PPTP/GRE problem

Similar Questions

• Problem setting out by ASA 5505 VPN

  While inside a network secured by an ASA 5505, I can't establish a PPTP VPN on. The ASA will connect the following:

  09-2009 20:50:09 creating 305006 24.13.209.125 regular translation failed for the internal protocol 47 src: 192.168.132.108 dst outside:xxx.xxx.xxx.125

  I looked at the msg of error in line, but for some reason, I'm just not understand what he says. How can I fix it? Let me know if you have any questions... Thank you guys!

  Colombia-British

  Hello

  Enable pptp inspection

  pixfirewall (config) #policy - map global_policy

  pixfirewall(config-pmap) #class inspection_default

  pixfirewall (config-pmap-c) #inspect pptp

  Go to this link for the use of pptp/gre info background detail under various codes.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080094a5a.shtml

  Concerning

• Problem with Port Forwarding (When PPTP is upward) in the WRT-160N

  Hello world!

  I'm looking for more help with Port Forwarding in my new Linksys router. I bought the daysago afew router and was pretty surprised when I discovered that there is no DD - WRT firmware is installed in it (the router was 100% NEW when I bought it). I downloaded latest firmware original and flashed Linksys file successfully.

  But I still have the problem (even that I was on DD - WRT firmware too) with the port forwarding for my DC ++ and Vuze (app from torrents): I wrote port forward for ports 49151 (for Vuze) and 4000 (for DC ++) to pass on to my desktop computer (IP 192.168.1.201) - I saw a post on this forum, that there could be a problem If you transfer to an IP address, which is within the local area of DHCP, so I forwarded to IP.201 (my local DHCPzone is 192.168.1.100-. 149) But does not forwardind (())

  What's wrong?

  My configuration:

  Router IP: 192.168.1.1

  PPTP (I my ISP)

  IP address: 192.168.226.127

  Default gateway: 192.168.226.2

  DNS 1: 192.168.1.1

  2 & 3 DNS: 0.0.0.0

  The IP address of the PPTP server: 192.168.226.2

  User name: *.

  Password: *.

  _____________________

  Simple Port Forwarding:

  Name of the external port application port internal protocol for IP address Enabled

  Vuze 49151 49151 times checked 192.168.1.201

  DC 4000 4000 checked two 192.168.1.201

  As you mentioned in your post that your ISP has provided you with a PPTP connection with an IP address: 192.x.x.x. The IP address that is provided by your ISP is in a private beach, and if you try to transfer all the ports on your router, it will not work, as long as your ISP modem is blocking this port. If you need get a public IP address from your ISP.

  As you get Private IP of your ISP, if this connection is called as NAT behind NAT and your Modem behaves like a router.

  So now you have 2 options, get the public IP address from your ISP or change the type of connection.

• Windows 7 Pro PPTP VPN 807 error and does not connect to the remote server, XP machine connect without problems

  I'm just set up my new windows 7 laptop (Dell Precision M4400) running windows 7 Professional and VPN are not working, they're always bombing with error 807.  "The connection between your computer and the VPN server was interrupted."

  I created a PPTP connection in order to connect to my workplace and connecting I continually receive an 807 error.

  To check my internet etc is work that I have connected to the same place through my existing XP laptop computer (DELL precision M4300) which has the same VPN settings.  Everything connects aok.

  I'm also running ESET as my anti-virus and firewall and that you have disabled it to test (normally I have no problem running this and is also running on my XP laptop).  I also confirmed that windows firewall is turned off.

  I connect wireless at home, internet works fine, firewall has not changed at each end (I manage both ends) and such noted works for my machine also running more XP wireless.

  Hello

  Welcome to Microsoft Windows 7 answers Forum!

  Note to resolve this problem, we have a support professionals who are well equipped with the knowledge on Windows 7 issues, do please visit the link provided below.

  http://social.technet.Microsoft.com/forums/en/w7itprovirt/threads

  Hope this information is useful.

  Thank you, and in what concerns:

  Suresh Kumar-Microsoft Support.

  Visit our http://social.answers.microsoft.com/Forums/en-US/answersfeedback/threads/ Microsoft answers feedback Forum and let us know what you think

• HSRP with GRE ipsec problems

  I have the following scenario to connect my main HQ with other directorates:

  Two routers HQ and work by their internal Giga HSRP interface and use WAN connections by serial interfaces to create VPN site-to-site with other branches using GRE over ipsec.

