Traffic going only 1-way?

Similar Questions

• Traffic permitted only one-way for VPN-connected computers

  Hello

  I currently have an ASA 5505.  I put up as a remote SSL VPN access. My computers can connect to the VPN very well.  They just cannot access the internal network (192.168.250.0).  They cannot ping the inside interface of the ASA, nor any of the machines.  It seems that all traffic is blocked for them.  The strange thing is that when someone is connected to the VPN, I can ping this ASA VPN connection machine and other machines inside the LAN.  It seems that the traffic allows only one way.  I messed up with ACL with nothing doesn't.  Any suggestions please?

  Pool DHCP-192.168.250.20 - 50--> for LAN

  Pool VPN: 192.168.250.100 and 192.168.250.101

  Outside interface to get the modem DHCP

  The inside interface: 192.168.1.1

  Courses Running Config:

  : Saved

  :

  ASA Version 8.2 (5)

  !

  hostname HardmanASA

  activate the password # encrypted

  passwd # encrypted

  names of

  !

  interface Ethernet0/0

  switchport access vlan 20

  !

  interface Ethernet0/1

  switchport access vlan 10

  !

  interface Ethernet0/2

  switchport access vlan 10

  !

  interface Ethernet0/3

  Shutdown

  !

  interface Ethernet0/4

  Shutdown

  !

  interface Ethernet0/5

  Shutdown

  !

  interface Ethernet0/6

  Shutdown

  !

  interface Ethernet0/7

  switchport access vlan 10

  !

  interface Vlan1

  No nameif

  no level of security

  no ip address

  !

  interface Vlan10

  nameif inside

  security-level 100

  IP 192.168.250.1 255.255.255.0

  !

  interface Vlan20

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  passive FTP mode

  DNS lookup field inside

  DNS domain-lookup outside

  pager lines 24

  Within 1500 MTU

  Outside 1500 MTU

  mask 192.168.250.100 - 192.168.250.101 255.255.255.0 IP local pool VPN_Pool

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  Global interface 10 (external)

  NAT (inside) 10 192.168.250.0 255.255.255.0

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  Enable http server

  http 192.168.250.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Telnet timeout 5

  SSH 192.168.250.0 255.255.255.0 inside

  SSH timeout 5

  SSH version 2

  Console timeout 0

  dhcpd dns 8.8.8.8

  !

  dhcpd address 192.168.250.20 - 192.168.250.50 inside

  dhcpd allow inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  allow outside

  SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image

  SVC disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2 image

  Picture disk0:/anyconnect-linux-2.5.2014-k9.pkg 3 SVC

  enable SVC

  tunnel-group-list activate

  attributes of Group Policy DfltGrpPolicy

  value of server DNS 8.8.8.8

  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

  tunnel-group AnyConnect type remote access

  tunnel-group AnyConnect General attributes

  address pool VPN_Pool

  tunnel-group AnyConnect webvpn-attributes

  enable AnyConnect group-alias

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  Review the ip options

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  call-home

  Profile of CiscoTAC-1

  no active account

  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

  email address of destination [email protected] / * /

  destination-mode http transport

  Subscribe to alert-group diagnosis

  Subscribe to alert-group environment

  Subscribe to alert-group monthly periodic inventory

  monthly periodicals to subscribe to alert-group configuration

  daily periodic subscribe to alert-group telemetry

  Cryptochecksum:30fadff4b400e42e73e17167828e046f

  : end

  Hello

  No worries

  As we change the config I would do as well as possible.

  First, it is strongly recommended to use a different range of IP addresses for VPN clients and the internal network

  No VPN_Pool 192.168.250.100 - 192.168.250.101 255.255.255.0 ip local pool mask

  mask 192.168.251.100 - 192.168.251.101 255.255.255.0 IP local pool VPN_Pool

  NAT_0 ip 192.168.250.0 access list allow 255.255.255.0 192.168.251.0 255.255.255.0

  NAT (inside) 0-list of access NAT_0

  Then give it a try and it work note this post hehe

• VPN launched only one way

  Does anyone have an idea why a site to site VPN tunnel could only be put in place a way? I have a pix to connect to a vpn tunnel using NAT - T IPSEC concentrator. Since the hub if I initiate traffic to the pix, the tunnel rises and then I can access resources behind the hub on the side pix.

