VLANS with Cisco ASA 5505 and non-Cisco switch

Similar Questions

• Site to Site VPN between Cisco ASA 5505 and Sonicwall TZ170

  I'm trying to implement a VPN site-to site between our data center and office.  The data center has a Cisco ASA 5505 and the Office has a Sonicwall TZ170.  I managed to configure the two so that the vpn connects.  Each of the firewall I ping the IP Address of the internet firewall on the other side and a desktop computer I can ping the IP Address of the firewall internal datacenter but I can't carry traffic between private subnets datacenter and desktop.  Can anyone help?

  The config below has had IPs/passwords has changed.

  External Datacenter: 1.1.1.4

  External office: 1.1.1.1

  Internal data center: 10.5.0.1/24

  Internal office: 10.10.0.1/24

  : Saved
  :
  ASA Version 8.2 (1)
  !
  hostname datacenterfirewall
  mydomain.tld domain name
  activate the password encrypted
  passwd encrypted
  names of
  name 10.10.0.0 OfficeNetwork
  10.5.0.0 DatacenterNetwork name
  !
  interface Vlan1
  nameif inside
  security-level 100
  10.5.0.1 IP address 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  1.1.1.4 IP address 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passive FTP mode
  clock timezone IS - 5
  clock to summer time EDT recurring
  DNS server-group DefaultDNS
  buydomains.com domain name
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  inside_access_in list extended access permit icmp any one
  inside_access_in list extended access permitted tcp a whole
  inside_access_in list extended access udp allowed a whole
  inside_access_in of access allowed any ip an extended list
  outside_access_in list extended access permit icmp any one
  outside_access_in list extended access udp allowed any any eq isakmp
  IP DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0 allow Access-list extended pixtosw
  pixtosw list extended access allow icmp DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0
  IP OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0 allow Access-list extended pixtosw
  pixtosw list extended access allow icmp OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0
  outside_cryptomap_66.1 list of allowed ip extended access all OfficeNetwork 255.255.255.0
  outside_cryptomap_66.1 ip OfficeNetwork 255.255.255.0 allowed extended access list all
  outside_cryptomap_66.1 list extended access permit icmp any OfficeNetwork 255.255.255.0
  outside_cryptomap_66.1 list extended access allowed icmp OfficeNetwork 255.255.255.0 everything
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  IP verify reverse path to the outside interface
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 623.bin
  don't allow no asdm history
  ARP timeout 14400
  NAT-control
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  inside_access_in access to the interface inside group
  Access-group outside_access_in in interface outside
  Route inside 0.0.0.0 0.0.0.0 1.1.1.1 1
  Route OfficeNetwork 255.255.255.0 outside 1.1.1.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 10.5.0.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set esp-aes-256 walthamoffice, esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto dynamic-map ciscopix 1 corresponds to the address outside_cryptomap_66.1
  Crypto dynamic-map ciscopix 1 transform-set walthamoffice
  Crypto dynamic-map ciscopix 1 the value reverse-road
  map dynmaptosw 66-isakmp ipsec crypto dynamic ciscopix
  dynmaptosw interface card crypto outside
  crypto isakmp identity address
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 13
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  lifetime 28800
  crypto ISAKMP policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  Telnet 10.5.0.0 255.255.255.0 inside
  Telnet timeout 5
  SSH 10.5.0.0 255.255.255.0 inside
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd address 10.5.0.2 - 10.5.0.254 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  NTP server 66.250.45.2 source outdoors
  NTP server 72.18.205.157 source outdoors
  NTP server 208.53.158.34 source outdoors
  WebVPN
  attributes of Group Policy DfltGrpPolicy
  VPN-idle-timeout no
  username admin password encrypted
  tunnel-group 1.1.1.1 type ipsec-l2l
  tunnel-group 1.1.1.1 ipsec-attributes
  pre-shared-key *.
  !
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  !
  context of prompt hostname
  Cryptochecksum:7f319172e5de9c0e550804a263f8e49e
  : end

  Mattew, obvious lack of education is the rule exempt from nat for your tunnel, your access list pixtosw is similar on this example, I assume that you have gone through this link, if it does not see the configs on both sides.

  Add the statement of rule sheep in asa and try again.

  NAT (inside) 0-list of access pixtosw

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008052c9d4.shtml

  Concerning

• Cisco asa 5505 and centos VPN server connection

  Hi all

  Please I want to set up a VPN between Cisco asa 5505 and centos server.

  Here's my senerio

  -------------------------

  ASA 5505

  Public IP 155.155.155.2

  Local NETWORK: 192.168.6.X

  CentOS Server

  ------------------

  Public ip address: 155.155.155.6

  Thank you guys

  Apology, do you mean access remote VPN Client of hundred BONE for Cisco ASA 5505?

  If the remote access, here are the sample configuration:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008060f25c.shtml

• How can I get voice and data to work with the ASA 5505?

