Programmatic access to remote files via VPN on Playbook

Similar Questions

• How to implement a local SOA/BPM project using remote resources via VPN

  Hello world

  Sorry for the dummy question, but I am a beginner and I'm in trouble with this problem.

  This is the scenario: I have to carry a BPM project using JDev 11.1.1.7 on my local environment and then deploy them on remote servers via VPN where a development environment is configured.

  All services are on remote servers.

  My question is: what I put up in my local environment?

  1 DB connection (distance connettion)

  2 configuration of MDS to share components?

  3 WebLogic server?

  3. what else?

  Any link o idea to share?

  Thank you.

  Fairlie

  Hello

  If you need to deploy and test in your front room to deploy remotely, then you will need to set up all the people in your premises + SOA Suite... If you need to do is put on your local, but can check remotely, you only JDev and connections...

  See you soon,.

  Vlad

• We can access autogen_dimensions.xml file via a URL?

  Hello
  
  We can access autogen_dimensions.xml file via a URL?
  
  Is it possible to access the file autogen_dimensions.xml with the URL as shown below.
  
  http://host:port / < App name > /Data/State/autogen_dimensions.xml file. I want to read this file in my java class.
  
  Kind regards
  Ravinder P

  Service platform is delivered with 2 copies of the reference application. The folder that you noted is not functional, for reference.

  Who is running is located at:

  \Endeca\PlatformServices\6.1.2\tools\server\webapps\endeca_jspref

  You should be able to just drag the files in there.

• Customer remote cannot access the server LAN via VPN

  Hi friends,

  I'm a new palyer in ASA.

  My business is small. We need to the LAN via VPN remote client access server.

  I have an ASA5510 with version 7.0. I have configured remote access VPN and it can establish the tunnel with success. But I can not access the server.

  Client VPN is 5.0.07.0290 version. Encrypted packages have increased but the decrypted packet is 0 in the VPN client statistics, after I connected successfully.

  Next to the ASA, I show crypto ipsec sa, just deciphering the packets increase.

  Who can help me?

  Thank you very much.

  The following configuration:

  ASA Version 7.0(7)
  
      !
  
      hostname VPNhost
  
      names
  
      dns-guard
  
      !
  
      interface Ethernet0/0
  
      nameif outside
  
      security-level 10
  
      ip address 221.122.96.51 255.255.255.240
  
      !
  
      interface Ethernet0/1
  
      nameif inside
  
      security-level 100
  
      ip address 192.168.42.199 255.255.255.0
  
      !
  
      interface Ethernet0/2
  
      shutdown
  
      no nameif
  
      no security-level
  
      no ip address
  
      !
  
      interface Management0/0
  
      shutdown
  
      no nameif
  
      no security-level
  
      no ip address
  
      management-only
  
      !
  
      ftp mode passive
  
      dns domain-lookup inside
  
      access-list PAT_acl extended permit ip 192.168.42.0 255.255.255.0 any
  
      access-list allow_PING extended permit icmp any any inactive
  
      access-list Internet extended permit ip host 221.122.96.51 any inactive
  
      access-list VPN extended permit ip 192.168.42.0 255.255.255.0 192.168.43.0 255.255.255.0
  
      access-list VPN extended permit ip 192.168.43.0 255.255.255.0 192.168.42.0 255.255.255.0
  
      access-list CAPTURE extended permit ip host 192.168.43.10 host 192.168.42.251
  
      access-list CAPTURE extended permit ip host 192.168.42.251 host 192.168.43.10
  
      pager lines 24
  
      mtu outside 1500
  
      mtu inside 1500
  
      ip local pool testpool 192.168.43.10-192.168.43.20
  arp timeout 14400
  
      global (outside) 1 interface
  
      nat (inside) 0 access-list VPN
  
      nat (inside) 1 access-list PAT_acl
  
      route outside 0.0.0.0 0.0.0.0 221.122.96.49 10
  
  
      username testuser password 123
  
      aaa authentication ssh console LOCAL
  
      aaa local authentication attempts max-fail 3
  no sysopt connection permit-ipsec
  
      crypto ipsec transform-set FirstSet esp-des esp-md5-hmac
  
      crypto dynamic-map dyn1 1 set transform-set FirstSet
  
      crypto dynamic-map dyn1 1 set reverse-route
  
      crypto map mymap 1 ipsec-isakmp dynamic dyn1
  
      crypto map mymap interface outside
  
      isakmp enable outside
  
      isakmp policy 1 authentication pre-share
  
      isakmp policy 1 encryption des
  
      isakmp policy 1 hash md5
  
      isakmp policy 1 group 2
  
      isakmp policy 1 lifetime 86400
  
      isakmp nat-traversal  3600
  
      tunnel-group testgroup type ipsec-ra
  
      tunnel-group testgroup general-attributes
  
      address-pool testpool
  
      tunnel-group testgroup ipsec-attributes
  
      pre-shared-key *
  
      telnet timeout 5
  ssh timeout 10
  
      console timeout 0
  : end
  

  Topology as follows:

  

  Hello

  Configure the split for the VPN tunneling.

  1. Create the access list that defines the network behind the ASA.

     ciscoasa(config)#access-list Split_Tunnel_List remark The corporate network behind the ASA. ciscoasa(config)#access-list Split_Tunnel_List standard permit 10.0.1.0 255.255.255.0 

  2. Mode of configuration of group policy for the policy you want to change.

     ciscoasa(config)#group-policy hillvalleyvpn attributes ciscoasa(config-group-policy)#

  3. Specify the policy to split tunnel. In this case, the policy is tunnelspecified.

     ciscoasa(config-group-policy)#split-tunnel-policy tunnelspecified 

  4. Specify the access tunnel split list. In this case, the list is Split_Tunnel_List.

     ciscoasa(config-group-policy)#split-tunnel-network-list value Split_Tunnel_List 

  5. Type this command:

     ciscoasa(config)#tunnel-group hillvalleyvpn general-attributes 

  6. Associate the group with the tunnel group policy

     ciscoasa(config-tunnel-ipsec)# default-group-policy hillvalleyvpn 

  7. Leave the two configuration modes.

     ciscoasa(config-group-policy)#exit ciscoasa(config)#exit ciscoasa#

  8. Save configuration to non-volatile RAM (NVRAM) and press enter when you are prompted to specify the name of the source file.

