Telnet in the Tunnel

Similar Questions

• S2S VPN - cannot get the tunnel upward

  I couldn't lift a VPN site-to site because of a configuration error that I can't fix

  The topology is Server1 > Hub > ASA - 1 ASA-2<><>

  When I launch a ping server 1 Server 2 to try to get out of the tunnel to the top, I get the following error:

  % ASA-6-110002: unable to locate the output for ICMP inside:192.168.100.2/2655 to 192.168.200.2/0 interface

  No matter which side I am ping, I get the error on both of the ASA. Here is the config for the two ASA, thanks for any help.

  !
  ASA-1 hostname
  !
  interface GigabitEthernet0
  nameif outside
  security-level 0
  IP 80.1.1.1 255.255.255.252
  !
  interface GigabitEthernet1
  nameif inside
  security-level 100
  IP 192.168.100.1 address 255.255.255.0
  !
  passive FTP mode
  network of the PC_LAN object
  255.255.255.0 subnet 192.168.100.0
  network of the REMOTE_LAN object
  192.168.200.0 subnet 255.255.255.0
  extended access list ACL-OUTSIDE-PING icmp permitted any one
  LAB_S2S_VPN to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.200.0 255.255.255.0 connect
  LAB_S2S_VPN list extended access allow icmp 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0 connect
  pager lines 24
  Enable logging
  exploitation forest-size of the buffer of 6000
  debug logging in buffered memory
  Outside 1500 MTU
  Within 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any inside
  ARP timeout 14400
  NAT static PC_LAN PC_LAN destination (indoor, outdoor) static source REMOTE_LAN REMOTE_LAN
  Access-Group ACL-OUTSIDE-PING to the interface inside
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec transform-set ikev1 aes-esp - SHA-AES-ESP esp-sha-hmac
  card crypto VPN_CRYPTO_MAP 1 corresponds to the address LAB_S2S_VPN
  card crypto VPN_CRYPTO_MAP 1 set peer 80.1.1.2
  card crypto VPN_CRYPTO_MAP 1 set transform-set ESP-AES-SHA ikev1
  VPN_CRYPTO_MAP interface card crypto outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  management-access inside
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  tunnel-group 80.1.1.2 type ipsec-l2l
  IPSec-attributes tunnel-group 80.1.1.2
  IKEv1 pre-shared-key *.

  ASA-2 host name
  !
  interface GigabitEthernet0
  nameif outside
  security-level 0
  IP 80.1.1.2 255.255.255.252
  !
  interface GigabitEthernet1
  nameif inside
  security-level 100
  192.168.200.1 IP address 255.255.255.0
  !
  interface GigabitEthernet2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  passive FTP mode
  network of the PC_LAN object
  192.168.200.0 subnet 255.255.255.0
  network of the REMOTE_LAN object
  255.255.255.0 subnet 192.168.100.0
  extended access list ACL-OUTSIDE-PING icmp permitted any one
  LAB_S2S_VPN to access extended list ip 192.168.200.0 allow 255.255.255.0 192.168.100.0 255.255.255.0 connect
  LAB_S2S_VPN list extended access allow icmp 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0 connect
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  NAT static REMOTE_LAN REMOTE_LAN destination (indoor, outdoor) static source PC_LAN PC_LAN
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec transform-set ikev1 aes-esp - SHA-AES-ESP esp-sha-hmac
  card crypto VPN_CRYPTO_MAP 1 corresponds to the address LAB_S2S_VPN
  card crypto VPN_CRYPTO_MAP 1 set peer 80.1.1.1
  card crypto VPN_CRYPTO_MAP 1 set transform-set ESP-AES-SHA ikev1
  VPN_CRYPTO_MAP interface card crypto outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  tunnel-group 80.1.1.1 type ipsec-l2l
  IPSec-attributes tunnel-group 80.1.1.1
  IKEv1 pre-shared-key *.
  !

  You won't have a road to 192.168.200.2 so he was not able to locate the next hop for the traffic of the tunnel.

  These static routes adding causes all traffic to be sent to the default gateway of the internet, including VPN and VPN traffic not.
  So adding a route for 192.168.200.0 pointing to 80.1.1.X gave the same results.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Return VPN traffic flows do not on the tunnel

  Hello.

  I tried to find something on the internet for this problem, but am fails miserably. I guess I don't really understand how the cisco decides on the road.

