Routing issue of Cisco VPN Client ASA
Hi, I use a Barracuda NG for firewalls and I would use a Cisco ASA 5505 for VPN Client connections. But I have the problem that I can't get a connection to the VPN PC connected to the internal network. But I can reach the VPN connected PC from the inside. Here is a diagram of my network:
Here the IP Configuration and the routing of the Barracuda firewall table:
I have a route on the Barracuda NG to the 10.10.10.0/24 network VPN Client on eth0.
The 192.168.1.0/24 LAN I ping the Client comes with Client VPN 10.10.10.11 as it should. But I can't ping or access network resources in the local network for AnyConnected customer's PC that connected through the VPN.
Here is the config Cisco ASA:
: Saved : : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.2(2) ! hostname leela names ip local pool VPN-Pool 10.10.10.10-10.10.10.200 mask 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 switchport access vlan 5 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.250 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address dhcp ! interface Vlan5 nameif dmz security-level 50 ip address 172.16.0.250 255.255.255.0 ! ftp mode passive clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns server-group DefaultDNS name-server 192.168.1.10 same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any subnet 0.0.0.0 0.0.0.0 object network VPN-Pool subnet 10.10.10.0 255.255.255.0 description VPN-Pool object network NETWORK_OBJ_10.10.10.0_24 subnet 10.10.10.0 255.255.255.0 access-list inside_access_in extended permit ip any any access-list inside_access_in extended permit ip object VPN-Pool any access-list dmz_access_in extended permit ip any any access-list global_access extended permit ip any any access-list outside_access_in extended permit ip any any pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu dmz 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,dmz) source static any any destination static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 no-proxy-arp route-lookup inactive access-group inside_access_in in interface inside access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz access-group global_access global route dmz 0.0.0.0 0.0.0.0 172.16.0.254 1 route inside 0.0.0.0 0.0.0.0 192.168.1.254 tunneled timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy server-type microsoft user-identity default-domain LOCAL aaa authentication enable console LDAP_SRV_GRP LOCAL aaa authentication http console LDAP_SRV_GRP LOCAL aaa authentication ssh console LDAP_SRV_GRP LOCAL aaa authentication serial console LOCAL http server enable 444 http 192.168.1.0 255.255.255.0 inside snmp-server location Vienna crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto map dmz_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map dmz_map interface dmz crypto ca trustpoint ASDM_TrustPoint0 enrollment self subject-name CN=leela proxy-ldc-issuer crl configure crypto ca trustpoint ASDM_TrustPoint1 enrollment terminal crl configure crypto ca trustpool policy crypto ca certificate chain ASDM_TrustPoint0 quit crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 enable dmz client-services port 443 crypto ikev2 remote-access trustpoint ASDM_TrustPoint0 telnet timeout 5 no ssh stricthostkeycheck ssh 192.168.1.0 255.255.255.0 inside ssh timeout 30 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd auto_config outside ! dhcpd address 192.168.1.254-192.168.1.254 inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-filter updater-client enable dynamic-filter use-database ntp server 192.168.1.10 source inside ssl trust-point ASDM_TrustPoint0 dmz ssl trust-point ASDM_TrustPoint0 inside webvpn enable dmz no anyconnect-essentials anyconnect image disk0:/anyconnect-macosx-i386-3.1.05170-k9.pkg 1 anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 2 anyconnect image disk0:/anyconnect-linux-3.1.05170-k9.pkg 3 anyconnect image disk0:/anyconnect-linux-64-3.1.05170-k9.pkg 4 anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml anyconnect enable tunnel-group-list enable group-policy DfltGrpPolicy attributes default-domain value group-policy GroupPolicy_AnyConnect internal group-policy GroupPolicy_AnyConnect attributes wins-server none dns-server value 192.168.1.10 vpn-tunnel-protocol ikev2 ssl-client webvpn anyconnect profiles value AnyConnect_client_profile type user group-policy portal internal group-policy portal attributes vpn-tunnel-protocol ssl-clientless webvpn url-list none username tunnel-group AnyConnect type remote-access tunnel-group AnyConnect general-attributes address-pool VPN-Pool authentication-server-group LDAP_SRV_GRP default-group-policy GroupPolicy_AnyConnect tunnel-group AnyConnect webvpn-attributes group-alias AnyConnect enable tunnel-group Portal type remote-access tunnel-group Portal general-attributes authentication-server-group LDAP_SRV_GRP default-group-policy portal tunnel-group Portal webvpn-attributes group-alias portal enable! ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 ! prompt hostname context no call-home reporting anonymous hpm topN enable : end no asdm history enable
Can someone please help me solve this problem?
When I tried to solve this I didn't choose which interface the Packet Tracer?
The interface inside or DMZ interface? Inside, he says it will not work with the dmz but the error did not help me
Anyone here knows why it does not work?
Hello
Inside LAN is directly connected to the right firewall VPN... then I don't think you have to have the itinerary tunnele... can you try to remove the road tunnel mode and check.
entrance to the road that is static to achieve 10.10.10.11 as its display is correct...
Route by tunnel watch also with 255 administrative distance. I've never used that in my scenarios... lets see...
Concerning
Knockaert
Tags: Cisco Security
Similar Questions
-
Configuration of Cisco for Cisco VPN Client ASA 5505
Our firm has finally made the move from Sonicwall Cisco for our SMB customers. Got our first customer with a VPN site-to site solid and you have configured the main router for connections via the Cisco VPN Client VPN Wizard.
When I install the VPN Client on desktop computers that does not capture all the necessary options (unless you have a SSL VPN). I guess that there is a process that I am missing to export a connection profile that Cisco VPN Client users can import for their connection.
There step by step guides to create the connection profile file to distribute to customers?
Hello
The ASDM wizard is for the configuration on the SAA. This wizard will help you complete the VPN configuration on the end of the ASA.
You will need to set the same in the client, so that they can negotiate and connect.
Input connection in the client field, that's what you want to be seen that on the VPN client - it can be any name
Host will be the external ip address of the ASA.
