Publish a server with NAT anchored through a tunnel VPN with ASA

Similar Questions

• Order of operations NAT on Site to Site VPN Cisco ASA

  Hello

  I have a question about the order of operations NAT on Site to Site VPN Cisco ASA 8.2.x. I have a scenario where the internal IP address of the range 10.17.128.x are NATTED IP public 31.10.10.x. below is the config:

  Tunnel normally passes traffic to dmz - 31.10.11.10, 31.10.11.11 servers.

  But the servers NATTED (10.17.128.x <->31.10.10.x) does not work.

  inside_map crypto 50 card value transform-set ESP-3DES-SHA

  tunnel-group 100.1.1.1 type ipsec-l2l

  tunnel-group 100.1.1.1 General-attributes

  Group Policy - by default-PHX_HK

  IPSec-attributes tunnel-group 100.1.1.1

  pre-shared key *.

  internal PHX_HK group policy

  PHX_HK group policy attributes

  VPN-filter no

  Protocol-tunnel-VPN IPSec svc webvpn

  card crypto inside_map 50 match address outside_cryptomap_50

  peer set card crypto inside_map 50 100.1.1.1

  inside_map crypto 50 card value transform-set ESP-3DES-SHA

  inside_map crypto 50 card value reverse-road

  the PHX_Local object-group network

  host of the object-Network 31.10.11.10

  host of the object-Network 31.10.11.11

  host of the object-Network 31.10.10.10

  host of the object-Network 31.10.10.11

  host of the object-Network 31.10.10.12

  host of the object-Network 31.10.10.13

  host of the object-Network 10.17.128.20

  host of the object-Network 10.17.128.21

  host of the object-Network 10.17.128.22

  host of the object-Network 10.17.128.23

  the HK_Remote object-group network

  host of the object-Network 102.1.1.10

  inside_nat0_outbound list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

  ACL_INSIDE list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

  ACL_OUTSIDE list extended access permitted ip object-group HK_Remote-group of objects PHX_Local

  outside_cryptomap_50 list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

  Route outside 102.1.1.10 255.255.255.255 30.1.1.1 1

  public static 31.10.10.10 (Interior, exterior) 10.17.128.20 netmask 255.255.255.255

  public static 31.10.10.11 (Interior, exterior) 10.17.128.21 netmask 255.255.255.255

  public static 31.10.10.12 (Interior, exterior) 10.17.128.22 netmask 255.255.255.255

  public static 31.10.10.13 (Interior, exterior) 10.17.128.23 netmask 255.255.255.255

  He started to work when I did another group of object by name PHX_Local1 and added to the list of access inside_nat0_outbound, instead of the object group PHX_Local, as below:

  the PHX_Local1 object-group network

  host of the object-Network 31.10.10.10

  host of the object-Network 31.10.10.11

  host of the object-Network 31.10.10.12

  host of the object-Network 31.10.10.13

  No inside_nat0_outbound access list extended only to allowed ip object-group PHX_Local-group of objects HK_Remote

  inside_nat0_outbound list extended access permitted ip object-group PHX_Local1-group of objects HK_Remote

  Can you please help me understand why group object PHX_Local failed with access-list inside_nat0_outbound, but he began to work with the Group of objects PHX_Local1.

  Also, if you could tell me the order of operations to NAT via VPN Site to Site, it would be useful.

  Thank you

  Kind regards

  Thomas

  Hello

  I think you could have said the original question in a way that could be missleading. In other words, if I understand now.

  From what I understand now, you have the DMZ set up the server that are measured with a public IP address on the real servers. And for those that you have configured NAT0.

  Then you have other servers that do not have public IP addresses themselves, but they are translated on the SAA.

  If this is the case, then the next question would be. The server with the NAT should attend the L2L VPN connection with their real IP or address IP NAT.

  Of course if you configure static NAT for the same servers and NAT0 the NAT0 will always win.

  You have these guests who were not able to use the VPN L2L

  31.10.10.10 10.17.128.20

  31.10.10.11 10.17.128.21

  31.10.10.12 10.17.128.22

  31.10.10.13 10.17.128.23

  IF you want them to go to the VPN L2L with their original IP address then you must configure

  object-group, LAN

  host of the object-Network 10.17.128.20

  host of the object-Network 10.17.128.21

  host of the object-Network 10.17.128.22

  host of the object-Network 10.17.128.23

  object-group, REMOTE network

  host of the object-Network 102.1.1.10

  inside_nat0_outbound list extended access allowed ip-group of objects LOCAL object-group remote

  outside_cryptomap_50 list extended access allowed ip-group of objects LOCAL object-group remote

  IF you want to use the L2L VPN with the public IP address, then you must configure

  object-group, LAN

  host of the object-Network 31.10.10.10

  host of the object-Network 31.10.10.11

  host of the object-Network 31.10.10.12

  host of the object-Network 31.10.10.13

  object-group, REMOTE network

  host of the object-Network 102.1.1.10

  outside_cryptomap_50 list extended access allowed ip-group of objects LOCAL object-group remote

  EDIT: in this case you naturally do not configure any NAT0 for actual IP addresses we want precisely the IP addresses to be visible to the L2L VPN with the IP NAT address.

