RV130W - VPN spontaneously blocks traffic

Similar Questions

• RV042 vpn - stops passing traffic but remains connected

  We have two boxes with a VPN tunnel RV042 connecting.  No problem, initiating the tunnel or passing traffic initially.  However, after "a certain" time (apparently random amounts of time) the VPN stops passing traffic.  Then, someone needs to go in web admin and disconnect/reconnect the VPN how it's ok once again.  What now happens several times a day.  FW ver is 1.3.12.6 on both sides - and addresses static ip from the ISP on both sides as well.  Any ideas on how to solve this problem?

  Thank you
  Drew

  Drew,

  Sorry I don't have a solution for you, but your post almost made me cry. We are experiencing the same problem, but with the VPN gateway to gateway static to the dynamic. I was hoping that the problem should go away if I could make the static dynamic side. It seems now I'm looking for other solutions. I wish you luck and thank you for bringing This gap to my attention.

• Block traffic using security groups.

  I want to block all traffic between two virtual machines, for which I created the security in Service named composer SG-WEB group.

  In the DFW, I have two simple rules:

  

  One rule that block traffic between the SG-WEB security group and another which helps everything. But I can still ping WEB1, WEB2 and vice versa. Of the ESXi if I look in the log of the FW I see traffic is allowed for the L2.

  If instead of security groups, I use subnets, everything works fine. I know I have used security groups to identify the DFW traffic, but here does not at all, is this a bug or I'm missing some configuration required to achieve this?

  Thank you.

  What is the status of the VMware Tools in these virtual machines?

• WRT160Nv3 problem with blocking traffic through Access Restrictions

  Hello.

  I want something very simple. Block Youtube. I go in "Access Restrictions", choose a name for the policy 1, turn it on, choose the pc in the list of pc, but then...

  If a click Deny, all other options will be disabled (grayed out, do not click or write on them).

  Therefore, I can't put the URL I want (youtube).

  I tried to write the url with "allow" and then change to 'decline', but it crashes ALL the traffic.

  Not good.

  So, how can I make a new policy just to block this URL?

  Is it normal that when I click and choose "Refuse" all is disabled afterwards?

  Thanks in advance.

  Kind regards

  Leo

  for the internet access policy DENY wants to restrict internet access for hours and days specified. This may block ALL internet traffic to the said Annex. Web site blocking of URLS, blocking by keyword and the applications would then NOT AVAILABLE as long as the computers would have access to internet at first if you have such a policy is disabled.

  for your case, you can try to turn on the restriction of access to the internet to ALLOW then specify youtube.com under website by URL blocking. This would have internet access all the time (if you have the DAILY deadline), computers or during certain days and hours but do NOT have access to youtube.

• Windows 7 Home Edition - Corporate VPN access - blocked?

  Is it true that Windows 7 Home Edition does NOT connect to a Corporate VPN? I was told that there is some sort of block on this form of access, regardless of the configuration of the system.

  If so, is it true that the upgrade to Windows 7 Professional Edition would solve this problem?

  Thank you

  Carlos

  Ask your question to Windows 7. Here is the link, choose the category you want from there.
  http://social.answers.Microsoft.com/forums/en-us/category/Windows7

  You are at Vista forum.

  t-4-2

• Installation of Server IPSec RV130W VPN router

  Recently, we bought 2 routers RV130W and didn't have problems establishing an IPSec VPN tunnel from site to site between 192.168.xxx.0 and 192.168.yyy.0 now on one of the routers (192.168.xxx.1) I want to configure the section of Server client IPSec for remote clients can VPN into the business.  When I try to do this on the router I don't able to assign a subnet to 192.168.xxx.0 in the Phase 2 section like it says then on the interface "rule is already in use.  I think that you can not have IPSec site-to-site and client-to-site IPSec running simultaneously on these routers? I'm not really interested to use PPTP in that moment.

  Hi Brian,.

  Please remove the Configuration of the Tunnel, start to configure the VPN server, first and after that set up the VPN Tunnel and it should work.

