Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

Similar Questions

• Using Loopback Interface as Source GRE/IPSec tunnel

  Hi all:

  I need one to spend a working router to router VPN tunnel using an IP WAN IP interface loopback as a source.  I am able to ping the loopback from the other router.  As soon as I change the source of tunnel to use the loopback IP address, change the encryption ACL map, and move the cryptographic card of the WAN interface to the loopback interface, the tunnel will not come to the top.  If I remove all the crypto config, the tunnel comes up fine as just a GRE tunnel.  On the other router, I see the message that says that's not encrypting the traffic below.

  * 00:10:33.515 Mar 1: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet. (ip) vrf/adr_dest = 192.168.0.1, src_addr = 192.168.1.2, prot = 47

  What Miss me?  Is there something else that needs to be done to use the closure of a GRE/IPSec tunnel?

  I have install below config in the laboratory to see if I can get it even work in a non-production environment.

  R1 WAN IP: 192.168.0.1

  R2 WAN IP: 192.168.0.2

  R2 Closure: 192.168.1.2

  hostname R2

  !

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key abc123 address 192.168.0.1

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac T1

  transport mode

  !

  crypto map 1 VPN ipsec-isakmp

  Description remote control

  defined peer 192.168.0.1

  game of transformation-T1

  match address VPN1

  !

  interface Loopback0

  IP 192.168.1.2 255.255.255.255

  VPN crypto card

  !

  Tunnel1 interface

  IP 172.30.240.2 255.255.255.252

  IP mtu 1440

  KeepAlive 10 3

  tunnel source 192.168.1.2

  tunnel destination 192.168.0.1

  VPN crypto card

  !

  interface FastEthernet0

  IP 192.168.0.2 255.255.255.0

  !

  VPN1 extended IP access list

  allow ACCORD 192.168.1.2 host 192.168.0.1

  you have tried to add "card crypto VPN 1 - address Loopback0".

• Public static IPsec tunnel between two routers cisco [VRF aware]

  Hi all

  I am trying to configure static IPsec tunnel between two routers. Router R1 has [no VRF] only global routing table.

  Router R2 has two routing tables:

  * vrf INET - used for internet connectivity

  * global routing table - used for VPN connections

  Here are the basic configs:

  R1

  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  ISAKMP crypto key 7V7u841k2D3Q7v98d6Y4z0zF address 203.0.0.3
  invalid-spi-recovery crypto ISAKMP
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
  transport mode
  !
  Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
  game of transformation-TRSET_AES-256_SHA
  !
  interface Loopback0
  10.0.1.1 IP address 255.255.255.255
  IP ospf 1 zone 0
  !
  interface Tunnel0
  IP 192.168.255.34 255.255.255.252
  IP ospf 1 zone 0
  source of tunnel FastEthernet0/0
  tunnel destination 203.0.0.3
  ipv4 ipsec tunnel mode
  Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
  !
  interface FastEthernet0/0
  IP 102.0.0.1 255.255.255.0

  !

  IP route 203.0.0.3 255.255.255.255 FastEthernet0/0 102.0.0.2

  #######################################################

  R2

  IP vrf INET
  RD 1:1
  !
  Keyring cryptographic test vrf INET
  address of pre-shared-key 102.0.0.1 key 7V7u841k2D3Q7v98d6Y4z0zF
  !
  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  invalid-spi-recovery crypto ISAKMP
  crypto isakmp profile test
  door-key test
  function identity address 102.0.0.1 255.255.255.255
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
  transport mode
  !
  Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
  game of transformation-TRSET_AES-256_SHA
  Test Set isakmp-profile
  !
  interface Loopback0
  IP 10.0.2.2 255.255.255.255
  IP ospf 1 zone 0
  !
  interface Tunnel0
  IP 192.168.255.33 255.255.255.252
  IP ospf 1 zone 0
  source of tunnel FastEthernet0/0
  tunnel destination 102.0.0.1
  ipv4 ipsec tunnel mode
  tunnel vrf INET
  Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
  !
  interface FastEthernet0/0
  IP vrf forwarding INET
  IP 203.0.0.3 255.255.255.0

  !