  Or you can of course use the same "object-group" as currently but change the content in an appropriate manner

  Be sure to mark it as answered if it was answered.

  Ask more if necessary

  -Jouni

• a way vpn with asa to the 800 router

  people

  I have a site to site vpn set up between a asa 5540 and a 800 router

  I want only the vpn to be initiated from the asa with the 800 remote listen incoming connections

  I know that I can define the type of connection on the asa as only come but I can find an equivalent command to answer only for the 800 remote

  can anyone point me in the right direction or is it enough to simply configure the asa as are created only for this encryption card

  Thanks to anyone who takes the time to answer

  Hello

  I recommend you configure the tunnel as a dynamic to static tunnel VPN, the ASA will be the static counterpart, so it will be the initiator and the router will never be able to establish the connection.

  The ASA will be a common L2L configuration, but the router will use a dynamic encryption card.

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008051a69a.shtml

  The PIX in the example is old, then you can simply adjust the controls to your current version, the important thing is to understand the concept.

  Please let me know if that answers your question,

  Thank you.

• Site VPN to IPsec with PAT through the tunnel configuration example

  Hello

  as I read a lot about vpn connections site-2-site
  and pass by PAT through it I still haven't found an example configuration for it on e ASA 55xx.

  now, I got suite facility with two locations A and B.

  192.168.0.0/24 Site has - ipsec - Site B 192.168.200.0/24
  172.16.16.0/24 Site has

  ---------------------------------------------------------------------------

  Host--> participated in IP 192.168.0.4: 192.168.0.3-> to 192.168.200.20
  Host 192.168.0.127--> participated in IP: 192.168.0.3-> to 192.168.200.20
  Host 192.168.0.129--> participated in IP: 192.168.0.3-> to 192.168.200.20
  Host 192.168.0.253--> participated in IP: 192.168.0.3-> to 192.168.200.20

  Host 172.16.16.127--> participated in IP: 192.168.0.3-> to 192.168.200.20
  Host 172.16.16.253--> participated in IP: 192.168.0.3-> to 192.168.200.20

  ---------------------------------------------------------------------------

  Now that I have guests autour within networks 172.16.16.0 like 192.168.0.0,
  witch need to access a server terminal server on the SITE b.

  As I have no influence on where and when guests pop up in my Site.
  I would like to hide them behind a single ip address to SITE B.

  If in the event that a new hosts need access, or old hosts can be deleted,
  its as simple as the ACL or conviniently inlet remove the object from the network.

  so I guess that the acl looks like this:

  ---------------------------------------------------------------------------

  access VPN-PARTICIPATED-HOSTS list allow ip 192.168.0.4 host 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 192.168.0.127 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 192.168.0.129 192.168.200.20
  access VPN-PARTICIPATED-HOSTS list allow ip 192.168.0.253 host 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 172.16.16.127 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 172.16.16.253 192.168.200.20

  ---------------------------------------------------------------------------

  But, now, my big question is, how do I said the asa to use: 192.168.0.3 as the
  address for the translation of PAT?

  something like this he will say, it must be treated according to the policy:

  NAT (1-access VPN INVOLVED-HOST internal list)

  Now how do I do that?
  The rest of the config, I guess that will be quite normal as follows:

  card crypto outside_map 1 match address outside_1_cryptomap
  card crypto outside_map 1 set of AA peers. ABM CC. DD
  card crypto outside_map 1 set of transformation-ESP-AES-256-SHA
  outside_map card crypto 1 lifetime of security set association, 3600 seconds

  permit access list extended ip 192.168.0.3 outside_1_cryptomap host 192.168.200.20

  ---------------------------------------------------------------------------

  On SITE B

  the config is pretty simple:

  card crypto outside_map 1 match address outside_1_cryptomap
  card crypto outside_map 1 set of peer SITE has IP
  card crypto outside_map 1 set of transformation-ESP-AES-256-SHA
  outside_map card crypto 1 lifetime of security set association, 3600 seconds

  outside_1_cryptomap list extended access allowed host host 192.168.200.20 IP 192.168.0.3

  inside_nat0_outbound list extended access allowed host host 192.168.200.20 IP 192.168.0.3

  ---------------------------------------------------------------------------

  Thank you for you're extra eyes and precious time!

