Site to Site VPN Possible behind routers NAT on both ends?

Nice day

After extensive research I have not found an answer so I turn to the community.

I'm trying to help a friend facility a VPN but it's a scenario that I have not dealt and hope that someone has.

Here's the basic scheme;

Site 1 - 172.16.23.0/24

Site 2 - 172.16.24.0/24

(Site of ASA 1 - router 172.16.23.5) - Linksys w / static public IP - Internet - Linksys router w / static public IP-(ASA Site 2 - 172.16.24.5)

Is this possible scenario with port forwarding?  The warnings, I need to watch out for?

I read that I'll need a route to my ASA, say Site 1 ASA, who said... Route 172.16.24.0 255.255.255.0 1.1.1.1 (point to ASA local public IP).

I also read I'll need one additional lane in my (site 1) linksys router that says... Route 172.16.24.0 255.255.255.0 172.16.23.5 (point to the local interface of the ASA)

Thanks for all comments and suggestions.

A

Hi Adam,.

You are right with a port forwarding, you can create an IPSEC tunnel, even if NAT is present on both ends.

Also, NAT - T is a feature enabled by default on the ASA that automatically detects if the camera is behind a NAT and pass the IPSEC UDP 4500 port. Here is the syntax of the command:

ASA (config) # crypto isakmp nat-traversal 20

How NAT - T works

So, here is a document for your reference build the VPN tunnel:

http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/119141-configure-ASA-00.html

About routing, all traffic will go out of the ASA using intellectual property where the card encryption is applied, routing on linkysys devices just take care that this IP is routed Internet and that there is connection between the 2 ASAs.

It may be useful

-Randy-

Tags: Cisco Security

Similar Questions

  • Site to site VPN between ios routers spoke with one asa possible hub?

    Hi people,

    I have a couple of series of routers 1841 ios as the rays and a nodal point using an ASA5520 box. Lan to Lan VPN has no problem of communication with nets of void behind the box of the ASA for A rays & speaks B.

    Problem with inter communication of talking, talking cannot ping spoke to B and vice versa. I now use GRE tunnels for inter communication speaks. I know that this is not a good way to do it if the VPN L2L must increase in size. Is it better average as the use of DMPVPN or a way to activate any function in the box of the ASA? (Tried to use the command same-security-traffic permit intra-interface on the ASA but did not work). Can advice you here other experts?

    Hello

    Talk to talk through the Hub of the SAA is possible. And it looks like you were going in the right direction by setting up "permit same-security-traffic intra-interface". Did you get a chance to look at the URL below and configure the Crypto and ACL SHEEP to include remote subnets. Also, did you do the necessary changes to the side talking to reflect the new set upwards.

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml

    Kind regards

    Arul

    * Rate pls if it helps *.

  • VPN site to Site on both ends using Cisco 871

    I would like to configure VPN Site to Site using the Cisco 871 templates at both ends, but a hard time to set it up. Can someone tell me how to do or if you know of a link that may help me set up as soon as possible?

    I can learn it, but it's time that banned me in the implementation. The other end is already configured to provide Internet access to all users.

    Tom,

    ########################################################################################

    Router 1 VPN config:

    Internal = 10.0.0.0/24
    Public = 196.1.161.65

    access-list 101 permit ip 10.0.0.0 0.0.0.255 10.193.12.0 0.0.3.255

    access-list 102 deny ip 10.0.0.0 0.0.0.255 10.193.12.0 0.0.3.255
    access-list 102 permit ip 10.0.0.0 0.0.0.255 any

    IP nat inside source list 102 in interface (check the name of the external interface) overload

    crypto ISAKMP policy 10
    3des encryption
    sha hash
    Group 2

    ISAKMP crypto key cisco123 address 196.1.161.66

    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

    MYmap 10 ipsec-isakmp crypto map
    defined by peer 196.1.161.66
    Set transform-set RIGHT
    match address 101

    interface (check the name of the interface inside)
    IP nat inside

    interface (check the name of the external interface)
    NAT outside IP
    crypto mymap map

    ########################################################################################

    Router 2 VPN config:

    Internal = 10.193.12.0/22
    Public = 196.1.161.66

    access-list 101 permit ip 10.193.12.0 0.0.3.255 10.0.0.0 0.0.0.255

    access-list 102 deny ip 10.193.12.0 0.0.3.255 10.0.0.0 0.0.0.255
    access-list 102 permit ip 10.193.12.0 0.0.3.255 all

    IP nat inside source list 102 in the fast4 interface overload

    crypto ISAKMP policy 10
    3des encryption
    sha hash
    Group 2

    ISAKMP crypto key cisco123 address 196.1.161.65

    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

    MYmap 10 ipsec-isakmp crypto map
    defined by peer 196.1.161.65
    Set transform-set RIGHT
    match address 101

    interface vlan1
    IP nat inside

    fast4 interface
    NAT outside IP
    crypto mymap map

    ########################################################################################

    The above is an example of configuration.
    It is always recommended to change the pre shared key to something else.

    Federico.

  • Site to Site VPN ASA 5510

    OK my forehead is painful to all keyboard strokes that I know that it must be something simple, but I am brand new to the SAA.  I had a site to site VPN configuration via routers 1751 that worked very well, but we're looking to add some more remote field offices, and I felt that it would be easier to maintain several sites is on the ASA 5510.  I have the VPN configured on the SAA and he said that the tunnel is up.  I can telnet to the ASA and ping the remote gateway on the even side of VPN and it pings fine.  If I try to ping on a local computer, I get a "Request timed out".  If I makes no changes apart from go to the computer room and replace the network cable the 1751 and then through the 1751 I can now ping the remote door way to my computer.  The remote router works obviously very well, my statement of route on my router for vpn push through the ASA (same ip address) IP traffic that has been used by the 1751 works obviously. It seems so just like ASA is not being pushed in the ethernet0/0 VPN traffic or at least it is not encrypted.  I also noticed that the ACL for NAT seems to increase in number of access either it seems, there is really just one small thing missing to make the ASA except and encrypt incoming traffic on ethernet0/0:

    My network is not configured with a DMZ is something like that, the ASA ethernet0/0 and my local network on the same subnet:

    Router (Cisco 2811)

    |

    Layer switch 2 (ProCurve)

    |                                      |

    ASA5510 LAN computers

    I'm trying to except both sides of the VPN in and out on Ethernet0/0 traffic I saw there was a framework for this "permit communication between VPN peers connected to the same interface' and I've activated this option.

    In short, I need to understand why the VPN tunnel shows that upward and I can ping the remote of the SAA, but peripheral gateway on my network can not ping to the remote gateway through the int Ethernet0/0 on the SAA.