  I need to know is - right configuration or there is another way to do.

  the following sample configuration on both active and standby routers and router for branch

  Active router

  ISAKMP crypto key password address 172.18.x.x

  Crypto ipsec transform-set aes aes - esp esp-sha-hmac

  Crypto card secure ipsec-isakmp 13
  the value of 172.18.x.x peer
  Set transform-set aes
  match address 101

  interface Tunnel3
  Description branch01
  IP 10.100.30.1 255.255.255.0
  KeepAlive 10 3
  source 10.100.0.x tunnel
  destination 172.18.x.x tunnel
  secure cryptographic card

  interface GigabitEthernet0/0
  IP 10.100.0.y 255.255.255.0
  automatic duplex
  automatic speed
  Watch 1 ip 10.100.0.x
  1 standby preempt

  point-to-point interface Serial0/0/0.16
  IP address 172.20.x.x 255.255.255.252

  secure cryptographic card

  access-list 101 permit will host 10.100.0.x host 172.18.x.x

  Standby router

  ISAKMP crypto key password address 172.18.x.x

  Crypto ipsec transform-set aes aes - esp esp-sha-hmac

  Crypto card secure ipsec-isakmp 13
  the value of 172.18.x.x peer
  Set transform-set aes
  match address 101

  interface Tunnel3
  Description branch01
  IP 10.100.30.3 255.255.255.0
  KeepAlive 10 3
  source 10.100.0.x tunnel
  destination 172.18.x.x tunnel
  secure cryptographic card

  interface GigabitEthernet0/0
  IP 10.100.0.z 255.255.255.0
  automatic duplex
  automatic speed
  Watch 1 ip 10.100.0.x
  1 standby preempt

  point-to-point interface Serial0/0/0.16

  IP address 172.19.x.x 255.255.255.252

  secure cryptographic card

  access-list 101 permit will host 10.100.0.x host 172.18.x.x

  Branch router

  ISAKMP crypto key password address 172.20.x.x
  ISAKMP crypto key password address 172.19.x.x
  ISAKMP crypto key password address 10.100.0.x

  Crypto ipsec transform-set aes aes - esp esp-sha-hmac

  Crypto card secure ipsec-isakmp 13
  the value of 172.19.x.x peer
  the value of 172.20.x.x peer
  Set transform-set aes
  match address 101

  interface Tunnel3
  Description branch01
  IP 10.100.30.3 255.255.255.0
  KeepAlive 10 3
  tunnel source 172.18.x.x
  destination of the 10.100.0.x tunnel
  secure cryptographic card

  point-to-point interface Serial0/0/0.16
  IP address 172.18.x.x 255.255.255.252
  secure cryptographic card

  access-list 101 permit will host 172.18.x.x host 10.100.0.x

  I had lots of massages of error with active or standby router and all the VPN settings are correct to the routers of the AC and branches

  % CRYPTO-6-IKMP_MODE_FAILURE: the mode of information processing failed with the peer to 172.18.x.x

  In your current design, I can see HSRP used to provide evacuation route VPN HA outwards.  IPSec plan HA, HSRP is usually deployed when the Wan is attached Ethernet.  In this case, we can build the tunnel using the virtual address HSRP giving a permanent IP address.  The problem with your design, is that to reach the HSRP virtual IP address, you must cross a single hosted serial interface. If this interface is unsuccessful or if there is a problem in the path routed between cryptographic peer, you will never be able to reach the HSRP virtual IP address so the resulting solution will fail.

  If it is the topology we work with, so the only recommendations I can do is to incorporate IP SLAS and followed in your design.  For example, you may track the status of the interface the main router series.  If the interface fails, you could decrement the HSRP interface boot priority in order to force traffic to converge on the backup router path.  With star-ISAKMP KeepAlive configured on the routers in topology, routers should be able to recognize the failure and the timeout of the old SAs.  Because the RADIUS is configured with two counterparts, the router can negotiae new SAs with the backup router.  When the serial interface comes back online, you can have the main router anticipate waking after a delay.  To detect indirect failures on the transit route, you could use ICMP IP SLA and monitoring instead.  This design, however, will be properly tested for stability during the failover process.