  Colin

  You want to PAT the traffic that goes through the tunnel?

  list of access allowed PAT ip 192.168.0.0 255.255.255.0 192.168.200.0 255.255.255.0

  PAT 172.16.16.0 permit ip access list 255.255.255.0 192.168.200.0 255.255.255.0

  NAT (inside) 1 access list PAT

  Global (outside) 1 192.168.0.3 255.255.255.255

  Then, the VPN ACL applied to the card encryption:

  list of access allowed vpn host ip 192.168.0.3 192.168.200.0 255.255.255.0

  Thus, all traffic from Site A will be PATed when you remotely 192.168.200.0/24

  The interesting thing is that traffic can only be activated from your end.

  The remote end cannot initialize traffic to 192.168.0.3 if there is not a version of dynamic translation on your side.

  Is that what you are looking for?

  Federico.

• Hub topology and talk: can I traffic Internet road to PC at a radius of the site through the tunnel and NAT outside in the world on the 5520 hub?

  I don't know if it can be made to work or not, or if it's a mutually excluded NAT configuration that is not possible, but I have a 5520 ASA to my site central office with a fiber of 20Mbps Internet streams and two remote offices with ASA 5505 devices connected via DSL or cable modem and have finally got from Site to Site "spoke" VPN upward tunnels and run with the ability to route traffic to through a 'hairpin turn' speak-to-Spoke on the Hub Site 5520.

  I have desktop PC at each remote site speaks A & B that need to communicate directly with them to support a small group of work-style of the software point of sale that is actually hosted on a remote site A PC.

  PC on two remote sites must also be able to communicate with a credit card processing by the public Internet service, and I wish have the ASA 5505 units in each block of remote office as all traffic directly NAT'ed from each respective out on the local LAN PC straight Internet above each site cable modem or DSL modem. I want to force these PCs need to NAT their Internet-destination back through the ASA 5520 traffic located at the Home Office, on the VPN tunnels. In other words, I want the cable modem and DSL connections to route traffic strictly VPN encrypted to the Home Office and also behave like routers NAT for the local PC it.

  I can kill the 5505 prevents NAT for PCS in remote offices simply removing the rule dynamic NAT factory default for 'everything', but then I can't understand how to get my 5520 central to perform NAT which required of the remote PCs to talk to their service of Internet credit card processor without breaking the configs "NAT-free" necessary for VPN traffic to spoke-to-spoke to work. If I'm trying to put an entry static or dynamic NAT for a remote desktop on my 5520 ASA central, it breaks the VPN tunnel so that PC specific.

  Is that what I want to accomplish even possible with the ASA?

  Hi Neal,

  Yes, it's quite possible! below is a loss of things you need to do:

  (1) make sure of course on both the 5505 s of the ASA, you send ALL traffic from the local network through the VPN.

  (2) as Andrew mentioned, have the 'same-security-traffic permit intra-interface' command on the ASA 5520.

  (3) you do not have to have a configured proxy server, but it is also a good solution. But to make it work without her, assuming that the ASA 5505 remote subnets 192.168.1.0/24 and 192.168.2.0/24, add the config lines below to the ASA 5520:

  NAT (outside) 1 192.168.1.0 255.255.255.0

  NAT (outside) 1 192.168.2.0 255.255.255.0

  Global 1 interface (outside)

  Please note that 1 id, and the interface can be replaced according to the configuration you already have in place in the ASA 5520.

  I don't know what kind of NAT exemptions are at the origin of the questions for you, but if you can put a sanitized one of your ASA 5505 and ASA 5520 config, I can make suggestions concerning the exact configuration.

  Let me know if it helps!

  Thank you and best regards,

  Assia

• Reactive layouts: publish multiple Sites with conditional Builds and which connect

  I hope that someone can provide a simple solution to publish problems I've had with adapted presentations when you try to publish several sites with conditional builds. Essentially, I want to be able to have an index page that links to one of the two variants of the published sites that I called 'General' and 'specific '. When I click on the 'general' link I want to not open the site which was published with a conditional for all these subjects compilation labeled as 'general' and when I click on the 'link' want it to open the site which was published using a conditional version for 'specific '.

  Here are the steps I took to create sites and can't seem to get to bind correctly:

  Table of contents, topic Creation and tagging content

  1. Creates a Table of contents.
  2. Added 2 topics in the Table of contents. The first topic, I called "general" and the second issue I called, 'specific '.
  3. I then click with the right button on the "general" and selected subject Tag to build conditional apply. From there, I've created a new tag called "General".
  4. I repeated this process to create the specific tag, but do a right-click on the 'specific' theme and the creation of a new tag called "specific".

  Layouts reactive and edited the sites based on the conditional tags

  1. Created sensitive presentation using the standard layout and content generated without any conditional builds.
  2. Duplicated sensitive put in page and gave him the content of 'general' then it is generated using the conditional, "General" version If the finished publication published content has shown that the 'general' subject, as expected.
  3. I then repeated the same process for the specific content and content using the version parole, generated 'specific '. When over content published showed that the subject marked as 'specific' as expected.

