Problem with VPN

Similar Questions

• Problem with VPN Site-to-Site between RV215W and ASA5510

  The RV215W is intended to connect a new branch via 3G, but fail.

  But when connected to the internet via a cable modem VPN works.

  I have set up with the FULL domain name and remote ip address.

  Please help me soon as soon as you can.

  Thaks a lot.

  Henriux2412.

  Dear Henry;

  Thank you to the small community of Support Business.

  I doubt that this VPN site-to-site is compatible with the USB modem broadband Mobile 3 G, but I have when even suggest to verify that the Status field of the map will show your mobile card is connected (status > Mobile network). I've seen a similar problem with a Verizon USB modem where the solution was to change a few settings in their access Manager software ("NDIS Mode - connect manually" has been selected and change this option to "Modem Mode - connect manually fixed), but if this is not your case then I suggest you to check with your service provider about supported VPN site to site on the WAN configuration.

  Except that I advise you to contact the Small Business Support Center for more information on this subject, although I don't think they will support

  https://supportforums.Cisco.com/community/NetPro/small-business/sbcountrysupport

  https://www.Cisco.com/en/us/support/tsd_cisco_small_business_support_center_contacts.html

  Do not hesitate to contact me if there is anything I can help you with in the meantime.

  Kind regards

  Jeffrey Rodriguez S... : | :. : | :.
  Support Engineer Cisco client

  * Please rate the Post so other will know when an answer has been found.

• Problem with "vpn sysopt connection permit.

  Hi all

  I would like to ask you for advice with "vpn sysopt connection permit". I have a problem with by-pass-access list (acl) in the INSIDE interface. As I understand it and I'm going to use this command, there is no need to especialy allow traffic in the access list for the INSIDE and I can control the filter-vpn traffic. But in my case it's quite the opposite, I want particularly to this INTERIOR acl traffi. When I allow this traffic inside acl L2L tunnel rises, hollow traffic flow vpn-fltr ane acl that everything is OK. But when I do not allow that this traffic is inside of the rule with Deny statement in acl INSIDE block traffic and tunnel goes ever upward. Part of the configuraciton which you can view below.

  Please let me know if I'm wrong, or what I did wrong?

  Thank you

  Karel

  PHA-FW01 # view worm | Worm Inc

  Cisco Adaptive Security Appliance Software Version 4,0000 1

  PHA-FW01 # display ru all sys

  No timewait sysopt connection

  Sysopt connection tcpmss 1380

  Sysopt connection tcpmss minimum 0

  Sysopt connection permit VPN

  Sysopt connection VPN-reclassify

  No sysopt preserve-vpn-stream connection

  no RADIUS secret ignore sysopt

  No inside sysopt noproxyarp

  No EXT-VLAN20 sysopt noproxyarp

  No EXT-WIFI-VLAN30 sysopt noproxyarp

  No OUTSIDE sysopt noproxyarp

  PHA-FW01 # display the id of the object-group ALGOTECH

  object-group network ALGOTECH

  object-network 10.10.22.0 255.255.255.0

  host of the object-Network 172.16.15.11

  PHA-FW01 # show running-config id of the object VLAN20

  network of the VLAN20 object

  subnet 10.1.2.0 255.255.255.0

  L2L_to_ALGOTECH list extended access permitted ip object object-group VLAN20 ALGOTECH

  extended access list ACL-ALGOTECH allow ip object-group object VLAN20 ALGOTECH

  Note EXT-VLAN20 of access list =.

  access list EXT-VLAN20 allowed extended ip object VLAN20 ALGOTECH #why object-group must be the rule here?

  access list EXT-VLAN20 extended permitted udp object VLAN20 object-group OUT-DNS-SERVERS eq field

  EXT-VLAN20 allowed extended VLAN20 object VPN-USERS ip access list

  EXT-VLAN20 extended access list permit ip object VLAN20 OPENVPN-SASPO object-group

  EXT-VLAN20 allowed extended object VLAN10 VLAN20 ip access list

  deny access list extended VLAN20 EXT ip no matter what LOCAL NETS of object-group paper