• Problem with client windows to 871 pptp router - no traffic back

  I have a 871 router as a host vpdn configuration. I can connect with a windows xp client (who is behind another router Polo he has resolve, if that helps), can ping inside the interface of the router, but no other host LAN. traffic is making it to the hosts, but do not return not (so no replys ping, etc.). I have attached what should be interesting config. any ideas greatly appreciated.

  seems logical, in fact, both the pool of pptp and the LAN are on the same segment, where activation proxy arp has solved the problem. Not a thogh of good practices, ideal thing will change the vpdn pool.

• Problem of pptp Windows ASA 8.4 (4) 1

  Hi all

  I hope someone can help I have an ASA 5505 that replaces a legacy firewall. Everything works apart from the Dáil in pptp sessions. These are sent to the windows 2003 server.

  See below for my config, I'm really stuck now. See below for my config

  ASA 4,0000 Version 1

  !

  hostname ITEFW01

  domain ite.local

  activate the encrypted password of X/3Ef.pSbYW/QCVY

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  Speed 100

  full duplex

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  nameif inside

  security-level 100

  the IP 10.0.0.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 83.218.142.244 255.255.255.248

  !

  passive FTP mode

  DNS server-group DefaultDNS

  domain ite.local

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  network of the External01 object

  Home 83.218.142.242

  external description

  the object Exchange service

  tcp destination eq smtp service

  network of the External02 object

  Home 83.218.142.243

  VPN description

  service of the PPTP01 object

  tcp destination eq pptp service

  service of the PPTP02 object

  tcp destination eq whois service

  network of the External03 object

  Home 83.218.142.243

  Description address VPN

  service object HTTPS

  tcp destination eq https service

  network of the ITEServer object

  host 10.0.0.2

  ITE server description

  network of the ITEServer02 object

  host 10.0.0.3

  object-group service Blackberry01 tcp - udp

  Description Blackberry01

  port-object eq 3101

  object-group service Blackberry02 tcp - udp

  Description of the Ports of Blackberry

  port-object eq 4101

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  the BrianBass object-group network

  Email Filtering Proxy description

  object-network 217.64.175.0 255.255.255.0

  host of the object-Network 62.133.28.58

  object-network 83.246.65.0 255.255.255.0

  host of the object-Network 87.224.100.82

  host of the object-Network 87.224.86.194

  network-object 94.100.128.0 255.255.255.240

  inside_access_in list extended access permit icmp any one

  inside_access_in of access allowed any ip an extended list

  inside_access_in list extended access will permit a full

  global_access list extended access allow icmp a whole

  outside_access list extended access allow accord any object ITEServer

  outside_access list extended access permit tcp any object ITEServer eq 1701

  outside_access list extended access permit tcp any object ITEServer eq pptp

  outside_access list extended access allow HTTPS object any object ITEServer

  outside_access list extended access allow object Exchange object-group Brian

  s object ITEServer

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  !

  network of the ITEServer object

  NAT External01 static (inside, outside)

  !

  NAT source auto after (indoor, outdoor) dynamic one interface

  inside_access_in access to the interface inside group

  Access-group outside_access in interface outside

  Access-Group global global_access

  Route outside 0.0.0.0 0.0.0.0 83.218.142.241 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:0

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  AAA authentication LOCAL telnet console

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  http 10.0.0.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmst cold start

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

  308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130

  010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a

  30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

  13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504

  0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

  20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269

  65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d

  65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

  30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b

  30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

  496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65

  74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332

  68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329

  302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f

  63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d

  010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597

  a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

  9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc

  7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

  15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

  1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd

  18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

  4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

  81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201

  082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868

  7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101

  ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff

  45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777

  2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a

  1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406

  03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973

  69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403

  02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1

  6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b

  c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973

  69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30

  1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603

  445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04

  1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d

  2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101

  4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e

  b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a

  99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018

  481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16

  b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0

  5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8

  6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28

  6c2527b9 deb78458 c61f381e a4c4cb66

  quit smoking

  Telnet 10.0.0.0 255.255.255.0 inside

  Telnet timeout 5

  SSH timeout 5

  SSH group dh-Group1-sha1 key exchange

  Console timeout 0

  dhcpd outside auto_config

  !

  dhcpd address 10.0.0.10 - 10.0.0.132 inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  username

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  inspect the pptp

  World-Policy policy-map

  class class by default

  inspect the pptp

  !

  service-policy-international policy global

  context of prompt hostname

  anonymous reporting remote call

  Cryptochecksum:59ea3f04159c32cce049d9654c6ade4d

  : end

  ITEFW01 #.