  Here's the issue I'm having.   Can I get a Cisco 7940 to work behind one site to another configured ASA 5505 and I can also get data to work behind it.  However, when I try to create a separate Vlan for voice and data, it does not work.  Our voice VLANs on our remote sites are 172.30 and data are 172.31, when I put the inside interface with 172.31 data will work and when I on it 172.30 voice will work.  I upgraded to a security more license and tried vlan3 created as voice.  I have the data to the top and work but I can't get vlan3 to work.   Any help would be greatly appreciated.  Thank you

  Here is my current config:

  hostname TESTvpn
  activate the password xxxxx

  passwd xxxxx

  username admin password xxxxx privilege 15

  name Corp_LAN 10.0.0.0
  name 192.168.64.0 Corp_Voice
  name 172.31.155.0 TESTvpn

  object-group network SunVoyager
  host of the object-Network 64.70.8.160
  host of the object-Network 64.70.8.242

  the Corp_Networks object-group network
  network-object Corp_LAN 255.0.0.0
  object-network Corp_Voice 255.255.255.0

  interface vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  No tap

  interface vlan1
  nameif inside
  security-level 100
  IP 172.31.155.1 255.255.255.0
  No tap

  interface vlan3
  nameif Corp_Voice
  security-level 100
  IP 172.30.155.1 255.255.255.0
  No tap

  output
  interface Ethernet0/0
  switchport access vlan 2
  No tap

  interface Ethernet0/7
  switchport access vlan 3
  No tap

  output

  dhcpd allow inside
  dhcpd address 172.31.155.10 - 172.31.155.30 inside
  dhcpd dns 10.10.10.7 10.10.10.44 interface inside
  dhcpd sun.ins area inside interface
  dhcpd allow inside

  enable Corp_Voice dhcpd
  dhcpd address 172.30.155.10 - 172.30.155.30 Corp_Voice
  dhcpd dns 10.10.10.7 10.10.10.44 interface Corp_Voice
  dhcpd interface of sun.ins of the Corp_Voice domain
  enable Corp_Voice dhcpd
  dhcpd option 150 ip 192.168.64.4 192.168.64.3

  Enable logging
  exploitation forest buffer-size 10000
  monitor debug logging
  logging buffered information
  asdm of logging of information

  outside_access_in list extended access allow all unreachable icmp
  outside_access_in list extended access permit icmp any any echo response
  outside_access_in list extended access permit icmp any one time exceed
  access extensive list ip 172.31.155.0 inside_access_in allow 255.255.255.0 any
  inside_access_in list extended access allow icmp 172.31.155.0 255.255.255.0 any
  Access extensive list ip 172.30.155.0 Corp_Voice_access_in allow 255.255.255.0 any
  Corp_Voice_access_in list extended access allow icmp 172.30.155.0 255.255.255.0 any

  VPN access list extended deny ip 172.31.155.0 255.255.255.0 object-group SunVoyager
  extended VPN ip 172.31.155.0 access list allow 255.255.255.0 any

  inside_access_in access to the interface inside group
  Access-group outside_access_in in interface outside
  Access-group Corp_Voice_access_in in the Corp_Voice interface

  Global 1 interface (outside)
  NAT (inside) 0-list of access VPN
  NAT (inside) 1 172.31.155.0 255.255.255.0

  Enable http server
  http 172.31.155.0 255.255.255.0 inside
  http 172.30.155.0 255.255.255.0 Corp_Voice
  http 192.168.64.0 255.255.255.0 Corp_Voice
  http 10.0.0.0 255.0.0.0 inside
  http 65.170.136.64 255.255.255.224 outside
  SSH 10.0.0.0 255.0.0.0 inside
  SSH 172.31.155.0 255.255.255.0 inside
  SSH 65.170.136.64 255.255.255.224 outside
  SSH timeout 20

  management-access inside

  dhcpd outside auto_config

  Crypto ipsec transform-set esp-3des esp-md5-hmac VPN
  crypto map outside_map 1 is the VPN address
  peer set card crypto outside_map 1 66.170.136.65
  card crypto outside_map 1 the value transform-set VPN
  outside_map interface card crypto outside
  crypto isakmp identity address
  crypto ISAKMP allow outside
  crypto ISAKMP policy 1
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  lifetime 28800

  tunnel-group 66.170.136.65 type ipsec-l2l
  IPSec-attributes tunnel-group 66.170.136.65
  pre-shared-key xxxxx

  output
  int eth 0/1
  close
  No tap
  int eth 0/2
  close
  No tap
  int eth 0/3
  close
  No tap
  int eth 0/4
  close
  No tap
  int eth 0/5
  close
  No tap
  int eth 0/6
  close
  No tap
  int eth 0/7
  close
  No tap

  Peter,

  Note that access list names are case-sensitive, so you've actually done something different from what I proposed.

