Telnet to a line specific vty

Similar Questions

• Telnet to port specific vty

  I know that it is possible to reverse-telnet on a specific serial port on some routers by telnet to a specific tcp port. For example:

  reverse-Telnet for Interface Async 5 with a TTY, 5 row identifier would you telnet to the local IP address of router to port 2005

  I would like to have the same capacity with vty ports.

  I have a router that uses Cisco Lock-key authentication and to add a dynamic access list entries to any host ip that connects to port vty 0. I also want the ability to connect on the router itself in order to establish an EXEC session. To do this, currently I have to open a second telnet session before the vty 0 ends.

  To make a long story short, here's how I would want it to work.

  move the lock and key of port vty authentication 4

  Telnet to port 20004 to go connect to the vty port 4

  generic telnet to port 23 will turn by previous vty ports 0-3 as usual to establish the EXEC session.

  Is this feasible? If Yes, please provide an example of configuration and/or instructions.

  Thank you.

  In fact, you can configure the vty as a rotating group.

  line vty 4

  transport of entry all

  rotating 4

  You can telnet to the router on port 3004. 23 is also open to if, but you can use a class access to restrict the use to vty 4 if necessary.

  Or by using the (dirtier) NAT:

  IP nat inside source static tcp 172.16.55.1 23 172.16.55.1 2002 extensible

  interface Ethernet0

  IP 172.16.55.1 255.255.255.0

  interface...

  the IP 10.0.0.1 255.255.255.0

  NAT outside IP

• Windows 7 - is possible to run telnet via the LINE of COMMAND BACK?

  I activated the Control Panel - programs - telnet client activate Windows features turn on or off - and a check by the Telnet client.

  I CAN run telnet from the Start button and typing telent.   Telnet.exe is located and I click on it, and a telnet window opens.   The title bar of the window is "C:\Windows\system32.telnet.exe".

  I can't run telnet from the command line, even as an administrator.

  C:\Windows\System32>Telnet
  'telnet' is not recognized as an internal or external command
  operable program or batch file.

  C:\Windows\System32>.\telnet
  '. \telnet' is not recognized as an internal or external, order
  operable program or batch file.

  C:\Windows\System32>.\telnet.exe
  «.\telnet.exe' is not recognized as an internal or external command
  operable program or batch file.

  I want to be able to enter telent 192.168.1.1 at the command prompt, is it possible on Windows 7 without having to install a client telnet replacement?

  I am running Windows 7 Enterprise 64-bit with Service Pack 1.    My computer is in the domain of the company.

  back / cmd - a rose by any other name...   You know what I mean.

  But I found the link interesting it specifically shows run telnet from the CMD prompt.   I am not able to do, the mistakes, I have indicated in my original post.

  So, I clicked on "Start", "Run" and type cmd and press ENTER.  I then typed in telnet you press on enter, and wow, this has worked.  So, what is the difference?

  I looked at the properties of the shortcut, I always click to open a command window.  I see that it does the following:

  C:\Windows\SysWOW64\cmd.exe

  I even clicked on start, run and then type the full path and the name "C:\Windows\SysWOW64\cmd.exe".

  I typed in telnet again and it failed!  Hmmm so my computer run when I enter cmd versus C:\Windows\SysWOW64\cmd.exe?  and why is there a difference anyway?

  I find these two files and I perform a checksum on each of them, the files are the same:

  ad7b9c14083b52bc532fba5948342b98 *c:\Windows\System32\cmd.exe
  ad7b9c14083b52bc532fba5948342b98 *c:\Windows\SysWOW64\cmd.exe

  In fact, I suspect that they are in fact only one file with a hard to another link.  (Okay beat me on that too because I know MS does not use Unix terminology)

  So, now that I have created a new shortcut pointing to c:\Windows\System32\cmd.exe and receive launch Telnet works!

  It seems that when I run SysWOW64 cmd.exe, it does not. \System32 on its passage.  I tried to run c:\Windows\System32\telnet.exe - he started, but he doesn't answer.  I assumed telnet.exe is not compatible with Windows 7 64-bit.   And that's what I think, it's the current response.