  I have to admit that I don't know if PPTP requires nothing else was open.

  But the most common problem is usually lack the "inspect pptp" you have.

  I suggest you simply followed the ASA through the ASDM while trying the VPN connection to eliminate situations where the firewall might block connections

  There isn't a lot of NAT rules on the firewall itself that I can't prevent connections

  You can use the command "packet - trace" to ensure that the firewall (or would rather) to certain connection tent

  entry Packet-trace out tcp 1.2.3.4 1234

  -Jouni

• Problem with GRE over IPsec with IOS Version 15.1 (2) T4

  Hello

  We have several sites that use of GRE Tunnels with card crypto for encryption.  To upgrade to the latest version of a UC-520 (15.1 (2) T4 or any version of this train) I get the following error: -.

  SIN-UC520(config-if) #crypto map aberdeen

  % NOTE: crypto card is configured on the tunnel interface.

  Currently, only one card encryption GDOI is supported on the tunnel interface.

  The original Tunnel config is below:-

  interface Tunnel0

  Description Tunnel to Aberdeen AC

  bandwidth of 512

  IP unnumbered Vlan1

  IP mtu 1420

  QoS before filing

  tunnel source a.b.c.d

  destination e.f.g.h tunnel

  Crypto map aberdeen

  Decommissioning of the IOS version solves the problem.   What gives?  Have Cisco dropped support for this configuration?

  I use this setup so I can choose exactly which traffic is encrypted (I do not encrypt voice for example).

  Thank you
  Peter.

  Hi Peter,.

  It looks like from the 15.1 this configuration is no longer supported. Here's what the release notes:

  Error message appears when you try to apply the tunnel interface to a card encryption.

  Old behavior: Error Message is not displayed when you try to apply tunnel interface card encryption using the command card crypto (interface IPSec).

  New behavior: an error message appears when you try to apply the tunnel interface to a crypto map using the

  crypto map command (interface IPSec).

  http://www.Cisco.com/en/us/docs/iOS/15_1/release/notes/151TNEWF.html

  The order reference has the following information about the error message:

  

  A card encryption cannot be applied to a tunnel interface. If you try to apply the tunnel interface to a card encryption, an error message is displayed as follows: crypto card is configured on the tunnel interface. Currently, only card crypto Group domain of interpretation (GDOI) is supported on the tunnel interface.

  http://www.Cisco.com/en/us/docs/iOS/Security/command/reference/sec_c4.html#wp1078283

  So it seems that on the new version, you can only use one (new to me) maps crypto GDOI on your tunnel interfaces.

  Here's a doc that explains the GDOI implementation, I wish that I could help with the Setup, but as I said, I had not heard of him until today.

  http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6660/ps6811/prod_white_paper0900aecd804c363f.html

  I hope this clarifies your questions.

  Raga

• Problem with GRE

  Hi all

  Basically, I have a vpn between a branch and central, it works fine but sometimes the GRE tunnels are off and stops working vpn. With reset solved, but the problem persists sometimes from time to time the way... is not a problem of saturation, because little traffic through the help of routerAny will be welcomeRegards

  Configure the gre with a keepalive tunnel.

  Sent by Cisco Support technique iPad App

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• Problem with IPSec GRE tunnel

  Hello, I have a radio link with a branch, but the link to the provider is not approved to set up a Tunnel GRE + IPSec, but I get that this log in my router.

  % CRYPTO-4-PKT_REPLAY_ERR: decrypt: re-read the verification failed

  The topology is:

  Router 1 C3825 IOS 12.4 (25f) Fa0/2/2 - link radio - router 2 C3825 IOS 15.1 (4) M4 Gi0/1

  I get the logs into the Router 1 only.

  Configurations are:

  Router 1:

  crypto ISAKMP policy 1

  BA aes

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key Andina12 address 172.20.127.114

  invalid-spi-recovery crypto ISAKMP

  !

  !