  EXT-VLAN20 allowed extended icmp access list no echo

  access list EXT-VLAN20 allowed extended object-group SERVICE VLAN20 object VLAN20 everything

  EXT-VLAN20 extended access list deny ip any any newspaper

  extended access list ACL-ALGOTECH allow ip object-group object VLAN20 ALGOTECH

  GROUP_POLICY-91 group policy. X 41. X.12 internal

  GROUP_POLICY-91 group policy. X 41. X.12 attributes

  value of VPN-filter ACL-ALGOTECH

  Ikev1 VPN-tunnel-Protocol

  tunnel-group 91.X41. X.12 type ipsec-l2l

  tunnel-group 91.X41. X.12 General attributes

  Group Policy - by default-GROUP_POLICY-91. X 41. X.12

  tunnel-group 91.X41. X.12 ipsec-attributes

  IKEv1 pre-shared-key *.

  PHA-FW01 # show running-config nat

  NAT (EXT-VLAN20, outdoors) static source VLAN20 VLAN20 static destination ALGOTECH ALGOTECH non-proxy-arp-search to itinerary

  network of the VLAN20 object

  dynamic NAT interface (EXT-VLAN20, outdoors)

  group-access to the INTERIOR in the interface inside

  Access-group interface VLAN20 EXT EXT-VLAN20

  Hello

  The command "sysopt connection permit-vpn" is the default setting and it applies only to bypass ACL interface to the interface that ends the VPN. It would be connected to the external network interface. This custom has no effect on the other interfaces ACL interface.

  So if you initiate or need to open connections from your local network to remote network through the VPN L2L connection then you will need to allow this traffic on your LAN interface ACL networks.

  If the situation was that only the remote end has launched connections to your network then 'sysopt permit vpn connection' would allow their connections around the external interfaces ACL. If If you have a VPN configured ACL filter, I think that the traffic will always accompany against this ACL.

  Here are the ASA reference section to order custom "sysopt"

  http://www.Cisco.com/en/us/docs/security/ASA/command-reference/S21.html#wp1567918

  -Jouni

• Problems with VPN tunnels after the upgrade to PIX 7.0

  It seems that Cisco has revamped the VPN process on the new Version of PIX 7.0.

  After I've upgraded, I noticed that AH (i.e. ah-sha-hmac, ah-md5-hmac) was no longer supported and all my container transformation games OH no were not converted.

  Another question, if you have enabled on Versieon 6.3, names when you upgrade, tunnel groups will be created (formerly "identity isakmp crypto, crypto key isakmp peer ') which will include a hostname (hostname of identity) instead of IP as it was to the point 6.3. Guess what... Nothing works! Having to delete and recreate it using the IP address.

  See an example...

  tunnel-group OTHER_END type ipsec-l2l

  IPSec-attributes tunnel-group OTHER_END

  pre-shared-key *.

  The above does not work... Having to recreate using the IP address mapped to OTHER_END...

  tunnel-group 2.2.2.2 type ipsec-l2l

  2.2.2.2 tunnel-group ipsec-attributes

  pre-shared-key *.

  Furthermore, I have problems with my racoon and freeswan extranet... Did someone recently updated with success and other gateways VPN provider (i.e. checkpoint, Freeswan and Racoon) work?

  We found the solution for this problem. It appeared that the perfect forward secrecy is enabled at the other side. If a 'card crypto outside_map 10 set pfs' is necessary. With the pix 6.3 version that appears not to make the difference, the vpn works even with pfs disabled on the side of pix.

• Problem with VPN compatibility between 2811 and 2911

  Hello

  I would ask anyone had problems with the implementation of a VPN tunnel between 2811 and 2911?

  The IPSec VPN is established, but for some reason, I cannot ping the side LAN across LAN to the other end of the VPN router?

  All experience would be highly appreciated

  Thank you

  IPSec VPN can be smoothly between routers cisco (and not nesesserely cisco) set up, so there should be no problem in your case.