Group options:
name - same tunnel as defined on the ASA group
Password - pre-shared as on ASA.Confirm password - same pre-shared key.
Once this is over, you will see the customer having an entry same as a login entry. You must click on connect there. He will be a guest user and the password. Please enter the login crendentials. VPN connects.
You can distribute the .pcf file that is formed at the place mentioned in the post above. Once the other client receive the .pcf, they need to import it by clicking this tab on the VPN client.
Kind regards
Anisha
-
Cisco VPN client (ASA) password expiry messages
Hi all
I am looking for a way to change the message displayed on the Cisco VPN client, when a password change is required. This configuration uses an ASA 5520 with Windows 2003 IAS radius for authentication server.
I have configured the option 'password-management' under the tunnel-group, but when the password expires the vpn client prompts you to "enter a new pin code.
This customizable message, for example "Please enter a new password to 8 characters etc.
The original message communicates enough information for the user.
Thank you
Hi Matt,
This is a known defect CSCeh13180 (when using RADIUS with expiry) and there is currently no plan to fix this bug.
But you can try this for one of your VPN client and see if that helps.
you need to change the VPNClient.ini on the PC that installed the VPN Client. Here are the settings you will need...
[RadiusSDI]
NewPinSubStr = "" enter the new password: ""
HTH
Kind regards
JK
-
All necessary licenses on ASA 5510 for old Cisco VPN Client
We're trying to migrate our firewall Watchguard to a Cisco ASA 5510, who bought some time ago. For some reason, all of our users have already installed the old Cisco VPN client. I think it will work. Are there licensing issues on the 5510 I had to be concerned with? No matter what special config that needs to be done on the 5510?
Fix. You don't require licensing of AnyConnect of any type of configuration and the use of IKEv1 IPsec remote access VPN (which use the old Cisco VPN client).
You will be limited to 250 active IPsec peers (remote access more no matter what VPN site-to-site) by the platform (hardware) device capabilities that are enforced by the software.
-
Cisco VPN Client and Windows XP VPN Client IPSec to ASA
I configured ASA for IPSec VPN via Cisco VPN Client and XP VPN client communications. I can connect successfully with Cisco VPN Client, but I get an error when connecting with the XP client. Debugging said "misconfigured groups and transport/tunneling mode" I know, they use different methods of transport and tunneling, and I think that I have configured both. Take a look at the config.
PS a funny thing - when I connect with client VPN in Windows Server 2003, I have no error. The only difference is that client XP is behind an ADSL router and client server is directly connected to the Internet on one of its public IP of interfaces. NAT in the case of XP can cause problems?
Config is:
!
interface GigabitEthernet0/2.30
Description remote access
VLAN 30
nameif remote access
security-level 0
IP 85.*. *. 1 255.255.255.0
!
access-list 110 scope ip allow a whole
NAT list extended access permit tcp any host 10.254.17.10 eq ssh
NAT list extended access permit tcp any host 10.254.17.26 eq ssh
access-list extended ip allowed any one sheep
access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh
sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0
tunnel of splitting allowed access list standard 192.168.121.0 255.255.255.0
flow-export destination inside-Bct 192.168.1.27 9996
IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0
ARP timeout 14400
global (outside-Baku) 1 interface
global (outside-Ganja) interface 2
NAT (inside-Bct) 0 access-list sheep-vpn
NAT (inside-Bct) 1 access list nat
NAT (inside-Bct) 2-nat-ganja access list
Access-group rdp on interface outside-Ganja
!
Access remote 0.0.0.0 0.0.0.0 85.*. *. 1 2
Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1
Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1
Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1
Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1
Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1
Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1
Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1
dynamic-access-policy-registration DfltAccessPolicy
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
Crypto ipsec transform-set newset aes - esp esp-md5-hmac
Crypto ipsec transform-set esp-3des esp-md5-hmac vpnclienttrans
Crypto ipsec transform-set vpnclienttrans transport mode
Crypto ipsec transform-set esp-3des esp-md5-hmac raccess
life crypto ipsec security association seconds 214748364
Crypto ipsec kilobytes of life security-association 214748364
raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map
vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1
card crypto interface for remote access vpnclientmap
crypto isakmp identity address
ISAKMP crypto enable vpntest
ISAKMP crypto enable outside-Baku
ISAKMP crypto enable outside-Ganja
crypto ISAKMP enable remote access
ISAKMP crypto enable Interior-Bct
crypto ISAKMP policy 30
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
No encryption isakmp nat-traversal
No vpn-addr-assign aaa
Telnet timeout 5
SSH 192.168.1.0 255.255.255.192 outside Baku
SSH 10.254.17.26 255.255.255.255 outside Baku
SSH 10.254.17.18 255.255.255.255 outside Baku
SSH 10.254.17.10 255.255.255.255 outside Baku
SSH 10.254.17.26 255.255.255.255 outside-Ganja
SSH 10.254.17.18 255.255.255.255 outside-Ganja
SSH 10.254.17.10 255.255.255.255 outside-Ganja
SSH 192.168.1.0 255.255.255.192 Interior-Bct
internal vpn group policy
attributes of vpn group policy
value of DNS-server 192.168.1.3
Protocol-tunnel-VPN IPSec l2tp ipsec
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value split tunnel
BCT.AZ value by default-field
attributes global-tunnel-group DefaultRAGroup
raccess address pool
Group-RADIUS authentication server
Group Policy - by default-vpn
IPSec-attributes tunnel-group DefaultRAGroup
pre-shared-key *.
Hello
For the Cisco VPN client, you would need a tunnel-group name configured on the ASA with a pre-shared key.
Please see configuration below:
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml
or
Please see the section of tunnel-group config of the SAA.
There is a tunnel-group called "rtptacvpn" and a pre-shared key associated with it. This group name is used by the VPN Client Group name.
So, you would need a specific tunnel-group name configured with a pre-shared key and use it on the Cisco VPN Client.