  If I try to open the flow of the side pix, the tunnel will not come to the top. Debugging on the pix, it's not even trying to open the tunnel.

  Here is an excerpt of the pix config:

  Crypto ipsec transform-set esp-3des esp-sha-hmac bench

  map TestMap 10 ipsec-isakmp crypto

  card crypto TestMap 10 corresponds to the address ACL_VPN

  card crypto TestMap 10 peer set 10.10.10.1

  card crypto TestMap 10 set transform-set bench

  TestMap outside crypto map interface

  ISAKMP allows outside

  ISAKMP key * address 10.10.10.1 netmask 255.255.255.255

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 sha hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  I'm just using 10. address of the top for the peer for example. The ACL_VPN specifies local/remote subnets correctly. The default route is the external interface of the pix.

  The hub, I've specified that the tunnel is bidirectional.

  Everyone why it will undertake only a way to any idea?

  See you soon

  Brian

  Thanks for posting your "ACL_VPN" and your NAT Exemption ACL ACL.

  Thank you!

• A PIX-to-PIX VPN can allow traffic in only one direction?

  Here is the configuration of the PIX 501 that accepts incoming VPN tunnels of the other PIX dynamic-ip.  Everything works very well, allowing traffic to flow both ways after that the tunnel rises.  But then I somehow limit or prevent the traffic that originates on the PIX (192.168.27.2) to go to other networks of PIX?  In other words, if a tunnel exists (192.168.3.0 to 192.168.27.0), I only want to allow network traffic to access the network 27.0 3.0, and I want to anyone on the network 27.0 access network 3.0.

  Thanks for any comments.

  pixfirewall # sh conf
  : Saved
  : Written by enable_15 at 13:29:50.396 UTC Saturday, July 3, 2010
  6.3 (4) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate the encrypted password
  encrypted passwd
  pixfirewall hostname
  .com domain name
  fixup protocol dns-maximum length 4096
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol they 389
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list 101 permit ip 192.168.27.0 255.255.255.0 10.10.10.0 255.255.255.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 10.10.0.0 255.255.0.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 192.168.3.0 255.255.255.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 192.168.7.0 255.255.255.0
  pager lines 24
  ICMP deny everything outside
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside xxx.xxx.xxx.248 255.255.255.255
  IP address inside 192.168.27.2 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  IP local pool ippool 10.10.10.1 - 10.10.10.254
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  NAT (inside) - 0 102 access list
  Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.1 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set esp - esp-md5-hmac gvnset
  Crypto-map dynamic dynmap 10 transform-set gvnset
  gvnmap 10 card crypto ipsec-isakmp dynamic dynmap
  gvnmap interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address 0.0.0.0 netmask 0.0.0.0
  ISAKMP identity address
  ISAKMP keepalive 60
  ISAKMP nat-traversal 20
  part of pre authentication ISAKMP policy 9
  encryption of ISAKMP policy 9
  ISAKMP policy 9 md5 hash
  9 2 ISAKMP policy group
  ISAKMP policy 9 life 86400
  vpngroup address ippool pool gvnclient
  vpngroup dns 192.168.27.1 Server gvnclient
  vpngroup gvnclient wins server - 192.168.27.1
  vpngroup gvnclient by default-domain '.com'
  vpngroup split tunnel 101 gvnclient
  vpngroup idle 1800 gvnclient-time
  vpngroup password gvnclient *.
  Telnet 0.0.0.0 0.0.0.0 inside
  Telnet timeout 30
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH timeout 30
  management-access inside
  Console timeout 0
  Terminal width 80
  Cryptochecksum:
  pixfirewall #.

  Of course, without a doubt capable.

  You can configure the inside interface access list to deny traffic from 192.168.27.0/24 to 192.168.3.0/24, and then allow anything else.

  Example:

  access list for the Interior-acl deny ip 192.168.27.0 255.255.255.0 192.168.3.0 255.255.255.0

  the Interior-acl ip access list allow a whole

  group-access Interior-acl in the interface inside

  Hope that helps.

