RV042 subnet separation problems...

Similar Questions

• ASA 5515 - Anyconnect - inside the subnet connection problem

  Hi all

  I have a problem with the connection to the Interior/subnet using Anyconnect SSL VPN.

  ASA worm. 5515

  Please find below of configuration:

  User access audit

  ASA1 # show running-config
  : Saved
  :
  ASA 9.1 Version 2
  !
  hostname ASA1
  activate 8Ry2YjIyt7RRXU24 encrypted password
  volatile xlate deny tcp any4 any4
  volatile xlate deny tcp any4 any6
  volatile xlate deny tcp any6 any4
  volatile xlate deny tcp any6 any6
  volatile xlate deny udp any4 any4 eq field
  volatile xlate deny udp any4 any6 eq field
  volatile xlate deny udp any6 any4 eq field
  volatile xlate deny udp any6 any6 eq field
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  mask of local pool swimming POOLS-for-AnyConnect 10.0.70.1 - 10.0.70.50 IP 255.255.255.0
  !
  interface GigabitEthernet0/0
  nameif outside
  security-level 0
  address IP A.A.A.A 255.255.255.240
  !
  interface GigabitEthernet0/1
  nameif inside
  security-level 100
  192.168.64.1 IP address 255.255.255.0
  !
  interface GigabitEthernet0/2
  nameif dmz
  security-level 20
  address IP B.B.B.B 255.255.255.0
  !
  interface GigabitEthernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  management only
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  passive FTP mode
  network of the OBJ_GENERIC_ALL object
  subnet 0.0.0.0 0.0.0.0
  network outside_to_inside_FR-Appsrv01 object
  Home 192.168.64.232
  network outside_to_dmz_fr-websvr-uat object
  Home 10.20.20.14
  network inside_to_dmz object
  192.168.64.0 subnet 255.255.255.0
  gtc-tomcat network object
  Home 192.168.64.228
  network of the USA-Appsrv01-UAT object
  Home 192.168.64.223
  network of the USA-Websvr-UAT object
  Home 10.20.20.13
  network vpn_to_inside object
  10.0.70.0 subnet 255.255.255.0
  extended access list acl_out permit everything all unreachable icmp
  acl_out list extended access permit icmp any any echo response
  acl_out list extended access permit icmp any one time exceed
  acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 3389
  acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 28080
  acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 9876
  acl_out list extended access permit udp any object outside_to_inside_FR-Appsrv01 eq 1720
  acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq www
  acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq https
  acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq 3389
  acl_out list extended access permit tcp any object USA-Appsrv01-UAT eq 9876
  acl_out list extended access permit udp any eq USA-Appsrv01-UAT object 1720
  acl_out list extended access permit tcp any object USA-Websvr-UAT eq www
  acl_out list extended access permit tcp any USA-Websvr-UAT eq https object
  acl_out list extended access permit tcp any object USA-Websvr-UAT eq 3389
  acl_out list extended access permit tcp any object USA-Appsrv01-UAT eq 3389
  acl_dmz list extended access permit icmp any any echo response
  acl_dmz of access allowed any ip an extended list
  acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 8080
  acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 8081
  acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 3389
  acl_dmz list extended access permitted tcp object USA-Websvr-UAT object USA-Appsrv01-UAT eq 8080
  acl_dmz list extended access permitted tcp object USA-Websvr-UAT object USA-Appsrv01-UAT eq 8081
  access extensive list ip 192.168.64.0 gtcvpn2 allow 255.255.255.0 10.0.70.0 255.255.255.0