Secondly, because you are behind a router ADSL, I'm sure that's configured for NAT. can you please activate NAT - T on your ASA.
"crypto isakmp nat-traversal.
Thirdly, change the transformation of the value
raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map
Let me know the result.
Thank you
Gilbert
-
PIX: Cisco VPN Client connects but no routing
Hello
We have a Cisco PIX 515 with software 7.1 (2). He accepts Cisco VPN Client connections with no problems, but no routing does to internal networks directly connected to the PIX. For example, my PC is affected by the IP 172.16.2.57 and then ping does not respond to internal Windows server 172.16.0.12 or trying to RDP. The most irritating thing is that these attempts are recorded in the system log, but always ended with "SYN timeout", as follows:
2009-01-06 23:23:01 Local4.Info 217.15.42.214% 302013-6-PIX: built 3315917 for incoming TCP connections (172.16.2.57/1283) outside:172.16.2.57/1283 inside: ALAI2 / 3389 (ALAI2/3389)
2009-01-06 23:23:31 Local4.Info 217.15.42.214% 302014-6-PIX: TCP connection disassembly 3315917 for outside:172.16.2.57/1283 inside: ALAI2 / 3389 duration 0:00:30 bytes 0 SYN Timeout
2009-01-06 23:23:31 Local4.Debug 217.15.42.214% 7-PIX-609002: duration of disassembly-outside local host: 172.16.2.57 0:00:30
We tried to activate and deactivate "nat-control", "permit same-security-traffic inter-interface" and "permit same-security-traffic intra-interface", but the results are the same: the VPN connection is successfully established, but remote clients cannot reach the internal servers.
I enclose the training concerned in order to understand the problem:
interface Ethernet0
Speed 100
full duplex
nameif outside
security-level 0
IP address xx.yy.zz.tt 255.255.255.240
!
interface Ethernet1
nameif inside
security-level 100
172.16.0.1 IP address 255.255.255.0
!
access extensive list ip 172.16.0.0 inside_nat0_outbound allow 255.255.255.0 172.16.2.56 255.255.255.248
!
access extensive list ip 172.16.0.0 outside_cryptomap_dyn_20 allow 255.255.255.0 172.16.2.56 255.255.255.248
!
VPN_client_group_splitTunnelAcl list standard access allowed 172.16.0.0 255.255.255.0
!
IP local pool pool_vpn_clientes 172.16.2.57 - 172.16.2.62 mask 255.255.255.248
!
NAT-control
Global xx.yy.zz.tt 12 (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 12 172.16.0.12 255.255.255.255
!
internal VPN_clientes group strategy
attributes of Group Policy VPN_clientes
xxyyzz.NET value by default-field
internal VPN_client_group group strategy
attributes of Group Policy VPN_client_group
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list VPN_client_group_splitTunnelAcl
xxyyzz.local value by default-field
!
I join all the details of the cryptographic algorithms because the VPN is successfully completed, as I said at the beginning. In addition, routing tables are irrelevant in my opinion, because the inaccessible hosts are directly connected to the internal LAN of the PIX 515.
Thank you very much.
can you confirm asa have NAT traversal allow otherwise, activate it in asa and vpn clients try again.
PIX / ASA 7.1 and earlier versions
PIX (config) #isakmp nat-traversal 20
PIX / ASA 7.2 (1) and later versions
PIX (config) #crypto isakmp nat-traversal 20
-
connect Cisco VPN client v5 to asa 5505
I have remote vpn configuration issues between ASA5505 and Cisco VPN client v5. Successfully, I can establish a connection between the client Vpn and ASA and receive the IP address of the ASA. Statistical customer VPN windows shows that packets are sent and encrypted but none of the packages is received/decrypted.
Cannot ping asa 5505
Any ideas on what I missed?
Try adding...
ISAKMP nat-traversal crypto
In addition, you cannot ping the inside interface of the ASA vpn without this command...
management-access inside
Please evaluate the useful messages.
-
Problems to connect via the Cisco VPN client IPSec of for RV180W small business router
Hello
I tried to configure my router Cisco of RV180W as a customer VPN IPSec, but have encountered a problem that I hope someone can help me with. "" I managed to do the work of configuration so that the Cisco's VPN IPSec client authenticates successfully with the XAUTH user, I put on the router, but during the negotiation, the client ends with the following, which appears several times on the router error message: ' Mar 20 Oct 19:41:53 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for
> [34360] has no config mode. I've read around the internet and a number of people seem to say that the Cisco VPN Client is not compatible with the router, but the same thing happens to my iPhone VPN client.
Is it possible that this can be implemented? Below, I have attached the full configuration files and the log files. Thank you much in advance.
Router log file (I changed the IP
addresses > respectively as well as references to MAC addresses) Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: floating ports NAT - T with counterpart
> [44074]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] WARNING: notification to ignore INITIAL-CONTACT> [44074] because it is admitted only after the phase 1.
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT - D payload does not match for> [4500]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT - D payload does not match for> [44074]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: received unknown Vendor ID
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: received Vendor ID: CISCO-UNITY
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT detected: is located behind a device. NAT and alsoPeer is behind a NAT device
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: request sending Xauth for> [44074]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: ISAKMP Security Association established for> [4500] - > [44074] with spi = >.
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: receives the type of the attribute 'ISAKMP_CFG_REPLY' of> [44074]
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: login successful for the user "myusername".
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: myusername XAuthUser connected from the IP>
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: sending of information Exchange: Notify payload [10381]
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: receives the type of the attribute 'ISAKMP_CFG_REQUEST' of> [44074]
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: ignored attribute 5
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: attribute ignored 28683
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no mode config
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: attribute ignored 28684
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no mode config
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: remove the invalid payload with doi:0.
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: purged-Association of ISAKMP security with proto_id = ISAKMP and spi =>.