  Please let me know after your test

  Greetings

  Mehdi

• VPN not send traffic

  Have a Cisco 3005 concentrator and some users are not able to route traffic because of the entry door is not not same as the VPN interface.  The problem occurred after one of the groups has been removed from the appliance 3005.  Users can connect, but cannot reach the remote network.  When we look at "route print" the bridge which shows another IP other than the IP Address of the VPN virtual device Interface.  Is there a way to force a change or clear the roads? Example;

  Network Destination gateway metric Interface subnet mask
  0.0.0.0 0.0.0.0 172.20.10.5 172.20.10.122 20
  10.1.0.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  10.2.0.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  65.216.9.229 255.255.255.255 172.20.10.5 172.20.10.122 100
  127.0.0.0 255.0.0.0 127.0.0.1 on route 306
  127.0.0.1 255.255.255.255 127.0.0.1 on route 306
  127.255.255.255 255.255.255.255 on-link 127.0.0.1 306
  169.254.0.0 255.255.0.0 on a 172.20.10.122 route 296
  169.254.255.255 255.255.255.255 on a 172.20.10.122 route 276
  172.20.10.0 255.255.255.0 on a 172.20.10.122 route 276
  172.20.10.0 255.255.255.0 on a 172.20.10.59 route 276
  172.20.10.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  172.20.10.6 255.255.255.255 on a link 172.20.10.122 100
  172.20.10.59 255.255.255.255 on a 172.20.10.59 route 276
  172.20.10.122 255.255.255.255 on a 172.20.10.122 route 276
  172.20.10.122 255.255.255.255 172.20.10.1 172.20.10.59 276
  172.20.10.255 255.255.255.255 on a 172.20.10.122 route 276
  172.20.10.255 255.255.255.255 on a 172.20.10.59 route 276
  172.20.10.255 255.255.255.255 172.20.10.1 172.20.10.59 276
  172.20.11.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  172.20.21.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  172.20.31.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  172.20.50.0 255.255.255.0 172.20.10.1 172.20.10.59 100
  172.20.51.0 255.255.255.0 172.20.10.1 172.20.10.59 100

  There are some parameters of NAT - T group, so it makes sense that some clients have the problem, but others do not.  Good to know that another cause of a client VPN routing problem could be linked to the absence of NAT - T.  I noticed your reply.

• A PIX-to-PIX VPN can allow traffic in only one direction?

  Here is the configuration of the PIX 501 that accepts incoming VPN tunnels of the other PIX dynamic-ip.  Everything works very well, allowing traffic to flow both ways after that the tunnel rises.  But then I somehow limit or prevent the traffic that originates on the PIX (192.168.27.2) to go to other networks of PIX?  In other words, if a tunnel exists (192.168.3.0 to 192.168.27.0), I only want to allow network traffic to access the network 27.0 3.0, and I want to anyone on the network 27.0 access network 3.0.

  Thanks for any comments.

  pixfirewall # sh conf
  : Saved
  : Written by enable_15 at 13:29:50.396 UTC Saturday, July 3, 2010
  6.3 (4) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate the encrypted password
  encrypted passwd
  pixfirewall hostname
  .com domain name
  fixup protocol dns-maximum length 4096
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol they 389
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list 101 permit ip 192.168.27.0 255.255.255.0 10.10.10.0 255.255.255.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 10.10.0.0 255.255.0.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 192.168.3.0 255.255.255.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 192.168.7.0 255.255.255.0
  pager lines 24
  ICMP deny everything outside
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside xxx.xxx.xxx.248 255.255.255.255
  IP address inside 192.168.27.2 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  IP local pool ippool 10.10.10.1 - 10.10.10.254
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  NAT (inside) - 0 102 access list
  Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.1 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set esp - esp-md5-hmac gvnset
  Crypto-map dynamic dynmap 10 transform-set gvnset
  gvnmap 10 card crypto ipsec-isakmp dynamic dynmap
  gvnmap interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address 0.0.0.0 netmask 0.0.0.0
  ISAKMP identity address
  ISAKMP keepalive 60
  ISAKMP nat-traversal 20
  part of pre authentication ISAKMP policy 9
  encryption of ISAKMP policy 9
  ISAKMP policy 9 md5 hash
  9 2 ISAKMP policy group
  ISAKMP policy 9 life 86400
  vpngroup address ippool pool gvnclient
  vpngroup dns 192.168.27.1 Server gvnclient
  vpngroup gvnclient wins server - 192.168.27.1
  vpngroup gvnclient by default-domain '.com'
  vpngroup split tunnel 101 gvnclient
  vpngroup idle 1800 gvnclient-time
  vpngroup password gvnclient *.
  Telnet 0.0.0.0 0.0.0.0 inside
  Telnet timeout 30
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH timeout 30
  management-access inside
  Console timeout 0
  Terminal width 80
  Cryptochecksum:
  pixfirewall #.