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 dmz
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT dynamic interface of OBJ_GENERIC_ALL source (indoor, outdoor)
  NAT (inside, outside) static source all all static destination vpn_to_inside vpn_to_inside
  !
  network outside_to_inside_FR-Appsrv01 object
  NAT static x.x.x.x (indoor, outdoor)
  network outside_to_dmz_fr-websvr-uat object
  NAT (dmz, outside) static x.x.x.x
  network of the USA-Appsrv01-UAT object
  NAT static x.x.x.x (indoor, outdoor)
  network of the USA-Websvr-UAT object
  NAT (dmz, outside) static x.x.x.x
  Access-group acl_out in interface outside
  Access-group acl_dmz in dmz interface
  Route outside 0.0.0.0 0.0.0.0 B.B.B.B 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Enable http server
  http 192.168.64.204 255.255.255.255 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec pmtu aging infinite - the security association
  Crypto ca trustpoint ASDM_TrustPoint0
  registration auto
  name of the object CN = ASA1
  GTCVPN2 key pair
  Configure CRL
  trustpool crypto ca policy
  string encryption ca ASDM_TrustPoint0 certificates
  certificate of 19897d 54
  308201cf 30820138 a0030201 02020419 897d 864886f7 0d 010105 5430 0d06092a
  0500302c 3111300f 06035504 03130851 57455354 32343031 17301506 092a 8648
  09021608 51574553 54323430 31343132 30333034 30333237 301e170d 86f70d01
  5a170d32 34313133 30303430 3332375a 302 c 3111 55040313 08515745 300f0603
  53543234 30311730 1506092a 864886f7 010902 16085157 45535432 34303081 0d
  9f300d06 092 has 8648 86f70d01 01010500 03818d 00 30818902 818100a 2 5e873d21
  dfa7cc00 ee438d1d bc400dc5 220f2dc4 aa896be4 39843044 d0521010 88 has 24454
  b4b1f345 84ec0ad3 cac13d47 a71f367a 2e71f5fc 0a9bd55f 05d 75648 72bfb9e9
  c5379753 26ec523d f2cbc438 d234616f a71e4f4f 42f39dde e4b99020 cfcd00ad
  73162ab8 1af6b6f5 fa1b47c6 d261db8b 4a75b249 60556102 03010001 fa3fbe7c
  300 d 0609 2a 864886 f70d0101 8181007a 05050003 be791b64 a9f0df8f 982d162d
  b7c884c1 eb183711 05d676d7 2585486e 5cdd23b9 af774a8f 9623e91a b3d85f10
  af85c009 9590c0b3 401cec03 4dccf99a f1ee8c01 1e6f0f3a 6516579c 12d9cbab
  59fcead4 63baf64b 7adece49 7799f94c 1865ce1d 2c0f3ced e65fefdc a784dc50
  350e8ba2 998f3820 e6370ae5 7e6c543b 6c1ced
  quit smoking
  Telnet 192.168.64.200 255.255.255.255 inside
  Telnet 192.168.64.169 255.255.255.255 inside
  Telnet 192.168.64.190 255.255.255.255 inside
  Telnet 192.168.64.199 255.255.255.255 inside
  Telnet timeout 5
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL-trust ASDM_TrustPoint0 inside point
  SSL-trust outside ASDM_TrustPoint0 point
  WebVPN
  allow outside
  AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
  AnyConnect enable
  tunnel-group-list activate
  internal GroupPolicy_GTCVPN2 group strategy
  attributes of Group Policy GroupPolicy_GTCVPN2
  WINS server no
  value of 192.168.64.202 DNS server 192.168.64.201
  client ssl-VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list gtcvpn2
  field default value mondomaine.fr
  username cHoYQ5ZzE4HJyyq password of duncan / encrypted
  username Aosl50Zig4zLZm4 admin password / encrypted
  password encrypted sebol U7rG3kt653p8ctAz user name
  type tunnel-group GTCVPN2 remote access
  attributes global-tunnel-group GTCVPN2
  Swimming POOLS-for-AnyConnect address pool
  Group Policy - by default-GroupPolicy_GTCVPN2
  tunnel-group GTCVPN2 webvpn-attributes
  enable GTCVPN2 group-alias
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory 19
  Subscribe to alert-group configuration periodic monthly 19
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:0b972b3b751b59085bc2bbbb6b0c2281
  : end
  ASA1 #.