    From the console of the ASA, I get this:

    ASA5510 # ping 192.52.128.1
    Send 5, echoes ICMP 100 bytes to 192.52.128.1, wait time is 2 seconds:
    !!!!!
    Success rate is 100 per cent (5/5), round-trip min/avg/max = 100/108/120 ms

    ASA5510 # show crypto ipsec his
    Interface: *.
    Tag crypto map: * _map, local addr: 10.52.120.23

    local ident (addr, mask, prot, port): (10.52.120.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (192.52.128.0/255.255.255.0/0/0)
    current_peer: x.x.x.204

    program #pkts: 9, #pkts encrypt: 9, #pkts digest: 9
    decaps #pkts: 9, #pkts decrypt: 9, #pkts check: 9
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 9, #pkts comp failed: 0, #pkts Dang failed: 0
    #send errors: 0, #recv errors: 0

    local crypto endpt. : 10.52.120.23, remote Start crypto. : x.x.x.204

    Path mtu 1500, fresh ipsec generals 60, media, mtu 1500
    current outbound SPI: C49EF75F

    SAS of the esp on arrival:
    SPI: 0x21FDBB9D (570276765)
    transform: esp-3des esp-md5-hmac
    running parameters = {L2L, Tunnel}
    slot: 0, id_conn: 1, crypto-map: * _map
    calendar of his: service life remaining (KB/s) key: (3824999/3529)
    Size IV: 8 bytes
    support for replay detection: Y
    outgoing esp sas:
    SPI: 0xC49EF75F (3298752351)
    transform: esp-3des esp-md5-hmac
    running parameters = {L2L, Tunnel}
    slot: 0, id_conn: 1, crypto-map: * _map
    calendar of his: service life remaining (KB/s) key: (3824999/3527)
    Size IV: 8 bytes
    support for replay detection: Y

    From my office on the 10.52.120.0 even the etherenet0/0 interface on the ASA network I get this:

    C:\Users\***>ping 192.52.128.1

    Ping 192.52.128.1 with 32 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 192.52.128.1:
    Packets: Sent = 4, received = 0, lost = 4 (100% loss)

    C:\Users\***>ping 10.52.120.23

    Ping 10.52.120.23 with 32 bytes of data:
    Reply from 10.52.120.23: bytes = 32 time = 5ms TTL = 255
    Reply from 10.52.120.23: bytes = 32 time = 3ms TTL = 255
    Reply from 10.52.120.23: bytes = 32 time = 1ms TTL = 255
    Reply from 10.52.120.23: bytes = 32 time = 1ms TTL = 255

    Ping statistics for 10.52.120.23:
    Packets: Sent = 4, received = 4, lost = 0 (0% loss),
    Time approximate round trip in milli-seconds:
    Minimum = 1ms, Maximum = 5ms, average = 2ms

    Count on VPN Tunnel ACL does not increase when I try to ping the address of the remote gateway.

    Here is the running of the ASA configuration:

    ASA Version 7.0 (2)
    names of
    !
    interface Ethernet0/0
    nameif InsideNetwork
    security-level 100
    IP 10.52.120.23 255.255.255.0
    !
    interface Ethernet0/1
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    Shutdown
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    management only
    !
    activate the encrypted password of XXXXXXXXXXXXXXXX
    passwd encrypted XXXXXXXXXXXXXXXXXXX
    ciscoasa hostname
    domain default.domain.invalid
    passive FTP mode
    permit same-security-traffic intra-interface
    Access extensive list ip 10.52.120.0 InsideNetwork_nat0_outbound allow 255.255.25
    5.0 192.52.128.0 255.255.255.0
    Access extensive list ip 10.52.120.0 InsideNetwork_cryptomap_20 allow 255.255.255
    .0 192.52.128.0 255.255.255.0
    pager lines 24
    asdm of logging of information
    management of MTU 1500
    MTU 1500 InsideNetwork
    management of the interface of the monitor
    the interface of the monitor InsideNetwork
    ASDM image disk0: / asdm - 502.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT (InsideNetwork) 0-list of access InsideNetwork_nat0_outbound
    Route InsideNetwork 0.0.0.0 0.0.0.0 10.52.120.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00
    Timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    Timeout, uauth 0:05:00 absolute
    Enable http server
    http 192.168.1.0 255.255.255.0 management
    http 10.52.120.0 255.255.255.0 InsideNetwork
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    card crypto InsideNetwork_map 20 corresponds to the address InsideNetwork_cryptomap_20
    card crypto InsideNetwork_map 20 set peer x.x.x.204
    InsideNetwork_map 20 transform-set ESP-3DES-MD5 crypto card game
    InsideNetwork_map InsideNetwork crypto map interface
    ISAKMP enable InsideNetwork
    part of pre authentication ISAKMP policy 10
    ISAKMP policy 10 3des encryption
    ISAKMP policy 10 md5 hash
    10 2 ISAKMP policy group
    ISAKMP life duration strategy 10 86400
    Telnet 10.52.120.0 255.255.255.0 InsideNetwork
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    dhcpd lease 3600
    dhcpd ping_timeout 50
    enable dhcpd management
    tunnel-group x.x.x.204 type ipsec-l2l
    x.x.x.204 group of tunnel ipsec-attributes
    pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    Policy-map global_policy
    class inspection_default
    inspect the dns-length maximum 512
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    !
    global service-policy global_policy
    Cryptochecksum:7e478b60b3e406091de466675c52eaaa
    : end

    I haven't added anything to the config except what seemed necessary to get the job of VPN tunnel.  It should be fairly clean.

    Thanks in advance for any help... I really hope that it is something really simple as a recruit ASA just forgot

    Strange, but good news. Thanks for the update. I'm glad everything is working.

    THX

    MS

  • NAT Traversal on site to site VPN pix

    I don't think it's possible to implement NAT traversal between a site to IPSEC VPN using ESP tunnels?

    Our ISP to the remote end will provide only a public IP address and which is attributed to their router...

    Sites are using pre-shared keys and IKE

    for example...

    LAN-PIX1-ISPROUTER-INTERNET-ISPPATROUTER-PIX2-LAN

    I have attached the card encryption for more info

    Thanks in advance...

    I guess that NAT - T is most commonly used in a customer VPN environment, but I'm sure that its not limited to this type of connection.

    I just set up a VPN this morning with the help of a customer on a router running 12.2.15T and tested connection with NAT - T works very well by using IP addresses.

    NAT - T enabled by a NAT detection process, and there is that to protect the ESP of a change should work in both environments.

    I'll have a go in my lab, see if I can implement and check it.

    However by going to the original post, you say that only one address is available from the ISP, it is on the router for pix link?

    Where are the limits of NAT, I expect to be in the PIX, but it must be a public IP address on you interfaces also. You can then use the external address as endpoints IPSec, don't need NAT - T in any case.

  • 2 one-Site VPN Cisco 2801 and with crossing NAT

    Hi guys,.

    I would like to configure two Cisco 2801 using IPSEC/IKE. Both routers are connected to the internet through DSL lines. The DSL line have RFC1918 address side LAN where routers connected to the internet face. I can do NAT on DSL modems.

    Cisco IOS 2801 routers allow to configure site-2-site VPN with NAT crossing?

    Here is a model of physics/IP configuration:

    LAN<->2801 Modem DSL<-Internet->DSL modem<-Priv ip-=""> 2801<-Priv ip-=""><-> LAN

    Thank you

    Gonçalo

    Yes, you're good to go only if one or both of the sites has an IP address which is natted with private IP address statically. The implementation of IPSec on SRI NAT support in most crosses so that shouldn't be a concern

  • Design site to Site VPN w/NAT traversal issue

    Hi, I have a number of site to site VPN that end on a PIX. I intend to migrate these VPN to a router that sits on a demilitarized zone connected to the PIX. Before doing that I'm going to set up a private network new virtual to end on the router but I also need than VPNS that end on the PIX to be not affected.

    If I configure NAT traversal on the PIX, affected my other VPN?

    Thanks in advance

    DOM

    Hi Dom,

    Why do you want to configure NAT-Traversal on PIX, if you wish to terminate your VPN router (which is on the DMZ).

    Do you do any NAT on PIX thru the router?

    If you want to configure NAT-Traversal, it must be configured on the end (on the router in your case) devices.

    Example:

    When a user with Cisco client or Cisco router behind NAT wants to connect to another device (such as PIX, ASA, or router) NAT - T must be configured on the machine (which will be the PIX or ASA)

    Hope that helps.

    * Please indicate the post

  • NAT and Site to site VPN

    Hi all

    We currently have a PIX in our local network. There is a Site to site VPN tunnel between this PIX and another network abroad.

    We have several networks in our local network.