  Please do:

  no nat (Corp_Voice) 0-list of access vpn

  No list of vpn access extended permitted ip TESTvpn 255.255.255.0 everything
  IP 172.30.155.0 255.255.255.0 extended vpn access do not allow any list all

  extended VPN ip 172.30.155.0 access list allow 255.255.255.0 any

  NAT (Corp_Voice) 0-list of access VPN

  In the case where you did deliberately, for example to separate the 2 acl: note that acl VPN (upper case) is also used in the encryption card, where you cannot add a second LCD.

  So if you want to separate you, you will need 3 access lists:

  list of access data-vpn ip TESTvpn 255.255.255.0 allow one

  voice-vpn ip 172.30.155.0 access list allow 255.255.255.0 any

  access-list all - vpn ip TESTvpn 255.255.255.0 allow one

  access-list all - vpn ip 172.30.155.0 allow 255.255.255.0 any

  NAT (inside) 0-list of access vpn data

  NAT (Corp_Voice) - access list 0 voice-vpn

  outside_map 1 match address all vpn crypto card

  Don't know if this was also clearly to my previous message, I recommend you to replace the "all" (in each of the ACL lines) to something more specific (i.e. a remote network, or group of objects that contain the remote networks).

  HTH

  Herbert

• How to accompany the IDS in ASA 5505 and 5520?

  Dear All;

  We have the following configuration of HW for the ASA 5505 and ASA 5520, we add the functionality of system of detection of Intrusion (IDS) to the two ASA. My question is: what are the modules required to support this function, and what is the deference between IPS and IDS, fact the same Module both the feature?

  Part number:	Description	QTY.
  ASA5505-BUN-K9	ASA 5505 appliance with SW 10 users, 8 ports, 3DES/AES	1
  CON-SNT-AS5BUNK9	SMARTNET 8X5XNBD ASA5505-BUN-K9	1
  SF-ASA5505 - 8.2 - K8	ASA 5505 Series Software v8.2	1
  CAB-AC-C5	Power supply cord Type C5 U.S.	1
  ASA5500-BA-K9	ASA 5500 license (3DES/AES) encryption	1
  ASA5505-PWR-AC	ASA 5505 power adapter	1
  ASA5505-SW-10	ASA 5505 10 user software license	1
  SSC-WHITE	ASA 5505 hood SSC of the location empty	1
  ASA-ANYCONN-CSD-K9	ASA 5500 AnyConnect Client + Cisco Security Office software	1

  Part number:	Description	QTY.
  ASA5520-BUN-K9	ASA 5520 appliance with SW HA, 4GE + 1FE, 3DES/AES	2
  CON-SNT-AS2BUNK9	SMARTNET 8X5XNBD ASA5520 w/300 VPN Prs 4GE + 1FE3DES/AES	2
  ASA5520-VPN-PL	ASA 5520 VPN over 750 IPsec User License (7.0 only)	2
  ASA-VPN-CLNT-K9	Cisco VPN Client (Windows Solaris Linux Mac) software	2
  SF - ASA - 8.2 - K8	ASA 5500 Series Software v8.2	2
  CAB - ACU	Power supply cord (UK) C13 BS 1363 2.5 m	2
  ASA-180W-PWR-AC	Power supply ASA 180W	2
  ASA5500-BA-K9	ASA 5500 license (3DES/AES) encryption	2
  ASA-ANYCONN-CSD-K9	ASA 5500 AnyConnect Client + Cisco Security Office software	2
  SSM-WHITE	ASA/IPS SSM hood of the location	2

  Thanks in advance.

  Rashed Ward.

  Okay, I was not quite correct in my first post.

  These modules - modules only available for corresponding models of ASA.

  They all can act as IPS (inline mode) or IDS ("Promiscuous" mode), depending on how you configure your policies.

  When acting as IPS, ASA redirects all traffic through the module, then all the traffic is inspected and can be dropped inline if a signature is triggered.

  When she acts as an ID, ASA a few exemplary traffic is the module for inspection, but the actual traffic is not affected by the module, as it's not inline in this case.

  In addition, these modules can be both comdination. That is part of the traffic can be inspected "inline", when some other (more sensitive) traffic can be inspected in promiscuous mode.

  To better understand, familiarize themselves with this link:

  http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/modules_ips.html

• LAN to Lan tunnel between ASA 5505 and 3030.

  I am unable to build a tunnel vpn site-to-site between an ASA 5505 and our Cisco 3030.  I tried all possible combinations except one that will work.  I am able to ping each peer on the other site.  Someone at - it a config between two tunnels of Lan to Lan to work between a 5505 and 3030 that works.  Thank you

  Hello

  Please visit this link using config:

  http://www.Cisco.com/c/en/us/support/docs/security/VPN-3000-series-conce...

  Kind regards

  Aditya

  Please evaluate the useful messages.