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: myusername XAuthUser Logged Out of the IP>
Mar 20 Oct 20:03:16 2015 (GMT + 0000): [r1] [IKE] INFO: ISAKMP Security Association deleted for> [4500] - > [44074] with spi = > The router configuration
IKE policy
VPN strategy
Client configuration
Hôte : < router="" ip=""> >
Authentication group name: remote.com
Password authentication of the Group: mysecretpassword
Transport: Enable Transparent Tunneling; IPSec over UDP (NAT/PAT)
Username: myusername
Password: mypassword
Please contact Cisco.
Correct, the RV180 is not compatible with the Cisco VPN Client. The Iphone uses the Cisco VPN Client.
You can use the PPTP on the RV180 server to connect a PPTP Client.
In addition, it RV180 will allow an IPsec connection to third-party customers 3. Greenbow and Shrew Soft are 2 commonly used clients.
-
Cisco VPN client 3.5.1 and Cisco ASA 5.2 (2)
Hello
I have a strange problem about Cisco VPN client (IPSec) with Cisco ASA. The Cisco ASA runs software version 5.2 (2). The Cisco VPN client version is 3.5.1.
The problem is the customer able Cisco VPN to authenticate successfully with Cisco ASA, but could not PING to any LAN behind the Cisco ASA. In any case, the problem disappeared when we used the Cisco VPN version 4.6 or 4.8 of the customer. All parameters are exactly the same. What has happened? What is the cause of this problem? How can I solve this problem?
Please advice.
Thank you
Nitass
I understand your problem, I never used 3.5.1 so I thought that maybe nat - t is not enabled by default as 4.x.
-
IPSec site to site VPN cisco VPN client routing problem and
Hello
I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.
The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.
There are on the shelves, there is no material used cisco - routers DLINK.
Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.
Can someone help me please?
Thank you
Peter
RAYS - not cisco devices / another provider
Cisco 1841 HSEC HUB:
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
ISAKMP crypto key x xx address no.-xauth
!
the group x crypto isakmp client configuration
x key
pool vpnclientpool
ACL 190
include-local-lan
!
86400 seconds, duration of life crypto ipsec security association
Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco
!
Crypto-map dynamic dynmap 10
Set transform-set 1cisco
!
card crypto ETH0 client authentication list userauthen
card crypto isakmp authorization list groupauthor ETH0
client configuration address card crypto ETH0 answer
ETH0 1 ipsec-isakmp crypto map
set peer x
Set transform-set 1cisco
PFS group2 Set
match address 180
card ETH0 10-isakmp ipsec crypto dynamic dynmap
!
!
interface FastEthernet0/1
Description $ES_WAN$
card crypto ETH0
!
IP local pool vpnclientpool 192.168.200.100 192.168.200.150
!
!
overload of IP nat inside source list LOCAL interface FastEthernet0/1
!
IP access-list extended LOCAL
deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255
deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255
IP 192.168.7.0 allow 0.0.0.255 any
!
access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255
!
How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.
Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL
DE:
access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255
TO:
access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255
Also change the ACL 190 split tunnel:
DE:
access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255
access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255
TO:
access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255
access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255
Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.
Hope that helps.
-
Hello
I installed a router cisco 2801 to accept vpn connections, I use the cisco vpn client and the tunnel is created and is being created of the its.
However, I cannot ping my vlan (only those who have a nat inside the ACL, those who have not said I can ping), so I have a NAT problem, just don't know where.
Heres part of my setup on the ACL,
IP local pool ippool 192.168.100.10 192.168.100.100
by default-gateway IP X.X.X.X (ISP GATEWAY)
IP forward-Protocol ND
IP http server
no ip http secure server
IP http flash path:
!
!
IP nat inside source list 1 interface FastEthernet0/1 overload
IP nat inside source list 2 interface FastEthernet0/1 overload
IP nat inside source list 3 interface FastEthernet0/1 overload
IP nat inside source list 6 interface FastEthernet0/1 overload
overload of IP nat inside source list 20 interface FastEthernet0/1
IP nat inside source map route SHEEP interface FastEthernet0/1 overload
IP route 0.0.0.0 0.0.0.0 X.X.X.X (external IP)
Route IP 192.168.10.0 255.255.255.0 192.168.90.2
IP route 192.168.20.0 255.255.255.0 192.168.90.2
IP route 192.168.30.0 255.255.255.0 192.168.90.2
IP route 192.168.40.0 255.255.255.0 192.168.90.2
IP route 192.168.50.0 255.255.255.0 192.168.90.2
IP route 192.168.60.0 255.255.255.0 192.168.90.2
IP route 192.168.200.0 255.255.255.0 192.168.90.2
!
NAT extended IP access list
deny ip 192.168.10.0 0.0.0.255 192.168.100.0 0.0.0.255
deny ip 192.168.20.0 0.0.0.255 192.168.100.0 0.0.0.255
deny ip 192.168.30.0 0.0.0.255 192.168.100.0 0.0.0.255
deny ip 192.168.60.0 0.0.0.255 192.168.100.0 0.0.0.255
deny ip 192.168.90.0 0.0.0.255 192.168.100.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 any
ip licensing 192.168.20.0 0.0.0.255 any
IP 192.168.30.0 allow 0.0.0.255 any
IP 192.168.60.0 allow 0.0.0.255 any
IP 192.168.90.0 allow 0.0.0.255 any
!
access-list 1 permit 192.168.90.0 0.0.0.255
access-list 2 allow to 192.168.10.0 0.0.0.255
access-list 3 allow 192.168.30.0 0.0.0.255
access-list 6 permit 192.168.60.0 0.0.0.255
access-list 20 allow 192.168.200.0 0.0.0.255
!
SHEEP allowed 10 route map
corresponds to the IP NAT
!
The 192.168.90.2 address is my switch L3 (Cisco 3750)
Any pointer is more than welcome,
Concerning
Miranda,
Have you tried to remove the following lines:
IP nat inside source list 1 interface FastEthernet0/1 overload
IP nat inside source list 2 interface FastEthernet0/1 overload
IP nat inside source list 3 interface FastEthernet0/1 overload
IP nat inside source list 6 interface FastEthernet0/1 overload
overload of IP nat inside source list 20 interface FastEthernet0/1
And simply let this one:
IP nat inside source map route SHEEP interface FastEthernet0/1 overload
?