    The VPN tunnel is on a single network: 192.50.175.0 / 24.

    and the network of the other site is:

    192.100.24.0 21

    Part of the configuration:

    inside_nat0_outbound ip 192.50.175.0 access list allow 255.255.255.0 192.100.24.0 255.255.248.0

    NAT (inside) 0-list of access inside_nat0_outbound

    As I said before, we have several networks.

    In particular, we have 192.50.160.0/24 too.

    And we would like that this network can use the VPN tunnel also.

    But the other site does not want to carry our another network in their LAN.

    They suggest we 192.50.160.0 NAT / 24 to an IP address on the 192.50.175.0 / 24, users in a network 192.50.160.0 / 24 can also use the VPN tunnel.

    Do you know if it is possible to do it with my PIX? And how?

    It's a PIX-515-DMZ, v6.3 (5).

    Any help would be appreciated!

    Thank you

    Good point. You can be good then.

  • Site to SIte VPN through a NAT device

    I have, I am having trouble running a vpn site-to site between two 3725 routers running c3725-advsecurityk9-mz124 - 15 T 1, that I hope I can get some help with, I am probably missing something here. The VPN ran very well when both VPN routers were connected directly to the internet and had on WAN interfaces public IP addresses, but I had to move one of the firewall inside on a private IP address. Installation is now as below

    Router VPN one (192.168.248.253) - internal company network - Fortigate FW - internet-(217.155.113.179) router VPN B

    The fortigate FW is doing some translations address
    -traffic between 192.168.248.253 and 217.155.113.179 has its source in 37.205.62.5
    -traffic between 217.155.113.179 and 37.205.62.5 has its destination translated to 192.168.248.253
    -Firewall rules allow all traffic between the 2 devices, no port locking enabled.

    -The 37.205.62.5 address is used by anything else.

    I basically have a GRE tunnel between two routers, and I'm trying to encrypt it.

    The router shows below

    Card crypto SERVER-RTR #show
    "S2S_VPN" 10 ipsec-isakmp crypto map
    Peer = 217.155.113.179
    Expand the access IP 101 list
    access-list 101 permit gre 192.168.248.253 host 217.155.113.179
    Current counterpart: 217.155.113.179
    Life safety association: 4608000 Kbytes / 3600 seconds
    PFS (Y/N): N
    Transform sets = {}
    STRONG,
    }
    Interfaces using crypto card S2S_VPN:
    FastEthernet0/1

    SERVER-RTR #show crypto sessio
    Current state of the session crypto

    Interface: FastEthernet0/1
    The session state: down
    Peer: 217.155.113.179 port 500
    FLOW IPSEC: allowed 47 192.168.248.253 host 217.155.113.179
    Active sAs: 0, origin: card crypto

    Interface: FastEthernet0/1
    The session state: IDLE-UP
    Peer: 217.155.113.179 port 4500
    IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 Active
    IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 inactive
    IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 inactive

    Router B shows below

    Card crypto BSU - RTR #show
    "S2S_VPN" 10 ipsec-isakmp crypto map
    Peer = 37.205.62.5
    Expand the access IP 101 list
    access-list 101 permit gre 217.155.113.179 host 37.205.62.5
    Current counterpart: 37.205.62.5
    Life safety association: 4608000 Kbytes / 3600 seconds
    PFS (Y/N): N
    Transform sets = {}
    STRONG,
    }
    Interfaces using crypto card S2S_VPN:
    FastEthernet0/1

    BSU - RTR #show sess crypto
    Current state of the session crypto

    Interface: FastEthernet0/1
    The session state: down
    Peer: 37.205.62.5 port 500
    FLOW IPSEC: allowed 47 217.155.113.179 host 37.205.62.5
    Active sAs: 0, origin: card crypto

    Interface: FastEthernet0/1
    The session state: IDLE-UP
    Peer: 37.205.62.5 port 4500
    IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 Active
    IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 inactive
    IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 inactive

    I can see counters incrementing on the ACL on both routers, so I don't know the traffic free WILL is interesting.

    Here are a few debugs too
    --------------
    Router

    Debug crypto ISAKMP

    * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node 940426884
    * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node 1837874301
    * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node-475409474
    * 23:07:20.794 Mar 2: ISAKMP (0:0): received 217.155.113.179 packet dport 500 sport 500 SA NEW Global (N)
    * 23:07:20.794 Mar 2: ISAKMP: created a struct peer 217.155.113.179, peer port 500
    * 23:07:20.794 Mar 2: ISAKMP: new position created post = 0x64960C04 peer_handle = 0x80000F0E
    * 23:07:20.794 Mar 2: ISAKMP: lock struct 0x64960C04, refcount 1 to peer crypto_isakmp_process_block
    * 23:07:20.794 Mar 2: ISAKMP: 500 local port, remote port 500
    * 23:07:20.794 Mar 2: ISAKMP: find a dup her to the tree during the isadb_insert his 6464D3F0 = call BVA
    * 23:07:20.794 Mar 2: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.794 Mar 2: ISAKMP: (0): former State = new State IKE_READY = IKE_R_MM1

    * 2 Mar 23:07:20.794: ISAKMP: (0): treatment ITS payload. Message ID = 0
    * 2 Mar 23:07:20.794: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.794: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 245
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T v7
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 157
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v3
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v2
    * 23:07:20.798 Mar 2: ISAKMP: (0): pair found pre-shared key matching 217.155.113.179
    * 2 Mar 23:07:20.798: ISAKMP: (0): pre-shared key local found
    * 23:07:20.798 Mar 2: ISAKMP: analysis of the profiles for xauth...
    * 23:07:20.798 Mar 2: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
    * 23:07:20.798 Mar 2: ISAKMP: DES-CBC encryption
    * 23:07:20.798 Mar 2: ISAKMP: SHA hash
    * 23:07:20.798 Mar 2: ISAKMP: default group 1
    * 23:07:20.798 Mar 2: ISAKMP: pre-shared key auth
    * 23:07:20.798 Mar 2: ISAKMP: type of life in seconds
    * 23:07:20.798 Mar 2: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
    * 23:07:20.798 Mar 2: ISAKMP: (0): atts are acceptable. Next payload is 0
    * 23:07:20.798 Mar 2: ISAKMP: (0): Acceptable atts: real life: 0
    * 23:07:20.798 Mar 2: ISAKMP: (0): Acceptable atts:life: 0
    * 23:07:20.798 Mar 2: ISAKMP: (0): fill atts in his vpi_length:4
    * 23:07:20.798 Mar 2: ISAKMP: (0): fill atts in his life_in_seconds:86400
    * 23:07:20.798 Mar 2: ISAKMP: (0): return real life: 86400
    * 23:07:20.798 Mar 2: ISAKMP: (0): timer life Started: 86400.

