Problems with NAT

Similar Questions

• Problems with NAT? Can't access internet from inside the network?

  I was intrigued with this problem for a few days now. I'm stuck on what could be the issue. The problem is that I can ping my router, G0/0 and G0/1, to the internet. However, since the switch and my PC, I can not ping Internet. I'm sure that everything is configured correctly, but here is my setup for the switch and the router:

  Router 1:

  version 15.1 no service button horodateurs service debug datetime msec Log service timestamps datetime msec encryption password service ! hostname LAN_Router_1 ! boot-start-marker boot-end-marker ! ! enable secret 5 *. ! No aaa new-model ! no location network-clock-participate 3 ! dot11 syslog no ip source route ! IP cef ! ! ! ! domain IP MyTestLab.com 8.8.8.8 IP name-server IP-server names 8.8.4.4 No ipv6 cef ! Authenticated MultiLink bundle-name Panel ! ! ! ! ! voice-card 0 ! ! ! ! ! ! ! Crypto pki token removal timeout default 0 ! ! ! ! license udi pid CISCO3845-MB sn FOC105013BA username * secret privilege 15 5 *. ! redundancy ! ! property intellectual ssh time 60 property intellectual ssh authentication-2 retries property intellectual ssh event logging property intellectual ssh version 2 ! ! ! ! ! ! ! ! interface Loopback0 192.168.254.1 IP 255.255.255.255 ! interface GigabitEthernet0/0 DHCP IP address penetration of the IP stream stream IP output NAT outside IP IP virtual-reassembly in automatic duplex automatic speed media type rj45 ! interface GigabitEthernet0/1 the IP 192.168.0.1 255.255.255.248 penetration of the IP stream stream IP output IP nat inside IP virtual-reassembly in GLBP 100 ip 192.168.0.4 priority GLBP 100 115 GLBP 100 preempt automatic duplex automatic speed media type rj45 ! ospf Router 5 router ID - 192.168.254.1 network 192.168.0.1 0.0.0.0 area 1 192.168.254.1 network 0.0.0.0 area 0 ! IP forward-Protocol ND no ip address of the http server no ip http secure server ! ! IP nat inside source list 10 interface GigabitEthernet0/0 overload IP route 0.0.0.0 0.0.0.0 dhcp ! access-list 10 permit 192.168.94.32 0.0.0.15 connect access-list 10 permit 192.168.17.0 connect 0.0.0.7 access-list 10 permit 192.168.52.0 connect 0.0.0.7

  
  access-list 10 permit 192.168.0.0 0.0.0.7 connect
  access-list 10 deny any newspaper
  !
  !
  !
  !
  !
  !
  control plan
  !
  !
  !
  !

  profile MGCP default
  !
  !
  !
  !
  !
  connection of the banner ^ C
  W A R N I N G

  THIS IS A PRIVATE COMPUTER SYSTEM.

  This computer system, including all related equipment, network devices
  (specifically including Internet access), are provided only for
  authorized used.

  All computer systems may be monitored for all lawful, including purpose
  to ensure that their use is authorized, for management of the system, to
  facilitate protection against unauthorized access, and to verify security
  survival and operational security procedures.

  Monitoring includes active attacks by authorized personnel and their
  entities to test or verify the security of the system. During the surveillance,.
  information may be examined, recorded, copied and used for authorized
  purposes.

  All information, including personal information, placed on or sent over
  This system may be monitored. Uses of this system, authorized or
  unauthorized, constitutes consent to monitoring of this system.

  Unauthorized use may subject you to criminal prosecution. Evidence of
  any unauthorized use collected during monitoring may be used for
  administrative, criminal or other adverse action. Use of this system
  constitutes a consent to monitoring for these purposes.
  ^ C
  !
  Line con 0
  Synchronous recording
  local connection
  line to 0
  line vty 0
  local connection
  entry ssh transport
  output transport ssh
  line vty 1 4
  opening of session
  transport of entry all
  !
  Scheduler allocate 20000 1000
  NTP 198.60.73.8 Server
  NTP 13.85.70.43 Server
  SaveRunConfig event manager applet
  cron cron-event timer entry ' 0 0 * * ".
  command action 1.0 cli 'enable '.
  cli 2.0 action command "RAM".

  Router 2:

  version 15.1 horodateurs service debug datetime msec Log service timestamps datetime msec encryption password service ! hostname LAN_Router_2 ! boot-start-marker boot-end-marker ! ! ! card order type necessary for slot 1 Monitor logging warnings enable secret 5 *. ! No aaa new-model ! clock timezone CST - 5 0 ! dot11 syslog IP source-route ! IP cef ! ! ! ! domain IP MyTestLab.com 8.8.8.8 IP name-server IP-server names 8.8.4.4 No ipv6 cef ! Authenticated MultiLink bundle-name Panel ! ! ! ! type of parameter-card inspect global Select a dropped packet newspapers ! voice-card 0 ! ! ! ! !

  
  !
  !
  Crypto pki token removal timeout default 0
  !
  !
  !
  !
  license udi pid CISCO3845-MB sn FOC1411592J
  username * secret 5 *.