• Cisco Asa 5505 and level 3 with remote access VPN switch

  Today I had a new CISCO LAYER 3 switch... So here's my scenrio

  Cisco Asa 5505

  I have

  Outside of the == 155.155.155.x

  Inside = 192.168.7.1

  Address POOL VPN = 10.10.10.1 - 10.10.10.20

  3 layer switch configuration

  VLAN 2

  ip address of the interface = 192.168.1.1

  VLAN 2

  ip address of the interface = 192.168.2.1

  VLAN 2

  ip address of 192.168.3.1 = interface

  VLAN 2

  ip address of the interface = 192.168.4.1

  VLAN 2

  ip address of the interface = 192.168.5.1

  IP Routing

  So I want the customers of my remote access VPN to access all that these networks. So please can you give me a useful tip or a link to set up the rest of my trip

  Thanks to you all

  Al ready has responded

  Sent by Cisco Support technique iPad App

• L2l between an ASA 5505 and WatchGuard XTM330 with dynamic IP

  Hi guys,.

  I looked for a solution on this one but can't find inappropriate, most of the discussions were old and with dead links to the solution.

  We have an ASA 5505 with static IP address on the outside and a customer who have a WatchGuard XTM330 with dynamic IP address to the outside.

  Is it possible to have an L2L VPN between our ASA and the WatchGuard when he has a dynamic IP?

  I have no experience on the series of WatchGuard,

  so, I am very grateful for any answer!

  Thanks in advance and have a nice day

  BR

  Robin

  Hi Robin,

  Here are the links you can make reference when configuring static to the dynamic VPN tunnel: -.
  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/112075-dynamic-IPSec-ASA-router-CCP.html

  This one is with Pix on the remote side, but the configuration will remain the same on the local side: -.
  http://www.WatchGuard.com/docs/4-6-Firebox-CiscoPix.PDF

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Compatibility of VLAN with Cisco

  Hello

  We just bought 10 x new Netgear switches (all M4100) to add to an existing Cisco infrastructure.

  Simple configuration with only 6 Valns.

  5: Admin, 30: VOIP, 101: management, 100: a set of Workstations, 102: second series of Workstations, 200: IPTV, 400: Internet, 401: Wireless Management

  All I wanted to do was: 2 last ports each switch netgear = T and all the VLANS. I have not identified all ports if I want to use in the appropriate vlan

  101 of VLAN is my Managementt Vlan. (Need to configure inter vlan routing for this to work)

  I only turned on three switches up to now and all three do not work. They work for a while and that packets but do not receive all.

  What I am doing wrong?

  What I need to get rid of the original vlan1 on the netgear?

  Is that what I need config in the STP to make these compatible with Cisco (300 and 400 series) switches.

  I use an optical backbone on Cisco and Netgear switches.

  Sincere greetings,

  OLAF

  Hi Moussa,.

  Thanks for reaching out.

  We got it working.

  Step 1: upgrade to the latest firmware.

  Step 2: Forget the MISTLETOE.

  We had a few questions about the old firmware - causing links to trunk have some incompatibility with their tag and removed the images between Cisco and Netgear brand.

  After the upgrade of the firmware that we had access to "switchport mode access" and "switchport mode trunk" orders fixing the access port and trunking issues.

  Thank you Mr President,

  OLAF

• VPN site-to-site between ASA 5505 and 2911

  Hi all

  I'm trying to setup VPN S2S. A.a.a.a of ip for the router 2911 office, remote office ASA 5505 8.4 (3) with ip b.b.b.b, but no luck.

  2911 config:

  !

  version 15.2

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  encryption password service

  !

  host name 2911

  !

  boot-start-marker

  Boot system flash c2900-universalk9-mz. Spa. 152 - 2.T.bin

  boot-end-marker

  !

  !

  Min-length 10 Security passwords

  logging buffered 51200 warnings

  !

  No aaa new-model

  !

  !

  min-threshold queue spd IPv6 62

  Max-threshold queue spd IPv6 63

  No ipv6 cef

  the 5 IP auth-proxy max-login-attempts

  max-login-attempts of the IP 5 admission

  !

  !

  !

  DHCP excluded-address IP 192.168.10.1 192.168.10.99

  DHCP excluded-address IP 192.168.22.1 192.168.22.99

  DHCP excluded-address IP 192.168.33.1 192.168.33.99

  DHCP excluded-address IP 192.168.44.1 192.168.44.99

  DHCP excluded-address IP 192.168.55.1 192.168.55.99

  192.168.10.240 IP dhcp excluded-address 192.168.10.254

  DHCP excluded-address IP 192.168.22.240 192.168.22.254

  DHCP excluded-address IP 192.168.33.240 192.168.33.254

  DHCP excluded-address IP 192.168.44.240 192.168.44.254

  DHCP excluded-address IP 192.168.55.240 192.168.55.254

  !

  desktop IP dhcp pool

  import all

  network 192.168.33.0 255.255.255.0

  router by default - 192.168.33.254

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  wi - fi IP dhcp pool

  import all

  network 192.168.44.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.44.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  DMZ IP dhcp pool

  import all

  network 192.168.55.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.55.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  IP dhcp pool voip

  import all

  network 192.168.22.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.22.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  IP dhcp pool servers

  import all

  network 192.168.10.0 255.255.255.0

  default router 192.168.10.254

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  !