  If you say that this tunnel is established successfully, then the problem most likely related to routing problems between sites or incorrect configured crypto-acl. Check if the hosts located on both sites have correct routing information on how to get to subnets on the other site.

  Make more accurate assumptions, it would be helpful that you provide config on both sites and describe your topology.

• Problem with VPN connection via a wireless card broadband Verizon Cisco VPN air

  I can't access any device on my network via RDP or applications via the host file - forwarded servers from my 64 bit Windows 7 laptop using wireless broadband Verizon and customer VPN Cisco 64 bit 5.0.7.290. I can connect easily via a LAN wired connection from home using the same laptop computer and client VPN and RDP.

  The VPN client connects to the server VPN (easy VPN on Cisco 2821 router) on the broadband wireless connection (I can see it in the GPMC on the router) but it will pass no data. I can't ping anything in the field, or external IP address. When I try to ping the laptop, it drops off the VPN (completed peer connection).

  The laptop is a Dell M4500 running Windows 7 Ultimate 64 bit OS. The VPN client is stated, rev 5.0.7.290. The card internal wireless broadband is a QualCom 5620 (EV-DO-HSPA) system (Gobi 2).

  What must I do to get this configuration to perform and log as does the wired connection?

  Tim Carlisle

  The Systems Manager

  Post edited by: Timothy Carlisle recently I discovered that the Cisco 64 bit client VPN running on my Dell Precision M6500 (Windows 7 64-bit OS) was able to connect properly using the WiFi on my iPhone 4S (Verizon Wireless). It will also connect when attached to the laptop via a USB cable. Once I discovered this, I was then able to do the same thing on the laptop that spawned this discussion, by attachment for Blackberry "BOLD" from the boss after the download and installation of a new Verizon Wireless Access Manager utility that has allowed to select the device (Blackberry) for installation.  I think that enabled us to bypass the wireless cards Gobi2 on two laptops and the factory installed Dell Connection Manager software which was not compatible with the Cisco VPN 64 bit client software. As much as I fear here, this new method (hotspot of Smartphone and attachment) is the way to go for us and has solved all the problems of connectivity distance for us. Thank you to all who have contributed to this discussion.   Tim Carlisle

  The Solution to the debate has been captured in this Document: -.

  https://supportforums.Cisco.com/docs/doc-18721

  We fought with the same question for quite awhile before finding that there seems to be a default setting in the Verizon Access Manager software that plays well with the Cisco Client.

  In VZAccess Manager, select Options | Preferences.  Connectivity options, the default setting for "NDIS Mode - connect manually" was chosen.  Change this option to "Modem Mode - connect manually" seems to have completely addressed the issue.  We can now connect to the WWAN, establish a Cisco VPN session and have connectivity.

  

• Strange problem with VPN

  I have a century to site IPSec VPN 3005 concentrator with a PIX.

  On the PIX config is:

  ...

  ...

  the VPNHosts object-group network

  the object-network 172.16.1.1 host

  network-object host 172.16.1.2

  network-object host 172.16.1.3

  the object-Network 172.16.1.4 host

  ...

  ...

  nat0_acl 10.1.0.0 ip access list allow 255.255.255.0 VPNHosts object-group

  nat0_acl 10.2.0.0 ip access list allow 255.255.255.0 VPNHosts object-group

  ...

  ...

  VPN1 10.2.0.0 ip access list allow 255.255.255.0 VPNHosts object-group

  VPN1 10.1.0.0 ip access list allow 255.255.255.0 VPNHosts object-group

  ...

  ...

  NAT (inside) 0-list of access nat0_acl

  ...

  ...

  outside_map 10 ipsec-isakmp crypto map

  address for correspondence outside_map 10 card crypto VPN1

  card crypto outside_map 10 peers set a.b.c.d

  outside_map crypto 10 card value transform-set ESP-DES-SHA

  ...

  ...