  Crypto ipsec transform-set TS aes - esp esp-md5-hmac

  !

  Profile of crypto ipsec protected-gre

  86400 seconds, life of security association set

  game of transformation-TS

  interface Tunnel0

  Description IPSec Tunnel of GRE a Víbora

  bandwidth 2000

  IP 172.20.127.117 255.255.255.252

  IP 1400 MTU

  IP tcp adjust-mss 1360

  tunnel source 172.20.127.113

  tunnel destination 172.20.127.114

  protection ipsec profile protected-gre tunnel

  interface FastEthernet0/2/2

  Description RadioEnlace a Víbora

  switchport access vlan 74

  bandwidth 2000

  No cdp enable

  interface Vlan74

  bandwidth 2000

  IP 172.20.127.113 255.255.255.252

  Router eigrp 1

  network 172.20.127.116 0.0.0.3

  Router 2:

  crypto ISAKMP policy 1

  BA aes

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key Andina12 address 172.20.127.113

  !

  !

  Crypto ipsec transform-set TS aes - esp esp-md5-hmac

  !

  Profile of crypto ipsec protected-gre

  86400 seconds, life of security association set

  game of transformation-TS

  interface Tunnel0

  Description IPSec Tunnel of GRE a CSZ

  bandwidth 2000

  IP 172.20.127.118 255.255.255.252

  IP 1400 MTU

  IP tcp adjust-mss 1360

  tunnel source 172.20.127.114

  tunnel destination 172.20.127.113

  protection ipsec profile protected-gre tunnel

  interface GigabitEthernet0/1

  Description Radio Enlace a CSZ

  bandwidth 2000

  IP 172.20.127.114 255.255.255.252

  automatic duplex

  automatic speed

  media type rj45

  No cdp enable

  Router eigrp 1

  network 172.20.127.116 0.0.0.3

  Thanks for the help.

  Yes, you can have just as configured:

  Crypto ipsec transform-set esp - aes TS

  transport mode

  Be sure to change it on both routers.

• Problem of IPSEC GRE tunnel

  Hello cracks!

  I configured a tunnel of ipsec between 2 sites with free will and ospf.

  The tunnel is up successfully and routes to ospf are correct and I ping at all sites, but http applications works very well.

  The first thing I it was an MTU problem.

  I started to do ping to a remote host with DF bit increase the size of the package to get the classic message, This is the necessary fragment

  but when I did a ping with 1400 f I ask expire.

  What could be the problem? It is the configuration of the tunnel.

  The tunnel is established between the 2 internet lines (10 MB and 30 MB)...

  Thank you very much...

  interface Tunnel0

  Description $FW_INSIDE$

  IP 10.29.0.9 255.255.255.252

  IP access-group 103 to

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP ospf cost 150

  source of tunnel GigabitEthernet0/1

  tunnel destination publicip

  !

  Tunnel1 interface

  IP 10.29.0.5 255.255.255.252

  IP access-group 103 to

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP mtu 1420

  IP ospf cost 150

  source of tunnel GigabitEthernet0/1

  tunnel destination publicip

  Albert,

  Say 'he' doesn't work is no help :-)

  As I said, it's time to take a trace of sniffer ideally on both sides to compare what is happening, not to guess what you're fixing - diagnose.

  M.

• R7000 PPTP VPN works not

  I have a windows VPN (PPTP) Server behimd my Nighthawk R7000 router but the router does not allow for VPN passthrough? Any ideas?

  I have port 47 GRE TCP/UDP and TCP 1723/UDP sent to my IP address of the VPN server. Am I missing something? It be a checkbox to enable VPN passthrough but I don't see on the R7000 nighthawk? Its not me to VPN in my network. Help, please. Once again it is for Windows VPN not the customer to Open VPN (that I don't want to use)

  Yes, I have forwarded manually and yes I have chosen pptp vpn in the drop down menu. I managed to solve the problem though! I just removed the pptp vpn service from the drop down and added service pptp again and now everything works fine.

• WRT160N V2 multiple PPTP connections

  Hello

  I have a problem, try to connect multiple computers to a PPTP VPN.

  I have a WRT160N connected to the internet with the option of Automatic Configuration - DHCP

  2 computers behind the router to get IP from the router via DHCP

  I can connect to a computer, without any

  problems.