  IP domain name of domain

  name-server IP 192.168.10.10

  IP cef

  connection-for block 180 tent 3-180

  Timeout 10

  VLAN ifdescr detail

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki token removal timeout default 0

  !

  Crypto pki trustpoint TP-self-signed-3956567439

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 3956567439

  revocation checking no

  rsakeypair TP-self-signed-3956567439

  !

  !

  TP-self-signed-3956567439 crypto pki certificate chain

  certificate self-signed 01 nvram:IOS - Self-Sig #1.cer

  license udi pid sn CISCO2911/K9

  !

  !

  the FULL_NET object-group network

  full range of the network Description

  192.168.10.0 255.255.255.0

  192.168.11.0 255.255.255.0

  192.168.22.0 255.255.255.0

  192.168.33.0 255.255.255.0

  192.168.44.0 255.255.255.0

  !

  object-group network limited

  description without servers and router network

  192.168.22.0 255.255.255.0

  192.168.33.0 255.255.255.0

  192.168.44.0 255.255.255.0

  !

  VTP version 2

  password username admin privilege 0 password 7

  !

  redundancy

  !

  !

  !

  !

  !

  no passive ftp ip

  !

  !

  crypto ISAKMP policy 10

  BA aes 256

  sha512 hash

  preshared authentication

  ISAKMP crypto key admin address b.b.b.b

  invalid-spi-recovery crypto ISAKMP

  !

  !

  Crypto ipsec transform-set esp - aes esp-sha-hmac SET

  !

  !

  !

  10 map ipsec-isakmp crypto map

  the value of b.b.b.b peer

  Set transform-set

  match address 160

  !

  !

  !

  !

  !

  Interface Port - Channel 1

  no ip address

  waiting-150 to

  !

  Interface Port - channel1.1

  encapsulation dot1Q 1 native

  IP 192.168.11.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.10

  encapsulation dot1Q 10

  IP address 192.168.10.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.22

  encapsulation dot1Q 22

  IP 192.168.22.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.33

  encapsulation dot1Q 33

  IP 192.168.33.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.44

  encapsulation dot1Q 44

  IP 192.168.44.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.55

  encapsulation dot1Q 55

  IP 192.168.55.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  the Embedded-Service-Engine0/0 interface

  no ip address

  Shutdown

  !

  interface GigabitEthernet0/0

  Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE $ 0/0

  no ip address

  Shutdown

  automatic duplex

  automatic speed

  !

  interface GigabitEthernet0/1

  no ip address

  automatic duplex

  automatic speed

  channel-group 1

  !

  interface GigabitEthernet0/2

  Description $ES_LAN$

  no ip address

  automatic duplex

  automatic speed

  channel-group 1

  !

  interface GigabitEthernet0/0/0

  IP address a.a.a.a 255.255.255.224

  NAT outside IP

  IP virtual-reassembly in

  automatic duplex

  automatic speed

  crypto map

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  23 class IP http access

  local IP http authentication

  IP http secure server

  IP http timeout policy slowed down 60 life 86400 request 10000

  !

  overload of IP nat inside source list NAT_INTERNET interface GigabitEthernet0/0/0

  IP nat inside source udp 500 interface GigabitEthernet0/0/0 500 a.a.a.a static

  IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx

  !

  NAT_INTERNET extended IP access list

  refuse the object-group ip FULL_NET 192.168.17.0 0.0.0.255

  refuse the object-group ip FULL_NET 192.168.1.0 0.0.0.255

  permit ip FULL_NET object-group everything

  !

  access-list 1 permit 192.168.44.100

  access-list 23 allow 192.168.10.7

  access-list 23 permit 192.168.44.0 0.0.0.255

  access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

  access-list 160 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  password password 7

  opening of session

  line to 0

  line 2

  no activation-character

  No exec

  preferred no transport

  transport of entry all

  transport output pad rlogin lapb - your MOP v120 udptn ssh telnet

  StopBits 1

  line vty 0 4

  access-class 23 in

  privilege level 15

  local connection

  entry ssh transport

  line vty 5 15

  access-class 23 in

  privilege level 15

  local connection

  entry ssh transport

  !