  Kind regards
  Abhishek Purohit
  CCIE-S-35269

• How to access messages remotely or via web?

  How can I access e-mail remotely or via web.  All I know is that you can't do through iCloud.  (With the help of Macbook 10.11).  Thank you.

  You can if you use email to iCloud. If you do not, then you will need to access it from the web site of your email provider, for example, Google, Comcast.

• Access to remote files blackBerry Z10

  I don't have a problem with the XP pc, can access it remotely. my Vista pc is problematic, most of the time it shows "offline" and even when 'online' I can't always access shared folders.

  Connected with link PCs, the two pc is matched, both have active WiFi.

  Today, pilots would not charge when I plugged the USB Vista, the Z10 restarted with no luck.

  Link uninstalled and re-installed, loading drivers and has worked perfectly, disconnected Z10, Lo an behold, remained connected to WiFi.

  Wonder for how long.

• Cannot access static nat address via vpn.

  I have an asa5510 where I

  a static nat from one interface to the other.

  I also have a VPN connection to the asa...

  On the other side of the vpn connection, I can not access this static NAT.

  192.168.170.x is the vpn network.

  Is it not possible to access the static NAT over vpn?

  the DM_INLINE_NETWORK_16 object-group network
  object-network 192.168.0.0 255.255.255.0
  object-network vxtron 255.255.255.0
  object-network dmz_zone 255.255.255.0
  object-network 192.168.170.0 255.255.255.0

  MPLS_nat0_outbound list extended access deny host ip 172.26.1.5 all

  Access extensive list ip 172.26.0.0 MPLS_nat0_outbound allow 255.255.252.0 object-group DM_INLINE_NETWORK_16

  pnat1 list extended access permit ip host 172.26.1.5 all

  static (MPLS, inside) 192.168.0.199 access list pnat1

  NAT (MPLS) 0-list of access MPLS_nat0_outbound
  NAT (MPLS) 1 172.26.0.0 255.255.252.0
  static (MPLS, inside) 172.26.1.5 MPLS_nat_static access list

  René, happy you including yourself this one! If you could, please mark the post as solved so that we know that it is not need more attention

• Cannot access remote network via VPN

  Hello

  I'm trying to set up a router vpn access to my office network. The router is connected to the Internet through using pppoe vdsl.
  There is also a public oriented Web server in the office which must be accessible.

  I can access the Web server from the Internet and the vpn connects successfully. I can also ping the LAN Gateway, however, I can't access all the local machines.

  I'm quite puzzled as to why it does not work. Please could someone help.

  The results of tests and the router configuration are listed below. Please let me know if you need additional information.

  Thank you and best regards,
  Simon

  1. routing on the router table
  Router #sh ip route
  Gateway of last resort is ggg.hhh.125.34 to network 0.0.0.0
  xxx.yyy.zzz.0/29 is divided into subnets, subnets 1
  C XXX.yyy.zzz.192 is directly connected, Vlan10
  GGG.hhh.125.0/32 is divided into subnets, subnets 1
  C GGG.HHH.125.34 is directly connected, Dialer0
  172.16.0.0/32 is divided into subnets, subnets 1
  S 172.16.100.50 [1/0] via mmm.nnn.ppp.sss
  S * 0.0.0.0/0 [1/0] via ggg.hhh.125.34

  2. ping PC remotely (172.16.100.50) local GW (172.16.100.1) successful
  > ping 172.16.100.1
  Ping 172.16.100.1 with 32 bytes of data:
  Response to 172.16.100.1: bytes = 32 time = 24ms TTL = 255
  Response to 172.16.100.1: bytes = 32 time = 10ms TTL = 255
  Response to 172.16.100.1: bytes = 32 time = 10ms TTL = 255
  Response to 172.16.100.1: bytes = 32 time = 11ms TTL = 255

  3. ping PC remotely (172.16.100.50) to the local server (172.16.100.10) failure
  > ping 172.16.100.10
  Ping 172.16.100.10 with 32 bytes of data:
  Request timed out.
  Request timed out.
  Request timed out.
  Request timed out.

  4. ping the router to the successful local server
  router #ping 172.16.100.10
  Type to abort escape sequence.
  Send 5, echoes ICMP 100 bytes to 172.16.100.10, wait time is 2 seconds:
  !!!!!
  Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/4 ms

  5 see the version
  Cisco IOS software, software of C181X (C181X-ADVIPSERVICESK9-M), Version 12.4 (15) T1, VERSION of the SOFTWARE (fc2)
  ROM: System Bootstrap, Version 12.3 YH6 (8r), RELEASE SOFTWARE (fc1)
  the availability of router is 1 hour, 9 minutes
  System image file is "flash: c181x-advipservicesk9 - mz.124 - 15.T1.bin".
  Cisco 1812-J (MPC8500) processor (revision 0 x 300) with 118784K / 12288K bytes of memory.
  10 FastEthernet interfaces
  1 ISDN basic rate interface
  Configuration register is 0 x 2102