  Added an Index page to the table of contents

  1. Created a new topic to serve as the launch page.
  2. Added a 'general' hyperlink called for the launch of the general "theme found in the general publishes from the resource manager.
  3. Added a hyperlink called 'specific' to the launch of the general "theme found in the specific issues from the resource manager.
  4. I then republish the sensitive standard layout site.

  From this point, it gets stuck and won't open properly published Web sites. I don't know why it won't launch hyperlinks correctly. Is there something I'm missing? Let me know if you do not want to see my files. I will be gladly their.

  OK, thanks a lot for the capture screen. They help more than you realize.

  So here's one of the biggest mistakes I think that you have done so far. You use the resource manager to link to published results. If it is technically possible to do, I'm pretty sure Adobe never planned for it to be used this way.

  It may help to think in terms of creation of food products. I have long considered as RoboHelp to be very much like working in my kitchen. All consumables (heading text in the headings, images, HTML pages, etc.) are just as raw ingredients. (Eggs, milk, flour, etc.). The places of storage (hard drive) it's like the pantry and the fridge. And RoboHelp provides facilities to easily combine ingredients to create the different recipes.

  This next bit will be somewhat exaggerated, but bear with me. Maybe you have one or more neighbors and all you want to share some common "ingredients". If you set the things where each of you have access to a wine cellar and a shared refrigerator. Maybe you do a Dutch sauce killer. You create it and place in the refrigerator, then your other participants have access through the common "fridge". This is exactly what the resource manager is intended to help.

  Now assume that you create something like cookies chocolate chip and you keep in the refrigerator. Well, that's fine, but you don't want to use cookies to chocolate chip already baked in a recipe that might call for cookie dough. But that's what happens when you take an exit and place in a place intended for raw ingredients. And you will see the strange behavior. Prepare for these cookies chemically changes them so that cookies already are significantly different from the dough used to create them. Similarly, you don't want to take one or more output files and reuse in a project source.

  So in your case, you run an index file and that fires events to produce the output. All should be well. But when you click on the links to open topics, topics are intended to show up more in the right panel. Think of the picture of how works of image on a TV. The moment that link you to something intended to fill the screen, he is forced into this smaller area on the right. If you end up with what you see in the last picture.

  I suggest the following steps.

  First, REMOVE your resource manager exits.

  REMOVE all links that can point here.

  Output records where people will consume copy your projects. (The web server)

  Then figure either the parent (.. /.. / somefolder/somefile.htm) path to other systems or the absolute path (http://www.whatever.com) and to link the projects in this way.

  Sorry, but without seeing the installation of first hand, it is difficult to say what should be these paths.

  I hope this was helpful... Rick

• Web server with CVI

  Hello

  I want to know if it is possible to create a webserver with CVI so that I can connect my application and see the data with internet Explorer?

  Backround: we run a CVI-application on a computer within a network. On this computer, collect US data from different systems and publish these data in a sign of the CVI. Users who want to see the data, connect to the computer with a remote control software.

  Now, we wondered if it is possible to create a web server with CVI. And if the user cannot see the data on his computer using internet Explorer.

  In the forum, we found a few messages very old. Are there new items on this subject?

  Thank you

  Oliver

  As far as I know that it is not supported at the moment.

  And there is the suggestion of product requiring a few laurels ;-)

• I finished the installation of Sharepoint 2010 and he is told to use the username and password you loged on the server with does not work. What should I do to access the sharepoint URL?

  I finished the installation of Sharepoint 2010 and went through the Setup Wizard. It is said to use the username and password you loged on the server with does not work. What should I do to access the sharepoint URL?

  Hello

  Your question of Windows is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please post your question in the TechNet Forum. You can follow the link to your question:
  http://social.technet.Microsoft.com/forums/en-us/sharepoint2010general/threads

• I have a ts 2008 license server with 90 per available user licenses (21 already issed). However, users get a message that says that there are no licenses available

  I have a ts 2008 license server with 90 per available user licenses (21 already issed). However, users get a message that says that there are no available licenses. The TS are iss device by installing licenses. Local group policy is not configured on each ts. The strange thing is that I can't find the option to license type within the domain group strategy, however, I suspect that this is the problem as when I go through the configuration in the RD Licensing Manager system indicates that the license server will be able to issue per user Cal. If anyone has had / overcome this problem I would be very gratefull to know the solution. Best regards Steve

  Please repost your request in one of the most appropriate Microsoft Windows Server Forums, thank you!

• VPN on ASA 5506 without internet access, help with NAT?

  Hello

  I have upgraded to a Cisco ASA 5505 to a 5506 X and as such have climbed to ASA 9.5

  For this reason, I'm a bit stuck on how to implement the VPN. I followed the wizard and I can now establish inbound connections, but when connected (all traffic is tunnel) there is no internet connectivity.