  Of course, without a doubt capable.

  You can configure the inside interface access list to deny traffic from 192.168.27.0/24 to 192.168.3.0/24, and then allow anything else.

  Example:

  access list for the Interior-acl deny ip 192.168.27.0 255.255.255.0 192.168.3.0 255.255.255.0

  the Interior-acl ip access list allow a whole

  group-access Interior-acl in the interface inside

  Hope that helps.

• Router firewall does not block traffic

  Hello

  I use vmware view Home 4.6 client.  I can authenticate and connect to a windows image 7, but only a black screen appears.  After about 30 seconds it disconnects with the error "the connection to the remote computer has ended."

  If I disable my billion router firewall, the machine virtual windows 7 appears and everything works as expected.  I tried port forwarding 4172 and 5002 but still does not work.  Then I tried port forwarding 50000 to 65000 I saw various 50456 to 64652 ports in firewall logs.  TCP and UDP are enabled in both cases, but no luck.

  Here is the part of the firewall log:

  04 August 23:01:38 home.gateway:firewall:info: 476378.910 blocked Prot = 17, 192.168.1.1:56143 > 10.100.200.1:137 - default defense

  04 August 23:01:38 home.gateway:firewall:info: 476378.910 blocked Prot = 17, 192.168.1.1:52771 > 10.100.200.1:137 - default defense

  04 August 23:01:38 home.gateway:firewall:info: 476378.910 blocked Prot = 17, 192.168.1.1:64632 > 10.100.200.1:137 - default defense

  192.168.1.1 is my computer and 10.100.200.1 is my domain controller from work.

  I then tried to create a packet filtering rule to allow 4172, then 50000 to 65000, but nothing worked.  To disable the firewall of the router or select the parameter of low security for her is the only way to operate.  The default medium security setting blocks the traffic.

  Router is a VGP 7301 billion.  Any advice would be much appreciated.  Thank you.

  Hello

  Im sorry im not familiar with this particular modem however I got something similar on my draytek at home. Mine to connect for a few seconds, and then stop working.

  I discovered that it was because my BACK settings on my modem have been set to protect against a stream of UDP. I was able to disable then part of security BACK settings and then it worked ok.

  Maybe it's the little, you have problems with that. I have no port forwarding on my configuration, and im sure I wasn't leaving the installation rules, all incoming traffic is blocked.

  I hope this helps.

  See you soon

  Phil

  [Edit]

  Just checked, I 32111 outgoing tcp (redirect usb) and also 4172 TCP/UDP outgoing (pcoip). Nothing, nothing allowed incoming traffic.

• VPN configuration blocking Internet connectivity

  I own an iPhone6 (bought in November 14 and another iPad4 (bought in early 2014) - I face a problem even in both devices.)

  Whenever I'm trying to be devices connecting to the Internet (this either through Mobile or wireless data, I have to take concrete steps to start-up the VPN setting without which the device connect to the Internet. However sometimes (although not very often) the VPN configuration gets turned on by itself without manual intervention (on start-up or mobile data or WiFi on the device). So there is always some delay time in the connection to the Internet whenever I want to use the device.

  I would be grateful for suggestions from the community in order to overcome the problem.

  You have installed VPN software or you have configured in your VPN settings? If you have a VPN configuration, then check its configuration. If you do not have a VPN configuration or a VPN software installed, then the VPN switch in settings should not illuminate.

• Unable to connect to the printer, VPN is blocking my computer

  try to connect the printer to the computer. says error meesage VPN crashes my computer. What should I do?

  How do you connect your computer to your printer?  Ethernet?  USB port?

  One thing you can try is to go to the Panel "Printers and faxes", right-click on your printer, select "Properties".  When the Properties window appears, click the "Advanced" tab  Try to select the option "print directly to the printer", then OK your way out.