    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 245
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T v7
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 157
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v3
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v2
    * 23:07:20.798 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    * 23:07:20.798 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM1

    * 2 Mar 23:07:20.802: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
    * 2 Mar 23:07:20.802: ISAKMP: (0): lot of 217.155.113.179 sending my_port 500 peer_port 500 (R) MM_SA_SETUP
    * 23:07:20.802 Mar 2: ISAKMP: (0): sending a packet IPv4 IKE.
    * 23:07:20.802 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    * 23:07:20.802 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM2

    * 23:07:20.822 Mar 2: ISAKMP (0:0): received 217.155.113.179 packet 500 Global 500 (R) sport dport MM_SA_SETUP
    * 23:07:20.822 Mar 2: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.822 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM2 = IKE_R_MM3

    * 2 Mar 23:07:20.822: ISAKMP: (0): processing KE payload. Message ID = 0
    * 2 Mar 23:07:20.850: ISAKMP: (0): processing NONCE payload. Message ID = 0
    * 23:07:20.854 Mar 2: ISAKMP: (0): pair found pre-shared key matching 217.155.113.179
    * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
    * 2 Mar 23:07:20.854: ISAKMP: (1027): provider ID is the unit
    * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
    * 2 Mar 23:07:20.854: ISAKMP: (1027): provider ID is DPD
    * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
    * 2 Mar 23:07:20.854: ISAKMP: (1027): addressing another box of IOS!
    * 23:07:20.854 Mar 2: ISAKMP: receives the payload type 20
    * 23:07:20.854 Mar 2: ISAKMP (0:1027): NAT found, the node inside the NAT
    * 23:07:20.854 Mar 2: ISAKMP: receives the payload type 20
    * 23:07:20.854 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    * 23:07:20.854 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM3 = IKE_R_MM3

    * 2 Mar 23:07:20.854: ISAKMP: (1027): lot of 217.155.113.179 sending my_port 500 peer_port 500 (R) MM_KEY_EXCH
    * 23:07:20.854 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:20.858 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    * 23:07:20.858 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM3 = IKE_R_MM4

    * 23:07:20.898 Mar 2: ISAKMP: (1024): serving SA., his is 64D5723C, delme is 64D5723C
    * 23:07:20.902 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) MM_KEY_EXCH sport
    * 23:07:20.902 Mar 2: ISAKMP: (1027): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.902 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM4 = IKE_R_MM5

    * 2 Mar 23:07:20.902: ISAKMP: (1027): payload ID for treatment. Message ID = 0
    * 23:07:20.902 Mar 2: ISAKMP (0:1027): payload ID
    next payload: 8
    type: 1
    address: 217.155.113.179
    Protocol: 17
    Port: 0
    Length: 12
    * 2 Mar 23:07:20.902: ISAKMP: (0): peer games * no * profiles
    * 2 Mar 23:07:20.906: ISAKMP: (1027): HASH payload processing. Message ID = 0
    * 2 Mar 23:07:20.906: ISAKMP: (1027): treatment protocol NOTIFIER INITIAL_CONTACT 1
    SPI 0, message ID = 0, a = 6464D3F0
    * 23:07:20.906 Mar 2: ISAKMP: (1027): SA authentication status:
    authenticated
    * 23:07:20.906 Mar 2: ISAKMP: (1027): SA has been authenticated with 217.155.113.179
    * 23:07:20.906 Mar 2: ISAKMP: (1027): port detected floating port = 4500
    * 23:07:20.906 Mar 2: ISAKMP: try to find found and existing peer 192.168.248.253/217.155.113.179/4500/ peer 648EAD00 to reuse existing, free 64960 04
    * 23:07:20.906 Mar 2: ISAKMP: Unlocking counterpart struct 0x64960C04 Reuse existing peer count 0
    * 23:07:20.906 Mar 2: ISAKMP: delete peer node by peer_reap for 217.155.113.179: 64960 04
    * 23:07:20.906 Mar 2: ISAKMP: lock struct 0x648EAD00, refcount 2 for peer peer reuse existing
    * 23:07:20.906 Mar 2: ISAKMP: (1027): SA authentication status:
    authenticated
    * 2 Mar 23:07:20.906: ISAKMP: (1027): process of first contact.
    lowering existing phase 1 and 2 with local 192.168.248.253 217.155.113.179 remote remote port 4500
    * 23:07:20.906 Mar 2: ISAKMP: (1026): received first contact, delete SA
    * 23:07:20.906 Mar 2: ISAKMP: (1026): peer does not paranoid KeepAlive.

    * 23:07:20.906 Mar 2: ISAKMP: (1026): deletion of 'Initial of receive Contact' State HIS reason (R) QM_IDLE (post 217.155.113.179)
    * 23:07:20.906 Mar 2: ISAKMP: (0): cannot decrement IKE Call Admission Control incoming_active stat because he's already 0.
    * 23:07:20.906 Mar 2: ISAKMP: (1027): UDP ENC parameter counterpart struct 0x0 his = 0x6464D3F0
    * 23:07:20.906 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    * 23:07:20.906 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM5 = IKE_R_MM5

    * 23:07:20.910 Mar 2: ISAKMP: node set-98987637 to QM_IDLE
    * 2 Mar 23:07:20.910: ISAKMP: (1026): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
    * 23:07:20.910 Mar 2: ISAKMP: (1026): sending a packet IPv4 IKE.
    * 23:07:20.910 Mar 2: ISAKMP: (1026): purge the node-98987637
    * 23:07:20.910 Mar 2: ISAKMP: (1026): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    * 23:07:20.910 Mar 2: ISAKMP: (1026): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

    * 23:07:20.910 Mar 2: ISAKMP: (1027): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
    * 23:07:20.910 Mar 2: ISAKMP (0:1027): payload ID
    next payload: 8
    type: 1
    address: 192.168.248.253
    Protocol: 17
    Port: 0
    Length: 12
    * 23:07:20.910 Mar 2: ISAKMP: (1027): the total payload length: 12
    * 2 Mar 23:07:20.914: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) MM_KEY_EXCH
    * 23:07:20.914 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:20.914 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    * 23:07:20.914 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

    * 23:07:20.914 Mar 2: ISAKMP: (1026): deletion of 'Initial of receive Contact' State HIS reason (R) QM_IDLE (post 217.155.113.179)
    * 23:07:20.914 Mar 2: ISAKMP: Unlocking counterpart struct 0x648EAD00 for isadb_mark_sa_deleted(), count 1
    * 23:07:20.914 Mar 2: ISAKMP: (1026): error suppression node 334747020 FALSE reason 'IKE deleted.
    * 23:07:20.914 Mar 2: ISAKMP: (1026): node-1580729900 error suppression FALSE reason 'IKE deleted.
    * 23:07:20.914 Mar 2: ISAKMP: (1026): node-893929227 error suppression FALSE reason 'IKE deleted.
    * 23:07:20.914 Mar 2: ISAKMP: (1026): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.914 Mar 2: ISAKMP: (1026): former State = new State IKE_DEST_SA = IKE_DEST_SA