  Our offices internal (inside) network is 192.168.2.0/24

  Our VPN pool is 192.168.4.0/24

  I guess that I'm missing a NAT rule, but in all honesty, I'm a user ASDM and as everything is changed, I am struggling to recreate it?

  Here is my config:

  Result of the command: "sh run"
  
  : Saved
  
  :
  : Serial Number: JAD194306H5
  : Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
  :
  ASA Version 9.5(1)
  !
  hostname ciscoasanew
  domain-name work.internal
  enable password ... encrypted
  names
  ip local pool RemoteVPNPool 192.168.4.1-192.168.4.254 mask 255.255.255.0
  !
  interface GigabitEthernet1/1
   nameif outside
   security-level 0
   ip address 192.168.3.4 255.255.255.0
  !
  interface GigabitEthernet1/2
   nameif inside
   security-level 100
   ip address 192.168.2.197 255.255.255.0
  !
  interface GigabitEthernet1/3
   shutdown
   no nameif
   no security-level
   no ip address
  !
  interface GigabitEthernet1/4
   shutdown
   no nameif
   no security-level
   no ip address
  !
  interface GigabitEthernet1/5
   shutdown
   no nameif
   no security-level
   no ip address
  !
  interface GigabitEthernet1/6
   shutdown
   no nameif
   no security-level
   no ip address
  !
  interface GigabitEthernet1/7
   shutdown
   no nameif
   no security-level
   no ip address
  !
  interface GigabitEthernet1/8
   shutdown
   no nameif
   no security-level
   no ip address
  !
  interface Management1/1
   management-only
   nameif management
   security-level 100
   ip address 192.168.1.1 255.255.255.0
  !
  ftp mode passive
  clock timezone GMT 0
  dns domain-lookup inside
  dns domain-lookup management
  dns server-group DefaultDNS
   name-server 192.168.2.199
   domain-name work.internal
  same-security-traffic permit inter-interface
  same-security-traffic permit intra-interface
  object network obj_any
   subnet 0.0.0.0 0.0.0.0
  object network 173.0.82.0
   host 173.0.82.0
  object network 173.0.82.1
   subnet 66.211.0.0 255.255.255.0
  object network 216.113.0.0
   subnet 216.113.0.0 255.255.255.0
  object network 64.4.0.0
   subnet 64.4.0.0 255.255.255.0
  object network 66.135.0.0
   subnet 66.135.0.0 255.255.255.0
  object network a
   host 192.168.7.7
  object network devweb
   host 192.168.2.205
  object network DevwebSSH
   host 192.168.2.205
  object network DEV-WEB-SSH
   host 192.168.2.205
  object network DEVWEB-SSH
   host 192.168.2.205
  object network vpn-network
   subnet 192.168.4.0 255.255.255.0
  object network NETWORK_OBJ_192.168.4.0_24
   subnet 192.168.4.0 255.255.255.0
  object network NETWORK_OBJ_192.168.2.0_24
   subnet 192.168.2.0 255.255.255.0
  object-group network EC2ExternalIPs
   network-object host 52.18.73.220
   network-object host 54.154.134.173
   network-object host 54.194.224.47
   network-object host 54.194.224.48
   network-object host 54.76.189.66
   network-object host 54.76.5.79
  object-group network PayPal
   network-object object 173.0.82.0
   network-object object 173.0.82.1
   network-object object 216.113.0.0
   network-object object 64.4.0.0
   network-object object 66.135.0.0
  object-group service DM_INLINE_SERVICE_1
   service-object icmp
   service-object icmp6
   service-object icmp alternate-address
   service-object icmp conversion-error
   service-object icmp echo
   service-object icmp information-reply
   service-object icmp information-request
  access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object DEVWEB-SSH eq ssh
  access-list outside_access_in remark AWS Servers
  access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object devweb eq ssh log debugging inactive
  access-list outside_access_in extended permit ip any any inactive
  access-list outside_access_in remark Ping reply
  access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any interface outside
  access-list outside_access_in remark Alarm
  access-list outside_access_in extended permit tcp any interface outside eq 10001
  access-list outside_access_in remark CCTV
  access-list outside_access_in extended permit tcp any interface outside eq 7443
  access-list outside_access_in extended deny ip any any
  access-list workvpn_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.255.0
  access-list workvpn_splitTunnelAcl_1 standard permit 162.13.130.12 255.255.255.252
  access-list workvpn_splitTunnelAcl_1 standard permit 162.13.133.72 255.255.255.252
  access-list workvpn_splitTunnelAcl_1 standard permit 164.177.128.200 255.255.255.252
  access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.16 255.255.255.252
  access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.72 255.255.255.252
  access-list workvpn_splitTunnelAcl_1 standard permit 212.64.147.184 255.255.255.248
  access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.116 255.255.255.254
  access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.118 255.255.255.254
  access-list workvpn_splitTunnelAcl_1 standard permit host 95.138.147.118
  access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.120 255.255.255.254
  access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.4.0 255.255.255.0
  access-list workvpn2_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
  access-list workVPN2016_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
  pager lines 24
  logging enable
  logging buffer-size 16000
  logging asdm-buffer-size 512
  logging asdm warnings
  logging flash-bufferwrap
  mtu outside 1500
  mtu inside 1500
  mtu management 1500
  icmp unreachable rate-limit 1 burst-size 1
  no asdm history enable
  arp timeout 7200
  no arp permit-nonconnected
  nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup
  !
  object network obj_any
   nat (any,outside) dynamic interface
  object network DEVWEB-SSH
   nat (inside,outside) static interface service tcp ssh ssh
  access-group outside_access_in in interface outside
  route outside 0.0.0.0 0.0.0.0 192.168.3.3 1
  timeout xlate 3:00:00
  timeout pat-xlate 0:00:30
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  timeout floating-conn 0:00:00
  user-identity default-domain LOCAL
  http server enable
  http 192.168.1.0 255.255.255.0 inside
  http 192.168.2.0 255.255.255.0 inside
  no snmp-server location
  no snmp-server contact
  service sw-reset-button
  crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
  crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
  crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
  crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
  crypto ipsec security-association pmtu-aging infinite
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
  crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  crypto map outside_map interface outside
  crypto ca trustpoint _SmartCallHome_ServerCA
   no validation-usage
   crl configure
  crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
   enrollment self
   fqdn none
   subject-name CN=192.168.2.197,CN=ciscoasanew
   keypair ASDM_LAUNCHER
   crl configure
  