I have all the neceary allowed in the ACL of NAT, so you do not have individual lines for each network.
Also, I noticed that your ACL 20 reads
access-list 20 allow 192.168.200.0 0.0.0.255
But your NAT ACL bed
ip licensing 192.168.20.0 0.0.0.255 any
I think you have a typo in there, you have a 200 on 20 and on the other.
Check it out and let me know how it goes. Don't forget to clear the NAT table after deleting these lines:
clear the ip nat trans *.
I hope this helps!
Raga
-
AnyConnect + possible PSK (pre-shared key) as under with cisco vpn client ikev1 and ikev2
Is it possible to create a VPN Anyconnect of RA with just the name of user and password + pre-shared key (Group) for the connection, as could do for ikev1 with cisco VPN client? I am running 8.4.X ASA code and looks like tunnel-group commands have 8.2.X somewhat change. If you change the group type of the tunnel for remote access, now there is no option for IKEv2 PSK. This is only available when you choose the type
Type of TG_TEST FW1 (config) # tunnel - group?
set up the mode commands/options:
Site IPSec IPSec-l2l group
Remote access using IPSec-IPSec-ra (DEPRECATED) group
remote access remote access (IPSec and WebVPN) group
WebVPN WebVPN Group (DEPRECATED)FW1(config-tunnel-General) # tunnel - group TG_TEST ipsec-attributes
FW1(config-tunnel-IPSec) #?configuration of the tunnel-group commands:
any required authorization request users to allow successfully in order to
Connect (DEPRECATED)
Allow chain issuing of the certificate
output attribute tunnel-group IPSec configuration
mode
help help for group orders of tunnel configuration
IKEv1 configure IKEv1
ISAKMP policy configure ISAKMP
not to remove a pair of attribute value
by the peer-id-validate Validate identity of the peer using the peer
certificate
negotiation to Enable password update in RADIUS RADIUS with expiry
authentication (DEPRECATED)FW1(config-tunnel-IPSec) # ikev1?
the tunnel-group-ipsec mode commands/options:
pre-shared key associate a key shared in advance with the connection policyI'm getting old so I hope that it is not in another complaint curmudgeonly on the loss of functionality. :)
Many small businesses do not want to invest in the PKI. It is usually a pain to deploy, backup, make redundant, etc..
But it would be nice to have a bit more security on VPN other than just the connections of username and password.
If this is not possible, it is possible to configure the Anyconnect customer to IKEv1 with PSK and name at the level of the Group client?
If this is not possible, WTH did cisco end customer VPN cisco as a choice of VPN connection (other than to get more fresh mail of license)?
I really hope that something like this exists still!
THX,
WR
You are welcome
In addition to two factors, you can also do double authentication (ie the two using the user name and password). Each set of credentials can come from a Bank of different identities.
With this scheme, you can can configure a local user name (common) with password on the SAA (think of it as your analog PSK) and the other be the AD user identification information.
-
How to allow access to a local area network behind the cisco vpn client
Hi, my question is about how to allow access to a local area network behind the cisco vpn client
With the help of:
- Cisco 5500 Series Adaptive Security Appliance (ASA) that is running version 8.2 software
- Cisco VPN Client version 5.0 software
Cisco VPN client allows to inject a local routes in the routing table Cisco ASA?
Thank you.
Hi Vladimir,.
Unfortunately this is not a supported feature if you connect through the VPN Client. With VPN Client, that the VPN Client can access the VPN Client LAN host/local machine, not host from the local network to business as customer VPN is not designed for access from the local company network, but to the local corporate network.
If you want to access from your local business to your LAN network, you need to configure LAN-to-LAN tunnel.
-
Cisco VPN Client 5.0.0 does not connect
Hello
I am trying to establish the VPN session the firewall to 5525 X Cisco ASA crossing 9.1.1 Cisco VPN Client. Although AnyConnect is the way to go, the inherited method must always be supported for some time as part of a migration. I tried two VPN users (authenticated by ad) on two client computers running Windows 7 64 bit and Cisco VPN Client 5.0.07.0440. Both users are able to establish a session to a computer at the ASA, but not the other. Entering credentails evil, the login popup will appear immediately. On the combination of username/password correct name, the following VPN client log messages are generated and the session drops that is "not connected" in the status bar. The PCF file is the same on both client computers.
Cisco Systems VPN Client Version 5.0.07.0440
Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 6.1.7601 Service Pack 1
119 22:49:16.933 06/23/13 Sev=Info/6 IKE/0x6300003B
Attempting to establish a connection with 203.99.111.44.