  6. router Config
  AAA authentication login default local
  connection of local AAA VPN authentication.
  AAA authorization exec default local
  local authorization AAA VPN network
  !
  !
  AAA - the id of the joint session
  !
  !
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  !
  Configuration group customer isakmp crypto ASI_Group
  key mykey
  DNS aaa.bbb.cccc.ddd
  domain mydomain.com
  pool VPN_Pool
  ACL VPN_ACL
  !
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac TS1
  !
  crypto dynamic-map 10 DYNMAP
  game of transformation-TS1
  market arriere-route
  !
  !
  list of authentication of VPN client VPN crypto card
  card crypto VPN VPN isakmp authorization list
  crypto map VPN client configuration address respond
  card crypto 10 VPN ipsec-isakmp dynamic DYNMAP
  !
  !
  !
  IP cef
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  username admin privilege 15 password mypassword
  Archives
  The config log
  hidekeys
  !
  !
  !
  !
  !
  interface FastEthernet0
  WAN description
  no ip address
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  no ip mroute-cache
  automatic duplex
  automatic speed
  PPPoE enable global group
  PPPoE-client dial-pool-number 1
  !
  interface FastEthernet2
  Description Public_LAN_Interface
  switchport access vlan 10
  full duplex
  Speed 100
  !
  FastEthernet6 interface
  Description Private_LAN_Interface
  switchport access vlan 100
  full duplex
  Speed 100
  !
  interface Vlan1
  no ip address
  !
  interface Vlan10
  Public description
  IP address xxx.yyy.zzz.193 255.255.255.248
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  no ip mroute-cache
  !
  interface Vlan100
  172.16.100.1 IP address 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  no ip mroute-cache
  !
  interface Dialer0
  IP unnumbered Vlan10
  no ip unreachable
  IP mtu 1452
  IP virtual-reassembly
  encapsulation ppp
  no ip mroute-cache
  Dialer pool 1
  Dialer-Group 1
  Authentication callin PPP chap Protocol
  PPP chap hostname myhostname
  PPP chap password mychappassword
  PPP ipcp dns request accept
  failure to track PPP ipcp
  PPP ipcp address accept
  VPN crypto card
  !
  IP pool local VPN_Pool 172.16.100.50 172.16.100.60
  !
  !
  no ip address of the http server
  no ip http secure server
  !
  VPN_ACL extended IP access list
  IP 172.16.100.0 allow 0.0.0.255 any
  !
  Dialer-list 1 ip protocol allow
  not run cdp
  !
  !

  Simon,

  Basically when you connect through a VPN Client PC routing table is updated automatically as soon as the connection is established. If you do not need to manually add routes. You can check this by doing a "route print" once you are connected.

  Ideally, you need to put your pool of VPN on subnet that does not exist on your physical network, the router would be to route traffic between the IP pool and internal subnet.

  Now, you said that you have a web server with a public IP address that you need to access through the VPN, that host also as a private IP addresses on the 172.16.100.0? If it isn't then the ACL that I proposed should work. If she only has a public IP then your ACL VPN address must have something like

  IP 172.16.100.0 allow 0.0.0.255 192.168.100.0 0.0.0.255

  219.xxx.yyy.192 ip 0.0.0.7 permit 192.168.100.0 0.0.0.255

  Who says the router and the client to encrypt all traffic between the subnets behind your router and your VPN pool.

  I hope this helps.

  Luis Raga

• Access to the DMZ to remote sites via VPN S2S

  We have an ASA 5520 and two remote site ASA 5505 that connect to each other through tunnels VPN S2S. They are doing tunneling split, while local traffic passes over the tunnel. We are local LAN (10.0.0.0/16) and our network to the DMZ (10.3.0.0/24) on the main site. The DMZ hosts our external sharepoint, but we access it internally

  The problem is site A (10.1.0.0/24) and B (10.2.0.0/24) have no idea of it, and when you try to go to the site, it fails. You can access it via the external site address, but that's the only way. Normally the external address is blocked when you're an intern.

  That I'm stuck on is even when we had all sent traffic from Site A to our Senior Center, would find it yet. I do a separate vpn purely tunnel that traffic to DMZ?

  Yes. So if you do this in ASDM under Edit Site profile connection Site, it will look like this.

  Local network: 10.0.0/16, 10.3.0.0/24

  Distance: 10.1.0.0/24

• Use the remote website via VPN site-to-site

  Hi all

  We have two sites, the site has and B. At site A, we have a Web site we want to share with all of site B. Currently, site B can access the site via the VPN site-to site on X 0, which is their LAN. Nothing outside X 0 cannot access or ping to the address.

  We added access rules to allow access from the DMZ to this interface, but again, no ping and no communication at all. The other strange thing is that we see that no trip package for these access rules either.

  Any help is appreciated. Thank you.

  It seems that the demilitarized zone is not part of the VPN tunnel.

  Can you confirm that the DMZ subnet is part of local destinations on the site B and a part of the local destinations on site?

  Kevin

• Need help to access the internal network via VPN on ASA5505 8.4 (1)

  Recently, I upgraded my ASA5055 from 8.02 to 8.4 and since I have updated to the new version I can access my home network is no longer through the VPN. I can connect to the VPN with no problems however I can no longer ping or you connect to my network of 10.0. Someone would be kind enough to look at my config and tell me what needs to be added to make it work? In my old config, I had a statement of NAT for VPN that is no longer here.

  I also wanted to configure WebVPN to work as well, and this is something that I've never been able to understand. Is it also possible that I can be on my 20.0 network and connect to the VPN and access 10.0 as well? When it is connected to my network of 20.0 I'm not received credentials to connect to the VPN. I would be grateful if someone can help out me. The major part of this is the first part of this question.

  My configuration:

  ASA Version 8.4 (1)

  !

  ASA5505 hostname

  domain xxxxxxxx.dyndns.org

  enable encrypted password xxxxxxxxxxxx

  xxxxxxxxxxxxxxx encrypted passwd

  names of

  nameserver 192.168.10.2

  Office of name 192.168.10.3

  name Canon 192.168.10.5

  name 192.168.10.6 mvix

  name 192.168.10.7 xbox

  name 192.168.10.8 dvr

  name 192.168.10.9 bluray

  name 192.168.10.10 lcd

  name 192.168.10.11 mp620

  name 192.168.10.12 kayla

  name 192.168.1.1 asa5505

  name 192.168.1.2 ap1

  name 192.168.10.4 mvix2

  name 192.168.10.13 lcd2

  name 192.168.10.14 dvr2

  !

  interface Vlan1

  nameif management

  security-level 100

  IP address asa5505 255.255.255.248

  management only

  !

  interface Vlan2

  0050.8db6.8287 Mac address

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  interface Vlan10

  nameif private

  security-level 100

  IP 192.168.10.1 255.255.255.224

  !

  interface Vlan20

  nameif Public

  security-level 100

  IP 192.168.20.1 255.255.255.224

  !

  interface Ethernet0/0

  Description pointing to WAN

  switchport access vlan 2

  !

  interface Ethernet0/1

  Uplink port Linksys 12 description

  switchport access vlan 10

  !

  interface Ethernet0/2

  Description Server 192.168.10.2/27

  switchport access vlan 10

  !

  interface Ethernet0/3

  Uplink Eth1 management description

  !

  interface Ethernet0/4

  switchport access vlan 30

  !

  interface Ethernet0/5

  switchport access vlan 30

  !

  interface Ethernet0/6

  switchport access vlan 30

  !

  interface Ethernet0/7

  Description of Cisco 1200 Access Point

  switchport trunk allowed vlan 1,10,20

  switchport trunk vlan 1 native

  switchport mode trunk

  !