  In any case, I have a Cisco 837 which I use for internet access and to which I would like to be able to complete a VPN on. When I vpn (using vpnc in a Solaris box as it happens which is connected to the cisco ethernet interface), I can establish a VPN and when I ping a host on the inside, I see this package ping happen, however, the return package, the cisco 837 is trying to send via the public internet facing interface Dialer1 without encryption. I can't work for the life of me why.

  (Also note: I can also establish a tunnel to the public internet, but again, I don't can not all traffic through the tunnel.) I guess I'm having the same problem, IE back of packages are not going where it should be, but I do know that for some, on the host being ping well, I can see the ping arriving packets and the host responds with a response to ICMP echo).

  Here is the version of cisco:

  version ADSL #show
  Cisco IOS software, software C850 (C850-ADVSECURITYK9-M), Version 12.4 (15) T5, VERSION of the SOFTWARE (fc4)
  Technical support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2008 by Cisco Systems, Inc.
  Updated Friday 1 May 08 02:07 by prod_rel_team

  ROM: System Bootstrap, Version 12.3 (8r) YI4, VERSION of the SOFTWARE

  ADSL availability is 1 day, 19 hours, 27 minutes
  System to regain the power ROM
  System restarted at 17:20:56 CEST Sunday, October 10, 2010
  System image file is "flash: c850-advsecurityk9 - mz.124 - 15.T5.bin".

  Cisco 857 (MPC8272) processor (revision 0 x 300) with 59392K / 6144K bytes of memory.
  Card processor ID FCZ122391F5
  MPC8272 CPU Rev: Part Number 0xC, mask number 0 x 10
  4 interfaces FastEthernet
  1 ATM interface
  128 KB of non-volatile configuration memory.
  20480 bytes K of on board flash system (Intel Strataflash) processor

  Configuration register is 0 x 2102

  And here is the cisco configuration (IP address, etc. changed of course):