  !
  redundancy
  !
  !
  property intellectual ssh time 60
  property intellectual ssh authentication-2 retries
  property intellectual ssh event logging
  property intellectual ssh version 2
  !
  !
  !
  !
  !
  !
  !
  !
  interface Loopback0
  192.168.254.2 the IP 255.255.255.255
  !
  interface GigabitEthernet0/0
  DHCP IP address
  penetration of the IP stream
  stream IP output
  NAT outside IP
  IP virtual-reassembly in
  automatic duplex
  automatic speed
  media type rj45
  !
  interface GigabitEthernet0/1
  IP 192.168.0.2 255.255.255.248
  penetration of the IP stream
  stream IP output
  IP nat inside
  IP virtual-reassembly in
  GLBP 100 ip 192.168.0.4
  priority GLBP 100 110
  automatic duplex
  automatic speed
  media type rj45
  !
  ospf Router 5
  router ID - 192.168.254.2
  network 192.168.0.2 0.0.0.0 area 1
  0.0.0.0 network 192.168.254.2 area 0
  !
  Default IP gateway 192.168.0.1
  IP forward-Protocol ND
  no ip address of the http server
  no ip http secure server
  !
  !
  IP nat inside source list 10 interface GigabitEthernet0/0 overload
  IP route 0.0.0.0 0.0.0.0 dhcp
  !
  SSH extended IP access list
  permit tcp host 192.168.52.2 any eq 22 log
  permit tcp 192.168.10.0 0.0.0.255 any eq 22 log
  permit tcp host 192.168.17.18 any eq 22 log
  any eq 22 host tcp 192.168.0.1 newspaper permit
  permit tcp host 192.168.0.2 any eq 22 log
  permit tcp host 192.168.0.3 any eq 22 log
  permit tcp host 192.168.0.5 any eq 22 log
  denyip a session
  !
  access-list 10 permit 192.168.94.32 0.0.0.15 connect
  access-list 10 permit 192.168.17.0 connect 0.0.0.7
  access-list 10 permit 192.168.52.0 connect 0.0.0.7
  access-list 10 permit 192.168.0.0 0.0.0.7 connect
  access-list 10 deny any newspaper
  !
  !
  !
  !
  !
  !
  control plan
  !
  !
  !
  !
  profile MGCP default
  !
  !
  !
  !
  !
  connection of the banner ^ C
  W A R N I N G

  THIS IS A PRIVATE COMPUTER SYSTEM.

  This computer system, including all related equipment, network devices
  (specifically including Internet access), are provided only for
  authorized used.

  All computer systems may be monitored for all lawful, including purpose
  to ensure that their use is authorized, for management of the system, to
  facilitate protection against unauthorized access, and to verify security
  survival and operational security procedures.

  Monitoring includes active attacks by authorized personnel and their
  entities to test or verify the security of the system. During the surveillance,.
  information may be examined, recorded, copied and used for authorized
  purposes.

  All information, including personal information, placed on or sent over
  This system may be monitored. Uses of this system, authorized or
  unauthorized, constitutes consent to monitoring of this system.

  Unauthorized use may subject you to criminal prosecution. Evidence of
  any unauthorized use collected during monitoring may be used for
  administrative, criminal or other adverse action. Use of this system
  constitutes a consent to monitoring for these purposes.
  ^ C
  !
  Line con 0
  session-timeout 360
  exec-timeout 360 0
  7 password *.
  Synchronous recording
  local connection
  line to 0
  opening of session
  line vty 0 4
  SSH access class in
  Synchronous recording
  local connection
  entry ssh transport
  output transport ssh
  !
  Scheduler allocate 20000 1000
  NTP 198.60.73.8 Server
  NTP 13.85.70.43 Server
  SaveRunConfig event manager applet
  cron cron-event timer entry ' 0 0 * * ".
  command action 1.0 cli 'enable '.
  cli 2.0 action command "RAM".

  Switch:

  version 12.2 no service button tcp KeepAlive-component snap-in service a tcp-KeepAlive-quick service horodateurs service debug uptime Log service timestamps uptime encryption password service ! hostname LAN_Switch ! boot-start-marker boot-end-marker ! ! username * secret privilege 15 5 *. ! ! ! No aaa new-model clock timezone CST - 6 1 supply ws-c3750-24ts switch mtu 1500 routing system IP routing IP - domain name MyTestLab.com 8.8.8.8 IP name-server IP-server names 8.8.4.4 ! ! ! ! ! ! ! ! ! spanning tree mode rapid pvst spanning tree logging spanning tree extend id-system ! internal allocation policy of VLAN ascendant ! property intellectual ssh time 60 property intellectual ssh authentication-2 retries property intellectual ssh event logging property intellectual ssh version 2 ! ! interface Loopback0 192.168.254.5 the IP 255.255.255.255 ! interface FastEthernet1/0/1 switchport access vlan 17 switchport mode access spanning tree portfast spanning tree enable bpduguard ! interface FastEthernet1/0/2 switchport access vlan 10 switchport mode access spanning tree portfast spanning tree enable bpduguard ! interface FastEthernet1/0/3 switchport access vlan 666 switchport mode access Shutdown spanning tree portfast spanning tree enable bpduguard ! interface FastEthernet1/0/4 switchport access vlan 666 switchport mode access Shutdown spanning tree portfast spanning tree enable bpduguard