• Windows appear on the taskbar, but won't focus, other 3 goes, only 1 that seems to be the main window is not found

  Windows appear on the taskbar, but won't focus, other 3 goes, only 1 that seems to be the main window is not found

  ALT + tab select window; ALT + SPACEBAR; maximize; sigh

• Calendar sync only one way

  Hello

  my iphone 4S calendar calendar app and google used to synchronize with each other, but only the application of the phone's calendar now receives new entries.
  IE: no appointment I do on the phone do not appear on my calendar google on a computer. It is a new problem, but I don't think I've changed settings to icloud. I've read through similar forum posts. Any ideas?

  Thank you

  Your profile says you have an iPhone 4 running iOS 7.1.2 s.  I'll assume that you have indeed an iPhone 4s, but it runs the latest version of iOS (9.3.2).

  Open the calendar on your iPhone app.  Click on the "Calendars" button at the bottom in the Center.  Are shown the correct calendars?  Are you sure when you add an event on the iPhone, he's going to the desired calendar?

• L70-A-K5S - Sound satellite goes only to the helmet

  Just Bough Satellite L70-A-K5S.
  Sound is only going through a headset. When plugged headphones, his (music, Skype) can be heard through speakers for a few seconds, then silence.
  I checked all the options - mute, levels, effects. Everything looks ok. I have updated driver for conexant.
  Did not help.

  Music/voice plays for a few seconds then stops (so that meters in the mixer shows it goes again).

  Hello

  and the sound is still visible using the headset?
  Well, for me it looks like a malfunction of speaker since returning to factory settings should solve all possible software problems. So I think that its hardware problem.

  However, I recommend to check some display settings.
  First go to Panel of-> sound-> the Read tab
  Here, you must make sure that the speakers are marked as the default device.

  It would also be interesting to remove the following devices in Device Manager:
  -in audio, video, game controller uninstall Conexant audio driver
  -devices to remove the High Definition Audio Controller

  Finally, reboot and retest the sound.

• lifeCam Studio Window xp SP3 Mic works only half way thur video recording

  My new webcam works fine on Skype for the photo and the microphone, but when I run a video of my grandson little, the image in the back room is very good.

  but the voice is only heard part way thur, setting on 640 * 360.  Thanks for any Help Window XP Sp3

  Hello

  1 how long have you been faced with this problem?

  2 have you made changes on the computer before this problem?

  3. are you watching a recorded video, or you are on a video call with your grandson?

  Answering these questions could help us help you better.

  You can also try to contact Skype support team to help on this issue.

• MS Exchange Contacts will sync only a way

  I had problems with the synchronization since the upgrade to 1.3.1 and noticed Friday that a contact that I had entered in Exchange was not synchronized with the Pre even after several synchronizations "forced."

  Further investigation this morning, I discovered that it was not an isolated incident and indeed all new contacts/amendments to existing contacts are not reflected on the meadow.

  However, new contacts/amendments generated on the meadow are synchronization with Exchange.

  After reading some of the threads and having lived in the better 'hit and miss' sync with the calendar and emails, I went through the routine to turn off zone schedule and partial erasure etc. suggested in a related thread dealing with the one-way only calendar synchronization (even if it was the other way around - that is to say the amendments Exchange will Pre but not Pre to Exchange).

  Sort, the timing seems now to be behaving very well (both directions) as is the email address, but (now empty in my pre) Contacts will not Exchange matter.

  All test contacts created on the pre sync correctly as do the amendments of pre to Exchange but absolutely nothing of the other way around (including contacts that appear in Exchange created in the meadow as a test).

  I deleted all the contacts Exchange, synchronized and then reimported them - no joy.

  Is there an Exchange that might have changed or needs to be changed by the LATTER?

  I am at a complete loss and very frustrated - he was working perfectly fine until the 1.3.1 update!

  Any advice would be welcome.

  Details:

  Exchange 2003 (running via Outlook) on desktop

  Windows XP (SP2 - Yes, I know that we should be on at least SP3 but I'm new in society and do not want to disturb IT!)

  Palm Pre on O2 network

  Thank you.

  Following messages earlier, I have also noticed that the emails would be to synchronize only when Outlook is running on my local computer or I was running remote webmail.