  Scheduler allocate 20000 1000

  !

  end

  The ASA config:

  : Saved : ASA Version 8.4(3) ! hostname C domain-name domain enable password password encrypted passwd passwd encrypted names ! interface Ethernet0/0 ! interface Ethernet0/1 shutdown ! interface Ethernet0/2 shutdown ! interface Ethernet0/3 shutdown ! interface Ethernet0/4 shutdown ! interface Ethernet0/5 switchport access vlan 100 ! interface Ethernet0/6 switchport trunk allowed vlan 2,6 switchport mode trunk ! interface Ethernet0/7 shutdown ! interface Vlan1 description INTERNET mac-address 1234.5678.0001 nameif WAN security-level 0 ip address b.b.b.b 255.255.255.248 standby c.c.c.c ospf cost 10 ! interface Vlan2 description OLD-PRIVATE mac-address 1234.5678.0102 nameif OLD-Private security-level 100 ip address 192.168.17.2 255.255.255.0 standby 192.168.17.3 ospf cost 10 ! interface Vlan6 description MANAGEMENT mac-address 1234.5678.0106 nameif Management security-level 100 ip address 192.168.1.2 255.255.255.0 standby 192.168.1.3 ospf cost 10 ! interface Vlan100 description LAN Failover Interface ! boot system disk0:/asa843-k8.bin ftp mode passive clock timezone NZST 12 clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 2:00 dns domain-lookup WAN dns server-group DefaultDNS name-server 208.67.222.222 domain-name domain same-security-traffic permit intra-interface object network obj-192.168.17.0 subnet 192.168.17.0 255.255.255.0 object network obj-192.168.10.0 subnet 192.168.10.0 255.255.255.0 object network obj-192.168.2.0 subnet 192.168.2.0 255.255.255.0 object network obj-192.168.9.0 subnet 192.168.9.0 255.255.255.0 object network obj-192.168.33.0 subnet 192.168.33.0 255.255.255.0 object network obj-192.168.44.0 subnet 192.168.44.0 255.255.255.0 object network obj_any object network obj_any-01 object network NETWORK_OBJ_192.168.10.0_24 subnet 192.168.10.0 255.255.255.0 object network NETWORK_OBJ_192.168.17.0_24 subnet 192.168.17.0 255.255.255.0 object network subnet-00 subnet 0.0.0.0 0.0.0.0 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service RDP tcp description RDP port-object eq 3389 object-group network DM_INLINE_NETWORK_1 network-object 192.168.17.0 255.255.255.0 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network DM_INLINE_NETWORK_2 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network subnet-17 network-object 192.168.17.0 255.255.255.0 object-group network subnet-2 network-object 192.168.2.0 255.255.255.0 object-group network subnet-9 network-object 192.168.9.0 255.255.255.0 object-group network subnet-10 network-object 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP standard permit 192.168.17.0 255.255.255.0 access-list WAN_access_in extended permit ip any any log debugging access-list WAN_access_in extended permit tcp any object-group RDP any object-group RDP log debugging access-list WAN_access_in extended permit icmp x.x.x.x 255.255.255.248 192.168.10.0 255.255.255.0 access-list MANAGEMENT_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit icmp any object-group DM_INLINE_NETWORK_1 access-list 101 extended permit tcp host 192.168.10.7 any eq 3389 log debugging access-list WAN_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_1_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list CiscoVPNClient_splitTunnelAcl standard permit 192.168.17.0 255.255.255.0 access-list LAN_access_in extended permit ip any any log debugging access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP_inbound standard permit 192.168.10.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 access-list vpnusers_splitTunnelAcl extended permit ip 192.168.17.0 255.255.255.0 any access-list nonat-in extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 52000 logging monitor informational logging trap informational logging asdm informational logging from-address syslog logging recipient-address admin level errors logging host OLD-Private 192.168.17.110 format emblem logging debug-trace logging permit-hostdown mtu WAN 1500 mtu OLD-Private 1500 mtu Management 1500 ip local pool VPN_Admin_IP 192.168.1.150-192.168.1.199 mask 255.255.255.0 ip local pool vpnclient 192.168.2.1-192.168.2.5 mask 255.255.255.0 failover failover lan unit primary failover lan interface failover Vlan100 failover polltime interface 15 holdtime 75 failover key ***** failover interface ip failover 192.168.100.1 255.255.255.0 standby 192.168.100.2 icmp unreachable rate-limit 1 burst-size 1 icmp permit 192.168.10.0 255.255.255.0 WAN icmp permit host x.x.x.x WAN icmp permit 192.168.17.0 255.255.255.0 WAN icmp permit host c.c.c.c WAN icmp permit host a.a.a.a WAN icmp deny any WAN icmp permit 192.168.10.0 255.255.255.0 OLD-Private icmp permit 192.168.17.0 255.255.255.0 OLD-Private icmp permit host a.a.a.a OLD-Private icmp permit host 192.168.10.0 Management icmp permit host 192.168.17.138 Management icmp permit 192.168.1.0 255.255.255.0 Management icmp permit host 192.168.1.26 Management icmp permit host a.a.a.a Management asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-10 subnet-10 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-2 subnet-2 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-9 subnet-9 no-proxy-arp nat (Management,WAN) source static NETWORK_OBJ_192.168.17.0_24 NETWORK_OBJ_192.168.17.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup ! object network subnet-00 nat (OLD-Private,WAN) dynamic interface access-group WAN_access_in in interface WAN access-group OLD-PRIVATE_access_in in interface OLD-Private access-group MANAGEMENT_access_in in interface Management route WAN 0.0.0.0 0.0.0.0 x.x.x.x 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa local authentication attempts max-fail 10 http server enable http b.b.b.b 255.255.255.255 WAN http 0.0.0.0 0.0.0.0 WAN no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart service resetoutside crypto ipsec ikev1 transform-set OFFICE esp-aes esp-sha-hmac crypto map WAN_map 1 match address WAN_1_cryptomap crypto map WAN_map 1 set pfs crypto map WAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map Office 2 match address WAN_1_cryptomap crypto map Office 2 set peer a.a.a.a crypto map Office interface WAN crypto map MAP 10 set peer a.a.a.a crypto map MAP 10 set ikev1 transform-set OFFICE crypto ikev2 enable WAN crypto ikev1 enable WAN crypto ikev1 policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption des hash sha group 1 lifetime 86400 telnet timeout 5 ssh a.a.a.a 255.255.255.255 WAN ssh timeout 30 ssh version 2 console timeout 0 dhcpd auto_config OLD-Private ! threat-detection basic-threat threat-detection statistics host threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 129.6.15.28 source WAN prefer webvpn group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ssl-client ssl-clientless group-policy admin internal group-policy admin attributes dns-server value 208.67.222.222 156.154.70.1 vpn-tunnel-protocol ikev1 group-policy GroupPolicy_a.a.a.a internal group-policy GroupPolicy_a.a.a.a attributes vpn-tunnel-protocol ikev1 ikev2 group-policy CiscoVPNClient internal group-policy CiscoVPNClient attributes vpn-idle-timeout 30 vpn-session-timeout none vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value CiscoVPNClient_splitTunnelAcl username admin password password encrypted privilege 15 tunnel-group admin type remote-access tunnel-group admin general-attributes address-pool vpnclient authorization-server-group LOCAL default-group-policy admin tunnel-group a.a.a.a type ipsec-l2l tunnel-group a.a.a.a general-attributes default-group-policy GroupPolicy_a.a.a.a tunnel-group a.a.a.a ipsec-attributes ikev1 pre-shared-key ***** ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** tunnel-group CiscoVPNClient type remote-access tunnel-group CiscoVPNClient general-attributes address-pool vpnclient default-group-policy CiscoVPNClient tunnel-group CiscoVPNClient ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp ! service-policy global_policy global smtp-server 192.168.17.10 prompt hostname context no call-home reporting anonymous call-home contact-email-addr admin contact-name admin profile CiscoTAC-1   no active : end asdm image disk0:/asdm-647.bin asdm location c.c.c.c 255.255.255.255 WAN asdm location 192.168.17.2 255.255.255.255 WAN asdm location a.a.a.a 255.255.255.255 OLD-Private no asdm history enable 