• Disable authentication for reverse Telnet over Async lines

  I have a 2811 which behaves as a server terminal server with several line async being used to access the console. Whenever I open a telnet reversed on one lines always make me touching up for my credentials. Is there a way to eliminate the requirement of authentication, but only on the async for telnet lines reversed? I can disable in the world (which is not good) and I tried to enter "no authentication connection" under the respective lines async - but still, I wonder. Any thoughts? My current global and line config:

  AAA new-model
  AAA authentication login default local-case
  authorization AAA console
  AAA authorization exec default local
  !

  line 1/0 1 / 15
  session-timeout 30
  exec-timeout 30 0
  No exec
  transport telnet entry

  I have not tried, but try something like below (which requires the aaa new-model):

  aaa authentication login no-auth noneline 1/0 1/15  login authentication no-auth 

• Export which lines specific to a date

  Greetings!

  I do not know how to export the rows that have a date that a specific day. For example, I want my table B with date lines Monday.

  Is it like this?
  

  expdp Directory =dir dumpfile = b user@myDB tables = b [...]

  Thank you very much for your help.

  Maybe you are looking for the expdp QUERY parameter: ' goal: specify a clause of the query that is used to filter the data that gets exported. " http://docs.Oracle.com/CD/E11882_01/server.112/e22490/dp_export.htm#SUTIL2989

• How to color line specific "BOLD" / inactive in the classic report (oracle apex).

  I have the classic report in oracle apex

  with query below

  Select EMPNO, ENAME, HIREDATE, ADDRESS of emp COMM;

  If the ENAME = "John".

  so, I want to do any "BOLD" line and readonly/inactive. (set of rank who name John)

  Thanks in advance...

  Simple answer: see this blog: reports APEX: color line based on column value

  Thank you

  Tony Miller
  Software LuvMuffin
  Ruckersville, WILL

• Add dynamic buttons to each line of the report and bind the data line to this line-specific buttons

  I have a page with a form in the upper part and a report at the bottom that is bound to a table. I need to add a pair of buttons for each row in the table and add dynamic actions for these buttons. I need to submit the data corresponding to the line to a REST service and update the table/line. I know that it is possible to add ajax call and refresh the table after receipt of the response. But I don't know how can I dynamically include a pair of buttons on each line and access the data corresponding to the record when a particular button is clicked. I was not able to find such a feature using the help page. Can you please let me know if this is possible. Thanks in advance.

  Here is the representation of how I need to the page to look like.

  Col 1	Col 2	Col 3
  data 1	data 21	data 31	Button 1	Button 2
  data 2	data 22	data 32	Button 1	Button 2
  data 3

  data 23

  data 33

  Button 1

  Button 2

  data 4

  data 24

  data 34

  Button 1

  Button 2

  I should be able to access the data 1, data21, data button 31 11 and button21 etc.

  Select data1,

  data2,

  data3,

  ......,

  Button1 null,

  Button2 null,

  ROWID r_id

  Of...

  If you change the column for button1 and navigate to the area of column formatting you can create your button here, in several different ways.  You will need to play with the way you prefer.  See below:

  or tag button or you could use and apply css of your theme.

  You create also two buttons in a single column.  From here you can reference columns in your selection by using the format #COLUNMNAME # (as I did with R_ID).

  Then, you will need something similar for all columns that you want to be able to recover when you click the buttons.  See below:

  -It would be Data1 column

  #DATA1 #.

  You would do this for each column that you want to access click the button as shown above.  You can skip this step and use jquery to iterate through the DOM using the. closest() and. find() and give each column a separate class.  Is your preference.

  You then create a dynamic action, when it is clicked on .button1.  Now that you have this object, you can get the id of the trigger object that would be your r_id and from here you can access all your individual data points (all this in a JavaScript in the dynamic action) and assign to items hidden on your page.  The next step in this dynamic action, you could run pl/sql and transmit the page elements.

  Hope that all of the senses.

  David

  Post edited by: DLittle

  As a bit of clarification: the r_id column does not have to be rowid, but it must be unique for each return line.  You can use your primary key or rownum.  Just what works for your scenario.

• Numbers: line specific of the worksheet a and worksheet 2

  I hope it make sense.