    * 23:07:20.914 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    * 23:07:20.914 Mar 2: ISAKMP: (1027): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    * 23:07:20.930 Mar 2: ISAKMP (0:1026): received 217.155.113.179 packet dport 4500 4500 Global (R) MM_NO_STATE sport
    * 23:07:20.934 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) QM_IDLE sport
    * 23:07:20.934 Mar 2: ISAKMP: node set 1860263019 to QM_IDLE
    * 2 Mar 23:07:20.934: ISAKMP: (1027): HASH payload processing. Message ID = 1860263019
    * 2 Mar 23:07:20.934: ISAKMP: (1027): treatment ITS payload. Message ID = 1860263019
    * 23:07:20.934 Mar 2: ISAKMP: (1027): proposal of IPSec checking 1
    * 23:07:20.934 Mar 2: ISAKMP: turn 1, ESP_AES
    * 23:07:20.934 Mar 2: ISAKMP: attributes of transformation:
    * 23:07:20.934 Mar 2: ISAKMP: program is 3 (Tunnel-UDP)
    * 23:07:20.934 Mar 2: ISAKMP: type of life in seconds
    * 23:07:20.934 Mar 2: ISAKMP: life of HIS (basic) 3600
    * 23:07:20.934 Mar 2: ISAKMP: type of life in kilobytes
    * 23:07:20.934 Mar 2: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
    * 23:07:20.934 Mar 2: ISAKMP: key length is 128
    * 23:07:20.934 Mar 2: ISAKMP: (1027): atts are acceptable.
    * 2 Mar 23:07:20.934: ISAKMP: (1027): IPSec policy invalidated proposal with error 32
    * 2 Mar 23:07:20.934: ISAKMP: (1027): politics of ITS phase 2 is not acceptable! (local 192.168.248.253 remote 217.155.113.179)
    * 23:07:20.938 Mar 2: ISAKMP: node set 1961554007 to QM_IDLE
    * 23:07:20.938 Mar 2: ISAKMP: (1027): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 1688526152, message ID = 1961554007
    * 2 Mar 23:07:20.938: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
    * 23:07:20.938 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:20.938 Mar 2: ISAKMP: (1027): purge the node 1961554007
    * 23:07:20.938 Mar 2: ISAKMP: (1027): error suppression node 1860263019 REAL reason "QM rejected."
    * 23:07:20.938 Mar 2: ISAKMP: (1027): entrance, node 1860263019 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    * 23:07:20.938 Mar 2: ISAKMP: (1027): former State = new State IKE_QM_READY = IKE_QM_READY
    * 23:07:24.510 Mar 2: ISAKMP: set new node 0 to QM_IDLE
    * 2 Mar 23:07:24.510: ITS a exceptional applications (100.100.213.56 local port 4500, 100.100.213.84 remote port 4500)
    * 2 Mar 23:07:24.510: ISAKMP: (1027): sitting IDLE. From QM immediately (QM_IDLE)
    * 23:07:24.510 Mar 2: ISAKMP: (1027): start Quick Mode Exchange, M - ID 670698820
    * 23:07:24.510 Mar 2: ISAKMP: (1027): initiator QM gets spi
    * 2 Mar 23:07:24.510: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
    * 23:07:24.510 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:24.514 Mar 2: ISAKMP: (1027): entrance, node 670698820 = IKE_MESG_INTERNAL, IKE_INIT_QM
    * 23:07:24.514 Mar 2: ISAKMP: (1027): former State = new State IKE_QM_READY = IKE_QM_I_QM1
    * 23:07:24.530 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) QM_IDLE sport
    * 23:07:24.534 Mar 2: ISAKMP: node set 1318257670 to QM_IDLE
    * 2 Mar 23:07:24.534: ISAKMP: (1027): HASH payload processing. Message ID = 1318257670
    * 2 Mar 23:07:24.534: ISAKMP: (1027): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 3268378219, message ID = 1318257670, a = 6464D3F0
    * 2 Mar 23:07:24.534: ISAKMP: (1027): removal of spi 3268378219 message ID = 670698820
    * 23:07:24.534 Mar 2: ISAKMP: (1027): node 670698820 REAL reason error suppression "remove larval.
    * 23:07:24.534 Mar 2: ISAKMP: (1027): error suppression node 1318257670 FALSE reason 'informational (en) State 1.
    * 23:07:24.534 Mar 2: ISAKMP: (1027): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    * 23:07:24.534 Mar 2: ISAKMP: (1027): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-238086324
    * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-1899972726
    * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-321906720

    Router B
    ----------
    Debug crypto ISAKMP

    1d23h: ISAKMP: (0): profile of THE request is (NULL)
    1d23h: ISAKMP: created a struct peer 37.205.62.5, peer port 500
    1d23h: ISAKMP: new position created post = 0x652C3B54 peer_handle = 0x80000D8C
    1d23h: ISAKMP: lock struct 0x652C3B54, refcount 1 to peer isakmp_initiator
    1d23h: ISAKMP: 500 local port, remote port 500
    1d23h: ISAKMP: set new node 0 to QM_IDLE
    1d23h: ISAKMP: find a dup her to the tree during the isadb_insert his 652CBDC4 = call BVA
    1d23h: ISAKMP: (0): cannot start aggressive mode, try the main mode.
    1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
    1d23h: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
    1d23h: ISAKMP: (0): built the seller-07 ID NAT - t
    1d23h: ISAKMP: (0): built of NAT - T of the seller-03 ID
    1d23h: ISAKMP: (0): built the seller-02 ID NAT - t
    1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    1d23h: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

    1d23h: ISAKMP: (0): Beginner Main Mode Exchange
    1d23h: ISAKMP: (0): lot of 37.205.62.5 sending my_port 500 peer_port 500 (I) MM_NO_STATE
    1d23h: ISAKMP: (0): sending a packet IPv4 IKE.
    1d23h: ISAKMP (0:0): received 37.205.62.5 packet dport 500 sport Global 500 (I) MM_NO_STATE
    1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

    1d23h: ISAKMP: (0): treatment ITS payload. Message ID = 0
    1d23h: ISAKMP: (0): load useful vendor id of treatment
    1d23h: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    1d23h: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
    1d23h: ISAKMP: (0): pre-shared key local found
    1d23h: ISAKMP: analysis of the profiles for xauth...
    1d23h: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
    1d23h: ISAKMP: DES-CBC encryption
    1d23h: ISAKMP: SHA hash
    1d23h: ISAKMP: default group 1
    1d23h: ISAKMP: pre-shared key auth
    1d23h: ISAKMP: type of life in seconds
    1d23h: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
    1d23h: ISAKMP: (0): atts are acceptable. Next payload is 0
    1d23h: ISAKMP: (0): Acceptable atts: real life: 0
    1d23h: ISAKMP: (0): Acceptable atts:life: 0
    1d23h: ISAKMP: (0): fill atts in his vpi_length:4
    1d23h: ISAKMP: (0): fill atts in his life_in_seconds:86400
    1d23h: ISAKMP: (0): return real life: 86400
    1d23h: ISAKMP: (0): timer life Started: 86400.

    1d23h: ISAKMP: (0): load useful vendor id of treatment
    1d23h: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    1d23h: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    1d23h: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

    1d23h: ISAKMP: (0): lot of 37.205.62.5 sending my_port 500 peer_port 500 (I) MM_SA_SETUP
    1d23h: ISAKMP: (0): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

    1d23h: ISAKMP (0:0): received 37.205.62.5 packet dport 500 sport Global 500 (I) MM_SA_SETUP
    1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

    1d23h: ISAKMP: (0): processing KE payload. Message ID = 0
    1d23h: ISAKMP: (0): processing NONCE payload. Message ID = 0
    1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
    1d23h: ISAKMP: (1034): load useful vendor id of treatment
    1d23h: ISAKMP: (1034): provider ID is the unit
    1d23h: ISAKMP: (1034): load useful vendor id of treatment
    1d23h: ISAKMP: (1034): provider ID is DPD
    1d23h: ISAKMP: (1034): load useful vendor id of treatment
    1d23h: ISAKMP: (1034): addressing another box of IOS!
    1d23h: ISAKMP: receives the payload type 20
    1d23h: ISAKMP: receives the payload type 20
    1d23h: ISAKMP (0:1034): NAT found, the node outside NAT
    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM4 = IKE_I_MM4

    1d23h: ISAKMP: (1034): send initial contact
    1d23h: ISAKMP: (1034): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
    1d23h: ISAKMP (0:1034): payload ID
    next payload: 8
    type: 1
    address: 217.155.113.179
    Protocol: 17
    Port: 0
    Length: 12
    1d23h: ISAKMP: (1034): the total payload length: 12
    1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) MM_KEY_EXCH
    1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM4 = IKE_I_MM5

    1d23h: ISAKMP: (1031): serving SA., his is 652D60C8, delme is 652D60C8
    1d23h: ISAKMP (0:1033): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
    1d23h: ISAKMP: node set 33481563 to QM_IDLE
    1d23h: ISAKMP: (1033): HASH payload processing. Message ID = 33481563
    1d23h: ISAKMP: receives the payload type 18
    1d23h: ISAKMP: (1033): treatment remove with load useful reason
    1d23h: ISAKMP: (1033): remove the doi = 1
    1d23h: ISAKMP: (1033): remove Protocol id = 1
    1d23h: ISAKMP: (1033): remove spi_size = 16
    1d23h: ISAKMP: (1033): remove the spis num = 1
    1d23h: ISAKMP: (1033): delete_reason = 11
    1d23h: ISAKMP: (1033): load DELETE_WITH_REASON, processing of message ID = 33481563, reason: Unknown delete reason!
    1d23h: ISAKMP: (1033): peer does not paranoid KeepAlive.