  Banner motd users only, all others must disconnect now!

  boot system Disk0: / asa841 - k8.bin

  passive FTP mode

  clock timezone PST - 8

  clock summer-time recurring PDT

  DNS server-group DefaultDNS

  domain xxxxxxx.dyndns.org

  network object obj - 192.168.50.0

  192.168.50.0 subnet 255.255.255.0

  Server network objects

  host 192.168.10.2

  network object obj - 192.168.10.0

  192.168.10.0 subnet 255.255.255.224

  network object obj - 192.168.20.0

  subnet 192.168.20.0 255.255.255.224

  network server-01 object

  host 192.168.10.2

  network server-02 object

  host 192.168.10.2

  xbox network object

  Home 192.168.10.7

  xbox-01 network object

  Home 192.168.10.7

  xbox-02 network object

  Home 192.168.10.7

  xbox-03 network object

  Home 192.168.10.7

  xbox-04 network object

  Home 192.168.10.7

  network server-03 object

  host 192.168.10.2

  network server-04 object

  host 192.168.10.2

  network server-05 object

  host 192.168.10.2

  Desktop Network object

  host 192.168.10.3

  kayla network object

  Home 192.168.10.12

  Home_VPN_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.224

  outside_access_in list extended access permit tcp any any eq 3389

  outside_access_in list extended access permit tcp any any eq 2325

  outside_access_in list extended access permit tcp any eq ftp server object

  outside_access_in list extended access permit tcp any any eq 5851

  outside_access_in list extended access udp allowed any any eq 5850

  outside_access_in list extended access permit tcp any any eq pptp

  outside_access_in list extended access udp allowed any any eq syslog

  outside_access_in list extended access udp allowed any any eq 88

  outside_access_in list extended access udp allowed any any eq 3074

  outside_access_in list extended access permit tcp any any eq 3074

  outside_access_in list extended access permit tcp any any eq field

  outside_access_in list extended access udp allowed any any eq field

  outside_access_in list extended access permitted tcp everything any https eq

  outside_access_in list extended access permit tcp any eq ssh server object

  outside_access_in list extended access permit tcp any any eq 2322

  outside_access_in list extended access permit tcp any any eq 5900

  outside_access_in list extended access permit icmp any any echo response

  outside_access_in list extended access permit icmp any any source-quench

  outside_access_in list extended access allow all unreachable icmp

  outside_access_in list extended access permit icmp any one time exceed

  outside_access_in list extended access udp allowed any any eq 5852

  KaileY_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.224

  pager lines 24

  Enable logging

  timestamp of the record

  exploitation forest-size of the buffer of 36000

  logging warnings put in buffered memory

  recording of debug trap

  asdm of logging of information

  address record [email protected] / * /

  exploitation forest-address recipient [email protected] / * / level of errors

  Management Server host forest

  MTU 1500 management

  Outside 1500 MTU

  MTU 1500 private

  MTU 1500 Public

  local pool IPPOOL 192.168.50.2 - 192.168.50.10 255.255.255.0 IP mask

  local pool VPN_POOL 192.168.100.2 - 192.168.100.10 255.255.255.0 IP mask

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow all outside

  ASDM image disk0: / asdm - 641.bin

  don't allow no asdm history

  ARP timeout 14400

  !

  Server network objects

  NAT (private, foreign) static tcp ftp 5851 service interface

  network object obj - 192.168.10.0

  NAT (private, foreign) dynamic interface

  network object obj - 192.168.20.0

  NAT (outside) dynamic public interface

  network server-01 object

  NAT (private, outside) interface static 2325 2325 tcp service

  network server-02 object

  NAT (private, outside) interface static udp syslog syslog service

  xbox network object

  NAT (private, outside) interface static service udp 88 88

  xbox-01 network object

  NAT (private, outside) interface static service udp 3074-3074

  xbox-02 network object

  NAT (private, outside) interface static service tcp 3074-3074

  xbox-03 network object

  NAT (private, outside) interface static tcp domain domain service

  xbox-04 network object

  field of the udp NAT (private, foreign) of the static interface function

  network server-03 object

  NAT (private, outside) interface static tcp https https service

  network server-04 object

  Static NAT (private, outside) interface service tcp ssh 2322

  network server-05 object

  NAT (private, outside) interface static 5900 5900 tcp service

  Desktop Network object

  NAT (private, outside) interface static service tcp 3389 3389

  kayla network object

  NAT (private, outside) interface static service udp 5852 5852

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  AAA authentication enable LOCAL console

  AAA authentication http LOCAL console

  the ssh LOCAL console AAA authentication

  AAA authentication LOCAL telnet console

  Enable http server

  http 192.168.1.0 255.255.255.248 management

  redirect http outside 80

  location of SNMP server on the Office floor

  SNMP Server contact [email protected] / * /

  Community SNMP-server

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  No vpn sysopt connection permit

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto-map dynamic outside_dyn_map pfs set 20 Group1

  Crypto-map dynamic outside_dyn_map 20 set transform-set ESP-3DES-SHA ikev1

  life together - the association of security crypto dynamic-map outside_dyn_map 20 28800 seconds

  Crypto-map dynamic outside_dyn_map 20 kilobytes of life together - the association of safety 4608000

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  Crypto ikev1 allow outside