120 22:49:16.939 06/23/13 Sev=Info/4 IKE/0x63000001
Starting IKE Phase 1 Negotiation
121 22:49:16.942 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 203.99.111.44
122 22:49:16.973 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
123 22:49:16.973 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from 203.99.111.44
124 22:49:16.974 06/23/13 Sev=Info/5 IKE/0x63000001
Peer is a Cisco-Unity compliant peer
125 22:49:16.974 06/23/13 Sev=Info/5 IKE/0x63000001
Peer supports XAUTH
126 22:49:16.974 06/23/13 Sev=Info/5 IKE/0x63000001
Peer supports DPD
127 22:49:16.974 06/23/13 Sev=Info/5 IKE/0x63000001
Peer supports NAT-T
128 22:49:16.974 06/23/13 Sev=Info/5 IKE/0x63000001
Peer supports IKE fragmentation payloads
129 22:49:16.977 06/23/13 Sev=Info/6 IKE/0x63000001
IOS Vendor ID Contruction successful
130 22:49:16.977 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 203.99.111.44
131 22:49:16.977 06/23/13 Sev=Info/6 IKE/0x63000055
Sent a keepalive on the IPSec SA
132 22:49:16.977 06/23/13 Sev=Info/4 IKE/0x63000083
IKE Port in use - Local Port = 0xCA7C, Remote Port = 0x1194
133 22:49:16.977 06/23/13 Sev=Info/5 IKE/0x63000072
Automatic NAT Detection Status:
Remote end is NOT behind a NAT device
This end IS behind a NAT device
134 22:49:17.000 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
135 22:49:17.000 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 203.99.111.44
136 22:49:17.211 06/23/13 Sev=Info/4 IPSEC/0x63700008
IPSec driver successfully started
137 22:49:17.211 06/23/13 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
138 22:49:23.207 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 203.99.111.44
139 22:49:23.393 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
140 22:49:23.393 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 203.99.111.44
141 22:49:23.393 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 203.99.111.44
142 22:49:23.401 06/23/13 Sev=Info/5 IKE/0x6300005E
Client sending a firewall request to concentrator
143 22:49:23.401 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 203.99.111.44
144 22:49:23.427 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
145 22:49:23.427 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 203.99.111.44
146 22:49:23.427 06/23/13 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.2.193.69
147 22:49:23.427 06/23/13 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 10.2.5.2
148 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 10.1.5.2
149 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000
150 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001
151 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #1
subnet = 10.0.0.0
mask = 255.0.0.0
protocol = 0
src port = 0
dest port=0
152 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000E
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = example.org
153 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
154 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000E
MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5525 Version 9.1(1) built by builders on Wed 28-Nov-12 11:15 PST
155 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001
156 22:49:23.428 06/23/13 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
157 22:49:23.445 06/23/13 Sev=Info/4 IKE/0x63000056
Received a key request from Driver: Local IP = 10.2.193.69, GW IP = 203.99.111.44, Remote IP = 0.0.0.0
158 22:49:23.445 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 203.99.111.44
159 22:49:23.477 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
160 22:49:23.477 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 203.99.111.44
161 22:49:23.477 06/23/13 Sev=Info/5 IKE/0x63000045
RESPONDER-LIFETIME notify has value of 86400 seconds
162 22:49:23.477 06/23/13 Sev=Info/5 IKE/0x63000047
This SA has already been alive for 7 seconds, setting expiry to 86393 seconds from now
163 22:49:23.477 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
164 22:49:23.477 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN) from 203.99.111.44
165 22:49:23.478 06/23/13 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 203.99.111.44
166 22:49:23.478 06/23/13 Sev=Info/4 IKE/0x63000049
Discarding IPsec SA negotiation, MsgID=F3E3C530
167 22:49:23.478 06/23/13 Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion (I_Cookie=CD65262E1C3808E4 R_Cookie=912AE160ADADEE65) reason = DEL_REASON_IKE_NEG_FAILED
168 22:49:23.478 06/23/13 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 203.99.111.44
169 22:49:23.479 06/23/13 Sev=Info/4 IKE/0x63000058
Received an ISAKMP message for a non-active SA, I_Cookie=CD65262E1C3808E4 R_Cookie=912AE160ADADEE65
170 22:49:23.479 06/23/13 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(Dropped) from 203.99.111.44
171 22:49:24.310 06/23/13 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
172 22:49:26.838 06/23/13 Sev=Info/4 IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=CD65262E1C3808E4 R_Cookie=912AE160ADADEE65) reason = DEL_REASON_IKE_NEG_FAILED
173 22:49:26.849 06/23/13 Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection
174 22:49:26.855 06/23/13 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
175 22:49:26.855 06/23/13 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
176 22:49:26.855 06/23/13 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
177 22:49:26.855 06/23/13 Sev=Info/4 IPSEC/0x6370000A
IPSec driver successfully stopped
Any ideas why the second client of Windows 7 does not work?
Kind regards
Rick.
Rick
Thanks for the additional output. It shows the xauth authentication step, which is good to see. But it does not offer much clarity on what is causing the problem.
My attention is drawn to a couple of message on the balls that are in line with the two sessions for which you posted newspapers.
32 00:36:08.178 24/06/13 Sev = Info/5 IKE/0x6300005E
Customer address a request from firewall to hub
I'm not sure that we see any answer to this, but it makes me wonder if it is somehow involved in the issue. Is it possible that there is a difference in the configuration of firewall and operating between two clients?
I am also interested in this series of posts
48 00:36:08.210 24/06/13 Sev = Info/4 IKE / 0 x 63000056
Received a request from key driver: local IP = 10.2.193.69, GW IP = 203.99.111.44, Remote IP = 0.0.0.0
I don't know why the pilot requested a key at this point, and I wonder why the remote IP is 0.0.0.0?
It is followed by a package in which the ASA provides the value of the life of SA - which seems to be on the path to a successful connection. that is followed by
55 00:36:08.350 24/06/13 Sev = Info/5 IKE/0x6300002F
Received packet of ISAKMP: peer = 203.99.111.44
56 00:36:08.350 24/06/13 Sev = Info/4 IKE / 0 x 63000014
RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">
during which the SAA indicates that no proposal has been selected. It seems therefore that the ASA is not happy about something.
If we do not find indications of the client that allows to identify the problem, then maybe we look at the ASA. Are all log messages generated on the SAA during this attempt to establish VPN that could show us the problem? Would it not be possible to run debugs on the SAA in a trial of this machine?
HTH
Rick
-
Another problem with the configuration of Cisco VPN Client access VPN Site2site
We have a Cisco ASA 5505 at our CORP. branch I configured the VPN Site2Site to our COLO with a Juniper SRX220h, to another site works well, but when users access the home Cisco VPN client, they cannot ping or SSH through the Site2Site. JTACS contacted and they said it is not on their end, so I tried to contact Cisco TAC, no support. So here I am today, after for the 3 days (including Friday of last week) of searching the Internet for more than 6 hours per day and try different examples of other users. NO LUCK. The VPN client shows the route secure 10.1.0.0
Sorry to post this, but I'm frustrated and boss breathing down my neck to complete it.