  I create sale spreadsheet to calculate how much I earn for sales of sheet 2 that I create a number of products that I sell. When I type "4" in the column of the products and total $800, sheet 1. I want $800 seem to leaf in two.  When I change from 4 to 8 and then the quantity changes to $1600. I must not copy the amount of sheet, a two sheet whenever I change.

  Salvation of

  Is that what you hear:

  

  Table 1:

  ALL data entry is done on this table.

  Data entered in A2, B2, and C2.

  D2 contains the formula: = B * C

  Table 2:

  A2 contains the formula: = 1::A2 Table

  B2 contains the formula: = 1::B2 Table

  C2 contains the formula: = 1::D2 Table

  In the tables below, the formulas in table 1::D2, Table 2::A2, Table 2::B2, and Table 2::C2 were filled until the end of their respective columns:

  

  The three data items in table 1 have been copied in row 3, then 4 replaced by a 8.

  Zeros result formulas in the cells of empty cells reading and calculating with the "nothing" that they find. For a cleaner looking table, add the parameters below for each of the forms before filling them down:

  Table 1::D2: = IF (OR (LEN (B) < 1, LEN (C) < 1), "", B * C)

  Table 2::A2: = IF (1::A2 = array "", "", table 1::A2)

  Table 2::B2: = IF (1::B2 = array "", "", table 1::B2)

  Table 2::C2: = IF (1::D2 = array "", "", table 1::D2)

  

  The table on sheet 2, it is probably also named table 1.

  Click any cell in the table to make it active and show the Format brush. In the table Format Inspector, click the box to display the name of the Table. Double click just to the right of the name of the table to place the insertion point, and then change the name of this table in table 2. To do this, before entering in the formulas above the tables.

  Kind regards

  Barry

• simple question on VTY

  Hello

  When I want to configure ssh to be used in telnet, should I enter the vty that is similar to the use of these commands:

  (config) # line vty 0 1180

  do I really need to 1180, and there is no reference to.

  With new versions of IOS (relatively recent), the number of VTY lines have been increased (from 5/16 to 1000 +). You need to do 'all the entries of transport' or "transport input telnet ssh" on the lines to allow telnet & ssh together.

  You can set up just as many lines as you need, for example lines from 0 to 15, and leave the rest. It is a good model to ensure the IOS configurations, check the VTY configuration section:

  http://www.Cymru.com/documents/secure-iOS-template.html

  Concerning

  Farrukh

• VTY access restriction

  Hello everyone,

  We have thought a lot about this problem for days without a solution. We would like to restrict ssh access from a specific to a particular vty source IP address. We'll tell whenever source A with IP X.X.X.X connects it will be redirected to vty 5. Even if vty 0 to 4 are free.

  We tried to solve this problem by using access lists. by denying A host on vty all except vty 5. But it did not work. The configuration looks like this:

  access-list 10 deny X.X.X.X

  access-list 10 permit Y.Y.Y.Y

  ACCESS-list 11 permit X.X.X.X

  access-list 11 allow Y.Y.Y.Y

  line vty 0 4

  access-class 10

  line vty 5

  ACCESSS-class 11 in

  Thanks adavance. Other ideas are welcome.

  PS: Curiously it worked in Packet trace

  The VTY port is chosen at random, so I think it would work sometimes and sometimes it won't. To make this work correctly I suggest using rotating groups. In this way, you can attach a specific to a specific VTY line port:

  http://www.Cisco.com/c/en/us/TD/docs/iOS-XML/iOS/sec_usr_ssh/configuration/15-s/sec-usr-SSH-15-s-book/sec-SSH-term-line.html

  I hope this helps!

  Thank you for evaluating useful messages!

• Operational status SCCP bring up is successful. message not sent to port or VTY sessions to THE

  Hello

  On a Cisco IOS router, when the command of the CSPC is configured, the following message is sent to the console port:

  Operational status SCCP bring up is successful

  However, this message is not sent to telnet or ssh sessions through VTYs, or ports in the

  Is this a bug?