  IP route 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

  #######################################################

  There is a router between R1 and R2, it is used only for connectivity:

  interface FastEthernet0/0
  IP 102.0.0.2 255.255.255.0
  !
  interface FastEthernet0/1
  IP 203.0.0.2 255.255.255.0

  The problem that the tunnel is not coming, I can't pass through phase I.

  The IPsec VPN are not my strength. So if someone could show me what mistake I make, I'd appreciate it really.

  I joined ouptup #debug R2 crypto isakmp

  Source and destination Tunnel0 is belong to VRF INET, the static route need to be updated.

  IP route vrf INET 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

  crypto isakmp profile test

  VRF INET

  door-key test
  function identity address 102.0.0.1 255.255.255.255

• IPSec tunnel between a client connection mobility and WRV200

  Someone has set up an IPSec tunnel between a client connection mobility and WRV200? I can't get the right configuration.

  Agitation, these products are treated by the Cisco Small Business support community. Please refer to the URL: https://supportforums.cisco.com/community/netpro/small-business

• IPSEC tunnel between 2 7606 PE

  I am creating an IPSec tunnel between two 7606 PE routers... get this error when I ping everywhere and if I start using the path descends LDP.

  12 Nov 16:32:22.801 IS: IPSEC (key_engine): request timer shot: count = 1,.

  local (identity) = 10.10.135.1, distance = 10.10.135.2.

  local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)

  12 Nov 16:32:22.801 IS: IPSEC (sa_request):,.

  (Eng. msg key.) Local OUTGOING = 10.10.135.1, distance = 10.10.135.2.

  local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  Protocol = ESP, transform = NONE (Tunnel),

  lifedur = 190 s and 4608000 Ko,.

  SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0

  12 Nov 16:32:22.801 IS: ISAKMP: (0): profile of ITS application is test

  12 Nov 16:32:22.801 IS: ISAKMP: created a struct peer 10.10.135.2, peer port 500

  12 Nov 16:32:22.801 IS: ISAKMP: new position created post = 0x5326A08C peer_handle = 0x8000001A

  12 Nov 16:32:22.801 IS: ISAKMP: lock struct 0x5326A08C, refcount 1 to peer isakmp_initiator

  12 Nov 16:32:22.801 IS: ISAKMP: 500 local port, remote port 500

  12 Nov 16:32:22.801 IS: ISAKMP: impossible to allocate IKE SA

  12 Nov 16:32:22.801 IS: ISAKMP: Unlocking counterpart struct 0x5326A08C for isadb_unlock_peer_delete_sa(), count 0

  12 Nov 16:32:22.801 IS: ISAKMP: delete peer node by peer_reap for 10.10.135.2: 5326A08C

  12 Nov 16:32:22.801 IS: ISAKMP: (0): purge SA., his = 0, delme = 532E8364

  PE2 #.

  12 Nov 16:32:22.801 IS: ISAKMP: error during the processing of HIS application: failed to initialize SA

  12 Nov 16:32:22.801 IS: ISAKMP: error while processing message KMI 0, error 2.

  12 Nov 16:32:22.801 IS: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

  PE2 #.

  12 Nov 16:32:52.801 IS: IPSEC (key_engine): request timer shot: count = 2,.

  local (identity) = 10.10.135.1, distance = 10.10.135.2.

  local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)

  IPsec only is not supported on the 6500 and 7600 without module series IPsec (IPsec-SPA or VPNSM), sorry.

• IPSec tunnels between duplicate LAN subnets

  Hi all

  Please help to connect three sites with our Central site has all the resources for users, including internet access.

  The three sites will be the ASA 5505 like their WAN device.

  We need to know is - it possible, allowing to configure an IPsec Tunnel between the three ASA with duplicate LAN subnets.