  It turns out that all of these mistakes seem to emanate from a problem of anti-virus.

  The COMPUTING service found a registry tweak as follows:

  "Change a pair of parameters in the registry on the Exchange Server:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan
  The value of VirusScan = 1 (proactive analysis occurs when an element is given in a folder, but a request was not made by a customer)

  The value ReloadNow = 1 (by default, this value is set to zero, by setting this value to '1', Exchange will reload the configuration settings in the registry and reload the provider DLL.) Once this value is reset to '0' by Exchange.)

  This fix works for Symantec and CA (and perhaps others). »

  This seems to have been around on my Pre (including issues of contacts) and interestingly there are other users with iPhones that had problems of synchronization and these also work well.

  I posted this solution because it seems the lack of response to my earlier posts is not a quite well known difficulty.

• BlackBerry Smartphones Yahoo contacts synchronizes only one way

  Sync OTA between the Contacts of Yahoo and the BB address book synchronizes only Yahoo for my BB.  If I make changes on a contact in Yahoo, it appears on the BB in 4 hours.  But if I make a change to a contact on my BB, the change does not appear in Yahoo.  Does anyone else have this problem or does anyone know if this is supposed to work this way or not?

  After you delete the account of the phone completely and then add, everything worked normally.  In fact, it seems to be synchronization immediately, rather than the 4 hour time limit specified in the master of BIS.

• Start-up mode normal or secure, proven system repair goes only blue screen

  I know it's a lot, so I understand if you don't want to help you.

  I have a Dell Studio 1737 laptop.  It has Vista.  I had the virus in the System32 in a folder called Services.exe.  The computer should boot & windows would start.  Then an error pops up: System will restart, close & save all of the work, a critical error has occurred. Also MS Security Essentials showed the virus in the System32 folder, he said in order to clean the system of the computer must be restarted.  I continued to clean and restart my computer several times.  I even rebooted in Mode safe to remove the virus.  Nothing has worked.

  Finally, I rebooted in Mode safe mode with command prompt & I manually deleted the Services folder where the virus.  There are 2 folders called Services but had a Services.exe so I deleted that one.  Now, whenever I restart my computer, it goes to the blue screen:

  A process or thread crucial to system operation has unexpectedly left or came to an end.

  Disable the BIOS memory options such as implementing caching or shading.

  Press F8 to start in SafeMode to restart

  STOP: 0X000000F4

  It does not start mode without failure.

  I tried pressing F8 repeatedly & select repair system restore back to factory settings, but it does not work.

  It said please wait about 30 seconds & then he'll sign on the screen: another user.  I tried my user/administrator name & the password, but it will not

  accept.  My. admin & password is typed correctly.

  Please help to post the answer here or by e-mail at littlemountzion@yahoo.com, thank you.

  Hello

  Read this information:

  "The computer does not start in Microsoft Windows Vista"

  http://support.Dell.com/support/topics/global.aspx/support/KCS/document?docid=DSN_343119&isLegacy=true

  And this;

  "How to run Dell 32-bit Diagnostics utility"

  http://support.Dell.com/support/topics/global.aspx/support/KCS/document?docid=52057

  See you soon.

• Internet connection going, only fixed by restarting?

  I recently had to reinstall Vista after it was trashed by one of its own updates and since then I had the problem I used to recover the past, months where every two days, the wireless internet stops working and a reboot seems to be the only thing he will get.  Y at - it an update or service pack or something I'm missing?

  Hello

  Try to update the driver:

  Control Panel - network - write down of the brand and the model of the Wifi - double click top - tab of the driver - write
  version - click the driver update (cannot do something that MS is far behind the pilots of certification). Then
  Right click on the Wifi device and UNINSTALL - Reboot - it will refresh the driver stack.

  Look at the sites of the manufacturer for drivers - and the manufacturer of the device manually.
  http://pcsupport.about.com/od/driverssupport/HT/driverdlmfgr.htm

  How to install a device driver in Vista Device Manager
  http://www.Vistax64.com/tutorials/193584-Device-Manager-install-driver.html

  Download - SAVE - go where you put it - right click – RUN AS ADMIN.

  You can download several at once however restart after the installation of each of them.