    1d23h: ISAKMP: (1033): deletion of 'Initial of receive Contact' State HIS reason (I) QM_IDLE (post 37.205.62.5)
    1d23h: ISAKMP: (1033): error suppression node 33481563 FALSE reason 'informational (en) State 1.
    1d23h: ISAKMP: node set 1618266182 to QM_IDLE
    1d23h: ISAKMP: (1033): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
    1d23h: ISAKMP: (1033): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1033): purge the node 1618266182
    1d23h: ISAKMP: (1033): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    1d23h: ISAKMP: (1033): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

    1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) MM_KEY_EXCH
    1d23h: ISAKMP: (1034): payload ID for treatment. Message ID = 0
    1d23h: ISAKMP (0:1034): payload ID
    next payload: 8
    type: 1
    address: 192.168.248.253
    Protocol: 17
    Port: 0
    Length: 12
    1d23h: ISAKMP: (0): peer games * no * profiles
    1d23h: ISAKMP: (1034): HASH payload processing. Message ID = 0
    1d23h: ISAKMP: (1034): SA authentication status:
    authenticated
    1d23h: ISAKMP: (1034): SA has been authenticated with 37.205.62.5
    1d23h: ISAKMP: try to insert a 217.155.113.179/37.205.62.5/4500/ peer and found existing in a 643BCA10 to reuse, free 652C3B54
    1d23h: ISAKMP: Unlocking counterpart struct 0x652C3B54 Reuse existing peer count 0
    1d23h: ISAKMP: delete peer node by peer_reap for 37.205.62.5: 652C3B54
    1d23h: ISAKMP: lock struct 0x643BCA10, refcount 2 for peer peer reuse existing
    1d23h: ISAKMP: (1034): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM5 = IKE_I_MM6

    1d23h: ISAKMP: (1033): deletion of 'Initial of receive Contact' State HIS reason (I) QM_IDLE (post 37.205.62.5)
    1d23h: ISAKMP: (0): cannot decrement IKE Call Admission Control outgoing_active stat because he's already 0.
    1d23h: ISAKMP: Unlocking counterpart struct 0x643BCA10 for isadb_mark_sa_deleted(), count 1
    1d23h: ISAKMP: (1033): error suppression node 1267924911 FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): error suppression node 1074093103 FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): node-183194519 error suppression FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): error suppression node 33481563 FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (1033): former State = new State IKE_DEST_SA = IKE_DEST_SA

    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM6 = IKE_I_MM6

    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

    1d23h: ISAKMP: (1034): start Quick Mode Exchange, M - ID 1297417008
    1d23h: ISAKMP: (1034): initiator QM gets spi
    1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
    1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1034): entrance, node 1297417008 = IKE_MESG_INTERNAL, IKE_INIT_QM
    1d23h: ISAKMP: (1034): former State = new State IKE_QM_READY = IKE_QM_I_QM1
    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    1d23h: ISAKMP: (1034): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
    1d23h: ISAKMP: node set-874376893 to QM_IDLE
    1d23h: ISAKMP: (1034): HASH payload processing. Message ID =-874376893
    1d23h: ISAKMP: (1034): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 56853244, message ID =-874376893, his 652CBDC4 =
    1d23h: ISAKMP: (1034): removal of spi 56853244 message ID = 1297417008
    1d23h: ISAKMP: (1034): node 1297417008 REAL reason error suppression "remove larval.
    1d23h: ISAKMP: (1034): node-874376893 error suppression FALSE reason 'informational (en) State 1.
    1d23h: ISAKMP: (1034): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    1d23h: ISAKMP: (1034): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
    1d23h: ISAKMP: node set 439453045 to QM_IDLE
    1d23h: ISAKMP: (1034): HASH payload processing. Message ID = 439453045
    1d23h: ISAKMP: (1034): treatment ITS payload. Message ID = 439453045
    1d23h: ISAKMP: (1034): proposal of IPSec checking 1
    1d23h: ISAKMP: turn 1, ESP_AES
    1d23h: ISAKMP: attributes of transformation:
    1d23h: ISAKMP: program is 3 (Tunnel-UDP)
    1d23h: ISAKMP: type of life in seconds
    1d23h: ISAKMP: life of HIS (basic) 3600
    1d23h: ISAKMP: type of life in kilobytes
    1d23h: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
    1d23h: ISAKMP: key length is 128
    1d23h: ISAKMP: (1034): atts are acceptable.
    1d23h: ISAKMP: (1034): IPSec policy invalidated proposal with error 32
    1d23h: ISAKMP: (1034): politics of ITS phase 2 is not acceptable! (local 217.155.113.179 remote 37.205.62.5)
    1d23h: ISAKMP: node set 1494356901 to QM_IDLE
    1d23h: ISAKMP: (1034): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 1687353736, message ID = 1494356901
    1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
    1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1034): purge the node 1494356901
    1d23h: ISAKMP: (1034): error suppression node 439453045 REAL reason "QM rejected."
    1d23h: ISAKMP: (1034): entrance, node 439453045 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    1d23h: ISAKMP: (1034): former State = new State IKE_QM_READY = IKE_QM_READY
    1d23h: ISAKMP: (1032): purge the node 1513722556
    1d23h: ISAKMP: (1032): purge the node-643121396
    1d23h: ISAKMP: (1032): purge the node 1350014243
    1d23h: ISAKMP: (1032): purge the node 83247347

    Hi Nav,

    I'm happy it's working now. Your interpretation is correct. Transport mode IPSEC encrypts the payload, while tunnel mode figure the whole ip packet (original header / payload) and inserts a new ip header. Thus, the tunnel mode is used for ipsec site to site VPN and transport is used for point to point VPN ipsec. GRE is used with ipsec, all packages will be encapsulated with a GRE header first, so, essentially, this is a point to point VPN ipsec.

    The problem that you are having with tunnel mode, the router's package is going to be wrapped with the header 192.168.248.253 GRE source 217.155.113.179 destination. The whole package is then encrypted and a new header is added with the same source/destination. This new header will be coordinated by the FW, but not incorporated or encrypted GRE header. When the packet arrives at Router B, after decrypt them the package, router B will see the GRE header, which is different from that of source/destination tunnel she uses. This breaks the GRE tunnel and the routing between router A and router B Protocol.

    HTH,

    Lei Tian

  • Site to Site VPN NAT conflicts

    I have a site to site vpn between my main office and an office.  Traffic between flow correctly with the exception of some protocols.  My main router has static NAT configured for port 25 and a few others.  For each of these protocols that have a static nat, I can't send the traffic from my office to the IP in the static nat

    either I can't access port 25 on 172.16.1.1 of my office of the branch of the 172.17.1.1, but I have remote desktop access

    It's like my list of NAT is excluding the static entries that follow.  I have posted below the configs.  Any help would be appreciated.

    Main office: 2811

    Branch: 1841

    Two routers connected to the internet.  VPN site to Site between them with the following config

    crypto ISAKMP policy 1

    BA 3des

    md5 hash

    preshared authentication

    Group 2

    isakmp encryption key * address *. ***. * *.116

    !