  Central site two networks 192.168.1.x 24, 192.168.100.x 24

  Distance a 24 192.168.1.x subnet

  Two remote a subnet 192.168.100.x 24

  If it is possible we also do hair distance one ping, above two remote to the Central Site to access internet, what sites need are on the Central Site, including e-mail, network, other resource also records.

  We have no other way to make this network, as all security is on our Central Site, website filtering, Application filtering, filtering of network traffic all.

  We understand that we can change two remote sites to a different subnet from the Central Site, but we have so many host devices, it will take weeks or months, so to change the MS AD domain for all users, servers too.

  We really need your expertise to do this in a laboratory and then in production.

  Thank you

  Hello Stephen,

  You can check the following links for the subnets overlap talk to each other:-

  1 LAN-to-LAN IPsec VPN with overlapping networks

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080b37d0b.shtml

  2 IPsec between two IOS routers with overlapping of private networks

  http://www.Cisco.com/en/us/products/ps5855/products_configuration_example09186a0080a0ece4.shtml

  Important point is local network must connect to the remote network via the translated addresses.

  for example, you won't be ablt to use real IP of the communication.

  For haripinning or turning U:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  Hope that helps.

  Kind regards

  Dinesh Moudgil

• I can weight of the IPSec Tunnels between ASAs

  Hello

  Remote site: link internet NYC 150 MB/s

  Local site: link internet Baltimore 400 MB/s

  Backup site: link internet Washington 200 Mb/s

  My main site and my backup site are connected via a gigabit Ethernet circuit between the respective base site switches.  Each site has its own internet connection and my OSPF allows to switch their traffic to the backup site if the main website is down.  We are opening an office in New York with one ASA unique connected to 150 Mbps FIOS internet circuit.  We want to set up an IPSec tunnel on the main site and the backup on the remote site, but want the remote site to prefer the tunnel in Baltimore, except if it is down.

  Interesting traffic would be the same for the two tunnels

  I know that ASA cannot be a GRE endpoint.  How can I force the New York traffic through the tunnel in Baltimore as long as it works?  An IPSec tunnel can be weighted?

  Thank you

  It is not in itself weighting, but you can create up to 10 backup over LAN to LAN VPN IPsec peers.

  For each tunnel, the security apparatus tried to negotiate with the first peer in the list. If this peer does not respond, the security apparatus made his way to the bottom of the list until a peer responds, or there is no peer more in the list.

  Reference.

• NAT in the IPSec tunnel between 2 routers x IOS (877)

  Hi all

  We have a customer with 2 x 877 routers connected to the internet. These routers are configured with an IPSec tunnel (which works fine). The question is the inbound static NAT translation problems with the tunnel - port 25 is mapped to the address inside the mail server. The existing configuration works very well for incoming mail, but prevents users from access to the direct mail server (using the private IP address) on port 25.

  Here is the Config NAT:

  nat INET_POOL netmask 255.255.255.252 IP pool

  IP nat inside source map route INET_NAT pool INET_POOL overload

  IP nat inside source static tcp 10.10.0.8 25 25 expandable

  IP nat inside source static tcp 10.10.0.8 80 80 extensible

  IP nat inside source static tcp 10.10.0.8 443 443 extensible

  IP nat inside source static tcp 10.10.0.7 1433 1433 extensible

  IP nat inside source static tcp 10.10.0.7 extensible 3389 3389

  allowed INET_NAT 1 route map

  corresponds to the IP 101

  access-list 101 deny ip 10.10.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 101 permit ip 10.10.0.0 0.0.0.255 any

  On the SAA, I would setup a NAT exemption, but how do I get the same thing in the IOS?

  See you soon,.