  
  !
  interface FastEthernet1/0/5
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/6
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/7
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/8
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/9
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/10
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/11
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/12
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/13
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/14
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/15
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/16
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/17
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/18
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/19
  Description # PC #.
  switchport access vlan 10
  switchport mode access
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/20
  Description # X_BOX #.
  switchport access vlan 666
  switchport mode access
  Shutdown
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/21
  switchport access vlan 94
  switchport mode access
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface FastEthernet1/0/22
  switchport access vlan 5
  switchport mode access
  !
  interface FastEthernet1/0/23
  switchport access vlan 5
  switchport mode access
  !
  interface FastEthernet1/0/24
  switchport access vlan 5
  switchport mode access
  !
  GigabitEthernet1/0/1 interface
  switchport access vlan 666
  Shutdown
  !
  interface GigabitEthernet1/0/2
  switchport access vlan 666
  Shutdown
  !
  interface Vlan1
  no ip address
  Shutdown
  !
  interface Vlan5
  IP 192.168.0.5 255.255.255.248
  !
  interface Vlan10
  address 192.168.10.2 255.255.255.0
  !
  interface Vlan17
  IP 192.168.17.17 255.255.255.248
  !
  interface Vlan52
  IP 192.168.52.1 255.255.255.248
  !
  interface Vlan94
  IP 192.168.94.33 255.255.255.240
  !
  ospf Router 5
  router ID - 192.168.254.5
  Log-adjacency-changes
  network 192.168.0.5 0.0.0.0 area 1
  network 192.168.10.2 0.0.0.0 area 2
  network 192.168.17.17 0.0.0.0 area 2
  network 192.168.52.1 0.0.0.0 area 2
  network 192.168.94.33 0.0.0.0 area 2
  0.0.0.0 network 192.168.254.5 area 0
  !
  IP classless
  IP route 0.0.0.0 0.0.0.0 192.168.0.4 permanent
  no ip address of the http server
  no ip http secure server
  !
  !
  SSH_IN extended IP access list
  permit tcp host 192.168.52.2 any eq 22 log
  permit tcp 192.168.10.0 0.0.0.255 any eq 22 log
  permit tcp host 192.168.17.18 any eq 22 log
  any eq 22 host tcp 192.168.0.1 newspaper permit
  permit tcp host 192.168.0.2 any eq 22 log
  permit tcp host 192.168.0.3 any eq 22 log
  permit tcp host 192.168.0.5 any eq 22 log
  deny ip any any newspaper
  !
  !
  connection of the banner ^ C
  W A R N I N G
  THIS IS A PRIVATE COMPUTER SYSTEM.
  This computer system, including all related equipment, network devices
  (specifically including Internet access), are provided only for
  authorized used.
  All computer systems may be monitored for all lawful, including purpose
  to ensure that their use is authorized, for management of the system, to
  facilitate protection against unauthorized access, and to verify security
  survival and operational security procedures.
  Monitoring includes active attacks by authorized personnel and their
  entities to test or verify the security of the system. During the surveillance,.
  information may be examined, recorded, copied and used for authorized
  purposes.
  All information, including personal information, placed on or sent over
  This system may be monitored. Uses of this system, authorized or
  unauthorized, constitutes consent to monitoring of this system.
  Unauthorized use may subject you to criminal prosecution. Evidence of
  any unauthorized use collected during monitoring may be used for
  administrative, criminal or other adverse action. Use of this system
  constitutes a consent to monitoring for these purposes.
  ^ C
  !
  Line con 0
  session-timeout 60
  exec-timeout 60 0
  Synchronous recording
  local connection
  line vty 0
  access-class SSH_IN in
  local connection
  line vty 1 4
  access-class SSH_IN in
  opening of session
  line vty 5 15
  access-class SSH_IN in
  opening of session
  !
  NTP 198.60.73.8 Server
  Event Manager environment suspend_ports_config flash: / susp_ports.dat
  Event Manager environment suspend_ports_days 7
  Event Manager user Directorystrategie "flash: / policies /.
  Event manager session cli username "stw".
  political event manager sl_suspend_ports.tcl
  political event manager tm_suspend_ports.tcl
  SaveRunConfig event manager applet
  cron cron-event timer entry ' 0 0 * * ".
  command action 1.0 cli 'enable '.
  cli 2.0 action command "RAM".

  Well, I totally forgot the keyword "log" and NAT:

  Cisco IOS NAT support ACLs with a keyword "log"?

  A. When you configure Cisco IOS NAT translation dynamic NAT, an ACL is used to identify the packages that can be translated. The current NAT architecture does not support the ACL with a keyword "log".

  http://www.Cisco.com/c/en/us/support/docs/IP/network-address-translation...

  If your problem is not the mask with joker, but the command "log"...

• IOS IPSEC VPN with NAT - translation problem

  I'm having a problem with IOS IPSEC VPN configuration.

  /*

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto keys TEST123 address 205.xx.1.4

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac CHAIN

  !

  !

  Map 10 CRYPTO map ipsec-isakmp crypto

  the value of 205.xx.1.4 peer

  transformation-CHAIN game

  match address 115

  !

  interface FastEthernet0/0

  Description FOR the EDGE ROUTER

  IP address 208.xx.xx.33 255.255.255.252

  NAT outside IP

  card crypto CRYPTO-map

  !

  interface FastEthernet0/1

  INTERNAL NETWORK description

  IP 10.15.2.4 255.255.255.0

  IP nat inside

  access-list 115 permit 192.xx.xx.128 0.0.0.3 ip 172.xx.1.0 0.0.0.3

  */

  (This configuration is incomplete / NAT configuration needed)

  Here is the solution that I'm looking for:

  When a session is initiated from the "internal network" to the "distance IPSEC - 172.xx.1.0/30 ' network I want the address scheme '10.15.0.0/16' NAT translation deals with '192.xx.xx.128/30' before forwarding via the IPSEC VPN Tunnel.

  For more information, see "SCHEMA ATTACHED".

  Any help is greatly appreciated!

  Thank you

  Clint Simmons

  Network engineer

  You can try the following NAT + route map approach (method 2 in this link)

  http://www.Cisco.com/en/us/Tech/tk648/tk361/technologies_tech_note09186a0080093fca.shtml

  Thank you

  Raja K

• Static NAT problem with PIX501

  Hi all

  We have problems with our PIX firewall. We have configured PIX 501 with static NAT for our Web server. Here's the running configuration.

