bytes of non-volatile configuration memory.
  254464K bytes of system CompactFlash ATA 0 (read/write)

  License info:

  License IDU:

  -------------------------------------------------
  Device SN # PID
  -------------------------------------------------
  * 0 FTX142281F4 CISCO1941/K9

  Technology for the Module package license information: "c1900".

  ----------------------------------------------------------------
  Technology-technology-package technology
  Course Type next reboot
  -----------------------------------------------------------------
  IPBase ipbasek9 ipbasek9 Permanent
  security, none none none
  given none none none

  Configuration register is 0 x 2102

  You need get the license of security feature to configure the IPSec VPN.

  Currently, you have 'none' for the security feature:

  ----------------------------------------------------------------
  Technology-technology-package technology
  Course Type next reboot
  -----------------------------------------------------------------
  IPBase ipbasek9 ipbasek9 Permanent
  security, none none none
  given none none none

  Here is the information about the licenses on router 1900 series:

  http://www.Cisco.com/en/us/partner/docs/routers/access/1900/hardware/installation/guide/Software_Licenses.html

• A Site VPN PIX501 and CISCO router

  Hello Experts,

  I have an at home test lab, I set up a site to site vpn using a router Cisco PIX501 and CISCO2691, for configurations, I have just a few links on the internet, because my background on VPN configuration is not too good, for the configuration of routers, I followed this link:

  www.Firewall.CX/Cisco-Technical-Knowledgebase/Cisco-Routers/867-Cisco-ro...

  and for configuring pIX I just use the VPN Wizard of pix. All confgurations but ping failed. Hope you can help me with this, don't know what to do here (troubleshooting).

  Joint here is the configuration of my router, topology, as well as the pix configuration. Hope you can help me with this. Thanks in advance.

  Hi Mark,

  I went in the Config of the ASA

  I see that the dispensation of Nat is stil missing there

  Please add the following

  access-list allowed sheep ip 192.168.1.0 255.255.255.0 172.21.1.0 255.255.255.0

  inside NAT) 0 access-list sheep

  Then try it should work

  Thank you

  REDA

• HOWTO configure SSL VPN router Cisco 1941?

  Hello.

  How to configure SSL VPN on a router Cisco 1941? I would like a howto guide that is step by step. I've found myself so far.

  Best regards Tommy Svensson

  Here are a few links that might help:

  http://www.Cisco.com/en/us/products/ps6657/prod_configuration_examples_list.html

  http://security-blog.netcraftsmen.NET/2009/02/Cisco-IOS-SSL-VPN-example.html

• Site to Site VPN Cisco IOS 1941 15.0 (1) M1

  Hello

  I am currently developing a Site VPN site between an ASA and a router in 1941. Configuring VPN on the SAA seems to be ok, because it works without problem with router 1841 with IOS 12.4 to the other site. The same VPN configuration on the new router in 1941 with M1 IOS 15.0 (1) does not work. It seems that the access to the crypto map list is the problem. The router never start the VPN connection. When the ASA attempts to establish the VPN, the debugging of the router log shows:

  ...

  * 14:37:52.263 may 5: ISAKMP: (1007): proposal of IPSec checking 1
  * 14:37:52.263 may 5: ISAKMP: turn 1, ESP_3DES
  * 14:37:52.263 may 5: ISAKMP: attributes of transformation:
  * 14:37:52.263 may 5: ISAKMP: type of life in seconds
  * 14:37:52.263 may 5: ISAKMP: life of HIS (basic) of 28800
  * 14:37:52.263 may 5: ISAKMP: type of life in kilobytes
  * 14:37:52.263 may 5: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
  * 14:37:52.263 may 5: ISAKMP: program is 1 (Tunnel)
  * 14:37:52.263 may 5: ISAKMP: authenticator is HMAC-SHA
  * 14:37:52.263 may 5: ISAKMP: group is 2
  * 14:37:52.263 may 5: ISAKMP: (1007): atts are acceptable.
  * 5 May 14:37:52.263: ISAKMP: (1007): IPSec policy invalidated proposal with error 32
  * 5 May 14:37:52.263: ISAKMP: (1007): politics of ITS phase 2 is not acceptable! (local... remote control...)

  ...

  Any clue?