  I tested it on:

  2821 router running IOS Version 12.4 (24) T6 with function ADVENTERPRISEK9 defined

  2801 router running IOS Version 12.4 (24) T6 with function SPSERVICESK9 defined

  2801 router running IOS Version 12.4 (24) T6 with function ADVENTERPRISEK9 defined

  2921 router running IOS Version 15.2 (3) T

  2851 router running IOS Version 12.4 (24) T6 with function ADVENTERPRISEK9 defined

  Gateway analog voice VG224 running IOS Version 15.1 (3) T1

  Router 7206VXR with NPE - 400, running IOS Version 15.1 (4) M4 with the ADVENTERPRISEK9 option

  I'd say it's a (minor) bug.  An IOS programmer SHOULD have sent the message to the logging engine, but sometimes a programmers could write a message directly to the console for internal diagnostics during development, even if it is not the best practice.

  They should remove this message before sending the code, or make a call suitable for the engine of logging to announce the event through standard logging mechanisms.

  Please engage the TAC in order to get a bug filed.

• Outdoor telnet using PIX 501

  We need allow telnet access to a server on the internal interface of one of our 501 s PIX of several workstations on the network to the external interface.

  I can ping the address 10.0.xxx.100 without problem, but I can not telnet. What Miss me?

  The host inside interface (10.0.xxx.100) has its value 10.0.xxx.1 entry door but the router to has 10.0.xxx.1 of a static route for 192.168.xxx.0 value address of the PIX of 10.0.xxx.2

  Here are the current config:

  6.3 (4) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  enable the encrypted password xxxx

  encrypted passwd xxxx

  PIX-2 host name

  domain xxx.internal

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  name 10.0.xxx.100 IBM_POS_Server

  name 192.168.xxx.93 HP_4350

  Allow Access-list host inside_access_in icmp IBM_POS_Server one

  inside_access_in tcp allowed access list all lpd eq all eq lpd

  outside_access_in list of access permit icmp any host IBM_POS_Server

  outside_access_in list all eq telnet access permitted tcp any eq telnet

  pager lines 24

  opening of session

  logging trap information

  logging out of the 192.168.xxx.10 host

  ICMP allow all outside

  ICMP allow any inside

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside 192.168.xxx.2 255.255.255.0

  IP address 10.0.xxx.2 255.255.255.0 inside

  alarm action IP verification of information

  alarm action attack IP audit

  PDM location 204.90.xxx.225 255.255.255.255 inside

  PDM location 192.168.xxx.11 255.255.255.255 outside

  location of PDM IBM_POS_Server 255.255.255.255 inside

  PDM location 192.168.xxx.10 255.255.255.255 outside

  location of PDM HP_4350 255.255.255.255 outside

  location of PDM HP_4350 255.255.255.255 inside

  PDM 100 debug logging

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) IBM_POS_Server IBM_POS_Server netmask 255.255.255.255 0 0

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route inside IBM_POS_Server 255.255.255.255 10.0.xxx.2 1

  Route inside 204.90.xxx.225 255.255.255.255 10.0.xxx.1 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.xxx.11 255.255.255.255 outside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  Terminal width 80

  Cryptochecksum:XXXXX

  : end

  Any help will be greatly appreciated!

  Kind regards

  Rick

  It is with this acl line:

  outside_access_in list all eq telnet access permitted tcp any eq telnet

  You have the source eq telnet port, which is not the case. The source port is gt 1023, so this code instead

  outside_access_in list all gt 1023 host IBM_POS_Server eq telnet tcp allowed access (this will also limit telnet to only appropriate inside host).

  Let me know if it helps.

• Copy the data from the selected record line

  Hello I use Oracle Forms Builder 10g.

  I want to copy a line from a record that populated the request but that the first lines can be copied when I click on it. I want to know how to copy the specific line-specific data when I click it. Thank you.

  

  using

  GO_RECORD(:SYSTEM.) MOUSE_RECORD);

  the current selected row updates as you click mouse a line. «: SYSTEM.» MOUSE_RECORD' gives you the line number of the recording, you click and it gives a value of '0' char if you click outside the record block.

• Several ports to listen for SSH on Catalyst switches

  Hello community,

  On Cisco routers, you can set up multiple SSH ports (instead of the default tcp 22) in combination with rotary groups. Then attach these rotating groups of specific VTY lines. It works very well.

  But it seems on Cisco switches, you cannot set different ports of SSH. The order Router(config) #ip ssh port portnum Rotary group is not available. You can use the rotating on the VTY lines, but it does for Telnet connections.