  6.3 (4) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  pixfirewall hostname

  domain ciscopix.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list 101 permit tcp any host x.x.x.26 eq www

  access-list 101 permit tcp any host x.x.x.26 EQ field

  access-list 101 permit udp any host x.x.x.26 EQ field

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside x.x.x.28 255.255.255.248

  IP address inside 192.168.90.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.90.0 255.255.255.0 inside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) x.x.x.26 192.168.90.3 netmask 255.255.255.255 0 0

  Access-group 101 in external interface

  Route outside 0.0.0.0 0.0.0.0 x.x.x.25 1

  Route inside 192.168.1.0 255.255.255.0 192.168.90.2 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.90.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  Terminal width 80

  : end

  the problem is the configuration, we are unable to access the web server both inside and outside the network.

  All input will be greatly appreciated.

  Kind regards

  udimpas

  activate icmp backtrace and then ping the x.x.x.26 of the internet. the output should be as below:

  3363574:-out ICMP echo request: ID = 21834 seq = 1202 length = 80

  3363575: ICMP echo request: external untranslating: inside: 192.168.90.3

  3363576: ICMP echo-reply from the inside: 192.168.90.3 ID = 21834 seq = 1202 length = 80

  3363577: response to ICMP echo -: translate inside: 192.168.90.3 out:

  by doing this, you can 1. Check the nat 2. If the server responds to the internet.

  do not forget to allow incoming icmp:

  access-l 101 permit icmp any one

• Need help, a problem with IPSec and NAT - T

  We had a successful between a Cisco remote access client and the ASA connection.   The connection is more data transfer, but the Phase I and Phase II complete successfully.   There are several sections between separate networks for the remote user to the ASA, including hotlines of Verizon and Verizon's ISP.

  Troubleshooting Cisco guides strongly suggests, it is a problem of NAT - T, but when I turn on debugging 254 isakmp and debug ipsec 254, I get only a modest messages on NAT - T, which is "Recieved NAT-Traversal version 02 VID.   This message and connections, are when I disabled it on the ASA of NAT - T.

  If I enable NAT - T on the SAA, the remote client cannot establish Phase I or II; I was not able to gather debugs on this scenerio yet.

  The customer has a second laptop, both of them experience the same problem.  We have ensured that the Tunneling, UPD 4500 is activated.

  I suspect that an intermediary device or Verizon, changed something.

  What should be my next troubleshooting (unfortunately, I can't post the configs)?

  Kind regards

  j

  From my very limited experience, both sides must have the NAT - T enabled, otherwise the side who did not need NAT - t won't be able to read the part of the IP header because it is encrypted.

  Good luck!

  Pedro

• weird problem with flash events

  I use a RTP300 (NA unlocked with 3.1.24 latest firmware) router and I'm having a strange problem with my phone.  I think I've finally pushed back.  The problem occurs only in the following circumstances.  When I'm on the phone with a single contact, and I get a call waiting 'click', if the first caller hangs up (I say someone calls etc.), and then when I pick up the 'click', the other appellant does not at all - hear me (sometimes I can hear them perfectly, sometimes without even that).  This problem occurs only if the first caller hangs up - if the first caller stays on the line when I pick up the second call all right.  It does not help if I hang up before you press the flash on the first point of contact.  The only way to make it work, is if I take the second call until the first caller hangs up.

  I'm not using a NAT, the telephone is directly connected to a cable modem and has an external IP address, so it can't be the problem.  Any ideas?  Thank you.

  I don't yet know what was causing the problem, but I found a work around.
  Instead of connect my phone to the port of line 1, I went to port RJ11 2 line and voila! problem solved.  So as long as I don't have need a second phone line I'll be ok .

• Sudden problems with Airplay, Apple TV etc with WAG320N

  Hi all

  Until recently I use DSL through my WAG320N and it worked perfectly. I used my AppleTV with airplay, Vuze, Xbox and so on without problem. I just moved to a new address with internet fiber. I've reconfigured the router for all route (and not an ADSL modem) by assigning the first to act as a WAN port ethernet port. Internet works fine as speed goes, but the wireless LAN is not optimal. I can't get my AppleTV to find iTunes on my laptop and Airplay is very slow and laggy. The router settings remained unchanged at first, but now I tried to reset to the factory settings and start over, this does not solve the problem however. I'm a bit puzled on this, as I know, the change of service provider (and go from ADSL to the fiber) should not have effects on the local network? I noticed that Vuze complains about problems NAT (just need to confirm that there is a NAT problem), but this should not matter in which of the local network, right?

  Any ideas what the problem might be?

  These devices are mentioned connected wireless? This could be a problem with wireless. It may be because of the interference. It is possible that in the new location, you have two or three neighbors who affects the Wi - Fi wireless signal. It is also possible that some other wireless devices are causing interference like cordless phones that moving on the same frequency with the router, the garage door openers and microwave machines. What you can do to prevent the interference must reconfigure wireless settings. Set width/bandwidth of 20 MHz channel and set the standard channel 1, 6 or 11. That should help him.

• IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

  Hello

  My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

  "Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

  NAT takes place before the encryption verification!

  In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

  Thanks for any help

  Best regards

  Heiko

  Hello

  Try to change your static NAT with static NAT based policy.

  That is to say the static NAT should not be applicable for VPN traffic

  permissible static route map 1

  corresponds to the IP 104

  access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

  access-list 104 allow the host ip 10.1.110.10 all

  IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

  HTH

  Kind regards

  GE.