  When I try to connect with my second computer freezes just the connections.

  I read it has todo with GRE packets, or almost, I'm not an expert in network so

  This information is enough for me, my questions are:

  1 - is it possible to use this router and have more than one connected computer

  to the VPN?

  2 - If not is there any other wireless router I can use to fix this?

  Any help will be greatly welcomed

  Thanks in advance

  Tonio

  It depends on. It should be possible to connect to two different PPTP servers in the internet.

  It is not possible to connect two computers on the same PPTP server via a NAT router. This is simply because the router should dig a lot deeper in the GRE to distinguish traffic Grateful for two client connections between the PPTP server and the router's public IP address.

• VPN to Pix problem

  It seems that I have problems similar to many others in the connection of remote clients to a PIX 515E.

  Currently, I have tried both the client VPN Cisco 3.6 and 4.03 without success. Users are authenticated very well and the customer, you can see that their assigned an address etc but they are unable to access the internal network. The crypto ipsec his watch HS no encrypted traffic has affected the Pix as its...

  within the State of the customer etc., it shows that packets are encrypted so I'm at a bit of a loss.

  I have also a problem with pptp connections - this seems to differ between the BONES on the client but Win2K machines can connect and get checked etc but again failed to connect within the networks. These could be linked?

  My current config is: (change of address, etc.)

  SH run

  : Saved

  :

  PIX Version 6.2 (1)

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  nameif ethernet2 security10 intf2

  enable password xxxx

  passwd xxxx

  hostname fw

  domain name

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol 2000 skinny

  No fixup protocol sip 5060

  names of

  name Inside_All 10.0.0.0

  name 10.30.1.0 Ireland1_LAN

  name 159.135.101.34 Ireland1_VPN

  name 213.95.227.137 IrelandSt1_VPN

  name 10.30.2.0 Cardiff_LAN

  name 82.69.56.30 Cardiff_VPN

  access-list 101 permit ip Inside_All 255.0.0.0 10.1.1.88 255.255.255.248

  access-list 101 permit ip Ireland1_LAN 255.255.255.0 255.0.0.0 Inside_All

  access-list 101 permit ip Cardiff_LAN 255.255.255.0 255.0.0.0 Inside_All

  access-list 101 permit ip Inside_All 255.0.0.0 10.30.3.0 255.255.255.0

  access-list 101 permit ip Inside_All 255.0.0.0 192.168.253.0 255.255.255.0

  outside_interface list access permit icmp any any echo

  outside_interface list access permit icmp any any echo response

  outside_interface list of access permit icmp any any traceroute

  outside_interface list access permit tcp any host 212.36.237.99 eq smtp

  outside_interface ip access list allow any host 212.36.237.100

  access-list permits outside_interface tcp host 212.241.168.236 host 212.36.237.101 eq telnet

  outside_interface list of access permitted tcp 192.188.69.0 255.255.255.0 host 212.36.237.101 eq telnet

  outside_interface list access permit tcp any any eq telnet

  allow the ip host 82.69.108.125 access list outside_interface a

  access-list 102 permit ip 10.1.1.0 255.255.255.0 Ireland1_LAN 255.255.255.0

  access-list 103 allow ip 10.1.1.0 255.255.255.0 Cardiff_LAN 255.255.255.0

  access-list 104. allow ip 10.1.1.0 255.255.255.0 10.30.3.0 255.255.255.0

  pager lines 24

  opening of session

  recording of debug console

  monitor debug logging

  interface ethernet0 10baset

  interface ethernet1 10baset

  Automatic stop of interface ethernet2

  Outside 1500 MTU

  Within 1500 MTU

  intf2 MTU 1500

  IP outdoor 212.36.237.98 255.255.255.240

  IP address inside 10.1.1.250 255.255.255.0

  intf2 IP address 127.0.0.1 255.255.255.255

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool ippool 10.1.1.88 - 10.1.1.95

  IP local pool mspool 10.7.1.1 - 10.7.1.50

  IP local pool mspools 192.168.253.1 - 192.168.253.50

  location of PDM Inside_All 255.255.255.0 inside

  location of PDM 82.69.108.125 255.255.255.255 outside

  location of PDM 10.55.1.0 255.255.255.0 inside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  public static 212.36.237.100 (Interior, exterior) 10.1.1.50 netmask 255.255.255.255 0 0

  public static 212.36.237.101 (Interior, exterior) 10.1.1.254 netmask 255.255.255.255 0 0

  public static 212.36.237.99 (Interior, exterior) 10.1.1.208 netmask 255.255.255.255 0 0