  Luke

  Take a look at this link:

  http://www.Cisco.com/en/us/docs/iOS/12_2t/12_2t4/feature/guide/ftnatrt.html

  Concerning

  Farrukh

• Problem with the HP 430 (bluetooth and teredo tunneling Pseudo-Interface) drivers

  Hello

  recently my bluetooth function cannot to connect to other devices... This is what happens to the Device Manager:

  

  What is teredo tunneling pseudo-interface is for? is it important?
  If so, how to solve this problem?
  How to solve the problem of the bluetooth?

  Generic Bluetooth adapter:
  USB\VID_03F0 & PID_311D & REV_0001
  USB\VID_03F0 & PID_311D

  Teredo tunneling pseudo-Interface:

  * TEREDO

  Go to Device Manager, right click on the device and select Update driver. Path to the .inf file that you downloaded for use.

• Traffic is failed on plain IPSec tunnel between two 892 s

  Have a weird case and you are looking for some suggestions/thougs where to dig because I have exhausted the options.

  Note: I replaced the Networkid real to a mentined below.

  Topology: a classic IPSec VPN tunnel between two 892 s of Cisco, with pre-shared key and no GRE. A 892 (branch_892) has access to the Internet using PPPoE and has three network / VLAN behind it. A VLAN is coordinated to the PPPoE internet access. Access to the other two VLAN - VL92 (100.100.200.0/24) and VL93 (100.100.100.0/24) is performed via the VPN tunnel.

  Second 892 (892_DC) has just one interface - WAN on Gigabit enabled/connected and a static route to the default GW. It doesn't have any defined interal network. If the router is strictly used to send traffic to VL92/VL93 to the domestic 892 via IPSec tunnel.

  Here's the problem: access to VL93 (100.100.100.0/24) works, however for VL92 (100.100.100.0/24) - does not work.

  Devices in VL92 I ping IP address of 892_DC through the VPN tunnel. The 892_DC router I can ping devices in VL92. However, I can't VL92 ping any device beyond the 892_DC and at the same time the packets arriving on 892_DC for VL92 are not sent through the VPN tunnel.

  I took the package trace on 892_DC using capture point/buffer to nathalie caron to VL92 packages and saw that the traffic coming to the 892_DC. I run the nathalie caron even on Branch_892, and there was not a single package.

  So... What's the problem? More interesting, I modified the way left on VL92 access list and still - no packets are sent through the tunnel.

  Any idea? Two routers config are below

  -------

  892_DC #show ru

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 1.2.3.4

  ISAKMP crypto keepalive 10 periodicals

  !

  address of 1.2.3.4 crypto isakmp peers

  Description of-COIL-892

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 1.2.3.4

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match a lists 101

  market arriere-route

  QoS before filing

  !

  interface GigabitEthernet0

  IP 10,20,30,40 255.255.255.240

  IP 1400 MTU

  IP tcp adjust-mss 1360

  automatic duplex

  automatic speed

  card crypto IT-IPSec-Crypto-map

  !

  IP route 0.0.0.0 0.0.0.0 10.20.30.41

  !

  access list 101 ip allow any 100.100.100.0 0.0.0.255 connect

  access list 101 ip allow any 100.100.200.0 0.0.0.255 connect

  -------------------------------------------------------------------------------------

  Branch_892 #sh run

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 10,20,30,40

  ISAKMP crypto keepalive 10 periodicals

  !

  address peer isakmp crypto 10,20,30,40

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 10,20,30,40

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match address 101

  market arriere-route

  QoS before filing

  !

  FastEthernet6 interface

  Description VL92

  switchport access vlan 92

  !

  interface FastEthernet7

  Description VL93

  switchport access vlan 93

  !

  interface GigabitEthernet0

  Description # to WAN #.

  no ip address

  automatic duplex

  automatic speed

  PPPoE-client dial-pool-number 1

  !

  interface Vlan1

  Description # local to #.