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.248 management

  SSH 0.0.0.0 0.0.0.0 outdoors

  SSH timeout 30

  Console timeout 30

  access to administration management

  dhcpd dns 24.205.1.14 66.215.64.14

  dhcpd ping_timeout 750

  dhcpd field xxxxxxxx.dyndns.org

  dhcpd outside auto_config

  !

  dhcpd manage 192.168.1.4 - 192.168.1.5

  dhcpd enable management

  !

  dhcpd address private 192.168.10.20 - 192.168.10.30

  enable private dhcpd

  !

  dhcpd 192.168.20.2 public address - 192.168.20.30

  dhcpd enable Public

  !

  a basic threat threat detection

  statistical threat detection port

  Statistical threat detection Protocol

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  Server NTP 192.43.244.18

  Server NTP 129.6.15.28

  WebVPN

  internal Home_VPN group strategy

  attributes of Group Policy Home_VPN

  value of 8.8.8.8 DNS Server 4.2.2.2

  Ikev1 VPN-tunnel-Protocol without ssl-client

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list Home_VPN_splitTunnelAcl

  value by default-field www.xxxxxx.com

  the address value IPPOOL pools

  WebVPN

  the value of the URL - list ClientlessBookmark

  political group internal kikou

  group attributes political kikou

  value of 8.8.8.8 DNS Server 4.2.2.2

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list KaileY_splitTunnelAcl

  XXXXXXX.dyndns.org value by default-field

  username scottrog encrypted password privilege 0 xxxxxxxxxxxxxx

  user_name john encrypted password privilege 0 xxxxxxxxxxxxxxx

  username joek encrypted password privilege 0 xxxxxxxxxxxx

  eostrike encrypted xxxxxxxxxxxx privilege 15 password username

  username almostsi encrypted password privilege 0 xxxxxxxxxxxxxx

  username ezdelarosa password xxxxxxxxxxxxxxencrypted privilege 0

  type tunnel-group Home_VPN remote access

  attributes global-tunnel-group Home_VPN

  IPPOOL address pool

  LOCAL authority-server-group

  authorization-server-group (outside LOCAL)

  Group Policy - by default-Home_VPN

  authorization required

  IPSec-attributes tunnel-group Home_VPN

  IKEv1 pre-shared-key *.

  type tunnel-group SSLClientProfile remote access

  tunnel-group SSLClientProfile webvpn-attributes

  enable SSLVPNClient group-alias

  tunnel-group type ClientLESS remote access

  tunnel-group kanazoé type remote access

  attributes global-tunnel-group kanazoé

  address VPN_POOL pool

  by default-group-policy kikou

  tunnel-group KaileY ipsec-attributes

  IKEv1 pre-shared-key *.

  by default-group Home_VPN tunnel-Group-map

  !

  !

  context of prompt hostname

  call-home

  Profile of CiscoTAC-1

  no active account

  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

  email address of destination [email protected] / * /

  destination-mode http transport

  Subscribe to alert-group diagnosis

  Subscribe to alert-group environment

  Subscribe to alert-group monthly periodic inventory

  monthly periodicals to subscribe to alert-group configuration

  daily periodic subscribe to alert-group telemetry

  Cryptochecksum:438ed6084bb3dc956574b1ce83f52b86

  : end

  ASA5505 #.

  Here are the declarations of NAT for your first question:

  network object obj - 192.168.100.0

  255.255.255.0 subnet 192.168.100.0

  NAT (private, foreign) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 192.168.50.0 obj - 192.168.50.0

  NAT (private, foreign) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 192.168.100.0 obj - 192.168.100.0

  And 'clear xlate' after the above and that should fix your first question.

  I would check your second question and get back to you shortly.

• ARD can not see remote clients via VPN

  Hi all. I found not been able to find an answer to what works. I appreciate the help.

  I have two networks, home and office, be it online by a router in Time Machine. I set up a VPN server in the office. I can however connect with success at home and can go up to the servers and can control the computer server in ARD. But I don't see any other machines on the network of the company unless I enter their IP directly, and even then I can't control them. I can control the server, and it can see and control the other remote machines. If I'm in the office, I can see and control all machines on the network.

  The network router is set to distribute addresses 10.0.1.2 - 200. The home network is set to distribute addresses of 10.0.1.201 - 250. The VPN server has address 10.0.1.250 - 255.

  What Miss me? Thank you very much.

  for VPN works normally your networks must be in a different IP address ranges

  you have everything in 10.0.1 range

  for example the Office Network 10.0.1.xxx

  network servant 10.0.1.xx

  This is maybe the reason why you cannot control the machines.

  VPN requires the Remote LAN to be on a different subnet/ip range

  If they are no routing etc. can get screwed up like router/VPN cannot know where things are

  Try to change your home network to a range of ip address/subnet different example 192.168.1.xx

• Access to the administration via VPN to 887 after config setup pro

  Hi all

  Ive just made a three 887w for a client in a few branches, and as this is the first time I have deployed these devices, I decided to go with the GUI (downloaded config pro 2.3) to get the configuration made that I had some constraints of time to get them in place (sometimes I go with the graphical interface first and then look back at the CLI to see what as its been) (, then hand it in Notepad to get a better understanding of the new features of the CLI may be gone and allowed).

  One thing I again, that I was going to do face was my first experience of the firewall IOS area type of config...

  At this point, I'm still unclear on the config (where why Im posting here I guess!) - but the main problem I have at the moment is with managing access to devices.

  Particularly with regard to access to the administration of headquarters inside the IP address of the branch routers.

  I should mention that the branch routers are connected to Headquarters by connections IPSec site-to-site VPN and these connections are all very good, all connectivity (PC server, PC, printer, etc.) is very well... I can also send packets (using the inside of the interface as a source) ping from branch routers to servers on the headquarters LAN.

  Set up access to administration using config pro to allow access to the router on the subnet headquarters (on its inside interface), as well as the local subnet and also SSH access to a specific host from the internet - the local subnet and the only host on the internet can access the router very well.