  Did someone knows if it is possible to use rotating groups on switches with SSH? What I'm trying to achieve is, I want to use multiple lists of AAA method and define these specific VTY lines slot. In this way, I am able to designate specific users, connecting from specific IP on a dedicated VTY line addresses, with a personalized list of AAA method.

  Any help is very appreciated!

  Kind regards

  Dion Dohmen

  Hello

  I am currently using 12.2 (58) SE2 on the 3560.

  Software Cisco IOS, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2 (58) SE2, RELEASE SOFTWARE (fc1)

  I lowered my IOS to check if she is still supported for the 3560 on 12.2 (55) SE1 and is not.

  XXX availability is 1 minute
  System to regain the power ROM
  System restarted at 14:38:50 GMT Tuesday, July 29, 2014
  System image file is "flash:/c3560-ipservicesk9-mz.122-55.SE1.bin".

  XXX (config) #ip ssh?
  new authentication attempts to specify number of authentication retries
  DSCP DSCP IP value for SSH traffic
  Configure logging for SSH logging
  priority of the value of IP precedence for SSH traffic
  source-interface interface to specify to address SSH source
  connections
  timeout specify SSH timeout
  Protocol version to specify supported version

  XXX (config) #ip ssh

  I then upgraded to 12.2 (55) SE9 and there is still not supported.

  XXX availability is 1 minute
  System to regain the power ROM
  System restarted at 14:47:49 GMT Tuesday, July 29, 2014
  System image file is "flash:/c3560-ipservicesk9-mz.122-55.SE9.bin".

  XXX (config) #ip ssh?
  new authentication attempts to specify number of authentication retries
  DSCP DSCP IP value for SSH traffic
  Configure logging for SSH logging
  priority of the value of IP precedence for SSH traffic
  source-interface interface to specify to address SSH source
  connections
  timeout specify SSH timeout
  Protocol version to specify supported version

  XXX (config) #ip ssh

  I would recommend that you upgrade, but I unfortunately don't see any point.

  Thank you

  Nehmaan

• Cisco ipsec Vpn connects but cannot communicate with lan

  I have a version of cisco 1921 15.2 (4) M3 I install vpn ipsec and may have customers to connect but cannot ping anything inside.  A glimpse of what could be wrong with my config would be greatly appreciated.  I posted the configuration as well as running a few outings of ipsec.  I also tried with multiple operating systems using cisco vpn client and shrewsoft.  I am able to connect to the other VPN ipsec running 1921 both of these computers by using a client.

  Thanks for any assistance

  SH run

  !
  AAA new-model
  !
  !
  AAA authentication login radius_auth local radius group
  connection of AAA VPN_AUTHEN group local RADIUS authentication
  AAA authorization network_vpn_author LAN
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  clock timezone PST - 8 0
  clock to summer time recurring PST
  !
  no ip source route
  decline of the IP options
  IP cef
  !
  !
  !
  !
  !
  !
  no ip bootp Server
  no ip domain search
  domain IP XXX.local
  inspect the high IP 3000 max-incomplete
  inspect the low IP 2800 max-incomplete
  IP inspect a low minute 2800
  IP inspect a high minute 3000
  inspect the IP icmp SDM_LOW name
  inspect the IP name SDM_LOW esmtp
  inspect the tcp IP SDM_LOW name
  inspect the IP udp SDM_LOW name
  IP inspect name SDM_LOW ssh
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  Crypto pki trustpoint TP-self-signed-2909270577
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2909270577
  revocation checking no
  rsakeypair TP-self-signed-2909270577
  !
  !
  TP-self-signed-2909270577 crypto pki certificate chain
  certificate self-signed 01
  license udi pid CISCO1921/K9 sn FTX1715818R
  !
  !
  Archives
  The config log
  Enable logging
  size of logging 1000
  notify the contenttype in clear syslog
  the ADMIN_HOSTS object-group network
  71.X.X.X 71.X.X.X range
  !
  name of user name1 secret privilege 15 4 XXXXXXX