  ASA:

  # show crypto ipsec his

  There is no ipsec security associations

  # show crypto isakmp his

  There are no SAs IKEv1

  There are no SAs IKEv2

  2911:

  #show crypto ipsec his

  Interface: GigabitEthernet0/0/0

  Tag crypto map: map, addr a.a.a.a local

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.17.0/255.255.255.0/0/0)

  current_peer b.b.b.b port 500

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0

  #pkts not unpacked: 0, #pkts decompress failed: 0

  Errors of #send 4, #recv errors 0

  local crypto endpt. : a.a.a.a, remote Start crypto. : b.b.b.b

  Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0/0

  current outbound SPI: 0x0 (0)

  PFS (Y/N): N, Diffie-Hellman group: no

  SAS of the esp on arrival:

  -Other - arrival ah sas:

  -More-

  -More - CFP sas on arrival:

  -More-

  -More - outgoing esp sas:

  -More-

  -More - out ah sas:

  -More-

  -More - out CFP sas:

  Thanks for your time,

  Nick

  Please add

  map Office 2 set transform-set OFFICE ikev1 crypto

  If it is not helpful, please enable debug crypto ipsec 255 and paste here.
  
  HTH. Please rate if it was helpful. "Correct answer" will be also pleasant.

• Configuration Wireless 3G as online backup with cisco switch layer 3?

  Hi all

  We have an existing GPRS modems for data transfer between 2 different sites, this connection is a bit slow to no more than approximately 114 Kbps, the idea is to add a 3G modem, so the solution will be based on a two-way communication lines which are 3G network and the GPRS network.

  The line GPRS will be the main and 3G will be secondary, this redundancy offers a high level of availability of communication between the two sites.

  is it possible to configure this redundancy with a cisco switch layer 3? If this is the case do you have a tutorial or a link which explain how to do this work with a layer switch 3 ciso?

  all information will be useful for me, thanks

  Hello

  The config is one provided by anisaini, but you need to change your NAT like this:

  IP nat inside source MAIN interface map route x/x main interface

  IP nat inside source route-map interface o/o interface secondary SCHOOL

  Interior int z/z interface

  IP nat inside

  int x/x

  NAT outside IP

  int y/y

  NAT outside IP

  access-list 99

  permit x.x.x.x y.y.y.y where x.x.x.x is your home subnet addresses and y.y.y.y is the corresponding generic mask

  PRIMARY route map

  match ip add 99

  match interface x/x

  SECONDARY route map

  match ip add 99

  game interface y/y

  Concerning

  Alain

  Remember messages useful rate.