  The hub, I have two address lists that are used in the definition of VPN:

  LANHosts: 172.16.1.1/0.0.0.0

  172.16.1.2/0.0.0.0

  172.16.1.3/0.0.0.0

  172.16.1.4/0.0.0.0

  Distance: 10.1.0.0/0.0.0.255

  10.2.0.0/0.0.0.255

  Now the problem. When an IPSec security association is initiated from a host in the range 10.2.0.0 to 172.16.1.1 for example the IPSec Security Association is not created. When I got the boot from the host 172.16.1.1 to a host in the 10.2.0.0 range, it works well. Everything works perfectly, so between the range 10.1.0.0 and hosts all IPSec SA are created little matter which side starts the IPSec Security Association.

  Why won't an IPSec security association, initiated from the 10.2.0.0/24 range upward? What's wrong?

  the problem may be the way in which you have configured the list of networks. I guess you are trying to restrict access between private sites.

  If so, the list of the network should be the whole subnet not an individual host, then set up the filter to restrict access.

• problems with vpn firewall/proxy configuration

  Hello

  I want to access vpn through firewall/proxy (Client VPN) client-side.

  I installed the vpn gateway as firewall pix 515 using Microsoft CA IKE SA.

  I want to establish the vpn tunnel to my vpn through a proxy/firewall client.

  I tried in some places of vpn client where the firewall acts as a linux machine in which he allowed with the ipsec and NAT esp feature. Its works perfectly. But only one concurrent vpn client. Also the first tunnel vpn disconnects when the second user tries without knowing the first established tunnel.

  I heard that we can drive this problem using "NAT Taversal" mode which is available in version ios 6.3 as concentrator 3000 Cisco pix.

  I want to know how NAT Traversal can solve my problem in which multiple concurrent users without support nat esp in a configuration only one simultaneous user without support nat esp in a configuration of firewall/proxy or firewall/proxy.

  Thank you

  Karthikeyan V

  The VPN client is able to detect that he's been through a NAT/PAT device on the way to the hub/PIX, and then if both ends support it, they will automatically start NAT - T and encapsulate the IPSec packets in UDP port 4500 packets. These can then be NAT would properly and you will not get disconnections or problems you currently see.

  You don't see that a client can connect and customers being disconnected when the other connects it is your PAT instrument cannot process the ISAKMP and IPSec packets correctly. It is a fairly common symptom.

  PIX v6.3 code will support NAT - T, should be available in March sometime.

• Problem with VPN Site-to-Site between RV215W and ISA550

  Hello

  I tried to set up a site connection to site between a RV215W and an ISA550 for a whole day without success now, could someone help me with an example of configuration?

  I'm new to this kind of configurations and VPN Options of two routers seem very different, with IKE an IPsec on the RV, IPsec and IKE policies, transform the policies on the ISA.

  Outputs the Wizards from Site to Site are not either.

  The RV215W is intended to connect a new branch via 3G and that it doesn't have a fixed IP address.

  Subnet the ISA is 10.10.11.0/24 VR 192.168.100.0/24

  Thanks for any help in advance!

  T

  Hello

  I check all the screenshots and you must:

  -Disable the PFS on ISA500 (screenshot of ISA500 of a second)

  -Enable IPsec on ISA500 (first screenshot of ISA500)

  -Activate the VPN on RV215W (first screenshot of RV215W) policy

  And iniate the RV215W VPN

  I hope that this step will fix the problem

  Thank you

  Mehdi

• Problems with VPN PIX 525 Lan-to-Lan Cisco 2610XM

  Hello world

  I have a VPN with PIX 525 versi problems? n 7.2 (1) and Cisco 2610XM Version 12.3 (18). When start the PIX, all tunnels works well, but 6-7 days, some of the tunnels do not work properly. Traffic passes the tunnel with some networks, but not with all networks. Sometimes the tunnel descends and it is imposible to go upward.

  Attach them files are the "debug crypto isakmp" in both devices.