  After watching the system manufacturer, you can check the manufacturer of the device an even newer version. (The
  manufacturer of system become your backup policies).

  Repeat for network (NIC) card and is a good time to get the other updated drivers as Vista like
  updated drivers.

  I would also turn off auto update for the drivers. If the updates Windows suggests a just HIDE as they
  are almost always old, and you can search drivers manually as needed.

  How to disable automatic driver Installation in Windows Vista - drivers
  http://www.AddictiveTips.com/Windows-Tips/how-to-disable-automatic-driver-installation-in-Windows-Vista/
  http://TechNet.Microsoft.com/en-us/library/cc730606 (WS.10) .aspx

  I hope this helps.

• dot1x system-auth-control on 62xx and all port/traffic goes down?

  Hello

  with three VLANS, and now presenting only certain ports that I do the dot1x:

  RD (config) #dot1x # system - auth - control enable

  RD (config) #aaa authentication dot1x default # spot within a RADIUS to RADIUS

  RD (config) #interface ethernet 1/g1 # bind it to a port

  RD #dot1x (config-if-1/g1) auto # config dot1x port-control

  I assumed dot1x must be forced/enabled on port/int per basis and before it's done there's no dot1x, but it seems that - dot1x system-auth-control - does not wait for anything and everything stops instantly.

  Is this desired behavior?

  And if yes then how introduced little by little dot1x, looking fixedly with an ethernet port that are configured as here:

  1/g1

  Flow control: enabled

  Port: g1/1

  Belonging to a VLAN: access mode Mode

  Operating parameters:

  PVID: 1

  Capture filtering: enabled

  Acceptable frame type: no label

  Default priority: 0

  GVRP status: Disabled

  Protected: disabled

  -Other - or ITU (q)

  Port 1/g1 is a member of:

  Rule of VLAN name evacuation Type

  ----    --------------------------------- -----------   --------

  1 by default not marked by default

  Static configuration:

  PVID: 1

  Capture filtering: enabled

  Acceptable frame type: no label

  Port 1/g1 is configured statically:

  Output name rule of VLAN

  ----    --------------------------------- -----------

  Prohibition of VLAN:

  Name of VLAN

  ----    ---------------------------------

  A lot! Thank you

  L.

  OK, you can implement other dot1x controls without having them no effect on the switch until the "dot1x system-auth-control' is given.

  I will certainly take a look at your other post.

• BBM BBM works only one-way

  Hello

  Since yesterday (2016-01-26) the following error portfolio:

  Messages sent from a BlackBerry device are received, but the messages that I send to a BlackBerry smartphone get only the check box, but no D or R marking.

  I use BBM on an Android phone, with the most recent version 2.11.0.18

  Try to solve the problem I did the following steps - but none of them changed something in the behaviour:

  . Restart of BBM

  . Restaring the phone

  . Reinstalling BBM

  . Try BBM on two other Android devices

  . Try to create a group - for this my invitation was received by the BlackBerry device, but cannot be accepted

  . You try to join a group - I received the invitation and I could accept it, but the group does not appear

  . Try a cat prlvate

  . Try another account

  The only thing that works is the exchange between two Android devices.

  Another curiosity: yesterday and today, that one message has send - only!

  I have some other ideas that I could try to solve the problem - did someone knows more? Is there a network BlackBerry problem?

  Today, I was able to exchange a few messages again, it seams to work again.

  Without changing anything.

• BlackBerry Smartphones help BB Storm will synchronize only one way

  When I enter an appointment in my calendar from device, and then try Outlook 2003 calendar SYC, it will not be synchronized (appointments appear in my Outlook calendar).  If I enter my Outlook calendar appointment it will synchronize the appointments on my device.  I have entered in the configuration of the Fund Manager and assign the two-way synchronization. Still no luck.

  I found the problem.  When you create a new appointment, there is an article that says "send help:" this is a list of all email addresses you receive from emails on your Blackberry.  In some ways, the email address was changed to another.  This has caused the problem of synchronization.  Once I changed it to one that was already there, the two way sync worked.

  I still don't know where you configure what email address it uses.  If someone knows let me know.  Or email to three addresses are emails that I synchronize in Outlook.