  Access-group outside_interface in interface outside

  Route outside 0.0.0.0 0.0.0.0 212.36.237.97 1

  Route inside Inside_All 255.255.255.0 10.1.1.254 1

  Route inside 10.2.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.3.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.4.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.5.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.6.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.7.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.8.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.9.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.10.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.11.1.0 255.255.255.0 10.1.1.253 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

  Timeout uauth 0:00:00 uauth absolute 0:30:00 inactivity

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  AAA-server AuthInOut Protocol Ganymede +.

  AAA-server AuthInOut (inside) host 10.1.1.203 Kinder timeout 10

  the AAA authentication include http outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  the AAA authentication include http inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  AAA accounting include http outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  AAA accounting include http inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  Enable http server

  http 82.69.108.125 255.255.255.255 outside

  http 10.1.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server SNMP community xxx

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac VPNAccess

  Crypto ipsec transform-set esp-3des esp-md5-hmac VPNAccess2

  Crypto-map dynamic dynmap 10 game of transformation-VPNAccess2

  card crypto home 9 ipsec-isakmp dynamic dynmap

  card crypto ipsec-isakmp 10 home

  address of 10 home game card crypto 102

  set of 10 House card crypto peer IrelandSt1_VPN

  House 10 game of transformation-VPNAccess crypto card

  card crypto ipsec-isakmp 15 home

  address of home 15 game card crypto 103

  set of 15 home map crypto peer Cardiff_VPN

  House 15 game of transformation-VPNAccess crypto card

  card crypto ipsec-isakmp 30 home

  address of 30 home game card crypto 104

  crypto home 30 card set peer 212.242.143.147

  House 30 game of transformation-VPNAccess crypto card

  interface card crypto home outdoors

  ISAKMP allows outside

  ISAKMP key * address IrelandSt1_VPN netmask 255.255.255.255

  ISAKMP key * address Cardiff_VPN netmask 255.255.255.255

  ISAKMP key * address 212.242.143.147 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 5

  ISAKMP strategy 5 3des encryption

  ISAKMP strategy 5 md5 hash

  5 2 ISAKMP policy group

  ISAKMP life duration strategy 5 86400

  part of pre authentication ISAKMP policy 7

  ISAKMP strategy 7 3des encryption

  ISAKMP strategy 7 sha hash

  7 2 ISAKMP policy group

  ISAKMP strategy 7 life 28800

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 1 ISAKMP policy group

  ISAKMP policy 10 life 85000

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 85000

  vpngroup client address mspools pool

  vpngroup dns-server 194.153.0.18 client

  vpngroup wins client-server 10.155.1.16

  vpngroup idle time 1800 customer

  vpngroup customer password *.

  Telnet 82.69.108.125 255.255.255.255 outside

  Telnet 10.55.1.0 255.255.255.0 inside

  Telnet 10.1.1.0 255.255.255.0 inside

  Telnet timeout 15

  SSH 82.69.108.125 255.255.255.255 outside

  SSH timeout 15

  VPDN Group 6 accept dialin pptp

  PAP VPDN Group 6 ppp authentication

  VPDN Group 6 chap for ppp authentication

  VPDN Group 6 ppp mschap authentication

  VPDN Group 6 ppp encryption mppe auto

  VPDN Group 6 client configuration address local mspools

  VPDN Group 6 pptp echo 60

  local 6 VPDN Group client authentication

  VPDN username xxxx password *.

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN username xxxx password *.

  VPDN allow outside

  username xxx pass xxx

  Terminal width 80

  Cryptochecksum:8f8ceca91c6652e3cc8086edc8ed62fa

  : end

  If you do not see decrypts side Pix while my thoughts are (for IPSEC) ESP and GRE (for PPTP) do not get to your Pix (blocks perhaps of ISP or other devices).

  If you do a "capture" of the packets on the external interface you see all traffic ESP or GRE? Where the customer? If this isn't the case, dialup is ESP or permitted GRE?