  Concerning

  Claudia

  The configuration of the router:

  version 15.0
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname Cisco1941
  !
  No aaa new-model
  !
  No ipv6 cef
  no ip source route
  IP cef
  !
  IP domain name xyz.de
  !
  Authenticated MultiLink bundle-name Panel
  !
  Crypto pki trustpoint TP-self-signature-...
  !
  TP-self-signature-... crypto pki certificate chain
  quit smoking
  license udi pid CISCO1941/K9 sn...
  !
  username privilege 15 secret 5 xyz $1$...
  !
  redundancy
  !
  session of crypto consignment
  !
  crypto ISAKMP policy 10
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key... address 1.2.3.4
  invalid-spi-recovery crypto ISAKMP
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac tsAsa
  !
  ASA 10 ipsec-isakmp crypto map
  defined peer 1.2.3.4
  Set transform-set tsAsa
  PFS group2 Set
  match address 100
  !
  interface GigabitEthernet0/0
  Description * inside *.
  IP 10.100.100.1 255.255.255.0
  automatic duplex
  automatic speed
  !
  !
  interface GigabitEthernet0/1
  IP 5.6.7.8 255.255.255.240
  IP access-group 111 to
  no ip-cache cef route
  no ip route cache
  automatic duplex
  automatic speed
  card crypto asa
  !
  !
  ATM0/0/0 interface
  no ip address
  Shutdown
  No atm ilmi-keepalive
  !
  !
  IP forward-Protocol ND
  !
  IP route 0.0.0.0 0.0.0.0 1.2.3.5
  !
  access-list 100 permit ip 10.100.100.0 0.0.0.255 10.10.10.0 0.0.0.255
  access-list 111 allow esp 1.2.3.4 host 5.6.7.8
  access-list 111 permit udp host 1.2.3.4 host 5.6.7.8 eq isakmp
  access-list 111 allow ahp host 1.2.3.4 5.6.7.8
  access-list 111 deny ip any any newspaper

  ....

  end

  Try to do this:

  IP route 10.10.10.0 255.255.255.0 interface Ge0/1

  Route IP 1.2.3.4 255.255.255.255 by default-gateway-to-Ge0/1

  The rest of your config looks very good.

• Cisco router 1921 internet problem with a site-to-site vpn connection

  I have TE-data Modem 3com dsl connection in 2 sites. and I have 2 routers cisco 1921 and there is a vpn site-to-site between them and

  the VPN connection works well. and I configured the PAT on one of them to allow users access to the internet but tere is a problem:

  all users can ping a public ip address

  all users can ping any URL

  but there is no navigation of the internet

  and it's configuration

  NOZHA #sh run
  Building configuration...

  Current configuration: 2425 bytes
  !
  ! Last configuration change at 11:24:08 UTC Thu Sep 20 2012
  !
  version 15.0
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname NOZHA
  !
  boot-start-marker
  boot-end-marker
  !
  enable secret 5
  !
  No aaa new-model
  !
  !
  !
  !
  No ipv6 cef
  IP source-route
  IP cef
  !
  !
  !
  IP dhcp pool 1
  network 192.168.40.0 255.255.255.0
  router by default - 192.168.40.1
  4.2.2.2 DNS Server 8.8.8.8
  Infinite rental
  !
  !
  IP domain name shady2012
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  license udi pid CISCO1921/K9 sn FCZ1432C5KM
  licence start-up module c1900 technology-package securityk9
  !
  !
  !
  redundancy
  !
  !
  !
  !
  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key shady2012 address 81.10.xxx.yy
  !
  !
  Crypto ipsec transform-set shady2012 aes - esp esp-sha-hmac
  !
  card crypto 150 s2s - VPN ipsec-isakmp
  the value of 81.10.xxx.yy peer
  PFS group2 Set
  match address s2s-vpn-Oly
  !
  !
  !
  !
  !
  interface GigabitEthernet0/0
  MTU 1000
  IP address 41.41.xx.yy 255.255.255.252
  NAT outside IP
  activate nat IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  s2s - VPN crypto card
  !
  !
  interface GigabitEthernet0/1
  192.168.40.1 IP address 255.255.255.0
  IP nat inside
  activate nat IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  !
  !
  default IP gateway (hop 41.41.xx.yy) next
  IP forward-Protocol ND
  !
  no ip address of the http server
  no ip http secure server
  !
  The dns server IP
  overload of the IP nat source list mypool GigabitEthernet0/0 interface
  IP route 0.0.0.0 0.0.0.0 41.41.xx.yy
  IP route 192.168.20.0 255.255.255.0 (41.41.xx.yy) next hop
  IP route 192.168.30.0 255.255.255.0 (41.41.xx.yy) next hop
  !
  mypool extended IP access list
  deny ip 192.168.21.0 0.0.0.255 192.168.20.0 0.0.0.255
  deny ip 192.168.21.0 0.0.0.255 192.168.30.0 0.0.0.255
  deny ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
  deny ip 192.168.40.0 0.0.0.255 192.168.30.0 0.0.0.255
  allow an ip
  s2s-vpn-Oly extended IP access list
  ip permit 192.168.40.0 0.0.0.255 192.168.30.0 0.0.0.255
  IP 192.168.21.0 allow 0.0.0.255 192.168.20.0 0.0.0.255
  IP 192.168.30.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
  ip licensing 192.168.20.0 0.0.0.255 192.168.21.0 0.0.0.255
  ip permit 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
  IP 192.168.21.0 allow 0.0.0.255 192.168.30.0 0.0.0.255
  !
  !
  !
  !
  !
  !
  !
  control plan
  !
  !
  !
  Line con 0
  line to 0
  line vty 0 4
  password
  opening of session
  !
  Scheduler allocate 20000 1000
  end