  Current configuration: 7782 bytes
  !
  ! Last configuration change at 11:57:21 CEST Monday, October 11, 2010 by bautsche
  ! NVRAM config updated at 11:57:22 CEST Monday, October 11, 2010 by bautsche
  !
  version 12.4
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  sequence numbers service
  !
  hostname adsl
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered 4096
  enable secret 5
  !
  AAA new-model
  !
  !
  AAA authentication login local_authen local
  AAA authentication login sdm_vpn_xauth_ml_1 local
  AAA authorization exec local local_author
  AAA authorization sdm_vpn_group_ml_1 LAN
  !
  !
  AAA - the id of the joint session
  clock timezone gmt 0
  clock daylight saving time UTC recurring last Sun Mar 01:00 last Sun Oct 01:00
  !
  !
  dot11 syslog
  no ip source route
  dhcp IP database dhcpinternal
  No dhcp use connected vrf ip
  DHCP excluded-address IP 10.10.7.1 10.10.7.99
  DHCP excluded-address IP 10.10.7.151 10.10.7.255
  !
  IP dhcp pool dhcpinternal
  import all
  Network 10.10.7.0 255.255.255.0
  router by default - 10.10.7.1
  Server DNS 212.159.6.9 212.159.6.10 212.159.13.49 212.159.13.50
  !
  !
  IP cef
  property intellectual auth-proxy max-nodata-& 3
  property intellectual admission max-nodata-& 3
  no ip bootp Server
  nfs1 host IP 10.10.140.207
  name of the IP-server 212.159.11.150
  name of the IP-server 212.159.13.150
  !
  !
  !
  username password cable 7
  username password bautsche 7
  vpnuser password username 7
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA aes 256
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 3
  BA 3des
  Prior authentication group part 2
  the local address SDM_POOL_1 pool-crypto isakmp client configuration
  !
  ISAKMP crypto client configuration group groupname2
  key
  DNS 10.10.140.201 10.10.140.202
  swangage.co.uk field
  pool SDM_POOL_1
  users of max - 3
  netmask 255.255.255.0
  !
  ISAKMP crypto client configuration group groupname1
  key
  DNS 10.10.140.201 10.10.140.202
  swangage.co.uk field
  pool SDM_POOL_1
  users of max - 3
  netmask 255.255.255.0
  ISAKMP crypto sdm-ike-profile-1 profile
  groupname2 group identity match
  client authentication list sdm_vpn_xauth_ml_1
  ISAKMP authorization list sdm_vpn_group_ml_1
  client configuration address respond
  ISAKMP crypto profile sdm-ike-profile-2
  groupname1 group identity match
  ISAKMP authorization list sdm_vpn_group_ml_1
  client configuration address respond
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set esp-3des esp-md5-hmac ESP_MD5_3DES
  Crypto ipsec transform-set ESP-AES-256-SHA aes - esp esp-sha-hmac
  !
  crypto dynamic-map SDM_DYNMAP_1 1
  Set the security association idle time 3600
  game of transformation-ESP-AES-256-SHA
  market arriere-route
  crypto dynamic-map SDM_DYNMAP_1 2
  Set the security association idle time 3600
  game of transformation-ESP-AES-256-SHA
  market arriere-route
  !
  !
  card crypto SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
  map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto
  map SDM_CMAP_1 65535-isakmp dynamic SDM_DYNMAP_1 ipsec crypto
  !
  Crypto ctcp port 10000
  Archives
  The config log
  hidekeys
  !
  !
  synwait-time of tcp IP 10
  !
  !
  !
  Null0 interface
  no ip unreachable
  !
  ATM0 interface
  no ip address
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  route IP cache flow
  No atm ilmi-keepalive
  PVC 0/38
  aal5mux encapsulation ppp Dialer
  Dialer pool-member 1
  !
  DSL-automatic operation mode
  waiting-224 in
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  interface Vlan1
  Description $FW_INSIDE$
  10.10.7.1 IP address 255.255.255.0
  IP access-group 121 to
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly
  route IP cache flow
  map SDM_CMAP_1 crypto
  Hold-queue 100 on
  !
  interface Dialer1
  Description $FW_OUTSIDE$
  the negotiated IP address
  IP access-group 121 to
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NAT outside IP
  IP virtual-reassembly
  encapsulation ppp
  route IP cache flow
  No cutting of the ip horizon
  Dialer pool 1
  Dialer idle-timeout 0
  persistent Dialer
  Dialer-Group 1
  No cdp enable
  Authentication callin PPP chap Protocol
  PPP chap hostname
  PPP chap password 7
  map SDM_CMAP_1 crypto
  !
  local IP SDM_POOL_1 10.10.148.11 pool 10.10.148.20
  IP local pool public_184 123.12.12.184
  IP local pool public_186 123.12.12.186
  IP local pool public_187 123.12.12.187
  IP local pool internal_9 10.10.7.9
  IP local pool internal_8 10.10.7.8
  IP local pool internal_223 10.10.7.223
  IP local pool internal_47 10.10.7.47
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 Dialer1
  IP route 10.10.140.0 255.255.255.0 10.10.7.2
  !
  no ip address of the http server
  no ip http secure server
  IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
  IP nat inside source static 10.10.7.9 123.12.12.184
  IP nat inside source static tcp 10.10.7.8 22 123.12.12.185 22 Expandable
  IP nat inside source static tcp 10.10.7.8 25 123.12.12.185 25 expandable
  IP nat inside source static tcp 10.10.7.8 80 123.12.12.185 80 extensible
  IP nat inside source static tcp 10.10.7.8 443 123.12.12.185 443 extensible
  IP nat inside source static tcp 10.10.7.8 993 123.12.12.185 993 extensible
  IP nat inside source static tcp 10.10.7.8 123.12.12.185 1587 1587 extensible
  IP nat inside source static tcp 10.10.7.8 8443 123.12.12.185 8443 extensible
  IP nat inside source static 10.10.7.223 123.12.12.186
  IP nat inside source static 10.10.7.47 123.12.12.187
  !
  record 10.10.140.213
  access-list 18 allow one
  access-list 23 permit 10.10.140.0 0.0.0.255
  access-list 23 permit 10.10.7.0 0.0.0.255
  Access-list 100 category SDM_ACL = 2 Note
  access-list 100 deny ip any 10.10.148.0 0.0.0.255
  access ip-list 100 permit a whole
  Note access-list 121 SDM_ACL category = 17
  access-list 121 deny udp any eq netbios-dgm all
  access-list 121 deny udp any eq netbios-ns everything
  access-list 121 deny udp any eq netbios-ss all
  access-list 121 tcp refuse any eq 137 everything
  access-list 121 tcp refuse any eq 138 everything
  access-list 121 tcp refuse any eq 139 all
  access ip-list 121 allow a whole
  access-list 125 permit tcp any any eq www
  access-list 125 permit udp any eq isakmp everything
  access-list 125 permit udp any any eq isakmp
  access-list 194 deny udp any eq isakmp everything
  access-list 194 deny udp any any eq isakmp
  access-list 194 allow the host ip 123.12.12.184 all
  IP access-list 194 allow any host 123.12.12.184
  access-list 194 allow the host ip 10.10.7.9 all
  IP access-list 194 allow any host 10.10.7.9
  access-list 195 deny udp any eq isakmp everything
  access-list 195 deny udp any any eq isakmp
  access-list 195 allow the host ip 123.12.12.185 all
  IP access-list 195 allow any host 123.12.12.185
  access-list 195 allow the host ip 10.10.7.8 all
  IP access-list 195 allow any host 10.10.7.8
  not run cdp
  public_185 allowed 10 route map
  corresponds to the IP 195
  !
  public_184 allowed 10 route map
  corresponds to the IP 194
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 100
  !
  !
  control plan
  !
  !
  Line con 0
  connection of authentication local_authen
  no activation of the modem
  preferred no transport
  telnet output transport
  StopBits 1
  line to 0
  connection of authentication local_authen
  telnet output transport
  StopBits 1
  line vty 0 4
  access-class 23 in
  privilege level 15
  authorization exec local_author
  connection of authentication local_authen
  length 0
  preferred no transport
  transport input telnet ssh
  !
  max-task-time 5000 Planner
  Scheduler allocate 4000 1000
  Scheduler interval 500
  130.88.202.49 SNTP server
  130.88.200.98 SNTP server
  130.88.200.6 SNTP server
  130.88.203.64 SNTP server
  end