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac VPN - TS

    !

    map VPN-map 10 ipsec-isakmp crypto

    set peer *. ***. * *.116

    game of transformation-VPN-TS

    match address VPN-TRAFFIC

    I have two IP addresses on the router principal.122 et.123

    There is an installer from the list of the deny on the two routers - that's the main:

    overload of IP nat inside source list 100 interface FastEthernet0/0

    access-list 100 remark = [Service NAT] =-

    access-list 100 deny ip 172.16.0.0 0.0.255.255 172.17.0.0 0.0.255.255

    access-list 100 permit ip 172.16.0.0 0.0.255.255 everything

    access-list 100 permit ip 172.24.0.0 0.0.255.255 everything

    To serve clients vpn no internet, the following nat is configured to send e-mail to exchamge

    IP nat inside source static tcp 172.16.1.1 25 *. ***. * expandable 25 *.122

    Try to use the nat policy to exclude traffic from your servers to be natted when switching to the branch office network.

    Sth like this

    STATIC_NAT extended IP access list

    deny ip 172.16.1.1 host 172.17.1.0 255.255.255.0 aka nat0 for traffic from the server

    allow the ip 172.16.1.1 host a

    policy-NAT route map

    corresponds to the IP STATIC_NAT

    IP nat inside source static tcp 172.16.1.1 25 *. ***. 25-card *.122 of extensible policy-NAT route

  • Site to Site VPN of IOS - impossible route after VPN + NAT

    Hello

    I have problems with a VPN on 2 routers access 8xx: I am trying to set up a quick and dirty VPN Site to Site with a source NAT VPN tunnel endpoint. This configuration is only intended to run from one day only inter. I managed to do the work of VPN and I traced the translations of NAT VPN tunnel endpoint, but I couldn't make these translated packages which must move outside the access router, because intended to be VPN traffic network is not directly connected to leave the router. However, I can ping the hosts directly connected to the router for access through the VPN.

    Something done routing not to work, I don't think the NATing, because I tried to remove the NAT and I couldn't follow all outgoing packets that must be sent, so I suspect this feature is not included in the IOS of the range of routers Cisco 8xx.

    I'm that extends the features VPN + NAT + routing too, or is there a configuration error in my setup?

    This is the configuration on the router from Cisco 8xx (I provided only the VPN endpoint, as the works of VPN endpoint)

    VPN endpoints: 10.20.1.2 and 10.10.1.2

    routing to 192.168.2.0 is necessary to 192.168.1.2 to 192.168.1.254

    From 172.31.0.x to 192.168.1.x

    !

    version 12.4

    no service button

    horodateurs service debug datetime msec

    Log service timestamps datetime msec

    encryption password service

    !

    hostname INSIDEVPN

    !

    boot-start-marker

    boot-end-marker

    !

    enable secret 5 xxxxxxxxxxxxxxx

    !

    No aaa new-model

    !

    !

    dot11 syslog

    no ip cef

    !

    !

    !

    !

    IP domain name xxxx.xxxx

    !

    Authenticated MultiLink bundle-name Panel

    !

    !

    username root password 7 xxxxxxxxxxxxxx

    !

    !

    crypto ISAKMP policy 10

    BA 3des

    preshared authentication

    ISAKMP crypto key address 10.20.1.2 xxxxxxxxxxxxx

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac VPN-TRANSFORMATIONS

    !

    CRYPTOMAP 10 ipsec-isakmp crypto map

    defined by peer 10.20.1.2

    game of transformation-VPN-TRANSFORMATIONS

    match address 100

    !

    Archives

    The config log

    hidekeys

    !

    !

    LAN controller 0

    line-run cpe

    !

    !

    !

    !

    interface BRI0

    no ip address

    encapsulation hdlc

    Shutdown

    !

    interface FastEthernet0

    switchport access vlan 12

    No cdp enable

    card crypto CRYPTOMAP

    !

    interface FastEthernet1

    switchport access vlan 2

    No cdp enable

    !

    interface FastEthernet2

    switchport access vlan 2

    No cdp enable

    !

    interface FastEthernet3

    switchport access vlan 2

    No cdp enable

    !

    interface Vlan1

    no ip address

    !

    interface Vlan2

    IP 192.168.1.1 255.255.255.248

    NAT outside IP

    IP virtual-reassembly

    !

    interface Vlan12

    10.10.1.2 IP address 255.255.255.0

    IP nat inside

    IP virtual-reassembly

    card crypto CRYPTOMAP

    !

    IP forward-Protocol ND

    IP route 192.168.2.0 255.255.255.0 192.168.1.254

    IP route 10.20.0.0 255.255.0.0 10.10.1.254

    Route IP 172.31.0.0 255.255.0.0 Vlan12

    !

    !

    no ip address of the http server

    no ip http secure server

    IP nat inside source static 172.31.0.2 192.168.1.11

    IP nat inside source 172.31.0.3 static 192.168.1.12

    !

    access-list 100 permit ip 192.168.1.0 0.0.0.255 172.31.0.0 0.0.255.255

    access-list 100 permit ip 192.168.2.0 0.0.0.255 172.31.0.0 0.0.255.255

    !

    !

    control plan

    !

    !

    Line con 0

    no activation of the modem

    line to 0

    line vty 0 4

    password 7 xxxxxxxxx

    opening of session

    !

    max-task-time 5000 Planner

    end

    Hi Jürgen,

    First of all, when I went through your config, I saw these lines,

    !

    interface Vlan2

    IP 192.168.1.1 255.255.255.248

    !

    !

    IP route 192.168.2.0 255.255.255.0 192.168.1.254

    !

    With 255.255.255.248 192.168.1.1 and 192.168.1.254 subnet will fall to different subnets. So I don't think you can join 192.168.2.0/24 subnet to the local router at this point. I think you should fix that first.

    Maybe have 192.168.1.2 255.255.255. 248 on the router connected (instead of 192.168.1.254)

    Once this has been done. We will have to look at routing.

    You are 172.31.0.2-> 192.168.1.11 natting


    Now, in order for that to work, make sure that a source addresses (192.168.1.11) NAT is outside the subnet router to router connected (if you go with 192.168.1.0/29 subnet router to router, with 192.168.1.1/29 on the local router and 192.168.1.2/29 on the connected router as suggested, it will be fine). So in this case 192.168.1.8/29 to the subnet that your NAT would be sources fall.

    Have a static route on the router connected (192.168.1.2) for the network 192.168.1.8/29 pointing 192.168.1.1,

    !

    IP route 192.168.1.8 255.255.255.248 192.168.1.1

    !

    If return packets will be correctly routed toward our local router.

    If you have an interface on the connected rotuer which includes the NAT would be source address range, let's say 192.168.1.254/24, even if you do your packages reach somehow 192.168.2.0/24, the package return never goes to the local router (192.168.1.1) because the connected router sees it as a connected subnet, so it will only expire

    I hope I understood your scenario. Pleae make changes and let me know how you went with it.

    Also, please don't forget to rate this post so useful.

    Shamal

  • Site to Site VPN tunnel is not come between 2 routers

    Dear all,

    I have 2 routers for branch which is configured for VPN site-to-site, but the tunnel does not come!

    I ran debug and I enclose herwith output for your kind review and recommendation. I also enclose here the 2 routers configs branch.

    Any idea on why the Site to site VPN is not coming?

    Kind regards

    Haitham

    You guessed it!

    Just because you have re-used the same card encryption for LAN to LAN and vpn-client traffic.

    This from the DOC CD

    No.-xauth

    (Optional) Use this keyword if the router to router IP Security (IPSec) is on the same card encryption as a virtual private network (VPN) - client - to-Cisco-IOS IPSec. This keyword prevents the router causing the peer for the information of extended authentication (Xauth) (username and password).

  • set up a vpn site-to-site on ASA5520 and use NAt

    I have to configure a site to site VPN, the vpn is already at work. but some business leaders don't like how its done, because a subnets of the peer is 10.*. *. * and he allied himself with my private subnet (10.*. *. *), then they want me nat my subnet. The moment of site to site vpn is set up with the 10.X.X.X and peer (4.4.X.X)

    Is that what someone has done this before?