  !
  redundancy
  !
  !
  !
  !
  !
  property intellectual ssh time 60
  property intellectual ssh authentication-2 retries
  property intellectual ssh event logging
  property intellectual ssh version 2
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  !
  ISAKMP crypto client configuration group roaming_vpn
  key XXXXX
  DNS 192.168.10.10 10.1.1.1
  XXX.local field
  pool VPN_POOL_1
  ACL client_vpn_traffic
  netmask 255.255.255.0
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  !
  !
  !
  crypto dynamic-map VPN_DYNMAP_1 1
  Set the security association idle time 1800
  game of transformation-ESP-3DES-SHA
  market arriere-route
  !
  !
  list of authentication of card crypto SDM_CMAP_1 client VPN_AUTHEN
  map SDM_CMAP_1 isakmp authorization list network_vpn_author crypto
  client configuration address map SDM_CMAP_1 crypto answer
  map SDM_CMAP_1 65535-isakmp dynamic VPN_DYNMAP_1 ipsec crypto
  !
  !
  !
  !
  !
  the Embedded-Service-Engine0/0 interface
  no ip address
  Shutdown
  !
  interface GigabitEthernet0/0
  IP 76.W.E.R 255.255.255.248
  IP access-group ATT_Outside_In in
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NAT outside IP
  inspect the SDM_LOW over IP
  IP virtual-reassembly in
  load-interval 30
  automatic duplex
  automatic speed
  No cdp enable
  No mop enabled
  map SDM_CMAP_1 crypto
  !
  interface GigabitEthernet0/1
  no ip address
  load-interval 30
  automatic duplex
  automatic speed
  !
  interface GigabitEthernet0/1.10
  encapsulation dot1Q 1 native
  IP 192.168.10.1 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  property intellectual accounting-access violations
  IP nat inside
  IP virtual-reassembly in
  !
  interface GigabitEthernet0/1.100
  encapsulation dot1Q 100
  10.1.1.254 IP address 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly in
  !
  interface GigabitEthernet0/1,200
  encapsulation dot1Q 200
  IP 10.1.2.254 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly in
  IP tcp adjust-mss 1452
  !
  local IP VPN_POOL_1 192.168.168.193 pool 192.168.168.254
  IP forward-Protocol ND
  !
  IP http server
  IP http authentication aaa-authentication of connection ADMIN_AUTHEN
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  IP nat inside source map route ATT_NAT_LIST interface GigabitEthernet0/0 overload
  IP nat inside source static tcp 192.168.10.10 25 expandable 25 76.W.E.R
  IP nat inside source static tcp 192.168.10.10 80 76.W.E.R 80 extensible
  IP nat inside source static tcp 192.168.10.10 76.W.E.R expandable 443 443
  IP nat inside source static tcp 192.168.10.10 76.W.E.R expandable 987 987
  IP route 0.0.0.0 0.0.0.0 76.W.E.F
  !
  ATT_Outside_In extended IP access list
  permit tcp object-group ADMIN_HOSTS any eq 22
  allow any host 76.W.E.R eq www tcp
  allow any host 76.W.E.R eq 443 tcp
  allow 987 tcp any host 76.W.E.R eq
  allow any host 76.W.E.R eq tcp smtp
  permit any any icmp echo response
  allow icmp a whole
  allow udp any any eq isakmp
  allow an esp
  allow a whole ahp
  permit any any eq non500-isakmp udp
  deny ip 10.0.0.0 0.255.255.255 everything
  deny ip 172.16.0.0 0.15.255.255 all
  deny ip 192.168.0.0 0.0.255.255 everything
  deny ip 127.0.0.0 0.255.255.255 everything
  refuse the ip 255.255.255.255 host everything
  refuse the host ip 0.0.0.0 everything
  NAT_LIST extended IP access list
  IP 10.1.0.0 allow 0.0.255.255 everything
  permit ip 192.168.10.0 0.0.0.255 any
  deny ip 192.168.10.0 0.0.0.255 192.168.168.192 0.0.0.63
  refuse the 10.1.1.0 ip 0.0.0.255 192.168.168.192 0.0.0.63
  deny ip 10.1.2.0 0.0.0.255 192.168.168.192 0.0.0.63
  client_vpn_traffic extended IP access list
  permit ip 192.168.10.0 0.0.0.255 192.168.168.192 0.0.0.63
  ip licensing 10.1.1.0 0.0.0.255 192.168.168.192 0.0.0.63
  IP 10.1.2.0 allow 0.0.0.255 10.1.1.0 0.0.0.255
  !
  radius of the IP source-interface GigabitEthernet0/1.10
  Logging trap errors
  logging source hostname id
  logging source-interface GigabitEthernet0/1.10
  !
  ATT_NAT_LIST allowed 20 route map
  corresponds to the IP NAT_LIST
  is the interface GigabitEthernet0/0
  !
  !
  SNMP-server community [email protected] / * /! s RO
  Server enable SNMP traps snmp authentication linkdown, linkup warmstart cold start
  Server enable SNMP traps vrrp
  Server SNMP enable transceiver traps all the
  Server enable SNMP traps ds1
  Enable SNMP-Server intercepts the message-send-call failed remote server failure
  Enable SNMP-Server intercepts ATS
  Server enable SNMP traps eigrp