  Any help would be appreciated.

  Thank you very much.

  Ciao,.

  Eric

  Hi Eric,.

  (Sorry for the late reply - needed some holidays)

  So I see that you have a few steps away now. I think that there are 2 things we can try:

  1)

  I guess you have provided that:

  IP nat inside source overload map route SDM_RMAP_1 interface Dialer1

  Since the routemap refers to ACL 100 to define the traffic to be translated, we can exclude traffic that initiates the router:

  Access-list 100 category SDM_ACL = 2 Note

  access-list 100 deny ip 123.12.12.185 host everything
  access-list 100 deny ip any 10.10.148.0 0.0.0.255
  access ip-list 100 permit a whole

  Which should prevent the source udp 4500 to 1029 changing port

  OR

  2)

  If you prefer to use a different ip address for VPN,

  Then, you can use a loop like this:

  loopback interface 0

  123.12.12.187 the IP 255.255.255.255

  No tap

  map SDM_CMAP_1 crypto local-address loopback 0

  I don't think you should apply card encryption to the loopback interface, but it's been a while since I have configured something like that, so if you have problems first try and if still does not get the crypto debugs new (isakmp + ipsec on the vpn, nat router on the router of the client package).

  HTH

  Herbert

• Dynamic L2L Tunnel - the Tunnel is up, will not pass the LAN traffic

  Hello everyone. I am repurposing an ASA for my business at a remote site and must use a dynamic Configuration of L2L with Split tunneling active. We used these in the past and they work a lot, and I've referenced Cisco official documentation for the implementation. Currently, I am having a problem where I am unable to pass traffic on the local remote network over the VPN tunnel (it does even not raise the tunnel of form). However, if I run the following command in the ASA remote:

  Ping inside the 192.168.9.1

  I receive the ICMP responses. In addition, this traffic causes the VPN Tunnel to be created as indicated by show ISA SA:

  1 peer IKE: xx.xx.xx.xx

  Type: L2L role: initiator

  Generate a new key: no State: MM_ACTIVE

  Here is the IP addressing scheme:

  Network remotely (with the ASA problem): 192.168.12.0/24

  Basic network (Hub): 192.168.9.0/24

  Other rays: 192.168.0.0/16

  Config:

  ASA Version 8.2 (1)
  !
  hostname xxxxxxxxx
  domain xxxxxxxxxxx.local
  activate the xxxxxxxx password
  passwd xxxxxxxxx
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  192.168.12.1 IP address 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS server-group DefaultDNS
  domain xxxxxxxx.local
  permit same-security-traffic intra-interface
  to_hq to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  inside_nat0_outbound to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  pager lines 24
  Within 1500 MTU
  Outside 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto outside_map 10 correspondence address to_hq
  crypto outside_map 10 card game CORE peers. ASA. WAN. INTELLECTUAL PROPERTY
  outside_map crypto 10 card value transform-set ESP-3DES-SHA
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd 192.168.9.2 dns 208.67.222.222
  !
  dhcpd address 192.168.12.101 - 192.168.12.131 inside
  rental contract interface 86400 dhcpd inside
  dhcpd xxxxxxxxx.local area inside interface
  dhcpd ip interface 192.168.9.50 option 66 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  tunnel-group basis. ASA. WAN. Type of IP ipsec-l2l
  tunnel-group basis. ASA. WAN. IPSec-attributes of intellectual property
  pre-shared key xxxxxxxxxxxx
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname

  Once the tunnel is in place, LAN to the Remote Site traffic won't pass through the VPN Tunnel any upward. On the side of ASA Core, I was able to Telnet in the ASA distance very well, but could not ping the Remote Access Point.

  Someone at - it a glimpse of my problem?

  Hello

  Add:

  NAT (inside) 0-list of access inside_nat0_outbound

• Windows 7 - is possible to run telnet via the LINE of COMMAND BACK?

  I activated the Control Panel - programs - telnet client activate Windows features turn on or off - and a check by the Telnet client.

  I CAN run telnet from the Start button and typing telent.   Telnet.exe is located and I click on it, and a telnet window opens.   The title bar of the window is "C:\Windows\system32.telnet.exe".

  I can't run telnet from the command line, even as an administrator.

  C:\Windows\System32>Telnet
  'telnet' is not recognized as an internal or external command
  operable program or batch file.

  C:\Windows\System32>.\telnet
  '. \telnet' is not recognized as an internal or external, order
  operable program or batch file.

  C:\Windows\System32>.\telnet.exe
  «.\telnet.exe' is not recognized as an internal or external command
  operable program or batch file.

  I want to be able to enter telent 192.168.1.1 at the command prompt, is it possible on Windows 7 without having to install a client telnet replacement?

  I am running Windows 7 Enterprise 64-bit with Service Pack 1.    My computer is in the domain of the company.

  back / cmd - a rose by any other name...   You know what I mean.

  But I found the link interesting it specifically shows run telnet from the CMD prompt.   I am not able to do, the mistakes, I have indicated in my original post.

  So, I clicked on "Start", "Run" and type cmd and press ENTER.  I then typed in telnet you press on enter, and wow, this has worked.  So, what is the difference?

  I looked at the properties of the shortcut, I always click to open a command window.  I see that it does the following:

  C:\Windows\SysWOW64\cmd.exe

  I even clicked on start, run and then type the full path and the name "C:\Windows\SysWOW64\cmd.exe".

  I typed in telnet again and it failed!  Hmmm so my computer run when I enter cmd versus C:\Windows\SysWOW64\cmd.exe?  and why is there a difference anyway?

  I find these two files and I perform a checksum on each of them, the files are the same:

  ad7b9c14083b52bc532fba5948342b98 *c:\Windows\System32\cmd.exe
  ad7b9c14083b52bc532fba5948342b98 *c:\Windows\SysWOW64\cmd.exe

  In fact, I suspect that they are in fact only one file with a hard to another link.  (Okay beat me on that too because I know MS does not use Unix terminology)

  So, now that I have created a new shortcut pointing to c:\Windows\System32\cmd.exe and receive launch Telnet works!

  It seems that when I run SysWOW64 cmd.exe, it does not. \System32 on its passage.  I tried to run c:\Windows\System32\telnet.exe - he started, but he doesn't answer.  I assumed telnet.exe is not compatible with Windows 7 64-bit.   And that's what I think, it's the current response.

• HOWTO ssh or telnet to the Simulator

  I watched last night on this dev site for my answer, maybe he was tired, but I could not find.  Can someone tell me the secret sause to ssh or telnet on the Simulator.