  I'm not sure if the problem is with the ZBF config or if its something really obvious Im missing! -Ive done routers branch several times previously, so with this being the first config ZBF I did, so I came to the conclusion that there must be something in the absence of my understanding.

  Any help greatly appreciated... sanitized config below!

  Thanks in advance

  Paul

  version 15.1
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  sequence numbers service
  !
  hostname name-model
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered 51200
  recording console critical
  enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxx
  !
  No aaa new-model
  !
  iomem 10 memory size
  clock timezone PCTime 0
  PCTime of summer time clock day March 30, 2003 01:00 October 26, 2003 02:00
  Service-module wlan-ap 0 autonomous bootimage
  !
  Crypto pki trustpoint TP-self-signed-2874941309
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2874941309
  revocation checking no
  rsakeypair TP-self-signed-2874941309
  !
  !
  TP-self-signed-2874941309 crypto pki certificate chain
  certificate self-signed 01
  

  no ip source route
  !
  !
  DHCP excluded-address IP 10.0.0.1 10.0.0.63
  DHCP excluded-address IP 10.0.0.193 10.0.0.254
  !
  DHCP IP CCP-pool
  import all
  Network 10.0.0.0 255.255.255.0
  default router 10.0.0.1
  xxxxxxxxx.com domain name
  Server DNS 192.168.xx.20 194.74.xx.68
  Rental 2 0
  !
  !
  IP cef
  no ip bootp Server
  IP domain name xxxxxxx.com
  name of the server IP 192.168.XX.20
  name of the server IP 194.74.XX.68
  No ipv6 cef
  !
  !
  Authenticated MultiLink bundle-name Panel

  parameter-card type urlfpolicy websense cpwebpara0
  Server 192.168.xx.25
  source-interface Vlan1
  allow mode on
  parameter-card type urlf-glob cpaddbnwlocparapermit0
  model citrix.xxxxxxxxxxxx.com