• problems with vpn firewall/proxy configuration

  Hello

  I want to access vpn through firewall/proxy (Client VPN) client-side.

  I installed the vpn gateway as firewall pix 515 using Microsoft CA IKE SA.

  I want to establish the vpn tunnel to my vpn through a proxy/firewall client.

  I tried in some places of vpn client where the firewall acts as a linux machine in which he allowed with the ipsec and NAT esp feature. Its works perfectly. But only one concurrent vpn client. Also the first tunnel vpn disconnects when the second user tries without knowing the first established tunnel.

  I heard that we can drive this problem using "NAT Taversal" mode which is available in version ios 6.3 as concentrator 3000 Cisco pix.

  I want to know how NAT Traversal can solve my problem in which multiple concurrent users without support nat esp in a configuration only one simultaneous user without support nat esp in a configuration of firewall/proxy or firewall/proxy.

  Thank you

  Karthikeyan V

  The VPN client is able to detect that he's been through a NAT/PAT device on the way to the hub/PIX, and then if both ends support it, they will automatically start NAT - T and encapsulate the IPSec packets in UDP port 4500 packets. These can then be NAT would properly and you will not get disconnections or problems you currently see.

  You don't see that a client can connect and customers being disconnected when the other connects it is your PAT instrument cannot process the ISAKMP and IPSec packets correctly. It is a fairly common symptom.

  PIX v6.3 code will support NAT - T, should be available in March sometime.

• Problem with Spotlight fields with the higher priority than browserfield

  It comes to JRE6.

  Some Web sites make a redirect of content or another ajax request when the document is loaded.  When the screen contains a browserfield and a focusable field with a higher priority, an illegal state Exception is thrown by the browser because it is not to the point when the content refreshes the field.  (As in defining BrowserField.setFocus () before calling BrowserField.refresh ()).

  Example: http://supportforums.blackberry.com/t5/Java-Development/BrowserField-Sample-Code-Create-your-first-B...

  Using the code of the BrowserField2 example, simply by adding a ButtonField in the survey except title when navigating to twitter.com.  Other sites work fine, but when the content/javascript is in a certain way on Twitter, she seems to have some problems.

  package mypackage;
  
  import net.rim.device.api.ui.component.ButtonField;
  import net.rim.device.api.ui.container.*;
  import net.rim.device.api.browser.field2.*;
  import net.rim.device.api.ui.*;
  
  class MyBrowserField2Sample extends UiApplication
  {
      private MainScreen _screen;
      private BrowserField _bf2;
      private ButtonField btnField;
  
      MyBrowserField2Sample()
      {   
  
          btnField = new ButtonField();
          btnField.setLabel("A BUTTON");
  
          _bf2 = new BrowserField();
  
          _screen = new MainScreen();
          _screen.setTitle(btnField);
          _screen.add(_bf2);
          pushScreen(_screen);
  
          _bf2.requestContent("http://www.twitter.com");
      }
  
      public static void main(String[] args)
      {
          MyBrowserField2Sample app = new MyBrowserField2Sample();
          app.enterEventDispatcher();
      }
  }
  

  The code above throws an illegal state exception at startup.  If you delete the setTitle (or any field focusable) that has a higher priority than the browserfield, so it works well.

  How can I force the focus on the browserfield when she needs?

  I Googled, found issues similar and all say "force focus on the browserfield", but even if you force the focus, the same illegal state occurs due to the updating of the content.

  Thanks in advance,

  Nate

  After reviewing the matter further, the problem may be to the field focusable, but it doesn't have to be on top.  Basically, any field focusable on the same screen as the browserfield throws the exception.

  While going to twitter.com in blackberry browser works very well (sends you to the mobile site), this behavior causes problems with the browserfield.

  The workaround, is just to force the link to open the mobile site directly.

• Problem with Tunnel VPN L2L between 2 ASA´s

  Hi guys,.

  I have some problems with my VPN Site to site tunnel between 2 ASA (5520/5505).

  I watched a lot of videos on youtube, but I can't find out why the tunnel does not...

  Both devices can ping eachothers WAN IP address (outside interfaces), but I don't see any traffic between the 2 sites. It seems that the tunnel is not open to everyone. When i PING from the local to the Remote LAN (which should be an interesting traffic for the tunnel...), the its IKEv1 remains empty...

  Am I missing something? I can't understand it more why same phase 1 is not engaged.

  You NAT won't. In your config file traffic is NATted initially and then does not match any more crypto ACL. You must move the rule dynamic NAT/PAT until the end of the table on two ASAs NAT:

   no nat (INSIDE,OUTSIDE) source dynamic any interface nat (INSIDE,OUTSIDE) after-auto source dynamic any interface

• Problem with the commissioning of Web check-in and ASK when swicht to the TMS Provisioning extend mode

  Hi, I need help please, because I have no contract and I cannot open a TAC case.