  Thank you and sorry for my bad English

  If your configuration of the tunnel on router 7500 series, the tunnel interface are not supported for politicians to service in the tunnel interfaces on 7500

• Problem with VPN connection from a connection shared cable modem

  Couple of my users on a remote site share a modem cable connection using a Linksys 4 port router. They connect to the main campus using VPN. When the two try to connect via VPN to the only main campus can connect at the same time. We have VPN 3015 concentrator on the main campus and the user is authenticated on our active directory. The machines of users has windows XP pro and use Microsoft VPN to connect. Anyone encountered this before? No solution/work around?

  Thank you.

  -Nik

  I suspect that the problem is to do with NAT / PAT - if only a customer wants to create a VPN session to the 3015, NAT is used, but if several clients go through your Linksys router, then you are using PAT, that requires NAT t (nat transparency), see the following URL for more information:- http://support.microsoft.com/default.aspx?scid=kb;en-us;818043

  Rowan

• Problems with VPN on a PAT router

  Hello

  I have problems to make my VPN to work. I read through various examples of configuration, but don't always have it work properly.

  Scenario: connection with the Cisco VPN Client to my router from outside.

  Router works like NAT/PAT overload. Internet: Internal FA0/1 network: FA0/0

  Problems: connection is working without problem, but I can't access anything in the network behind the router. Some hosts ping sometimes works, sometimes doesn't.

  Does anyone have an idea of what could be the problem and what wrong with my setup?

  Thanks in advance!

  Here is my configuration:

  Current configuration: 5817 bytes
  !
  ! Last modification of the configuration at 14:41:13 CEST Saturday, July 3, 2010
  !
  version 12.3
  horodateurs service debug uptime
  Log service timestamps uptime
  no password encryption service
  !
  router01 hostname
  !
  boot-start-marker
  boot-end-marker
  !
  enable secret 5 - CENSORED-

  activate the password - CENSORED-

  !
  clock timezone THIS 1
  clock to summer time it IS recurring
  AAA new-model
  !
  !
  local USERLIST of AAA authentication login.
  local GROUP AAA authorization network
  AAA - the id of the joint session
  IP subnet zero
  IP cef
  !
  !
  !
  Max-events of po verification IP 100
  IPv6 unicast routing
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  username password 0 - CENSORED - TEST

  !
  !
  !
  !
  crypto ISAKMP policy 10
  BA aes 256
  preshared authentication
  Group 2
  the local address ADDRESSPOOL pool-crypto isakmp client configuration
  ISAKMP xauth timeout 60 crypto
           