  I know the real phone I used the root/root for user name and password.  When I telnet to the Simulator I get a newspaper online, but do not know the user name and password

  Thank you very much

  First you will need to bring up the Terminal in Momentics (window > Show View > [other...] > Terminal), then click on the Green connection icon.

  

  You will then see a window of Terminal Server Settings. Select SSH - Blackberry as your connection type, then select your Simulator from the list of devices:

  

  And that's, you should have SSH access to the Simulator.

• allow icmpv6 in ipv4-access list in the tunnel

  Hello

  I have a little problem with an access list ipv4 blocking my ipv6 tunnel.

  My tunnel works and is as follows:

  interface Tunnel0

  no ip address

  IPv6 address

  enable IPv6

  source of tunnel

  ipv6ip tunnel mode

  tunnel destination

  So when I apply the below, access list to the WAN interface on the sense IN, IPV6 stops working (everything works on IPV4 when the access list is applied). I mean, I cannot ping ipv6.google.com or ipv6.google.coms IP. I can still ping the IP ipv6 remote tunnel ().

  Access list that I apply is the following:

  allow tcp any a Workbench

  allowed UDP any eq field all

  allowed any EQ 67 udp no matter what eq 68

  allowed UDP any eq 123 everything

  allowed UDP any eq 3740 everything

  allowed UDP any eq 41 everything

  allowed UDP any eq 5072 everything

  allow icmp a whole

  deny ip any any newspaper

  Here are the requirements to the supplier of tunnel, and one of the entries is ICMPv6. Is it possible to allow icmp v6 on a Cisco access list?

  TCP 3874	TIC.sixxs.net	IPv4	ICT (Information Tunnel & Control Protocol)	Used to retrieve the information of tunnel (for instance AICCU)	Uses the TCP protocol and should work without problems
  UDP 3740	PoP	IPv4	Heartbeat Protocol	Used for signalling where is the endpoint current IPv4 of the tunnel and he's alive	the user only to pop out
  Protocol 41	PoP	IPv4	IPv6 over IPv4 (6 in 4 tunnel)	Used for tunneling IPv6 over IPv4 (static tunnels + heartbeat)	We have to appoint the internal host as the DMZ host that leaves usually passes the NAT
  UDP 5072	PoP	IPv4	AYIYA (anything in anything)	Used for tunneling IPv6 over IPv4 (AYIYA tunnels)	Must cross most NAT and even firewalls without any problem
  ICMPv6 echo response.	Tunnel endpoints	IPv6	Internet Control Message Protocol for IPv6	Used to test if a tunnel is alive in scathing tunnel endpoint (tunnel: 2) on the side PoP of the tunnel (tunnel: 1) on the tunnel	No, because it is happening inside the tunnel

  I missed something?

  sidequestion: I added the "deny ip any any newspaper" in the access list, but it adds no registration entry in the log (show log). I'm sure it hits because when I run "display lists access": 110 deny ip any any newspaper (2210 matches).

  Hope someone can help me.

  Hello

  In the ACL above you are atleast specifying source and destination UDP and 41 SOURCE ports

  If you specify IPv6 over an IPv4 ACL I guess that the format would be to "allow 41 a whole" for example.

  Although I have barely touched IPv6 myself yet. Wouldn't it be possible to configure ACL Ipv4 and IPv6 ACL and attach them to the same interface?

  But looking at my own router it does not support these commands so that other devices to make. Maybe something related model/software I guess.

  -Jouni

• Background switch detected for MyApp (24) who doesn't have the tunnels open - defocus is NOT called

  I get the error "background switch detected for MyApp (24) who doesn't have the tunnels open - defocus is NOT called. Then the Simulator freezes and I can't do anything. Tried to debug but no luck!

  My application has two other entry points implemented from article http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/348583/800738/800901/How_To _...