  snip
  
  dhcpd auto_config outside
  !
  dhcpd address 192.168.1.2-192.168.1.254 management
  dhcpd enable management
  !
  no threat-detection basic-threat
  threat-detection statistics port
  threat-detection statistics protocol
  threat-detection statistics access-list
  threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
  ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
  ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip
  group-policy DfltGrpPolicy attributes
   vpn-tunnel-protocol ssl-client
  group-policy workVPN2016 internal
  group-policy workVPN2016 attributes
   dns-server value 192.168.2.199
   vpn-tunnel-protocol ikev1
   split-tunnel-policy tunnelall
   ipv6-split-tunnel-policy tunnelall
   default-domain value work.internal
   split-dns value work.internal
   split-tunnel-all-dns enable
  dynamic-access-policy-record DfltAccessPolicy
  
  !
  class-map inspection_default
   match default-inspection-traffic
  !
  !
  policy-map type inspect dns preset_dns_map
   parameters
    message-length maximum client auto
    message-length maximum 512
  policy-map global_policy
   class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
  !
  service-policy global_policy global
  prompt hostname context
  call-home reporting anonymous
  hpm topN enable
  Cryptochecksum:
  : end
  

  Hi Ben-

  What you are trying to accomplish is called VPN crossed.  Depending on your initial configuration, you have 2 NAT problems.  The first has to do with the NAT you place your order.  In the code later that we are dealing with two NAT ASA 8.3 times and who are ranked 2 sections going on before and after the device NAT. object

  My general rule for control of NAT is like this:

  1. Twice NAT (front) - use this section for exemptions from NAT or unusual configurations that have to go first
  2. Purpose of NAT - Use this section to the static NAT instructions for servers
  3. Twice NAT (after) - use this section to your global declarations of NAT, basically a catch-all

  Then, never use 'all' as an interface for all training of NAT.  This may seem like a good idea, but it will bite you.  Remember, it is more the notion of control NAT, then 'all' interface is bit VPN configurations and similar DMZ.  Always be specific about your interface for NAT pairs.

  To this end, here is what I suggest that your NAT configuration should resemble:

  nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup!object network DEVWEB-SSH nat (inside,outside) static interface service tcp ssh ssh !nat (inside,outside) after-auto source dynamic any interfacenat (outside,outside) after-auto source dynamic any interface

  The key is that you need a NAT device explicitly reflecting the VPN traffic. PSC

• move the local ip address to a different server (problem natting)

  Dear,

  I have a local database server with a local ip 192.168.101.3 and cisco ASA 5500, I use nat static as below:

  #static (Interior, exterior) xx.xx.xx.xx 192.168.101.3 netmask 255.255.255.255

  the server has been broken, and we moved the data to another server and give him the exact address of the intellectual property.

  Now we can ping the actual ip side.

  Help, please.

  Thanks in advance.

  Hello Asad,

  I've seen this problem before, hosts with the firewall or anti virus windows will not respond to any other host that is not on their Local network.