  If anyone has the answer please answer ASAP

  When you say can ping any URL, I am assuming that you are pinging of the FULL domain name, IE: it is resolved to an ip address, right?

  If you disable the VPN, can you access the internet?

  You have a proxy server or anything that could block navigation?

  This error message you get on your web browser?

  Also try another web browser, and none works?

• Cisco IOS router 837 - configure DDNS / dynamic DNS

  I have an Internet, connected to my Cisco router link. The package that I subscribed comes with a dynamic IP address. I said me, if I need remote access in the Cisco router, I need to enable the DDNS function. Is this possible on a Cisco router? I have been informed that this feature is not supported. Please help me

  Hi Bro

  Yes, Cisco ASA and Cisco IOS router supported DDNS. Just make sure you have the right version of IOS, which you could refer to this URL of Cisco http://www.cisco.com/en/US/docs/ios/12_3/12_3y/12_3ya8/gt_ddns.html#wp1202953.

  Please refer to the config below made with dyndns.org.

  !

  hostname INT-RTR1
  !
  IP domain name dyndns.org
  8.8.8.8 IP name-server
  !
  IP ddns update DynDNS method
  HTTP
  Add http://ramraj: [email protected] / * //nic/update?system=dyndns&hostname=&myip=>
  maximum interval of 30 0 0 0
  minimum interval 30 0 0 0
  !
  interface Dialer1
  IP ddns update hostname INT - RTR1.dyndns.org
  IP ddns update DynDNS
  !

  Note: hostname = INT - RTR1.dyndns.org was the host added/registered in the dyndns.org site.

  Note: Press Ctrl + V, then just type the symbol? When to add the CLI adds http://___ above.

  Note: ramraj:cisco123 is simply an example of an IDs in dyndns.org.

  You can also refer to this URL for more details http://www.petri.co.il/csc_configuring_dynamic_dns_in_cisco_ios.htm

  P/S: If you cela this comment is useful, please rate well :-)

• SA520w routing through site-to-site VPN tunnels

  I have several offices that are connected using site-to-site VPN tunnels and all will use the SA520W (firmware 2.1.18). I currently have 3 routers in place, router tunnels created for the router B and c of router. I need assistance with the configuration to allow the guests to router site B get to the router site C. I have attempted to add a static route, but get a destination unreachable host trying to ping. Also, if I connect to the router site has via the Cisco VPN client, I'm not able to get resources on each site, B, or C.

  A - the site 10.10.0.0/24

  Site B - 10.0.0.0/24

  Site of the C - 10.25.0.0/24

  Any help is greatly appreciated.

  So, that's what you have configured correctly?

  RTR_A

  ||

  _____________ || ___________

  ||                                            ||

  RTR_B                                RTR_C

  Since there is no tunnel between B and C there is no way for us past that traffic through RTR_A for two reasons. The most important reason is that subnet 10.25.0.0/24 (rtr_c) is not allowed to pass through the IPSec tunnel (it's okay to IPSec?) of rtr_a ==> rtr_b. You can't just add a statement of road because your addresses are not routable which is the reason why it fails.

  Your only option is to create another tunnel between rtr_b and rtr_c. This may not be the ONLY option, but you should get what you need.

  I hope this helps.