  !
  Configuration group customer isakmp crypto GROUP
  -UNCENSORED - key

  pool ADDRESSPOOL
  ACL 150
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac SET
  !
  crypto dynamic-map 10 DYNMAP
  Set transform-set
  market arriere-route
  !
  !
  list of authentication of card crypto client DYNMAP USERLIST
  list of crypto isakmp DYNMAP card authorization GROUP
  crypto card for the DYNMAP client configuration address respond
  card crypto DYNMAP 10-isakmp dynamic ipsec DYNMAP
  !
  !
  !
  !
  !
  !
  interface FastEthernet0/0
  IP 172.16.0.250 255.255.252.0
  IP nat inside
  automatic speed
  full-duplex
  !
  interface FastEthernet0/0.93
  encapsulation dot1Q 93
  IP 172.20.2.5 255.255.255.252
  !
  interface Serial0/0
  no ip address
  Shutdown
  no fair queue
  !
  interface FastEthernet0/1
  DHCP IP address
  NAT outside IP
  automatic duplex
  automatic speed
  No cdp enable
  card crypto DYNMAP
  !
  interface Serial0/1
  no ip address
  Shutdown
  No cdp enable
  !
  !
  local IP ADDRESSPOOL 172.17.0.100 pool 172.17.0.150
  IP nat inside source list 1 interface FastEthernet0/1 overload
  IP nat inside source static tcp 172.16.1.51 80 interface FastEthernet0/1 81
  IP nat inside source static tcp 172.16.2.4 2909 interface FastEthernet0/1 2909
  IP nat inside source static tcp 172.16.2.1 3389 3389 FastEthernet0/1 interface
  IP nat inside source static tcp 172.16.1.51 50000 interface FastEthernet0/1 50000
  IP nat inside source static tcp 172.16.1.51 52000 interface FastEthernet0/1 52000
  IP nat inside source static tcp 172.16.1.51 52001 interface FastEthernet0/1 52001
  IP nat inside source static tcp 172.16.1.51 52002 interface FastEthernet0/1 52002
  IP nat inside source static tcp 172.16.1.51 52003 interface FastEthernet0/1 52003
  IP nat inside source static tcp 172.16.1.51 52004 interface FastEthernet0/1 52004
  IP nat inside source static tcp 172.16.1.51 52005 interface FastEthernet0/1 52005
  IP nat inside source static tcp 172.16.1.51 52006 interface FastEthernet0/1 52006
  IP nat inside source static tcp 172.16.1.51 52007 interface FastEthernet0/1 52007
  IP nat inside source static tcp 172.16.1.51 52008 interface FastEthernet0/1 52008
  IP nat inside source static tcp 172.16.1.51 52009 interface FastEthernet0/1 52009
  IP nat inside source static tcp 172.16.1.51 52010 interface FastEthernet0/1 52010
  IP nat inside source static tcp 172.16.1.51 52011 interface FastEthernet0/1 52011
  IP nat inside source static tcp 172.16.1.51 52012 interface FastEthernet0/1 52012
  IP nat inside source static tcp 172.16.1.51 52013 interface FastEthernet0/1 52013
  IP nat inside source static tcp 172.16.1.51 52014 interface FastEthernet0/1 52014
  IP nat inside source static tcp 172.16.1.51 52015 interface FastEthernet0/1 52015
  IP nat inside source static tcp 172.16.1.51 52016 interface FastEthernet0/1 52016
  IP nat inside source static tcp 172.16.1.51 52017 interface FastEthernet0/1 52017
  IP nat inside source static tcp 172.16.1.51 52018 interface FastEthernet0/1 52018
  IP nat inside source static tcp 172.16.1.51 52019 interface FastEthernet0/1 52019
  IP nat inside source static tcp 172.16.1.51 52020 interface FastEthernet0/1 52020
  IP nat inside source static tcp 172.16.1.11 80 interface FastEthernet0/1 80
  IP nat inside source static tcp 172.16.1.11 443 interface FastEthernet0/1 443
  IP nat inside source static tcp 172.16.1.1 25 interface FastEthernet0/1 25
  no ip address of the http server
  no ip http secure server
  IP classless
  !
  enable IP pim Bennett
  !
  access-list 1 permit 172.16.0.0 0.0.3.255
  access-list 101 permit tcp any any eq 50000
  access-list 101 permit tcp everything any 52000 52020 Beach
  access-list 101 permit tcp any any eq www
  access-list 101 permit tcp any any eq 443
  access-list 101 permit tcp any any eq smtp
  access-list 101 permit tcp any any eq 3389
  access-list 101 permit tcp any any eq 2909
  access-list 150 permit ip 172.16.0.0 0.0.3.255 172.17.0.0 0.0.0.255
  access-list 151 allow ip 172.16.0.0 0.0.3.255 all
  !
  SHEEP allowed 10 route map
  corresponds to the IP 151

  !
  public RO SNMP-server community
  !
  !
  !
  !
  !
  Line con 0
  exec-timeout 0 0
  line to 0
  line vty 0 4
  password - CENSORED-

  !
  NTP-period clock 17180405
  source NTP FastEthernet0/1
  NTP 162.23.41.34 Server
  NTP 162.23.41.56 Server
  NTP 162.23.41.55 Server
  !
  end

  Jenny,

  The NAT config is a little weird, you list 1.

  List 1 is everything inside. (so all traffic inside subnet must be natted).

  You must create an extended access list and create the entry

  IP access-l ext 195

  10 deny ip LOCAL_ADDRESS LOCAL_MASK VPN_POOL VPN_MASK

  1000 ip LOCAL_ADDRESS LOCAL_MASK perm all

  and apply that list to NAT overload.