  HTH,
  JW

• Connection VPN, but NO traffic

  This seems to be a common theme, but no other positions are exactly like mine.

  I have 4 clients of VPN (different versions) software that can connect to a VPN concentrator 3005. 2 clients work very well, they connect and can ping the server. I have two clients who connect but cannot ping the server.

  1 customer - who can NOT ping. VPN client 4.0.3c on XP Pro IP 10.10.0.0/16 private leaving a 501 PIX via Internet to a VPN 3005 concentrator inside a LAN 10.100.30.0/24.

  ---> PIX 501 VPN client - > Internet VPN Conc 3005--->---> LAN---> Server

  2nd customer who cannot ping. 4.6 VPN client. on XP Pro private IP 192.168.17/24 leaving a MS Win 2 K through the Internet server in a VPN 3005 concentrator inside a LAN 10.100.30.0/24.

  Client VPN---> Win 2 K server - > Internet VPN Conc 3005--->---> LAN---> Server

  Both can make the VPN connection to the VPN Conc throughout the day, but cannot ping the server. BUT other clients can ping the server.

  ??? Help?

  See MTU:

  http://www.Cisco.com/en/us/Tech/tk175/TK15/technologies_tech_note09186a0080093bc7.shtml

  NAT - T see:

  command:

  ISAKMP nat-traversal 20

  Link:

  http://www.Cisco.com/en/us/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a9.html#wp1027312

  Network address translation (NAT), including translation of address of Port (PAT), is used in many networks where IPSec is also used, but there are a number of incompatibilities that prevent IPSec packets to cross successfully. NAT route NAT devices enables ESP packets to pass through one or more NAT devices.

  The firewall supports NAT traversal as described by the Version 2 and Version 3 of the IETF "UDP Encapsulation of IPsec packets" project, available at http://www.ietf.org/html.charters/ipsec-charter.htmland NAT traversal is supported for dynamic and static cryptographic cards. Route NAT is disabled by default on the firewall.

  To enable NAT traversal, check that ISAKMP is enabled (you can activate it with the if_name isakmp enable command) then use the nat traversal [natkeepalive] command isakmp. (This command appears in the configuration if both ISAKMP is enabled and NAT traversal). If you have enabled NAT traversal, you can disable it with the nat-traversal No. isakmp command. The valid values for natkeepalive are from 10 to 3600 seconds. The default value is 20 seconds.

• Enable the VLAN on sub interface internet access but block traffic to VLAN native

  I have a 2821 router w / MLS 2024 switches.  Native VLAN(default vlan) is my private network and VLAN 100 is my comments system.  Below is my interface config...

  interface GigabitEthernet0/1

  Description ES_LAN, ETH - LAN$ $$

  IP 10.1.0.2 255.255.0.0

  penetration of the IP stream

  IP nat inside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  !

  !

  interface GigabitEthernet0/1.1

  encapsulation dot1Q 100

  IP 10.3.1.254 255.255.255.0

  penetration of the IP stream

  IP nat inside

  IP virtual-reassembly

  !

  IP default-gateway xx.xxx.xxx.xxx

  IP forward-Protocol ND

  IP http server

  23 class IP http access

  local IP http authentication

  IP http secure server

  IP http timeout policy slowed down 60 life 86400 request 10000

  Default route is defined...

  IP route 0.0.0.0 0.0.0.0 xx.xxx.xxx.xxx

  Access list are...

  access-list 175 deny ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255

  access-list 175 allow ip 10.1.0.0 0.0.255.255 everything

  access-list 175 deny ip 10.3.1.0 0.0.0.255 10.1.0.0 0.0.255.255

  access-list 175 allow ip 10.3.1.0 0.0.0.255 any

  I want to continue to have access to the guest VLAN in VLAN private to allow the management of points of access etc.

  I want to allow internet access as guest newtork but block it to access my private network.

  Don't know how to do in this regard.  I tried to change the ACLs (remove the 10.3.1.0 entries) and creating an another acl for the Scriptures and applying that VLAN 100 sub interface... so far without success.

  Thanks in advance for the help!

  Hello Chris,

  > From this point of view should I leave the above lines and create another list acl for the 10.3.1.0 of the network and apply entering gig0/1.1?