  Customer think usually it is a question of ASA, but as soon as we set up a NAT (OUTSIDE) 10 your_public_ip

  Global (inside) 10 interface;   We can see how it works because the server will now receive the packets of the SAA within the interface

  Anyway glad to hear it works fine.

  Please check the question as answered so future users can pull of this

  Julio

• Remote access VPN with ASA 5510 by using the DHCP server

  Hello

  Can someone please share your knowledge to help me find out why I'm not able to receive an IP address on the remote access VPN connection so that I can get an IP local pool DHCP?

  I'm trying to set up remote access VPN with ASA 5510. It works with dhcp local pool but does not seem to work when I tried to use an existing DHCP server. It is tested in an internal network as follows:

  !

  ASA Version 8.2 (5)

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  IP 10.6.0.12 255.255.254.0

  !

  IP local pool testpool 10.6.240.150 - 10.6.240.159 a mask of 255.255.248.0. (worked with it)

  !

  Route inside 0.0.0.0 0.0.0.0 10.6.0.1 1

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto-map dynamic dyn1 1jeu transform-set FirstSet

  dynamic mymap 1 dyn1 ipsec-isakmp crypto map

  mymap map crypto inside interface

  crypto ISAKMP allow inside

  crypto ISAKMP policy 1

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 43200

  !

  VPN-addr-assign aaa

  VPN-addr-assign dhcp

  !

  internal group testgroup strategy

  testgroup group policy attributes

  DHCP-network-scope 10.6.192.1

  enable IPSec-udp

  IPSec-udp-port 10000

  !

  username testlay password * encrypted

  !

  tunnel-group testgroup type remote access

  tunnel-group testgroup General attributes

  strategy-group-by default testgroup

  DHCP-server 10.6.20.3

  testgroup group tunnel ipsec-attributes

  pre-shared key *.

  !

  I got following output when I test connect to the ASA with Cisco VPN client 5.0

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: (4) SA (1) + KE + NUNCIO (10) + ID (5), HDR + VENDO

  4024 bytesR copied in 3,41 0 seconds (1341 by(tes/sec) 13) of the SELLER (13) seller (13) + the SELLER (13), as well as the SELLER (13) ++ (0) NONE total length: 853

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, SA payload processing

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ISA_KE

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, nonce payload processing

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received xauth V6 VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, DPD received VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received Fragmentation VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received NAT-Traversal worm 02 VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, the customer has received Cisco Unity VID

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, connection landed on tunnel_group testgroup

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA payload processing

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA proposal # 1, turn # 9 entry overall IKE acceptable matches # 1

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build the payloads of ISAKMP security

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building ke payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building nonce payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for answering machine...

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of payload ID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of Cisco Unity VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing payload V6 VID xauth

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building dpd vid payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing the payload of the NAT-Traversal VID ver 02

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of Fragmentation VID + load useful functionality

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, send Altiga/Cisco VPN3000/Cisco ASA GW VID

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR SA (1) KE (4) NUNCIO (10) + ID (5) + HASH (8) + SELLER (13) + the SELLER (13) + the SELLER (13) + the SELLER (13) NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) total length: 440

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + HASH (8) + NOTIFY (11) + NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) overall length: 168

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, useful treatment IOS/PIX Vendor ID (version: 1.0.0 capabilities: 00000408)

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, the customer has received Cisco Unity VID

  Jan 16 15:39:21 [IKEv1]: Group = testgroup, I

  [OK]

  KenS-mgmt-012 # P = 10.15.200.108, status of automatic NAT detection: remote end is NOT behind a NAT device this end is NOT behind a NAT device

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, empty building hash payload

  Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash qm

  Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 72

  Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 87

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): enter!

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, transformation MODE_CFG response attributes.

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = authorized

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = authorized

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized primary WINS

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized secondary WINS

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Compression IP = disabled

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling political = disabled

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: setting Proxy browser = no - modify

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: browser Local Proxy bypass = disable

  Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, (testlay) the authenticated user.

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

  Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 64

  Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + NONE (0) overall length: 60

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

  Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cfg ACK processing attributes

  Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 49ae1bb8) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 182

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, treatment cfg request attributes

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 address!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 network mask!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for DNS server address.

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the address of the WINS server.

  Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, transaction mode attribute unhandled received: 5

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the banner!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting save PW!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: receipt of request for default domain name!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for Split-Tunnel list!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for split DNS!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for PFS setting!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Proxy Client browser setting!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the list of backup peer ip - sec!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting disconnect from the Client Smartcard Removal!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Version of the Application.

  Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Type of Client: Windows NT Client Application Version: 5.0.07.0440

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for FWTYPE!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: request received for the DHCP for DDNS hostname is: DEC20128!

  Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the UDP Port!

  Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

  Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = b04e830f) with payloads: HDR + HASH (8) + NOTIFY (11) + (0) NONE total length: 84

  Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload

  Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload

  Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE has received the response from type [] at the request of the utility of IP address

  Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cannot get an IP address for the remote peer

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE TM V6 WSF (struct & 0xd8030048) , : TM_DONE, EV_ERROR--> TM_BLD_REPLY, EV_IP_FAIL--> TM_BLD_REPLY NullEvent--> TM_BLD_REPLY, EV_GET_IP--> TM_BLD_REPLY, EV_NEED_IP--> TM_WAIT_REQ, EV_PROC_MSG--> TM_WAIT_REQ, EV_HASH_OK--> TM_WAIT_REQ, NullEvent

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE AM Responder WSF (struct & 0xd82b6740) , : AM_DONE, EV_ERROR--> AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL--> AM_TM_INIT_MODECFG_V6H NullEvent--> AM_TM_INIT_MODECFG, EV_WAIT--> AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG--> AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK--> AM_TM_INIT_XAUTH_V6H NullEvent--> AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b ending: 0x0945c001, refcnt flags 0, tuncnt 0

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending clear/delete with the message of reason

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing the payload to delete IKE

  Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

  Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 9de30522) with payloads: HDR HASH (8) + DELETE (12) + (0) NONE total length: 80

  Kind regards

  Lay

  For the RADIUS, you need a definition of server-aaa:

  Protocol AAA - NPS RADIUS server RADIUS

  AAA-server RADIUS NPS (inside) host 10.10.18.12

  key *.

  authentication port 1812

  accounting-port 1813

  and tell your tunnel-group for this server:

  General-attributes of VPN Tunnel-group

  Group-NPS LOCAL RADIUS authentication server

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Publish a project with an expiration date

  Hello

  We have some clients in the Middle East who have very limited access to the internet, so will not be able to use our Captivate courses that are hosted on LearnUpon.com. We want to give our customers a local copy of the published files to use, but we want to restrict access to a certain period of time, the same that any customer who purchases through LearnUpon.

  I know that when I used the trial version of Captivate my published projects expired with the trial version of the software. Is it possible that I can publish in PDF format (for example) and specify an expiration of myself?

  See you soon,.

  Kevin

  Hello

  I'm not sure of the PDF, but it should probably work.

  Try clicking on Edit > Preferences > project > start and end

  

  Note that this is not really sure. If the end Viewer simply changes the date on the computer then it is the specs, they could still use the output.

  See you soon... Rick

• Server with a database and an installed network agent... Add a new database

  First of all, sorry for my English.
  I have a server with Oracle 10.2.0.4, where there was already an agent of the grid control and a database. Now, we have created a new database on the same server. What I do to make this new database is displayed in the grid control?
  
  Best regards
  Vitor Jr

  Did you do the following?

  agentca -d -c "hostname1,hostname2,hostname3"
  

  Change - read your bad output... exceed the correct host names. You may need to use the full host name IE hostname1.tpn.cliente.com as in your output... Try and see.

  Published by: Freddie Essex on April 24, 2013 16:56

• Server with 10 TB LUN attached by physical brutes FC connection works, but second 10TB seems to be limited

  I have an ESX Server with two virtual machines on it, one of the servers is to store medical images. These virtual machines are essentially backup servers to servers that are physical (not virtual).  The main server is a physical server with an attached IBM DS4700 direct and secondary sandbox. I have 20 TB of data spaced so far.  Side virtual server also direct a of DS4700 attached to the area of ESX and he sees the first 10 fine to, as a single disc, and Yes, I know that this seems to go against the norm.  In any case we work for well over a year to date.  I add the second 10TB and I now seem to be limited by the expected 2 TB-512 b per LUN through documentation.  I would like to know why I was able to create the first 10 TB LUN without problem using physical RDM mode, but when I try to add the next physical drive from RDM on the same server (see 9.54 TB LUN very well), using the same method, why windows or should I say VMWare ESX is not being able to see the 10 to complete this time.  I am aware of the supposed limits, but the first works fine, why only now did he not see it.  To clarify the "Add" function of VMWare 9.54 Tb thin LUN during the creation of the new disc, but in Windows, it only recognizes the first 1.5 to (so it seems) I have not actually tried to format the volume in Windows and have yet once removed from the virtual machine.

  Windows 2008 64 bit standard on top of ESX 4 Enterprise Plus connected via direct fiber DS4700 and DS4000 with 10 TB on each table.  The virtual machine has been improved to version 7 machine and I have NOT tried add the second 10TB still with the new VM version. Thought I would ask first.

  Yes, you can map your volume of GPT in any physical Windows but I can't tell if you will experience data corruption or not, as I know that more than 2 TB volumes don't are not supported with current versions of vSphere.

  It is a good article on 2 TB limit, and how taken Windows support that: http://blogs.technet.com/b/askcore/archive/2010/02/18/understanding-the-2-tb-limit-in-windows-storage.aspx

  Tomi

  http://v-reality.info