  Server enable SNMP traps ospf-change of State
  Enable SNMP-Server intercepts ospf errors
  SNMP Server enable ospf retransmit traps
  Server enable SNMP traps ospf lsa
  Server enable SNMP traps ospf nssa-trans-changes state cisco-change specific
  SNMP server activate interface specific cisco-ospf traps shamlink state change
  SNMP Server enable neighbor traps cisco-specific ospf to the State shamlink change
  Enable SNMP-Server intercepts specific to cisco ospf errors
  SNMP server activate specific cisco ospf retransmit traps
  Server enable SNMP traps ospf cisco specific lsa
  SNMP server activate license traps
  Server enable SNMP traps envmon
  traps to enable SNMP-Server ethernet cfm cc mep-top low-mep Dispatcher loop config
  Enable SNMP-Server intercepts ethernet cfm overlap missing mep mep-unknown service-up
  Server enable SNMP traps auth framework sec-violation
  Server enable SNMP traps c3g
  entity-sensor threshold traps SNMP-server enable
  Server enable SNMP traps adslline
  Server enable SNMP traps vdsl2line
  Server enable SNMP traps icsudsu
  Server enable SNMP traps ISDN call-information
  Server enable SNMP traps ISDN layer2
  Server enable SNMP traps ISDN chan-not-available
  Server enable SNMP traps ISDN ietf
  Server enable SNMP traps ds0-busyout
  Server enable SNMP traps ds1-loopback
  SNMP-Server enable traps energywise
  Server enable SNMP traps vstack
  SNMP traps enable mac-notification server
  Server enable SNMP traps bgp cbgp2
  Enable SNMP-Server intercepts isis
  Server enable SNMP traps ospfv3-change of State
  Enable SNMP-Server intercepts ospfv3 errors
  Server enable SNMP traps aaa_server
  Server enable SNMP traps atm subif
  Server enable SNMP traps cef resources-failure-change of State peer peer-fib-state-change inconsistency
  Server enable SNMP traps memory bufferpeak
  Server enable SNMP traps cnpd
  Server enable SNMP traps config-copy
  config SNMP-server enable traps
  Server enable SNMP traps config-ctid
  entity of traps activate SNMP Server
  Server enable SNMP traps fru-ctrl
  SNMP traps-policy resources enable server
  Server SNMP enable traps-Manager of event
  Server enable SNMP traps frames multi-links bundle-incompatibility
  SNMP traps-frame relay enable server
  Server enable SNMP traps subif frame relay
  Server enable SNMP traps hsrp
  Server enable SNMP traps ipmulticast
  Server enable SNMP traps msdp
  Server enable SNMP traps mvpn
  Server enable SNMP traps PNDH nhs
  Server enable SNMP traps PNDH nhc
  Server enable SNMP traps PNDH PSN
  Server enable SNMP traps PNDH exceeded quota
  Server enable SNMP traps pim neighbor-rp-mapping-change invalid-pim-message of change
  Server enable SNMP traps pppoe
  Enable SNMP-server holds the CPU threshold
  SNMP Server enable rsvp traps
  Server enable SNMP traps syslog
  Server enable SNMP traps l2tun session
  Server enable SNMP traps l2tun pseudowire status
  Server enable SNMP traps vtp
  Enable SNMP-Server intercepts waas
  Server enable SNMP traps ipsla
  Server enable SNMP traps bfd
  Server enable SNMP traps gdoi gm-early-registration
  Server enable SNMP traps gdoi full-save-gm
  Server enable SNMP traps gdoi gm-re-register
  Server enable SNMP traps gdoi gm - generate a new key-rcvd
  Server enable SNMP traps gdoi gm - generate a new key-fail
  Server enable SNMP traps gdoi ks - generate a new key-pushed
  Enable SNMP traps gdoi gm-incomplete-cfg Server
  Enable SNMP-Server intercepts gdoi ks-No.-rsa-keys
  Server enable SNMP traps gdoi ks-new-registration
  Server enable SNMP traps gdoi ks-reg-complete
  Enable SNMP-Server Firewall state of traps
  SNMP-Server enable traps ike policy add
  Enable SNMP-Server intercepts removal of ike policy
  Enable SNMP-Server intercepts start ike tunnel
  Enable SNMP-Server intercepts stop ike tunnel
  SNMP server activate ipsec cryptomap add traps
  SNMP server activate ipsec cryptomap remove traps
  SNMP server activate ipsec cryptomap attach traps
  SNMP server activate ipsec cryptomap detach traps
  Server SNMP traps enable ipsec tunnel beginning
  SNMP-Server enable traps stop ipsec tunnel
  Enable SNMP-server holds too many associations of ipsec security
  Enable SNMP-Server intercepts alarm ethernet cfm
  Enable SNMP-Server intercepts rf
  Server enable SNMP traps vrfmib vrf - up low-vrf vnet-trunk-up low-trunk-vnet
  Server RADIUS dead-criteria life 2
  RADIUS-server host 192.168.10.10
  Server RADIUS 2 timeout
  Server RADIUS XXXXXXX key
  !
  !
  !
  control plan
  !
  !