  I would go this way, as in a simple ACL, you can't express your needs. The ACL to apply on gi0/1.1 will probably need further instructions then the ones I suggested, but divide the problem into smaller manageable pieces is a good strategy.

  > Also with this config would be NAT be performed on each network by making this change?

  Until the internal network and network of comments are on the same side (ip nat inside) there is no NAT triggered in communication between them so that you should not influence the NAT configuration with this change.

  Hope to help

  Giuseppe

• Trend deep security 9 Service Pack 1 upgrade problems - protected device blocks traffic host

  Hello

  I started the process of Trend Micro Deep Security 9 update to Service Pack 1, but ran into a problem during this process.

  Just like the information, I run VMware View VMs (virtual desktops) on these hosts.

  After the upgrade of the DSM, relay and ESXi filter drivers, I then upgrade one of these devices to SP1. After that, each virtual desktop on the host related to SP1-Upgraded TDS unit is unable to communicate correctly with the server administrator display Horizon, client applications of sight and portal service of VMware View Blast. When I try to Ping (ICMP) the same VM, they respond very well.

  I checked the ESXi firewall rules, they are as they should be (no specific restrictions on traffic Web or PCoIP ports etc.), and double-checked that deep in Trend Micro Security firewall policy is turned off.

  Any ideas? I'm not trend-expert, I really have no idea where to start to fix this problem.

  5.1 ESXi

  5.2 horizon view

  Deep trend Security 9 and partially v9 with Service Pack 1 (see above)

  Update: A cold-restart of the device seems to have solved the problem. The main NETWORK card was stuck somehow and does not have a normal reboot.

• Block incoming traffic not requested by VPN L2L on ASA5505

  I have an L2L work between two locations. Location A and B.

  Location A: 172.16.16.0/24

  B location: 192.168.0.0/24

  I would like to block any incoming pitch A b location which is not initiated from A location. The block must be done on the ASA5505 location a. location B uses a router ISR G2.

  that is A location can start an SSH session to a server at the point B

  Location B cannot start an SSH session to a server in A location

  I tried to use a VPN on the ASA5505 filter but is not dynamic, I can not pass any traffic during its use.

  Config on my ASA:

  vpn-circulation 172.16.16.0 ip access list allow 255.255.255.0 192.168.0.0 255.255.255.0

  access vpn-local block list extended deny ip 192.168.0.0 255.255.255.0 172.16.16.0 255.255.255.0

  access vpn-local block list extended ip allowed any one

  crypto vpn 100 match address vpn-traffic map

  card crypto 100 counterpart set location-public-IP vpn

  card crypto vpn 100 transform-set esp-aes256-sha

  vpn outside crypto map interface

  Group internal vpn-local-political block policy

  bloc-vpn-a-locales-strategie-strategie of group attributes

  VPN-filter block vpn-local value

  Protocol-tunnel-VPN IPSec

  type of tunnel-group location-public-IP-ipsec-l2l

  attributes global-tunnel-group location-public-IP

  strategy-group-by default-vpn-to-local-blocking strategy

  tunnel-group location-public-IP-ipsec-attributes

  pre-shared key *.

  I also have an AnyConnect VPN for the ASA5505 configuration and it runs 8.2 (5). Any tips?

  Hello

  Unless you already have a lot of VPN connections to use theres also another option other than VPN filter ACL.

  You can globally change the "sysopt permit vpn connection" setting (the default is that this option is enabled)

  If you change this setting to "no sysopt permit vpn connection" every connection from remote site will require an ACL rule on the ACL interface that end the VPN. And it's usually the 'outer' interface

  I find its rules in a way easy and clear of the ACL rules for construction VPN connections also although the 'outside' ACL would now include VPN traffic and Internet. It still beats the use of VPN filter ACL if you ask me.

  The downside activating this later is the fact that if you have no restrections between VPN and LAN connections, you would now determine which must be open before you can change the global settings so that connections don't stop working.

  Here is the section of the overview of ASA 8.2 for the order parameter controls / I do not speak of

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/command/reference/S8.html#wp1517364

  If you want to go with VPN filter ACL then follow the earlier instructions of messages while strengthening the ACL rules.

  -Jouni