• ASA 5505 and ASA 5510 Site to Site VPN Tunnel cannot be established

  Hi all experts

  We are now plan to form an IPSec VPN tunnel from site to site between ASA 5505 (ASA Version 8.4) and ASA 5510 (ASA Version 8.0) but failed, would you please show me how to establish? A reference guide?

  I got error syslog 713902 and 713903, how to fix?

  I got the following, when I type "sh crypto isakmp his."

  Type: user role: initiator

  Generate a new key: no State: MM_WAIT_MSG2

  Hugo

  Hello

  This State is reached when the policies of the phase 1 do not correspond to the two ends.

  Please confirm that you have the same settings of phase 1 on both sides with the following commands:

  See the isakmp crypto race

  See the race ikev1 crypto

  Also make sure that port UDP 500 and 4500 are open for communication between your device and the remote peer.

  Finally, make sure you have a route suitable for the remote VPN endpoint device.

  Hope that helps.

  Kind regards

  Dinesh Moudgil

• ASA 5505 to the Juniper switch

  I wonder if anyone knows known problems connecting an ASA to a Juniper switch?

  We have a remote site where we have an installed ASA 5505 put in place running EzVPN.  We do not have control/access to the Internet or the internal infrastructure.  Basically, we have an office within their building.  Our ASA has one of their external IP addresses and is connected to their Juniper switch.  Our PCs / printers are corrected to another switch to Juniper, which is the link to our ASA.  The question we have is that the connection is down intermittently where we cannot ping pc / printers on the remote site through the VPN tunnel but we can still do a ping to the external IP address of our ASA remote.  The strange thing is that we cannot manage the ASA via SSH or ASDM using the external interface, but it can ping when this happens.  Most of the time the VPN tunnel does not diminish when we check the sessions at the head of the network, even if it will from time to time.

  Any ideas on what could cause this kind of problem?

  Thanks in advance.

  The f

  The problem with the impossibility to achieve (ssh or https) external but still able to ping IP address suggests an assignment of IP addresses in duplicate provider in this building. Arp for the SAA expiration you have to losse SSH access, but in even time you ping the device now that same IP, now when someone behind the ASA initiates an external connection ASA updates the ARP on the upstream device and everything starts normally allows.

  Now, all of the above is what I think, I could be wrong). Please have your admin look (arp-cache) Mac address when you firewall is unresponsive to SSH, but only for ping and see if it matches your external interface ASA Mac

  Thank you

  Manish

• Cisco ASA 5505 and comodo SSL certificate

  Hey all,.

  I'm having a problem with setting up the piece of Certificate SSL of Cisco AnyConnect VPN. I bought the certificate and installed it via the ASDM under Configuration > VPN remote access > Certificate Management > identity certificates. I also placed the piece of 2 CA under the CA certificates. I have http redirect to https and under my browser, it is green.

  Once the AnyConnect client installs and automatically connect I get no error or anything. The minute I disconnect and try to reconnect again, I get the "VPN Server untrusted certificates! ' which is not true because the connection information to be https://vpn.mydomain.com and the SSL certificate is configured as vpn.mydomain.com.

  On that note, it lists the IP address instead of the vpn.mydomain.com as the unreliable piece of this. Now of course I don't have the IP as part of the SSL-cert, just the web address. On the side of the web, I have a record A Setup to go from vpn.mydomain.com to the IP address of the Cisco ASA.

  What I'm missing here? I can post config if anyone needs.

  (My Version of the Software ASA is 9.0 (2) and ASDM Version 7.1 (2))

  Yes that's correct. technically, it will take you to EKU as keys to authenticate server who was a little forced in version 3.1. But eventually, he was taken away. If you get no error using the browser and ot only comes with the anyconnect client. Most likely, you do not have to configured values. I can confirm that if you can share the fqdn with me also, you can try the upgrade and check it out.

  Thank you

  Bad Boy

• Query VLANS with Cisco configuration example

  List of expensive,

  I was wondering if there is an error on the Cisco documentation below.

  The schema and configuration shows the LWAPs attached to the switch on vlan 5, but the trunk to the WLC is pruning vlan 5.

  If this is true, how the LWAPP LWAPs with the WLC to talk?

  The proposed config is a few lines of the diagram below.

  Thanks for any comments.

  http://www.Cisco.com/en/us/products/ps6366/products_configuration_example09186a0080665cdf.shtml#DIA

  Chris.

  Management of the AP is on vlan 5, so there's no reason to be vlan 5 allowed on the trunk for the wlc.  Only the interfaces configured on the WLC should be allowed.

  Management, AP-Manager and all dynamic interfaces... service-port can be included, but should not be routable.

  Hope that explains it... If not let me know :)