  license udi pid xxxxxxxxxxx sn CISCO887MW-GN-E-K9
  !
  !
  username xxxxxxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxx
  username privilege 15 secret 5 xxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx
  !
  !
  !
  !
  synwait-time of tcp IP 10
  !
  type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-1
  game group-access 106
  type of class-card inspect entire game SDM_SHELL
  match the name of group-access SDM_SHELL
  type of class-card inspect entire game SDM_SSH
  match the name of group-access SDM_SSH
  type of class-card inspect entire game SDM_HTTPS
  match the name of group-access SDM_HTTPS
  type of class-card inspect all match sdm-mgmt-cls-0
  corresponds to the SDM_SHELL class-map
  corresponds to the SDM_SSH class-map
  corresponds to the SDM_HTTPS class-map
  type of class-card inspect entire game SDM_AH
  match the name of group-access SDM_AH
  type of class-card inspect entire game SDM_ESP
  match the name of group-access SDM_ESP
  type of class-card inspect entire game SDM_VPN_TRAFFIC
  match Protocol isakmp
  match Protocol ipsec-msft
  corresponds to the SDM_AH class-map
  corresponds to the SDM_ESP class-map
  type of class-card inspect the correspondence SDM_VPN_PT
  game group-access 105
  corresponds to the SDM_VPN_TRAFFIC class-map
  type of class-card inspect entire game PAC-cls-insp-traffic
  match Protocol cuseeme
  dns protocol game
  ftp protocol game
  h323 Protocol game
  https protocol game
  match icmp Protocol
  match the imap Protocol
  pop3 Protocol game
  netshow Protocol game
  Protocol shell game
  match Protocol realmedia
  match rtsp Protocol
  smtp Protocol game
  sql-net Protocol game
  streamworks Protocol game
  tftp Protocol game
  vdolive Protocol game
  tcp protocol match
  udp Protocol game
  inspect the class-map match PAC-insp-traffic type
  corresponds to the class-map PAC-cls-insp-traffic
  type of class-map urlfilter match - all cpaddbnwlocclasspermit0
  Server-domain urlf-glob cpaddbnwlocparapermit0 match
  type of class-card inspect entire game PAC-cls-icmp-access
  match icmp Protocol
  tcp protocol match
  udp Protocol game
  class-map type urlfilter websense match - all cpwebclass0
  match any response from the server
  type of class-card inspect correspondence ccp-invalid-src
  game group-access 100
  type of class-card inspect correspondence ccp-icmp-access
  corresponds to the class-ccp-cls-icmp-access card
  type of class-card inspect sdm-mgmt-cls-ccp-permit-0 correspondence
  corresponds to the class-map sdm-mgmt-cls-0
  game group-access 103
  type of class-card inspect correspondence ccp-Protocol-http
  http protocol game
  !
  !
  type of policy-card inspect PCB-permits-icmpreply
  class type inspect PCB-icmp-access
  inspect
  class class by default
  Pass
  type of policy-card inspect sdm-pol-VPNOutsideToInside-1
  class type inspect sdm-cls-VPNOutsideToInside-1
  inspect
  class class by default
  drop
  type of policy-card inspect urlfilter cppolicymap-1
  urlfpolicy websense cpwebpara0 type parameter
  class type urlfilter cpaddbnwlocclasspermit0
  allow
  Journal
  class type urlfilter websense cpwebclass0
  Server-specified-action
  Journal
  type of policy-map inspect PCB - inspect
  class type inspect PCB-invalid-src
  Drop newspaper
  class type inspect PCB-Protocol-http
  inspect
  service-policy urlfilter cppolicymap-1
  class type inspect PCB-insp-traffic
  inspect
  class class by default
  drop
  type of policy-card inspect PCB-enabled
  class type inspect SDM_VPN_PT
  Pass
  class type inspect sdm-mgmt-cls-ccp-permit-0
  inspect
  class class by default
  drop
  !
  security of the area outside the area
  safety zone-to-zone
  zone-pair security PAC-zp-self-out source destination outside zone auto
  type of service-strategy inspect PCB-permits-icmpreply
  zone-pair security PAC-zp-in-out source in the area of destination outside the area
  type of service-strategy inspect PCB - inspect
  source of PAC-zp-out-auto security area outside zone destination auto pair
  type of service-strategy inspect PCB-enabled
  sdm-zp-VPNOutsideToInside-1 zone-pair security source outside the area of destination in the area
  type of service-strategy inspect sdm-pol-VPNOutsideToInside-1
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key address 194.105.xxx.xxx xxxxxxxxxxxx
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to194.105.xxx.xxx
  the value of 194.105.xxx.xxx peer
  game of transformation-ESP-3DES-SHA
  match address VPN - ACL
  !
  !
  !
  !
  !
  interface BRI0
  no ip address
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  encapsulation hdlc
  Shutdown
  Multidrop ISDN endpoint
  !
  ATM0 interface
  no ip address
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  No atm ilmi-keepalive
  !
  point-to-point interface ATM0.1
  Description $ES_WAN$
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  PVC 0/38
  aal5mux encapsulation ppp Dialer
  Dialer pool-member 1
  !
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  wlan-ap0 interface
  description of the Service interface module to manage the embedded AP
  IP unnumbered Vlan1
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  ARP timeout 0
  !
  interface GigabitEthernet0 Wlan
  Description interface connecting to the AP the switch embedded internal
  !
  interface Vlan1
  Description $ETH - SW - LAUNCH, INTF-INFO-HWIC $$ $4ESW $FW_INSIDE$
  the IP 10.0.0.1 255.255.255.0
  IP access-group 104 to
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  IP nat inside
  IP virtual-reassembly
  Security members in the box area
  IP tcp adjust-mss 1452
  !
  interface Dialer0
  Description $FW_OUTSIDE$
  IP address 81.142.xxx.xxx 255.255.xxx.xxx
  IP access-group 101 in
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  NAT outside IP
  IP virtual-reassembly
  outside the area of security of Member's area
  encapsulation ppp
  Dialer pool 1
  Dialer-Group 1
  Authentication callin PPP chap Protocol
  PPP chap hostname xxxxxxxxxxxxxxxx
  PPP chap password 7 xxxxxxxxxxxxxxxxx
  No cdp enable
  map SDM_CMAP_1 crypto
  !
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  !
  IP nat inside source overload map route SDM_RMAP_1 interface Dialer0
  IP route 0.0.0.0 0.0.0.0 Dialer0
  !
  SDM_AH extended IP access list
  Note the category CCP_ACL = 1
  allow a whole ahp
  SDM_ESP extended IP access list
  Note the category CCP_ACL = 1
  allow an esp
  SDM_HTTP extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq www
  SDM_HTTPS extended IP access list
  Note the category CCP_ACL = 0
  permit any any eq 443 tcp
  SDM_SHELL extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq cmd
  SDM_SNMP extended IP access list
  Note the category CCP_ACL = 0
  allow udp any any eq snmp
  SDM_SSH extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq 22
  SDM_TELNET extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq telnet
  scope of access to IP-VPN-ACL list
  Note ACLs to identify a valuable traffic to bring up the VPN tunnel
  Note the category CCP_ACL = 4
  Licensing ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
  Licensing ip 10.0.0.0 0.0.0.255 10.128.xx.0 0.0.255.255
  Licensing ip 10.0.0.0 0.0.0.255 160.69.xx.0 0.0.255.255
  !
  recording of debug trap
  Note category of access list 1 = 2 CCP_ACL
  access-list 1 permit 10.0.0.0 0.0.0.255
  access-list 23 allow 193.195.xxx.xxx
  Note access-list 23 category CCP_ACL = 17
  access-list 23 permit 192.168.xx.0 0.0.0.255
  access-list 23 allow 10.0.0.0 0.0.0.255
  Access-list 100 category CCP_ACL = 128 note
  access-list 100 permit ip 255.255.255.255 host everything
  access-list 100 permit ip 127.0.0.0 0.255.255.255 everything
  access-list 100 permit ip 81.142.xxx.xxx 0.0.0.7 everything
  Access-list 101 remark self-generated by SDM management access feature
  Note access-list 101 category CCP_ACL = 1
  access-list 101 permit tcp host 193.195.xxx.xxx host 81.142.xxx.xxx eq 22
  access-list 101 permit tcp host 193.195.xxx.xxx host 81.142.xxx.xxx eq 443
  access-list 101 permit tcp host 193.195.xxx.xxx host 81.142.xxx.xxx eq cmd
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq telnet
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq 22
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq www
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq 443
  access-list 101 tcp refuse any host 81.142.xxx.xxx eq cmd
  access-list 101 deny udp any host 81.142.xxx.xxx eq snmp
  access-list 101 permit ip 160.69.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  access-list 101 permit ip 10.128.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  access-list 101 permit ip 192.168.xx.0 0.0.0.255 10.0.0.0 0.0.0.255
  access-list 101 permit udp host 194.105.xxx.xxx host 81.142.xxx.xxx eq non500-isakmp
  access-list 101 permit udp host 194.105.xxx.xxx host 81.142.xxx.xxx eq isakmp
  access-list 101 permit host 194.105.xxx.xxx host 81.142.xxx.xxx esp
  access-list 101 permit ahp host 194.105.xxx.xxx host 81.142.xxx.xxx
  access list 101 ip allow a whole
  Note access-list 102 CCP_ACL category = 1
  access-list 102 permit ip 192.168.xx.0 0.0.0.255 everything
  access-list 102 permit ip host 193.195.xxx.xxx all
  access-list 102 permit ip 10.0.0.0 0.0.0.255 any
  Note access-list 103 self-generated by SDM management access feature
  Note access-list 103 CCP_ACL category = 1
  access-list 103 allow ip host 193.195.xxx.xxx host 81.142.xxx.xxx
  Note access-list 104 self-generated by SDM management access feature
  Note access-list 104 CCP_ACL category = 1
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq telnet
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq telnet
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 eq on host 10.0.0.1 22
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq 22
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq www
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 eq to host 10.0.0.1 www
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq 443
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq 443
  access-list 104 permit tcp 192.168.xx.0 0.0.0.255 host 10.0.0.1 eq cmd
  access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.1 eq cmd
  access-list 104 tcp refuse any host 10.0.0.1 eq telnet
  access-list 104 tcp refuse any host 10.0.0.1 eq 22
  access-list 104 tcp refuse any host 10.0.0.1 eq www
  access-list 104 tcp refuse any host 10.0.0.1 eq 443
  access-list 104 tcp refuse any host 10.0.0.1 eq cmd
  access-list 104 deny udp any host 10.0.0.1 eq snmp
  104 ip access list allow a whole
  Note access-list 105 CCP_ACL category = 128
  access-list 105 permit ip host 194.105.xxx.xxx all
  Note access-list 106 CCP_ACL category = 0
  access-list 106 allow ip 192.168.xx.0 0.0.0.255 10.0.0.0 0.0.0.255
  access-list 106 allow ip 10.128.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  access-list 106 allow ip 160.69.0.0 0.0.255.255 10.0.0.0 0.0.0.255
  Note category from the list of access-107 = 2 CCP_ACL
  access-list 107 deny ip 10.0.0.0 0.0.0.255 160.69.0.0 0.0.255.255
  access-list 107 deny ip 10.0.0.0 0.0.0.255 10.128.0.0 0.0.255.255
  access-list 107 deny ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
  access-list 107 allow ip 10.0.0.0 0.0.0.255 any
  Dialer-list 1 ip protocol allow
  not run cdp