  I have the following two issues:

  1. when I do the tms extension preparation mode switch as stop working sip calls, I get the following error of internal and internet scenarios for my internal network:

  VCS-e when the call is the Internet to the internal network

  2013-09 - 05T 11: 50:38 - 04:30

  "" "" "" "TVCS: event = 'Search is complete" reason ="authorization not valid - insufficient privilege" Service = "H323" type-aliases-Src ="E164" CBC-alias = '7449"Dst-alias-type ="H323"Dst-alias ="anthony_accardi"call-number ="1a069dfa-1647-11e3-86f9-0010f328943a"Tag ="1a069f44-1647-11e3-b22f-0010f328943a"detail ="found: fake, searchtype:ARQ"Level ="1"elements UTCTime = '2013-09-05 16:20:38, 670"

  VCS - c when the call is internal network to the Internet:

  2013-09 - 05T 11: 53:31 - 04:30

  "" "" "" "TVCS: event = 'Search is complete" reason ="prohibited" Service = "H323" type-aliases-Src ="E164" CBC-alias = '7429"Dst-alias-type ="H323"Dst-alias ="vianyfel_cordaro"call-number ="812a5198-1647-11e3-ba89-0010f325da04"Tag ="812a52e2-1647-11e3-93c9-0010f325da04"detail ="found: fake, searchtype:ARQ"Level ="1"elements UTCTime = '2013-09-05 16:23:31, 687"

  2013-09 - 05T 11: 53:31 - 04:30

  "" "" "TVCS: Event = 'research has attempted" Service ="H323" CBC-alias-type = "E164" CBC-alias ='7429"Dst-alias-type ="H323"Dst-alias ="vianyfel_cordaro"call-number ="812a5198-1647-11e3-ba89-0010f325da04"Tag ='812a52e2-1647-11e3-93c9-0010f325da04" detail = "searchtype:ARQ" Level = "1" elements UTCTime ='2013-09-05 16:23:31, 680"

  2013-09 - 05T 11: 53:23 - 04:30

  "" "" "" "TVCS: event = 'Search is complete" reason ="prohibited" Service = "H323" type-aliases-Src ="E164" CBC-alias = '7429"Dst-alias-type ="H323"Dst-alias ="vianyfel_cordaro"call-number ="7c9181c4-1647-11e3-bda8-0010f325da04"Tag ="7c918304-1647-11e3-865b-0010f325da04"detail ="found: fake, searchtype:ARQ"Level ="1"elements UTCTime = '2013-09-05 16:23:23, 974"

  BUT WHEN THE MODE IS AGENT LEGACY TMS ALL THE CALL WORKS FINE

  2 when I switch I can tms mode of preparation I can do internal network equipment supply but not from the outside and this worries me more is the jabber that being Internet I get the following error:

  013 09 - 05 T 11: 07:42 - 04:30	"" "" TVCS: elements UTCTime = '2013-09-05 15:37:42, 263"Module ="network.sip"Level = 'INFO': Src - ip ="192.168.0.252"Src-port ="25084"detail = 'receive the Request OPTIONS = method, Request-URI = sip: 192.168.0.250:7001; transport = tls, [email protected] / * /"
  2013-09 - 05T 11: 07:42 - 04:30

  "" TVCS: elements UTCTime = '2013-09-05 15:37:42, 261"Module ="network.sip"Level ="DEBUG": Dst - ip ="192.168.0.252"Dst-port ="25084"
  SIPMSG:
  | SIP/2.0 401 Unauthorized
  Via: SIP/2.0/TLS 192.168.0.252:5061; branch = z9hG4bK4de281330ed1277914e57a4bb98ac81416134; received = 192.168.0.252; rport = 25084
  Call ID: [email protected]/ * /.
  CSeq: 38570 OPTIONS
  Starting at: ; tag = 21e96c96b3f9a439
  To: ; tag = ba0e03ca2f6b3957
  Server: TANDBERG/4120 (X7.2.1)
  WWW-Authenticate: Digest realm = "TraversalZone", nonce = "b40cb8278b4a11da992154324161d566d2b57bac3d83c5c518c4528c790d", opaque = "AQAAAN1NC9IHdFS3kNJ3Q6UX2JiBXhut", stale = FALSE, algorithm = MD5, qop = "auth".
  Content-Length: 0

  |

  2013-09 - 05T 11: 07:42 - 04:30

  "" "" TVCS: elements UTCTime = '2013-09-05 15:37:42, 261"Module ="network.sip"Level = 'INFO': Dst - ip ="192.168.0.252"Dst-port ="25084"detail ="sending = 401, method = OPTIONS, To = sip response Code: 192.168.0.250:7001, [email protected] / * /"

  2013-09 - 05T 11: 07:42 - 04:30

  "" TVCS: elements UTCTime = '2013-09-05 15:37:42, 261"Module ="network.sip"Level ="DEBUG": Src - ip ="192.168.0.252"Src-port ="25084"
  SIPMSG:
  | Sip OPTIONS: 192.168.0.250:7001; transport = tls SIP/2.0
  Via: SIP/2.0/TLS 192.168.0.252:5061; branch = z9hG4bK4de281330ed1277914e57a4bb98ac81416134; received = 192.168.0.252; rport = 25084
  Call ID: [email protected]/ * /.
  CSeq: 38570 OPTIONS
  Starting at: ; tag = 21e96c96b3f9a439
  TO:
  Max-Forwards: 0
  User-Agent: TANDBERG/4120 (X7.2.1)
  Support: com.tandberg.vcs.resourceusage
  Content-Type: text/xml
  Content-Length: 250

  25075024960|

  2013-09 - 05T 11: 07:42 - 04:30

  "" "" TVCS: elements UTCTime = '2013-09-05 15:37:42, 261"Module ="network.sip"Level = 'INFO': Src - ip ="192.168.0.252"Src-port ="25084"detail = 'receive the Request OPTIONS = method, Request-URI = sip: 192.168.0.250:7001; transport = tls, [email protected] / * /"

  2013-09 - 05T 11: 07:36 - 04:30

  "" "" "TVCS: elements UTCTime = '2013-09-05 15:37:36, 757" Module ="network.tcp" Level = "DEBUG": Src - ip = "10.10.10.1" Src-port ="10191" Dst - ip = "10.10.10.10" Dst-port ='5060"detail = 'TCP connection is closed"