CORP netowrk 192.168.1.0
IP VPN 192.168.12.0 pool
Colo 10.1.0.0 internal ip address
Also, here's an example of my config ASA
: Saved
:
ASA Version 8.2 (1)
!
hostname lwchsasa
names of
name 10.1.0.1 colo
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
interface Vlan2
backup interface Vlan12
nameif outside_pri
security-level 0
IP 64.20.30.170 255.255.255.248
!
interface Vlan12
nameif backup
security-level 0
IP 173.165.159.241 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 12
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
object-group network NY
object-network 192.168.100.0 255.255.255.0
BSRO-3387 tcp service object-group
port-object eq 3387
BSRO-3388 tcp service object-group
port-object eq 3388
BSRO-3389 tcp service object-group
EQ port 3389 object
object-group service tcp OpenAtrium
port-object eq 8100
object-group service Proxy tcp
port-object eq 982
VOIP10K - 20K udp service object-group
10000 20000 object-port Beach
the clientvpn object-group network
object-network 192.168.12.0 255.255.255.0
APEX-SSL tcp service object-group
Description of Apex Dashboard Service
port-object eq 8586
object-group network CHS-Colo
object-network 10.1.0.0 255.255.255.0
the DM_INLINE_NETWORK_1 object-group network
object-network 192.168.1.0 255.255.255.0
host of the object-Network 64.20.30.170
object-group service DM_INLINE_SERVICE_1
the purpose of the ip service
ICMP service object
service-object icmp traceroute
the purpose of the service tcp - udp eq www
the tcp eq ftp service object
the purpose of the tcp eq ftp service - data
the eq sqlnet tcp service object
EQ-ssh tcp service object
the purpose of the service udp eq www
the eq tftp udp service object
object-group service DM_INLINE_SERVICE_2
the purpose of the ip service
ICMP service object
EQ-ssh tcp service object
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 clientvpn object-group
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo
inside_nat0_outbound list of allowed ip extended access any 192.168.12.0 255.255.255.0
outside_pri_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY
outside_pri_access_in list extended access permit tcp any interface outside_pri eq www
outside_pri_access_in list extended access permit tcp any outside_pri eq https interface
outside_pri_access_in list extended access permit tcp any interface outside_pri eq 8100
outside_pri_access_in list extended access permit tcp any outside_pri eq idle ssh interface
outside_pri_access_in list extended access permit icmp any any echo response
outside_pri_access_in list extended access permit icmp any any source-quench
outside_pri_access_in list extended access allow all unreachable icmp
outside_pri_access_in list extended access permit icmp any one time exceed
outside_pri_access_in list extended access permit tcp any 64.20.30.168 255.255.255.248 eq 8586
levelwingVPN_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
levelwingVPN_splitTunnelAcl list standard access allowed 10.1.0.0 255.255.255.0
outside_pri_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo
backup_nat0_outbound list extended access allowed object-group DM_INLINE_NETWORK_1 192.168.12.0 ip 255.255.255.0
outside_pri_cryptomap_1 list extended access allow DM_INLINE_SERVICE_2 of object-group 192.168.1.0 255.255.255.0 10.1.0.0 255.255.255.0
outside_19_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0
inside_nat0_outbound_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo
VPN-Corp-Colo extended access list permits object-group DM_INLINE_SERVICE_1 192.168.12.0 255.255.255.0 10.1.0.0 255.255.255.0
Note to OUTSIDE-NAT0 NAT0 customer VPN remote site access-list
OUTSIDE-NAT0 192.168.12.0 ip extended access list allow 255.255.255.0 10.1.0.0 255.255.255.0
L2LVPN to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0
pager lines 24
Enable logging
debug logging in buffered memory
exploitation forest asdm warnings
record of the rate-limit unlimited level 4
destination of exports flow inside 192.168.1.1 2055
timeout-rate flow-export model 1
Within 1500 MTU
outside_pri MTU 1500
backup of MTU 1500
local pool LVCHSVPN 192.168.12.100 - 192.168.12.254 255.255.255.0 IP mask
no failover
ICMP unreachable rate-limit 100 burst-size 5
ICMP allow any inside
ICMP allow any outside_pri
don't allow no asdm history
ARP timeout 14400
NAT-control
interface of global (outside_pri) 1
Global 1 interface (backup)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access
NAT (inside) 1 0.0.0.0 0.0.0.0
NAT (outside_pri) 0-list of access OUTSIDE-NAT0
backup_nat0_outbound (backup) NAT 0 access list
static TCP (inside outside_pri) interface https 192.168.1.45 https netmask 255.255.255.255 dns
static TCP (inside outside_pri) interface 192.168.1.45 www www netmask 255.255.255.255 dns
static TCP (inside outside_pri) interface 8586 192.168.1.45 8586 netmask 255.255.255.255 dns
static (inside, inside) tcp interface 8100 192.168.1.45 8100 netmask 255.255.255.255 dns
Access-group outside_pri_access_in in the outside_pri interface
Route 0.0.0.0 outside_pri 0.0.0.0 64.20.30.169 1 track 1
Backup route 0.0.0.0 0.0.0.0 173.165.159.246 254
Timeout xlate 03:00
Conn Timeout 0:00:00 half-closed 0:30:00 udp icmp from 01:00 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 01:00 uauth uauth absolute inactivity from 01:00
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
AAA authentication enable LOCAL console
AAA authentication http LOCAL console
the ssh LOCAL console AAA authentication
http server enable 981
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside_pri
http 0.0.0.0 0.0.0.0 backup
SNMP server group Authentication_Only v3 auth
SNMP-server host inside 192.168.1.47 survey community lwmedia version 2 c
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Sysopt connection tcpmss 1200
monitor SLA 123
type echo protocol ipIcmpEcho 216.59.44.220 interface outside_pri
Annex ALS life monitor 123 to always start-time now
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set esp-3des-sha1 esp-3des esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto ipsec df - bit clear-df outside_pri
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
card crypto outside_pri_map 1 match address outside_pri_1_cryptomap
card crypto outside_pri_map 1 set pfs
peer set card crypto outside_pri_map 1 50.75.217.246
card crypto outside_pri_map 1 set of transformation-ESP-AES-256-MD5
card crypto outside_pri_map 2 match address outside_pri_cryptomap
peer set card crypto outside_pri_map 2 216.59.44.220
card crypto outside_pri_map 2 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
86400 seconds, duration of life card crypto outside_pri_map 2 set security-association
card crypto outside_pri_map 3 match address outside_pri_cryptomap_1
peer set card crypto outside_pri_map 3 216.59.44.220
outside_pri_map crypto map 3 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_pri_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
card crypto outside_pri_map interface outside_pri
crypto isakmp identity address
ISAKMP crypto enable outside_pri
crypto ISAKMP policy 5
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 10
preshared authentication
the Encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 50
preshared authentication
aes encryption
md5 hash
Group 2
life 86400
!