  I can connect to the ASA from outside with the Anyconnect client, split tunneling works well unfortunately I can't ping anything inside the network, VPN subnet: 255.255.255.0, inside the 192.168.64.x 255.255.255.0 subnet 10.0.70.x

  When connecting from the outside, cisco anyconnect is showing 192.168.64.0/24 in the tab "details of the trip.

  Do you know if I'm missing something? (internal subnet to subnet route vpn?)

  Thank you

  Use your internal subnet ASA as its default gateway? If this isn't the case, it will take a route pointing to the ASA inside the interface.

  You can perform a packet - trace as:

  Packet-trace entry inside tcp 192.168.64.2 80 10.0.70.1 1025

  (simulation of traffic back from a web server inside a VPN client)

• The RV042 Firmware upgrade problem

  Hello

  I was responsible for upgrading the firmware on the router RV042 in more than 30 remote locations. The problem is that when I update the firmware the vpn tunnel or office does not reconnect and we lose communication with the router. What can I do to keep the vpn tunnel directly without having to travel to each site just to get the vpn tunnel to the top?

  Thanks for any help.

  Hello

  You should check if the option Keep Alive and the dead peer detection is enabled on both ends of the tunnel VNP. They help to plug the tunnel once it falls.

  I hope this helps

• RV042 expired password problem

  Hello

  I have a problem really stupid with my RV042. The main logon password has expired, but it won't let me change at all. Basically, I'm trying to connect but get the error ' the old password has expired. Please change the password '. But without any calls at all for a new password and just return to the login page. Tried several different browsers, tried the old password by default, but nothing will work. There seems to be no way to change and I can not connect.

  Am I missing something urgent? I don't want to really not reset to its default value as I have many configured VPN tunnels and various other parameters. Any help much appreciated.

  Mike

  Hi Mike, unfortunately the router will have to be reset if you can't connect.

  There is an aging featue, default password is disabled. When activated, it is 180 days unless you specify differently.

  -Tom
  Please mark replied messages useful

• RV042 load balancing problem

  We have two network connections coming into the office. One is a private Wan, and the other is a WAN on the internet. We have a RV042 router configured for load balancing. We have our private WAN which includes Exchange and 6 VPN Wan1. On WAN2, we have a public IP address and home workers. Both connections are 5 Mg T1s and both have the ability to access the internet but only wan2 has a public IP (76.x.x.x) were as WAN1 has a private IP address. (10.x.x.x).

  Were now the problem lies is our new website based on payroll, system does not support load balancing. We have on one hand stop when we do pay (Tower load balancing off.)

  Now is it possible to use our computers to pay only one side? change the host file maybe? Or force a certain MAC address of use only the WAN1 or is there a better router to achieve?

  Any help would be appreciated

  Peter Labelle

  I don't have a RV042 and have had reference to the Administrator's guide:

  http://www.Cisco.com/en/us/docs/routers/CSBR/RV042/Admin/Guide/RV042_V10_UG_C-Web.PDF

  I hope these comments are useful. Perhaps you can comment and let me know if it works for you. Check balancing load and the binding protocol section.  These changes are disruptive... Please assume a failure during the change.  Not a long interruption, but the sessions at the same distance could be lowered.

  Out, you can use the protocol binding. This could cause some problems with the VPN client... you can try this after hours?

  For entrants, how customers and remote computers know the accounting software?  You are advertising this IP address via a link or another?

  If you are, then you can have a preference through one of the links.  If you advertise this IP address then you will not be able to provide a preference to a supplier of services on the other.

  Do please see the Administrator's guide and let me know your thoughts.  Sincere greetings and HTH,

  Andrew Lissitz

• WAG120N subnet mask problem

  Hello

  I have router WAG120N and I want to change the ip address of the local 10.1.X.Y computer and subnet mask of 255.255.248.0

  I changed the ip address but I couldn't change the subnet mask.

  Please help me...

  You can not. Linksys devices are mainstream devices and support only LAN 255.255.255.0 subnet or smaller. They consider that 254 IP addresses is sufficient for a consumer LAN.

• Signal separator problem

  I use a signal splitter in the given file. It separates the signal into six parts. I use a waveform chart to show the signals. But the only exit from split is shown on the chart... Five others are missing... Why... ? How can I get six waveforms on the output... ??

  As far as I know none of the screws on the standard pallets provide no direct way to create a three-phase signal.  Six sources, all with the same frequency and different phases and amplitudes, is a simple way to do it. Alternatively, you can create a table of the phases and amplitudes and thread in a loop with the signal source VI inside the loop.