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  interface Vlan92

  Description fa6-nexus e100/0/40

  IP 100.100.200.1 255.255.255.0

  !

  interface Vlan93

  Description fa7-nexus e100/0/38

  IP 100.100.100.1 255.255.255.0

  !

  interface Dialer0

  no ip address

  No cdp enable

  !

  interface Dialer1

  IP 1.2.3.4 255.255.255.248

  IP mtu 1454

  NAT outside IP

  IP virtual-reassembly in max-pumping 256

  encapsulation ppp

  IP tcp adjust-mss 1414

  Dialer pool 1

  Dialer-Group 1

  Authentication callin PPP chap Protocol

  PPP chap hostname ~ ~ ~

  PPP chap password =.

  No cdp enable

  card crypto IT-IPSec-Crypto-map

  !

  Dialer-list 1 ip protocol allow

  !

  access-list 101 permit ip 100.100.100.0 0.0.0.255 any

  access-list 101 permit ip 100.100.200.0 0.0.0.255 any

  !

  IP route 0.0.0.0 0.0.0.0 Dialer1

  Yes correct sounds - so another possible problem is the routing is routing 100% correct on both sides? Can you put the two sides config for review?

• IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

  Hello

  My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

  "Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

  NAT takes place before the encryption verification!

  In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

  Thanks for any help

  Best regards

  Heiko

  Hello

  Try to change your static NAT with static NAT based policy.

  That is to say the static NAT should not be applicable for VPN traffic

  permissible static route map 1

  corresponds to the IP 104

  access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

  access-list 104 allow the host ip 10.1.110.10 all

  IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

  HTH

  Kind regards

  GE.

• IPSec tunnel between 2 routers

  Hello

  I am trying to configure an IPSec VPN tunnel between 2 routers Cisco, connected to the internet via the ATM interface, my router is a 1841 with the network 10.200.36.0 address the remote router is a Cisco network 192.168.9.0 address with 877.

  I have tryied to follow some tutorials, unsuccessfully, because I can't always ping all IP addresses on the remote network and also the VPN tunnel is not up!

  Can help you please give me a configuration model, or maybe let me know how to configure step by step on mine and remote router?

  Thank you very much!

  Concerning

  Riccardo

  Here is an example. x.x.x.x and y.y.y.y are the public IPs of routers:

  ROUTER1 hostname

  !

  crypto ISAKMP policy 10

  BA aes 256

  AUTH pre

  Group 5

  !

  ISAKMP crypto key cisco1234 address y.y.y.y

  !

  Crypto ipsec transform-set ESP-AES256-SHA1 esp - aes 256 esp-sha-hmac

  !

  Profile of crypto ipsec TunnelProfile

  the transform ESP-AES256-SHA1 value

  !

  interface Tunnel0

  IP 10.255.255.0 255.255.255.254

  tunnel Dialer source 0

  tunnel destination y.y.y.y

  ipv4 ipsec tunnel mode

  Tunnel TunnelProfile ipsec protection profile

  !

  interface Dialer0

  IP x.x.x.x

  !

  IP route 192.168.9.0 255.255.255.0 Tunnel0

  hostname ROUTER2

  !

  crypto ISAKMP policy 10

  BA aes 256

  AUTH pre

  Group 5

  !

  ISAKMP crypto cisco1234 key address x.x.x.x

  !

  Crypto ipsec ESP-AES256-SHA1 transform-set esp - aes 256 esp-sha-hmac

  !

  Profile of crypto ipsec TunnelProfile

  the transform ESP-AES256-SHA1 value

  !

  interface Tunnel0

  IP 10.255.255.1 255.255.255.254

  tunnel Dialer source 0

  tunnel destination x.x.x.x

  ipv4 ipsec tunnel mode

  Tunnel TunnelProfile ipsec protection profile

  !

  interface Dialer0

  IP address y.y.y.y

  !

  IP route 10.200.36.0 255.255.255.0 Tunnel0

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Double IPSec tunnel between routers

  I am facing the following challenge:

  I have two routers and want to build two IPSec encapsulated between them, with the help of ASIT tunnel interfaces.