  This gives a try and let me know.

  Edit: Ouch, 12.3 Mainline... Ollllllllllllld

• Problem with VPN client connecting the PIX of IPSec.

  PIX # 17 Sep 14:58:51 [IKEv1 DEBUG]: IP = Y, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false

  Sep 17 14:58:51 [IKEv1]: IP = Y, landed on tunnel_group connection

  Sep 17 14:58:51 [IKEv1 DEBUG]: Group = X, IP = Y, IKE SA proposal # 1, transform # 13 entry overall IKE acceptable matches # 1

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, the authenticated user (X).

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, mode of transaction attribute not supported received: 5

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, Y = IP, Type of customer: Client Windows NT Version of the Application: 5.0.06.0160

  Sep 17 14:58:58 [IKEv1]: Group = Xe, Username = X, IP = Y, assigned private IP 10.0.1.7 remote user address

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, IP = Y, fast Mode resumed treatment, Cert/Trans Exch/RM IDDM

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, PHASE 1 COMPLETED

  Sep 17 14:58:58 [IKEv1]: IP = Y, Keep-alive type for this connection: DPD

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, Y = IP, timer to generate a new key to start P1: 6840 seconds.

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, Y = IP, data received in payload ID remote Proxy Host: address 10.0.1.7, protocol 0, Port 0

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, received data IP Proxy local subnet in payload ID: address 0.0.0.0 Mask 0.0.0.0, protocol 0, Port 0

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, his old QM IsRekeyed not found addr

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, Y = IP, remote peer IKE configured crypto card: outside_dyn_map

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, Y = IP, IPSec processing SA payload

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, Y = IP, IPSec SA proposal # 14, turn # 1 entry overall SA IPSec acceptable matches # 20

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, IKE: asking SPI!

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, Y = IP, IPSec initiator of the substitution of regeneration of the key duration to 2147483 to 7200 seconds

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, IP = Y, passing the Id of the Proxy:

  Remote host: 10.0.1.7 Protocol Port 0 0

  Local subnet: 0.0.0.0 mask 0.0.0.0 Protocol Port 0 0

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, IP = notification sending answering MACHINE service LIFE of the initiator

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, the security negotiation is complete for the user (slalanne) answering machine, Inbound SPI = 0 x 6

  044adb5, outbound SPI = 0xcd82f95e

  Sep 17 14:58:58 [IKEv1 DEBUG]: Group = X, Username = X, Y = IP, timer to generate a new key to start P2: 6840 seconds.

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, adding static route to the customer's address: 10.0.1.7

  Sep 17 14:58:58 [IKEv1]: Group = X, Username = X, IP = Y, PHASE 2 COMPLETED (msgid = c4d80320)

  PIX # 17 Sep 14:59:40 [IKEv1]: Group = X, Username = X, Y = IP, Connection over for homologous X.  Reason: Peer terminate remote Proxy 10.0.1.7, 0.0.0.0Sep Proxy Local 17 14:59:40 [IKEv1 DEBUG]: Group = X, Username = X, IP = Y, IKE removing SA: 10.0.1.7 Remote Proxy, Proxy Local 0.0.0.0

  Sep 17 14:59:40 [IKEv1]: IP = Y, encrypted packet received with any HIS correspondent, drop

  Then debugging IPSec are also normal.

  Now this user is a disconnect and other clients to connect normally. the former user is trying to connect to the site and here is the difference in debugging:

  Sep 17 14:25:22 [IKEv1]: Group = X, Username = X, Y = IP, tunnel IPSec rejecting: no entry card crypto for remote proxy proxy 10.0.1.8/255.255.255.255/0/0 local 0.0.0.0/0.0.0.0/0/0 on the interface outside
  Sep 17 14:25:22 [IKEv1]: Group = X, Username = X, IP = Y, error QM WSF (P2 struct & 0x2a5fd68, mess id 0x16b59315).
  Sep 17 14:25:22 [IKEv1 DEBUG]: Group = X, Username = X, IP = O, case of mistaken IKE responder QM WSF (struct & 0x2a5fd68) , :
  QM_DONE, EV_ERROR--> QM_BLD_MSG2, EV_NEGO_SA--> QM_BLD_MSG2, EV_IS_REKEY--> QM_BL
  D_MSG2, EV_CONFIRM_SA--> QM_BLD_MSG2, EV_PROC_MSG--> QM_BLD_MSG2, EV_HASH_OK--> QM_
  BLD_MSG2, NullEvent--> QM_BLD_MSG2, EV_COMP_HASH
  Sep 17 14:25:22 [IKEv1]: Group = X, Username = X, IP = Y, peer table correlator withdrawal failed, no match!
  Sep 17 14:25:22 [IKEv1]: IP = Y, encrypted packet received with any HIS correspondent, drop

  Here is the config VPN... and I don't see what the problem is:

  Dynamic crypto map outside_dyn_map 20 match address outside_cryptomap_dyn_20
  Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-DES-MD5 value
  life together - the association of security crypto dynamic-map outside_dyn_map 20 seconds 7200
  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
  outside_map interface card crypto outside
  ISAKMP crypto identity hostname
  crypto ISAKMP allow outside
  crypto ISAKMP policy 20
  preshared authentication
  the Encryption
  md5 hash
  Group 2
  life 7200
  crypto ISAKMP policy 65535
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400

  outside_cryptomap_dyn_20 list of allowed ip extended access any 10.0.1.0 255.255.255.248

  attributes global-tunnel-group DefaultRAGroup
  authentication-server-group (outside LOCAL)
  Type-X group tunnel ipsec-ra
  tunnel-group X general attributes
  address pool addresses
  authentication-server-group (outside LOCAL)
  Group Policy - by default-X
  tunnel-group X ipsec-attributes
  pre-shared-key *.
  context of prompt hostname

  mask of 10.0.1.6 - 10.0.1.40 IP local pool 255.255.255.0

  Please remove the acl of the dynamic encryption card crypto, it causes odd behavior

  try to use split instead of the acl acl in dynamic crypto map, and let me know how it goes

• Problem with VPN. Router is not encrypted but decrypts

  Hello, I have a problem in my IPSec tunnel. One of the routers (Cisco 861) is not encrypt the packets but decrypts those incoming from the remote peer (RV042). In the access list for the wan interface I deny traffic between subnets and vpn access list, I authorize the traffic. Could someone give me a help or advice. Thank you.

  Hello

  The problem is with the list of access-102.  This is your NAT access list.  You see that you allow the 172.16.2.0 at all until you deny, so all traffic is reflected on your public IP address before you try to go through the VPN.  You always want to DENY traffic before making any permit in an access list because they treat up and down on the first game.

  Try the following commands:

  no nat ip inside the source list 102 interface FastEthernet4 overload

  no access list 102

  access-list 102 deny ip 172.26.2.0 0.0.0.255 172.26.3.0 0.0.0.255

  access-list 102 permit ip 172.26.2.0 0.0.0.255 any

  overload of IP nat inside source list 102 interface FastEthernet4

• Problem with VPN L2L and RA in a failover configuration

  I use two ASA 5540 in failover active-standby configuration. These boxes (primary and secondary) are used to establish some L2L and VPN RA (remote access). The active area run the OSPF process.

  The problem is when the failover (blocking just to the bottom of the active area, or "active failover" running in a secondary zone) all L2L be restored in a secondary zone. The only way I can do this (re-connect) removes the configuration of IPP (Reverse injectable way) (for example. ("no card crypto rprbbe_map 3 don't set reverse-road") and the configuration of IPP ("card crypto rprbbe_map 3 Road opposite the value"). After this the connection is re-established.

  In RA guests the session persists on a failover event, but the customer loses access. To resolve this problem, the customer needs to disconnect and reconnect.

  Anyone has any experience with this kind of (L2L and RA) VPN configuration using failover?

  Behavior seems buggy.

  What version do you use?