  I'm not a fan of the Express VIs for this kind of things.  First, they have the flexibility to run the lower floor screws on the range of Signal Processing.  The Type of dynamic data hides the data structure he wears.  According to what will be done with the data later, I prefer the waveform data type or simple tables.  And the huge icons occupy too much area of block diagram.

  Note that the use of tables as in this example change the x-axis in the charts. The units are clues of paintings, the equivalent of 1 sample per second.

  Lynn

• I used hplaserjet p1007 and I use win7ultimate operating system. But win7 ultimate does not support hp laserjet p1007 printer.pleeeeeeeeeeeeeees solve my drivers separated problem.any installing in win7 ultimate for hp printer.

  gdgdgdgdg

  Hello

  Sorry to inform you, but only of HP will be able to provide a solution.  They are responsible for the pilot to making their products within Windows 7.  You need to contact HP support for more information when they have the appropriate printer drivers that are compatible with Windows 7.

  Regards, ~ Alex T. ~.
  ~ MVP Windows desktop experience ~

• What are the vSphere components must be on the same subnet?

  VSphere components, those who need to be on the same subnet / vLAN?

  For example:

  vCenter Server and ESXi hosts?

  Groups separated from ESXi hosts are on separate VLANS / subnets? What is the limit of the number of hosts ESXi I should have on one vLAN to avoid having too much broadcast traffic?

  vCenter Server and he associated with SQL Server?

  VMware Update Manager and vCenter Server?

  VMware Update Manager and ESXi hosts it updated?

  There is no technical requirement that vSphere components must be on the same IP subnet. You can have all the components on a separate and routed (or even a firewall, you implement granted sufficient rules) subnet without problems. If that made sense, however, is a completely different question.

  vCenter Server and ESXi hosts?

  Does not really matter, but makes the most sense to be on the same subnet.

  Groups separated from ESXi hosts are on separate VLANS / subnets? What is the limit of the number of hosts ESXi I should have on one vLAN to avoid having too much broadcast traffic?

  If they are managed by the same vCenter, or similar commercial purposes, I would put them on the same subnet. I only consider something a subnet extra for things like DMZ-Clusters, that can be distinguished from any other as much as possible. A vMotion VLAN cluster might be a correct point in a normal scenario too.

  ESXi hosts really do not generate any significant broadcast traffic, apart from a few ARP requests here and there. This isn't Windows, after all, and even if that were the case, the time when you had to worry about the reasons broadcasting with 'only' a few hundreds or thousands of systems on a broadcast domain have long been more with the advent of fast and gigabit ethernet.

  vCenter Server and he associated with SQL Server?

  VMware Update Manager and vCenter Server?

  Even once it does not really matter, but I would put them on the same subnet unless I have a very good reason not to.

  VMware Update Manager and ESXi hosts it updated?

  As long as they are not connected via a WAN snail, causing the staging of updates hours, that's fine.

• Disaster recovery network topology

  I am creating an exact replica of the production network to the location of DR.  Using replication from host to host, host to vmdk and data backup, I am replicating servers and data via.  Now, I need delete it even subnet and the server and domain names.  The network of production and the location of Dr. currently use different subnet separated by a point T3 connection to point addresses.

  Main reasons:

  1. Applications were not designed with Dr. in mind.  The resources are referenced by name or IP address.
  2. Easier to clone DC and specific application systems.
  3. Other systems can be online on the subnet of DR and replication of data until the time of the disaster, then give DR server with the same name and IP address of the production system.
  4. You need to be able to put a server on the field mirrored online to test without affecting the production network and the domain.

  Considered L2TPv3, but this does not solve my problem of mirroring systems.  I can't make it appear 2 controllers domain mirrored or replicated upwards at the same time servers.

  Thinking of using a router NAT of DR subnet for the subnet of replicated production. Adds a lot of complexity and the mapping of IP conplexity.

  Whereas also the implementation of a DMZ on DR PIX with the subnet of production.  Allows me to route traffic to the Dr and the Internet subnet.  Allows me to filter traffic to avoid conflicts by IP and name.

  Of course any test that will be done will require disabling the T3 connection and access to the network of DR from a different path as the VPN.