  The interaces two tunnel would in that case the same source and destination ip addresses.

  With a single tunnel interface defined, it works well, however, as soon as the second tunnel interface is defined, the first breaks down.

  Here is an example configuration:

  interface Tunnel0
  IP 192.168.1.1 255.255.255.252
  source of tunnel Serial1/0
  tunnel destination 10.1.1.6
  ipv4 ipsec tunnel mode
  protection of ipsec profile ipsecprofile tunnel
  !
  Tunnel1 interface
  IP 192.168.1.5 255.255.255.252
  source of tunnel Serial1/0
  tunnel destination 10.1.1.6
  ipv4 ipsec tunnel mode
  protection of ipsec profile ipsecprofile tunnel
  !

  In fact, the matter is rather a conceptual issue than a direct. What is the root cause, this type of configuration does not work?

  ESP protocol is the distinction between endponits ESP SAs based on SPI identifier as well, isn't? If so, what is wrong here?

  Thanks in advance...

  Hi Frank,.

  As a general rule, you cannot have two interfaces of tunnel with the same tunnel source (series 1/0) and destinations (10.1.1.6) tunnel; with the same method (ipv4) tunel.

  The work around that would be to bounce one of the tunnels on a loopback interface.

  This tunnel 1: tunnel_interface_1 - series 1/0---internet---10.1.1.6

  and tunnel 2: tunnel_interface_2---loopback---serial1/0---internet---10.1.1.6

  In this way the two tunnels can be up at the same time.

  I hope this helps.

  -Shrikant

  P.S.: Please check question one answer, if it has been resolved. Note the useful messages. Thank you.

• Problem in the establishment of the IPs of various NICs through Set-OSCustomizationNicMapping

  I need to create multiple VMs to Linux from a few different models and I would use a customization specification profile. The VM model has 3 NIC in 3 different VLANS, the 3rd is not suppposed to have a default gateway (which is not my main problem). Cloning via vCenter works, after I provide the IPs 3 virtual machine is cloned correctly.

  However, this script, I try this code:

  $custSpec = get-OSCustomizationSpec "D1 RedHat | New-OSCustomizationSpec-name "xyz".
  $custSpec | Get-OSCustomizationNicMapping | Game-OSCustomizationNicMapping - IpMode UseStaticIP-position 1 IP address - 10.70.236.99 - mask subnet 255.255.255.0 - DefaultGateway 10.70.236.1
  $custSpec | Get-OSCustomizationNicMapping | Game-OSCustomizationNicMapping - IpMode UseStaticIP-position 2 - IpAddress 10.70.237.99 - mask subnet 255.255.255.0 - DefaultGateway 10.70.237.1
  $custSpec | Get-OSCustomizationNicMapping | Game-OSCustomizationNicMapping - IpMode UseStaticIP-position 3 - IpAddress 10.10.10.99 - mask subnet 255.255.255.0 - DefaultGateway 10.10.10.1
  $custSpec | Get-OSCustomizationNicMapping

  gives some problems with PowerCLI 4.1U1. The first Set-OSCustomizationNicMapping command sets the IP address correctly, but the 2nd and the 3rd gives:

  Game-OSCustomizationNicMapping: 14/04/2011-16:23:10 Set-OSCustomizationNicMapping the Posiotion of the object property has changed. This property represents a portion of the Id of the object, so this operation is ambiguous. Please get the new object and run the operation.
  At line: 1 char: 74
  + $custSpec | Get-OSCustomizationNicMapping | Game-OSCustomizationNicMapping < < < < - IpMode UseStaticIP-position 2 - IpAddress 10.70.237.99 - mask subnet 255.255.255.0 - DefaultGateway 10.70.237.1
  + CategoryInfo: ResourceUnavailable: (:)) [game-OSCustomizationNicMapping], VimException)
  + FullyQualifiedErrorId: Client20_ObjectVersionService_VerifyIsCurrentVersion_ExpiredObject, VMware.VimAutomation.ViCore.Cmdlets.Commands.SetOSCustomizationNicMapping

  and the profile of customization is set to:

  SpecId Position IPMode IPAddress DefaultGateway
  ------ -------- ------           ---------       --------------
  XYZ 1 UseStaticIP 10.70.237.99 10.70.237.1
  XYZ 2 UseStaticIP 10.10.10.99 10.10.10.1
  XYZ 3 UseStaticIP 10.10.10.99 10.10.10.1

  When there are:

  SpecId Position IPMode IPAddress DefaultGateway
  ------ -------- ------           ---------       --------------
  XYZ 1 UseStaticIP 10.70.236.99 10.70.236.1
  XYZ 2 UseStaticIP 10.70.237.99 10.70.237.1
  XYZ 3 UseStaticIP 10.10.10.99 10.10.10.1

  Why it gives the above errors and that's why changing the IPs incorrectly?

  Thanks in advance.

  Hello

  This behavior is by design. Here is the explanation:

  Cause:

  1. misuse of command
  

  ' Set-OSCustomizationNicMapping - Position' sets the posiotion of the nic past mapping object.

  The following call assigns consecuently the posiotion three objects to map nic 1:

  $custSpec | Get-OSCustomizationNicMapping | Game-OSCustomizationNicMapping - IpMode UseStaticIP-position 1 IP address - 10.70.236.99 - mask subnet 255.255.255.0 - DefaultGateway 10.70.236.1

  2 locking mechanism

  So lets have the mapping objects following nic

  1 mappingA

  2 mappingB

  3 mappingC

  If you keep the reference to A and B and change the posiotion c and 1st then the references of the A and B will expire and you will no longer be able to edit them with this old references. The reason behind this is the unique identifier of A and B, we know is their position and this ID has changed--they became the 2nd and 3rd. So to change the old references with bad identifiers may cause problems only. That's why we have implemented the locking mechanism and you have to get the nic mapping objects to change.

  Solution:

  $custSpec | Get-OSCustomizationNicMapping | où {$_. {Position - eq 1} | Game-OSCustomizationNicMapping - IpMode UseStaticIP - IpAddress 10.70.236.99 - mask subnet 255.255.255.0 - DefaultGateway 10.70.236.1
  $custSpec | Get-OSCustomizationNicMapping | où {$_. {Position - eq 2} | Game-OSCustomizationNicMapping - IpMode UseStaticIP - IpAddress 10.70.237.99 - mask subnet 255.255.255.0 - DefaultGateway 10.70.237.1
  $custSpec | Get-OSCustomizationNicMapping | où {$_. {Position - eq 3} | Game-OSCustomizationNicMapping - IpMode UseStaticIP - IpAddress 10.10.10.99 - mask subnet 255.255.255.0 - DefaultGateway 10.10.10.1

  I hope this will help.

  Thank you

  Nedko

• Problem of authenticating users on L2TP over IPSec tunnel

  I have a client with an old PIX-515e firewall with firmware 7.2 (4), and due to certain circumstances, I'm trying to configure L2TP over IPSec. I'm stuck at a "Error 691: the remote connection has been deinied because the user name and password combination, you have provided is not recognized, or the selected authentication protocol is not permitted on the remote access server." I have local installation of authentication for this connection, and I tried to use ms-chap-v2, chap and pap, and give the same results. I have confirmed the username and the password, but I can't after that.

  The PIX, I don't see "AAA user authenticaton rejected: reason = invalid password: local database: user = tetstuser". I can still see the password unencrypted on the screen, so I can copy and paste the username and password in the appropriate fields, and I still have this error.

  Does anyone have an idea where the problem lies perhaps? Thank you.

  Can you please change the user as described in the doc, I shared and as indicated by the Rohan peers and share the results of the tests?

  Kind regards

  Dinesh Moudgil

  PS Please rate helpful messages.