  Please see code below

  public class UserInterface extends UiApplication{
  
      public static void main(String[] args){
  
          if ((args != null) && (args.length > 0) && (0==StringUtilities.compareToIgnoreCase(args[0].toString(), "GUI"))){
  
              UserInterface theApp = new UserInterface();
              theApp.enterEventDispatcher();
          }
          else {
              try
              {
                  Wait();
                              SetTimer();
                  ManageResources mg = new ManageResources();
                  System.exit(0);
  
              }
              catch (Exception ex)
              {
                  if (RuntimeConfig.DEBUG)
                  {
                      System.out.println("UserInterface, main:  " + ex);
                  }
              }
          }
      }
      public UserInterface() {
          //  DialogDisplay dd = new DialogDisplay();
          pushScreen(new UserInterfaceScreen(this));
      }
  

  I also had this problem, the cause is that my computer is behind a proxy firewall so that MDS services Simulator cannot connect to internet, I added the following lines in the file rimpublic.property in the directory "Eclipse\plugins\net.rim.eide.componentpack4.7.0_4.7.0.46\components\MDS\config".

  application.handler.http.proxyEnabled = true
  application.handler.http.proxyHost = proxyserver
  application.handler.http.proxyPort = 8080

  These lines must be placed in the [MANAGER HTTP] section.

  It will be useful.

• ASA 5505 VPN works great but can't access internet via the tunnel to customers

  We have an ASA 5505 ASA 8.2.1 running and using IPSec for Remote access clients in the main office.  Remote access is a lot of work, with full access to network resources in the main office and the only thing I can't get to work is access to internet through the tunnel.  I don't want to use split tunneling.  I use ASDM 6.2.1 for configuration.  Any help is appreciated.  I'm probably missing something simple and it looked so much, I'm probably looking at right beyond the error.  Thanks in advance for your time and help!    Jim

  Add a statement of nat for your segment of customer on the external interface

  NAT (outside) - access list

  then allow traffic routing back on the same interface, it is entered in the

  permit same-security-traffic intra-interface

  *

  *

  * more than information can be found here:

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807...

  On Wednesday, 27 January 2010, at 23:12, jimcanova

• If a PC with a DHCP server is connected via VPN, with her serve IP addresses on the tunnel?

  Situation: we have a few portable computers test Ubuntu running DHCP servers.  We need get the updates and other changes in corporate network sometimes.  Today, we turn off the DHCP server, set up to get an IP via DHCP (besides) and make our updates.

  Problem: we do not want someone accidentally connect the laptop to the corporate network, while its DHCP server is running.

  Question: so, if we go via wifi using a Cisco VPN client, the DHCP server IP addresses above the tunnel?

  Thanks for reading.

  N ° DHCP uses layer 2 broadcasts to disseminate IP addresses.  Because your clients are connected via VPN, there is no contiguity of layer 2.  The only way he would accidentally do it is if you have configured an address to support IP dhcp as one of your VPN clients on the network, which I imagine you wouldn't.

• name of the tunnel-group

  Hello

  In the configuration below I put in place a tunnel-group name that is the same as the counterpart of VPN tunnel. Is that what you have to do, or could call you the tunnel-group what you want?

  part of pre authentication ISAKMP policy 1

  ISAKMP policy 1 3des encryption

  ISAKMP policy 1 sha hash

  Group of ISAKMP policy 1 2

  ISAKMP policy 1 life 43200

  ISAKMP allows outside

  Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

  l2l_list to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  tunnel-group 10.10.10.1 type ipsec-l2l

  tunnel-group 10.10.10.1 ipsec-attributes

  pre-shared key xxx

  card crypto abcmap 1 match address l2l_list

  card crypto abcmap 1 set counterpart 10.10.10.1

  card crypto abcmap 1 set of transformation-FirstSet

  abcmap interface card crypto outside

  Robert,

  The tunnekl group should be the IP address of the remote end - because it is used as ID. The only time where ever you need to use a specific name - is if you are certificate authentication.

  HTH.

• Cannot ping vpn client of 1721 cli on the tunnel endpoint

  I have a 1721 fortunately supporting ipsec vpn client connections. With one small exception, everything works perfectly fine.

  The VPN pool is 10.10.10.1 - 10.10.10.254

  The interface internal f0 is attributed to 192.168.1.254/24.

  In my example:

  Ip address of the VPN client is 10.10.10.5

  The host address of an arbitrary machine on the internal lan is 192.168.1.151

  I am able to ping 192.168.1.151 10.10.10.5

  I'm * not * able to ping 10.10.10.5 192.168.1.254 using the cli on the 1721.

  There is a very good reason to want to solve this problem. I would like to be able to access a tftp server on the client vpn directly from the router in order to download the new startup-config files. Is it possible to get the traffic of vpn-/ tunnel-point endpoint client tftp to travel through the tunnel?