  Looking for previous configurations, thoughts, recommendations.

  Thanks in advance.

  Hello

  It is a typical site of the DR cold installation which normally only used in times of disaster only. The only two test available ti DR site system option are as below.

  Turn off the main site communication

  Apply the NAT & ACl to DR router to link to main site.

  Option two allows Dr. validation of access and the application of the system of main site.

  Thank you

  Mustafa

• Network of Cisco 1140 Standalone AP "guest."

  I think the purchase of the stand-alone version of the AP of 1140, (AIR-AP1142N-x-K9-bi-bande Standalone 802.11a/g/n). My question is can I install a network of 'guest' with these conditions:

  1. Subnet separated, gets dhcp from the AP.
  2. No configuration of the DMZ on the firewall.
  3. No access to other subnets, internet only.
  4. You need a VLAN?

  Thanks in Advace for your help!

  L. Mace

  1. Subnet separated, gets dhcp from the AP.   Yes, this could be done, just need to configure a scope on the AP, may support ip take for IP of the AP management.
  2. No configuration of the DMZ on the firewall.  Don't necessarily need the DMZ, but you'll have to leave the new subnet to cross
  3. No access to other subnets, internet only.  not a problem, ACL to the L3 device.
  4. You need a VLAN?  Yes.

  See you soon,.
  Steve

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• RV220W PPTP does not

  I recently installed a new 220W for the sole purpose of setting up the PPTP server. I I have the router installed and works, but cannot get the PPTP server working. When I set up a block of IP address of my local network for the server it also tells me I can't use this subnet? I've implemented this way with other routers (RV042) without any problem. any suggestions?

  firmware is 1.0.0.26

  Hello Joe,

  My name is Joseph. The first thing I would do is update the firmware on the router to the latest version 1.0.3.5. With the PPTP IP addresses, you try to configure a range of addresses in a different subnet from your LAN or the same subnet? The subnet that you configure on this page must be different from your subnet of the network LAN IP addresses. For now, update the firmware and make sure you use a different subnet. I would like to know if it works for you.

• ESX 3.5i / software iSCSI?

  I plan on upgrading a cluster of ESX 3.02 tomorrow to ESX 3.5.

  I would use 3.5i because of its lack of a service console, we had some problems in the initial Setup, getting the iSCSI traffic because we have an iSCSI subnet separated from our hosted customer (who is on 192.168.x.x network).

  Although I am quite familiar with 3.5i - I still try to use the software iSCSI with this version.   Can it be done?

  Sven

  It should work without problem.  You will need to create a separate vSwitch for the iSCSI network with a kernel port assigned to the iSCSI IP address range.  You will also ensure that iSCSI is allowed through the firewall.

• Why users need to disconnect and reconnect to the VPN to RDP?

  Most of the time our VPN works perfectly, but sporadically users must reconnect to the VPN to use remote desktop. Is that the user can log on to the VPN and access to things like network drives, but not other features like RDP. If they disconnect and then reconnect to the VPN, poof, everything works fine. No matter if it is minutes or hours in the VPN connection, it still requires reconnection. It seems that it is always on the second attempt at the nick of this post point called 'the second time's a charm

  We are using RRAS in SBS 2008 and the problem is multiple users tempting to VPN in XP and Win7 machines. We replaced the switches (now using Dell Powerconnects) and the router (now using Cisco RV042) and the problem persists.

  Suggestions or responses are greatly appreciated.

  Hello

  The question you have posted is related to Technet and would be better suited to the Technet community. Please visit the link below to find a community that will provide the best support.
  http://social.technet.Microsoft.com/forums/en-us/w7itpronetworking/threads

• Substantive distinction and objects of interest

  Hi, I have a separation problem objects of interest to the background. Attach file is the image of the sample. I have tried using some methods such as the 'threshold' or followed the example of analysis of particles in the example of the Vision. However, these mothods weren't work in this application, as the result of above methods distroted shape objects. In this application, the objects of interest are the particles in the form of line because they are marked numbering in attach them files, these particles cannot be distroted, because they will be evaluated after the separation. If you have any ideas or tools please guide me.

  Please notify.

  Skytalker.