  Line con 0
  privilege level 15
  connection of authentication radius_auth
  line to 0
  line 2
  no activation-character
  No exec
  preferred no transport
  transport of entry all
  transport output pad rlogin lapb - your MOP v120 udptn ssh telnet
  StopBits 1
  line vty 0 4
  privilege level 15
  connection of authentication radius_auth
  entry ssh transport
  line vty 5 15
  privilege level 15
  connection of authentication radius_auth
  entry ssh transport
  !
  Scheduler allocate 20000 1000
  NTP-Calendar Update
  Server NTP 192.168.10.10
  NTP 64.250.229.100 Server
  !
  end

  Router ipsec crypto #sh her

  Interface: GigabitEthernet0/0
  Tag crypto map: SDM_CMAP_1, local addr 76.W.E.R

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (0.0.0.0/0.0.0.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.168.213/255.255.255.255/0/0)
  current_peer 75.X.X.X port 2642
  LICENCE, flags is {}
  #pkts program: 1953, #pkts encrypt: 1953, #pkts digest: 1953
  #pkts decaps: 1963, #pkts decrypt: 1963, #pkts check: 1963
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 76.W.E.R, remote Start crypto. : 75.X.X.X
  Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0
  current outbound SPI: 0x5D423270 (1564619376)
  PFS (Y/N): N, Diffie-Hellman group: no

  SAS of the esp on arrival:
  SPI: 0x2A5177DD (709982173)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel UDP-program}
  Conn ID: 2115, flow_id: VPN:115 on board, sibling_flags 80000040, crypto card: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4301748/2809)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE (ACTIVE)

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0x5D423270 (1564619376)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel UDP-program}
  Conn ID: 2116, flow_id: VPN:116 on board, sibling_flags 80000040, crypto card: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4301637/2809)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE (ACTIVE)

  outgoing ah sas:

  outgoing CFP sas:

  Routing crypto isakmp #sh its
  IPv4 Crypto ISAKMP Security Association
  DST CBC conn-State id
  76.W.E.R 75.X.X.X QM_IDLE 1055 ACTIVE

  IPv6 Crypto ISAKMP Security Association

  

  

  In your acl, nat, you will need to refuse your VPN traffic before you allow the subnet at all. Just put all the declarations of refusal before the declarations of licence.

  Sent by Cisco Support technique iPhone App