    Priscilla,

    It is a common practice when he rides local networks when you do the L2L VPN, it's called policy NAT, where either end NAT their internal IPscheme in their policy of tunnel, here is a link with a sample policy NAT in the L2L VPN.

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9950.shtml

    HTH

    -Jorge

  • Order of operations NAT on Site to Site VPN Cisco ASA

    Hello

    I have a question about the order of operations NAT on Site to Site VPN Cisco ASA 8.2.x. I have a scenario where the internal IP address of the range 10.17.128.x are NATTED IP public 31.10.10.x. below is the config:

    Tunnel normally passes traffic to dmz - 31.10.11.10, 31.10.11.11 servers.

    But the servers NATTED (10.17.128.x <->31.10.10.x) does not work.

    inside_map crypto 50 card value transform-set ESP-3DES-SHA

    tunnel-group 100.1.1.1 type ipsec-l2l

    tunnel-group 100.1.1.1 General-attributes

    Group Policy - by default-PHX_HK

    IPSec-attributes tunnel-group 100.1.1.1

    pre-shared key *.

    internal PHX_HK group policy

    PHX_HK group policy attributes

    VPN-filter no

    Protocol-tunnel-VPN IPSec svc webvpn

    card crypto inside_map 50 match address outside_cryptomap_50

    peer set card crypto inside_map 50 100.1.1.1

    inside_map crypto 50 card value transform-set ESP-3DES-SHA

    inside_map crypto 50 card value reverse-road

    the PHX_Local object-group network

    host of the object-Network 31.10.11.10

    host of the object-Network 31.10.11.11

    host of the object-Network 31.10.10.10

    host of the object-Network 31.10.10.11

    host of the object-Network 31.10.10.12

    host of the object-Network 31.10.10.13

    host of the object-Network 10.17.128.20

    host of the object-Network 10.17.128.21

    host of the object-Network 10.17.128.22

    host of the object-Network 10.17.128.23

    the HK_Remote object-group network

    host of the object-Network 102.1.1.10

    inside_nat0_outbound list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

    ACL_INSIDE list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

    ACL_OUTSIDE list extended access permitted ip object-group HK_Remote-group of objects PHX_Local

    outside_cryptomap_50 list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

    Route outside 102.1.1.10 255.255.255.255 30.1.1.1 1

    public static 31.10.10.10 (Interior, exterior) 10.17.128.20 netmask 255.255.255.255

    public static 31.10.10.11 (Interior, exterior) 10.17.128.21 netmask 255.255.255.255

    public static 31.10.10.12 (Interior, exterior) 10.17.128.22 netmask 255.255.255.255

    public static 31.10.10.13 (Interior, exterior) 10.17.128.23 netmask 255.255.255.255

    He started to work when I did another group of object by name PHX_Local1 and added to the list of access inside_nat0_outbound, instead of the object group PHX_Local, as below:

    the PHX_Local1 object-group network

    host of the object-Network 31.10.10.10

    host of the object-Network 31.10.10.11

    host of the object-Network 31.10.10.12

    host of the object-Network 31.10.10.13

    No inside_nat0_outbound access list extended only to allowed ip object-group PHX_Local-group of objects HK_Remote

    inside_nat0_outbound list extended access permitted ip object-group PHX_Local1-group of objects HK_Remote

    Can you please help me understand why group object PHX_Local failed with access-list inside_nat0_outbound, but he began to work with the Group of objects PHX_Local1.

    Also, if you could tell me the order of operations to NAT via VPN Site to Site, it would be useful.

    Thank you

    Kind regards

    Thomas

    Hello

    I think you could have said the original question in a way that could be missleading. In other words, if I understand now.

    From what I understand now, you have the DMZ set up the server that are measured with a public IP address on the real servers. And for those that you have configured NAT0.

    Then you have other servers that do not have public IP addresses themselves, but they are translated on the SAA.

    If this is the case, then the next question would be. The server with the NAT should attend the L2L VPN connection with their real IP or address IP NAT.

    Of course if you configure static NAT for the same servers and NAT0 the NAT0 will always win.

    You have these guests who were not able to use the VPN L2L

    31.10.10.10 10.17.128.20

    31.10.10.11 10.17.128.21

    31.10.10.12 10.17.128.22

    31.10.10.13 10.17.128.23

    IF you want them to go to the VPN L2L with their original IP address then you must configure

    object-group, LAN

    host of the object-Network 10.17.128.20

    host of the object-Network 10.17.128.21

    host of the object-Network 10.17.128.22

    host of the object-Network 10.17.128.23

    object-group, REMOTE network

    host of the object-Network 102.1.1.10

    inside_nat0_outbound list extended access allowed ip-group of objects LOCAL object-group remote

    outside_cryptomap_50 list extended access allowed ip-group of objects LOCAL object-group remote

    IF you want to use the L2L VPN with the public IP address, then you must configure

    object-group, LAN

    host of the object-Network 31.10.10.10

    host of the object-Network 31.10.10.11

    host of the object-Network 31.10.10.12

    host of the object-Network 31.10.10.13

    object-group, REMOTE network

    host of the object-Network 102.1.1.10

    outside_cryptomap_50 list extended access allowed ip-group of objects LOCAL object-group remote

    EDIT: in this case you naturally do not configure any NAT0 for actual IP addresses we want precisely the IP addresses to be visible to the L2L VPN with the IP NAT address.

    Or you can of course use the same "object-group" as currently but change the content in an appropriate manner

    Be sure to mark it as answered if it was answered.

    Ask more if necessary

    -Jouni

  • Site to Site VPN IPsec IPv6 on issue of routers-Tunnel

    Hi, I am experiencing a problem can any one address the question below and let me know the solution. I have two routers and try to build "Site to Site VPN IPsec IPv6". I followed orders from Cisco and community document but when I apply my profile of ipsec for tunnel interfaces, that the tunnel is down.

    https://supportforums.Cisco.com/docs/doc-27009

    Ali,

    VTI tunnels are meant to be broken when there is no active negotiated spinnakers.

    The tunnel will go towards up/face upwards when there is a means of transport of packages - i.e. the SPIs are present.

    You can control the order spinnakers 'show peer's crypto ipsec '.

    For debugging:

    Debug crypto isa

    Debug crypto ipsec

    M.

Maybe you are looking for

  • Satellite L350-171: Question about the Draft N card WiFi Intel 5100

    Recently traded this machine after having fun with a P300.My question is this; under the properties of the 5100 in Device Manager, there is an option to activate the project-n, but does not have an option to select draft n in wireless mode. Project-n

  • meet specific loop indices for

    Hi guys,. I have a loop with N = 60, I'm doing something when the specific index (i) reachs number, the index I'm interested in are 1, 5, 9,13, 17, 22, 26, 30,34,38,43,47,51,55,59 the difference is 4 in some of them, but it turns into 5 @ 22 and 43 a

  • Is Version 1 available Utility Setup WPSM54G any where?

    Anyone know where I can download the Version 1 of the configuration for the WPSM54G Print Server utility?  Version 1.1 available on Linksys website does not work with the version of the firmware 1017.  I cannot locate my original CD and prefer do not

  • Unreadable E Mails just a jumble of letters and numbers

    A few emails and attatchments are unreadable just a jumble of letters and numbers of any suggestions as to why this is happening to a few emails and how I can fix this annoying problem.  Thank you

  • Unable to boot to the desktop does not work auto repair

    I recently updated my windows 7 to windows 8 and now the PC is stuck in a loop of auto repair of windows 8. The PC does not the same page and there is no way to start the PC in safe mode (as you can when you get a virus). The repair just doesn't work