  2013-09 - 05T 11: 07:36 - 04:30

  "" TVCS: elements UTCTime = '2013-09-05 15:37:36, 641"Module ="network.sip"Level ="DEBUG": Dst - ip ="10.10.10.1"Dst-port ="10191"
  SIPMSG:
  | SIP/2.0 404 not found
  Via: SIP/2.0/TCP 201.210.111.54:2379; branch = z9hG4bK5fc6a3c5021e3557216ef01c2434fb00.1; received = 10.10.10.1; rport = 10191; DefaultZone = ingress-box
  Call ID: [email protected]/ * /.
  CSeq: 301 SUBSCRIBE
  From: <> [email protected] / * />; tag = 2991aa56d191ede3
  To: <> [email protected] / * />; tag = c4114db76ace49d8
  Server: TANDBERG/4120 (X7.2.1)
  WARNING: 200.11.230.253:5060 399 'political response '.
  Content-Length: 0

  |

  2013-09 - 05T 11: 07:36 - 04:30

  "" "" TVCS: elements UTCTime = '2013-09-05 15:37:36, 641"Module ="network.sip"Level = 'INFO': Dst - ip ="10.10.10.1"Dst-port ="10191"detail = 'send = 404, method = SUBSCRIBE, To = sip response Code: [email protected] / * /, [email protected] / * /"

  2013-09 - 05T 11: 07:36 - 04:30

  "" TVCS: elements UTCTime = '2013-09-05 15:37:36, 638"Module ="network.sip"Level ="DEBUG": Src - ip ="10.10.10.1"Src-port ="10191"
  SIPMSG:
  | Sip SUBSCRIBE:[email protected] / * / SIP/2.0
  Via: SIP/2.0/TCP 201.210.111.54:2379; branch = z9hG4bK5fc6a3c5021e3557216ef01c2434fb00.1; received = 10.10.10.1; rport = 10191
  Call ID: [email protected]/ * /.
  CSeq: 301 SUBSCRIBE
  Contact: <> [email protected]/ * /: 2379; transport = tcp >
  From: <> [email protected] / * />; tag = 2991aa56d191ede3
  To: <> [email protected] / * />
  Max-Forwards: 70
  Directions:
  User-Agent: TANDBERG/774 (4.6.3.17194 PCS) - Windows
  Expires: 300
  Event: ua-profile;model=movi;vendor=tandberg.com;profile-type=user;version=4.6.3.17194;clientid="S-1-5-21-1078081533-484061587-725345543";connectivity=1
  Accept: application/pidf + xml
  Content-Length: 0

  The setup I have is:

  

  Configuration on VCS Expressway:

  TMS Agent Legacy mode

  Search rule:

  local area-no domain

  Any

  Any

  NO.

  Alias matching

  Regex

  (. +) @domain.com. *.

  Replace

  Continue

  LocalZone.GetDaylightChanges

  local area full URL

  Any

  Any

  NO.

  Alias matching

  Regex

  (. +) @domain.com. *.

  Leave

  Continue

  LocalZone.GetDaylightChanges

  Search of covered area rule

  Any

  Any

  NO.

  Any alias

  Continue

  TraversalZone

  Search for DNS zone rule

  Any

  AllZones

  NO.

  Alias matching

  Regex

  (?. *@%localdomains%.*$).*)

  Leave

  Continue

  DNSZone

  Transform

  Transform the alis destinations to URL

  ([^@]*)

  Regex

  Replace

  ------[email protected] / * /

  Presence PUA - on

  Presence server - off

  CONTROL VCS:

  TMS Extension commissioning of fashion

  Search rule

  local area-no domain

  Any

  Any

  NO.

  Alias matching

  Regex

  (. +) @domain.com. *.

  Replace

  Continue

  LocalZone.GetDaylightChanges

  local area full URL

  Any

  Any

  NO.

  Alias matching

  Regex

  (. +) @domain.com. *.

  Leave

  Continue

  LocalZone.GetDaylightChanges

  Search of covered area rule

  Any

  Any

  NO.

  Any alias

  Continue

  TraversalZone

  External IP address search rule

  Any

  Any

  NO.

  Any IP address

  Continue

  TraversalZone

  Transform

  Transform the alis destinations to URL

  ([^@]*)

  Regex

  Replace

  ------[email protected] / * /

  PUA - on

  presence server - on

  I do not have political appeal hace

  Please help me to see what I'm missing or what's wrong?

  Thankss

  Hello

  Ok. Are you saying that VCSe uses the IP address 10.10.10.10 in interface external, right? Of course, what the IP address of 200.x.x.x? It's your VCSe NAT IP address, right? What is this configured in VCSe?

  Well, reaally you have a problem of NAT. look at the SUBSCRIPTION message of jabber to VCSe:

  SIPMSG:

  | Sip SUBSCRIBE:[email protected] / * / SIP/2.0

  Via: SIP/2.0/TCP 201.210.116.201:3612; branch = z9hG4bK138dca6bf6cdd458588900dbaf7b45f4.1; received = 10.10.10.1; rport = 9368

  Call ID: [email protected]/ * /.

  CSeq: 301 SUBSCRIBE

  Contact:

  From: [email protected] / * />; tag = 1e82c817dc3224d5

  In: [email protected] / * />

  Max-Forwards: 70

  Directions:

  User-Agent: TANDBERG/774 (4.6.3.17194 PCS) - Windows

  Expires: 300

  Event: ua-profile;model=movi;vendor=tandberg.com;profile-type=user;version=4.6.3.17194;clientid="S-1-5-21-1078081533-484061587-725345543";connectivity=1

  Accept: application/pidf + xml

  Content-Length: 0

  Do you see? If the Red 192.168.41.205 IP address is the IP address of your router/nat, then you can come to the conclusion that your router is inspection/ALG, it puts its own IP address in the SIP headers. Your router/firewall device should not use any function ALG/inspection, otherwise you will have problems.