  When you ping from the CLI on the router, the packet will be from the external interface, not the IP address fa0 interface. The VPN client and the router only built a tunnel from the 10.10.10.5 address the 192.168.1.0 network, then the router not cryptera a package that her origin is outside the IP address.

  Try to ping extended to 10.10.10.5 and source of 192.168.1.254 package and see if it works. If it does, you will have also to the source of your TFTP packets from inside interface, you can do with:

  IP tftp source interface fa0

• Force traffic into the tunnel?

  No IPSEC applied anywhere yet.

  If you have 2 routers configured back to back with the physical interfaces tunnel interfaces - which way will be the traffic travels above?

  Answer - It will follow the path of the routing table that I guess. OSPF or static or other routes.

  Series enough.

  Now add one IPSEC.

  OSPF fails as IPSEC does not support multicast.

  Series enough.

  Now, add IPSEC and GRE to the mix. Apply card crypto both physical and tunnel interfaces.

  Included here is the common ACL associated with free WILL. That is: -.

  access-list 100 permit will host [address physical source] [address physical destination]

  It's the ACL that is supposed to define what traffic is 'interesting' and which must be encrypted.

  We will repeat the question: what should be the traffic?

  I guess it's the same answer. Refer to the routing table.

  But that traffic is encrypted? Answer - ONLY traffic destined to the IP tunnel interface.

  If you ping from physics to physics, it will be clear.

  Question - do you need to force ALL traffic to the bottom of the tunnel interface in the order so he could match the ACL and therefore get encrypted?

  How do accomplish us this?

  Discussion and debate would be greatly appreciated.

  He

  Only traffic with the source/destination of the tunnel interfaces - you just encapsulate & encrypt what happens / leaves the tunnel. If you have two sites connected through a VPN IPSEC, 'interesting' traffic for VPN is the source/destination on tunnel interfaces you need to LAN traffic in the tunnel interfaces. If you have either the static routes, or run you a dynamic routing such as OSPF or EIGRP Protocol.

  You may have a default route pointing to the firewall, a routing protocol dynamic running - so that all "internal" traffic will take place on the tunnel = encrypted vpn to a remote site, while all the 'internet' traffic routes to the firewall and leaves normally.

  HTH

• Limit the bandwidth in the tunnel VPN on Cisco ASA

  Hello

  I have a site VPN tunnel to create with the local desktop client. I fear that the traffic in the tunnel in impacting the Internet bandwidth for the entire office. Is it possible to limit bandwidth on the speed VPN tunnel. I have attached a configuration that shows the configuration of the ASA at the local office.

  Any help would be much appreciate. I watched QoS mapping but it's hard to make sense.

  Thank you very much

  Kind regards

  Michael.

  The ASA supported QoS features are:
  Police, LLQ and Traffic Shaping

  To avoid the individual flows hogging the bandwidth of the network, you can limit the maximum bandwidth used by flow (with the police)
  The police is a way of ensuring that no traffic exceeds the rate (in bits per second) that you configure,
  so make that person not traffic or the class can return to any of the resource.
  When traffic is higher than the maximum rate, the ASA removes the excess traffic. Policy defines also the largest single burst of allowed traffic.

  Example of font options:
  class policing_map_name hostname(config-pmap) #.
  Police hostname(config-pmap-c) # {exit | entry} to compliance rates [conform burst]
  [action in line [drop | send]] [action exceed [drop | send]]

  That is to say

  HostName (config) # class - police-class card
  HostName(config-CMAP) # match any
  HostName(config-CMAP) # QoS_policy policy-map
  class police_class hostname(config-pmap) #.
  HostName(config-pmap-c) # exit police 56000 10500

  The configuration depends on the "this" base that you want to limit the connection.

  Federico.

• PIX of Concentrator VPN tunnel, can I NAT traffic before the tunnel?

  I have a tunnel IPSEC of PIX-to-VPNConcentrator.

  I have a localhost on my PIX inside interface with the IP 192.168.5.5 but the site on the end of the tunnel VPNConcentrator wants to see the IP 192.168.77.9 (because they use the 192.168.5.x network to an end for another use)

  I know how things NAT from inside out, but I never have NAT - ed before traffic tunnel.

  Can I NAT a local inside IP address BEFORE traffic hits the tunnel?

  Yes, it is possible. Please see the below URL for the configuration details:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00800949f1.shtml

  Kind regards

  Arul