track 1 rtr 123 accessibility
Telnet timeout 5
SSH 192.168.1.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
management-access inside
dhcpd auto_config outside_pri
!
dhcpd address 192.168.1.51 - 192.168.1.245 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
rental contract interface 86400 dhcpd inside
dhcpd field LM inside interface
dhcpd allow inside
!
a basic threat threat detection
statistical threat detection port
Statistical threat detection Protocol
Statistics-list of access threat detection
a statistical threat detection host number rate 2
no statistical threat detection tcp-interception
WebVPN
port 980
allow inside
Select outside_pri
enable SVC
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
internal GroupPolicy2 group strategy
attributes of Group Policy GroupPolicy2
Protocol-tunnel-VPN IPSec svc
internal levelwingVPN group policy
attributes of the strategy of group levelwingVPN
Protocol-tunnel-VPN IPSec svc webvpn
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list levelwingVPN_splitTunnelAcl
username password encrypted Z74.JN3DGMNlP0H2 privilege 0 aard
aard attribute username
VPN-group-policy levelwingVPN
type of remote access service
rcossentino 4UpCXRA6T2ysRRdE encrypted password username
username rcossentino attributes
VPN-group-policy levelwingVPN
type of remote access service
bcherok evwBWqKKwrlABAUp encrypted password username
username bcherok attributes
VPN-group-policy levelwingVPN
type of remote access service
rscott nIOnWcZCACUWjgaP encrypted password privilege 0 username
rscott username attributes
VPN-group-policy levelwingVPN
sryan 47u/nJvfm6kprQDs password encrypted username
sryan username attributes
VPN-group-policy levelwingVPN
type of nas-prompt service
username, password cbruch a8R5NwL5Cz/LFzRm encrypted privilege 0
username cbruch attributes
VPN-group-policy levelwingVPN
type of remote access service
apellegrino yy2aM21dV/11h7fR password encrypted username
username apellegrino attributes
VPN-group-policy levelwingVPN
type of remote access service
username rtuttle encrypted password privilege 0 79ROD7fRw5C4.l5
username rtuttle attributes
VPN-group-policy levelwingVPN
username privilege 15 encrypted password vJFHerTwBy8dRiyW levelwingadmin
username password nbrothers Amjc/rm5PYhoysB5 encrypted privilege 0
username nbrothers attributes
VPN-group-policy levelwingVPN
clong z.yb0Oc09oP3/mXV encrypted password username
clong attributes username
VPN-group-policy levelwingVPN
type of remote access service
username, password finance 9TxE6jWN/Di4eZ8w encrypted privilege 0
username attributes finance
VPN-group-policy levelwingVPN
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
type of remote access service
IPSec-attributes tunnel-group DefaultL2LGroup
Disable ISAKMP keepalive
tunnel-group 50.75.217.246 type ipsec-l2l
IPSec-attributes tunnel-group 50.75.217.246
pre-shared-key *.
Disable ISAKMP keepalive
type tunnel-group levelwingVPN remote access
tunnel-group levelwingVPN General-attributes
address LVCHSVPN pool
Group Policy - by default-levelwingVPN
levelwingVPN group of tunnel ipsec-attributes
pre-shared-key *.
tunnel-group 216.59.44.221 type ipsec-l2l
IPSec-attributes tunnel-group 216.59.44.221
pre-shared-key *.
tunnel-group 216.59.44.220 type ipsec-l2l
IPSec-attributes tunnel-group 216.59.44.220
pre-shared-key *.
Disable ISAKMP keepalive
!
!
!
Policy-map global_policy
!
context of prompt hostname
Cryptochecksum:ed7f4451c98151b759d24a7d4387935b
: end
Hello
It seems to me that you've covered most of the things.
You however not "said" Configuring VPN L2L that traffic between the pool of VPN and network camp should be in tunnel
outside_pri_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 object-group CHS-Colo
Although naturally the remote end must also the corresponding configurations for users of VPN clients be able to pass traffic to the site of the camp.
-Jouni
Maybe you are looking for
-
I can adjust the chime that alerts me when I restart my pc.
I can adjust the sound of the chime that alerts me when I restart my pc. I have a Mac OS X Yosemite 10.10.5 Mini late 2014.
-
Qosmio F50 - Volume OSD Bar missing
Hello all,. Although I searched and found some information on this particular issue, I couldn't find any solution yet. As far as I remember, immediately after I turned on the F-50 for the first time, I could see on the screen display (OSD) indication
-
Wall mounting for the TouchSmart all-in-One 7320 (A2K04ES)
Please, help me mount TS 7320 on the wall. I have the only information there are built-in VESA in my PC. Can you give me instruction?
-
Organize a multiplexer of data acquired in a spreadsheet of a column field order file
I am a novice user of Labview, but I managed to make increment of an index from 0 to 15 operating VI to interface with a multiplexer, while ensuring a time predetermined between each cycle of 16 iterations. I just imitated this case study prior to it
-
What program should I install to be able to watch movies / downloaded Demonoid
Original title: XP laptop What program should I install to be able to watch movies / downloaded Demonoid