  I can say with great confidence, VCSe rejects the message SUBSCRIBE "404 not found" response because VCSE does not recognize this IP address in the field 'road', 192.168.41.205.

  In addition, the configuration of your NAT is not recommended. First, you use the port-based NAT (PAT), in fact, you must use a NAT. Second, when your NAT firewall allows VCSe, the source address is 10.10.10.1, which means that your firewall is NATing the source address and destination address not only. This type of NAT, it is not recommended for h.323/SIP applications.

  Well, don't be angry with me, I try to help, but I need to say, your deployment VCSe is almost completely false, there are a lot of blind spots.

  I suggest reviewing and reconfigure your deployment following this guide:

  http://www.Cisco.com/en/us/docs/Telepresence/infrastructure/VCs/config_guide/Cisco_VCS_Basic_Configuration_Control_with_Expressway_Deployment_Guide_X7-2.PDF

  I hope this helps.

  Concerning

  Paulo Souza

  My answer was helpful? Please note the useful answers and do not forget to mark questions resolved as "responded."

• Problem with VPN connection from a connection shared cable modem

  Couple of my users on a remote site share a modem cable connection using a Linksys 4 port router. They connect to the main campus using VPN. When the two try to connect via VPN to the only main campus can connect at the same time. We have VPN 3015 concentrator on the main campus and the user is authenticated on our active directory. The machines of users has windows XP pro and use Microsoft VPN to connect. Anyone encountered this before? No solution/work around?

  Thank you.

  -Nik

  I suspect that the problem is to do with NAT / PAT - if only a customer wants to create a VPN session to the 3015, NAT is used, but if several clients go through your Linksys router, then you are using PAT, that requires NAT t (nat transparency), see the following URL for more information:- http://support.microsoft.com/default.aspx?scid=kb;en-us;818043

  Rowan

• LAN to LAN VPN with NAT - solved!

  Hello world

  I have problems with a VPN L2L is implemented and logged, however when traffic comes from the other side of the tunnel it is not the host to internal network using a static NAT. Inside host 172.18.30.225 is current NATted to yyy.30.49.14 which is an IP address on the DMZ (yyy.30.49.0 255.255.255.240) Interface.

  Here is the configuration

  object-group network NET Tunnel
  network-host xxx.220.129.134 object

  Access tunnel list - extended ACL permit ip host yyy.30.49.14 object-group NET Tunnel

  correspondence address card crypto MAP_Tunnel 20 Tunnel-ACL

  the Tunnel-iServer-NAT object network
  Home yyy.30.49.14
  network of the Tunnel and drop-in iServer object
  Home 172.18.30.225

  network of the Tunnel and drop-in iServer object
  NAT (internal, DMZ) static Tunnel-iServer-NAT

  I hope that it is enough for someone to help me.

  Thank you

  M

  Version 8.3.1 ASA

  Post edited by: network operations

  The internal host does live on the network DMZ or internal? If she lives on the internal network, you can not NAT to the DMZ to interface and make it out of the external Interface, assuming that the external interface is the interface of VPN endpoint. If you terminate the VPN on the DMZ interface and the internal host lives on the internal network, then that's fine.

• Validation of the IOS VPN peer identity IP with NAT - T

  I just lost a lot of time to understand this behavior of the IOS. My conclusion reached: If you work with the good old peer identity address validation in profiles ISAKMP and the peer you are talking about is located behind a NAT, you must use the private IP address of the peer in the command "adapter address of the identity". I thought that NAT - T takes care of the translation in all sections of required configuration, but here especially, seems not so much. The interesting thing is that for all other orders, you must use the public IP address.

  See the following example (showing only the relevant articles with statements by peer inside):

  door-key crypto OUR_KEYRING

  key pre-shared key address 1.2.3.4

  Crypto isakmp PROFILE_NAME profile

  VRF TEST

  key ring OUR_KEYRING

  function identity address 192.168.99.5 255.255.255.255

  OUR_MAP 6 ipsec-isakmp crypto map

  defined peer 1.2.3.4

  the value of PROFILE_NAME isakmp-profile

  Does anyone know if this is normal or if it is a bug? It would be useful and consistent if NAT - T changed the identity of the peer address during the phase 1 negotiation, then we would not deal with peer private addressing within site to site VPN configs. I also think of IP scenarios that overlap that may occur when you work with dealing with private peer.

  See the release of relevant debugging in the attachment, after documenting a failed connection attempt (using the public, NATted IP of the peer in the command 'fit the address of identity') and once a following connection attempt (using the IP private, internal counterpart).

  My router is a C2951 with IOS 15.3 (2) T2. The counterpart is an ASA (version & unknown config so far, but I'm sure that the other engineer did not indicate what it is using a private address in its config, despite my session from behind a NAT router, too).

  Thank you & best regards

  Toni

  Toni,

  Problem with identity is that it is an encrypted package (in Exchange MM) so cannot be changed in transit, so that a host may not know reliably it is the external IP address (it can make assumptions, but he doesn't know how long it is valid for).

  Also if you "NAT 'd" identity you can't the difference between two devices behind same NAT/PAT on end of answering machine.

  There are some implmentations IKE allowing IKE to identity type and value to specify manually. IOS not among them.

  Yes decouple us identity and peer of the intellectual property, it adds flexability with a few corner cases which may arrise.

  Yet another reason why NAT is evil?

  M.