  !
  !
  !
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 107
  !
  !
  control plan
  !
  !
  Line con 0
  local connection
  no activation of the modem
  line to 0
  line 2
  no activation-character
  No exec
  preferred no transport
  transport of entry all
  line vty 0 4
  access-class 102 in
  privilege level 15
  local connection
  transport input telnet ssh
  !
  Scheduler allocate 4000 1000
  Scheduler interval 500
  NTP-Calendar Update
  130.159.196.118 source Dialer0 preferred NTP server
  end

  Hi Paul,.

  Here is the relevant configuration:

  type of policy-card inspect PCB-enabled

  class type inspect sdm-mgmt-cls-ccp-permit-0
  inspect

  
  

  type of class-card inspect sdm-mgmt-cls-ccp-permit-0 correspondence
  corresponds to the class-map sdm-mgmt-cls-0
  game group-access 103

  
  

  type of class-card inspect all match sdm-mgmt-cls-0
  corresponds to the SDM_SHELL class-map
  corresponds to the SDM_SSH class-map
  corresponds to the SDM_HTTPS class-map

  
  

  type of class-card inspect entire game SDM_SHELL
  match the name of group-access SDM_SHELL
  type of class-card inspect entire game SDM_SSH
  match the name of group-access SDM_SSH
  type of class-card inspect entire game SDM_HTTPS
  match the name of group-access SDM_HTTPS

  
  

  SDM_SHELL extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq cmd
  SDM_SSH extended IP access list
  Note the category CCP_ACL = 0
  permit tcp any any eq 22
  SDM_HTTPS extended IP access list
  Note the category CCP_ACL = 0
  permit any any eq 443 tcp

  
  

  Note access-list 103 self-generated by SDM management access feature
  Note access-list 103 CCP_ACL category = 1
  access-list 103 allow ip host 193.195.xxx.xxx host 81.142.xxx.xxx

  The above configuration will allow you to access the router on the 81.142.xxx.xxx the IP address of the host 193.195.xxx.xxx using HTTPS/SSH/SHELL. To allow network 192.168.16.0/24 access to the router's IP 10.0.0.1, add another entry to the access list 103 as below:

  access-list 103 allow ip 192.168.16.0 0.0.0.255 host 10.0.0.1

  This should take enable access to this IP address for hosts using ssh and https. Try this out and let me know how it goes.

  Thank you and best regards,

  Assia

• ORA-28500 when you access an Excel file

  Hello
  
  I'm getting the dreaded ORA-28500 "optional not implemented" when you try to access an Excel file via ODBC HS. This is a bug in 11.1.0.6 (6701400), however my flavor is 11.1.0.7 fully patched. Because I'm trying to use the OLAP on Windows XP 32, I installed version 11.1.0.6 and applied the patches 6890831 and 7682184, as recommend it on [this page | http://www.oracle.com/technology/products/bi/olap/collateral/olap_certification.html], without as far as I can tell error. This should have fixed the problem with dg4odbc according to the bug page, but when now trying to access an Excel spreadsheet I get the exact same message:
  

  SQL> select * from "International$"@refdata;
  select * from "International$"@refdata
                *
  ERROR at line 1:
  ORA-28500: connection from ORACLE to a non-Oracle system returned this message:
  [Microsoft][ODBC Excel Driver]Optional feature not implemented
  ORA-02063: preceding 2 lines from REFDATA

  Is it possible that the patch do not go as planned? Or the second patch to restore the old behavior? I am really lost at what to do now.
  
  Thanks for your help,
  Chris

  Hi Chris,

  The problem is really fixed in 11.1.0.7 However you must change this setting:
  HS_FDS_SUPPORT_STATISTICS = FALSE

  11.1.0.6, the default value of HS_FDS_SUPPORT_STATISTICS is set to 'TRUE '.
  even if the trace files see the value is set to "FALSE".
  In 11.1.0.7 is always 'TRUE' by default, but the trace files now show that
  value.
  Use DG4ODBC with Excel, requires that the value "false".

  I hope this helps you

  Kind regards

  Mireille

• Cannot connect remotely via VPN since installing the new modem/router

  Can anyone help please. Since the acquisition of a new router / modem I can no longer connect via VPN to my work PC remotely. It comes in I receive the error message. Can someone tell me if I need to change the settings for the new modem / router to access?

  

  Hello Joanna,

  Here are the steps you need to do first:

  1. Off static IP for my server and let the router assign IP address and changed the IP address of the port forward.
  2. Check the IP address because obviously, that changed when you plugged into the router again.
  3. Updated to the latest firmware for the router and NIC.

  For more detailed troubleshooting you can refer to this link: troubleshooting common VPN related errors.

  Let us know how it goes.