VPN and DMZ problem

Similar Questions

• SSL VPN and routing problem

  Hi all

  I have a strange architecture including VPN and I have a few problems that I am not able to solve:

  -J' use the ssl vpn gateway to allocate internal IP addresses of the local network described in the schema (8.8.2.0 or 8.8.3.0 according to the tunnel-group network.

  -The purpose is for vpn clients directly access the internal network.

  This works very well if there are strictly internal communications within the network. But recently, we have installed an application that needs to access both networks. No problem, I thought, but I was wrong, there seems to be a problem of routing inherent in the architecture in place.

  Let me explain the problem:

  -When I access the VPN, for example I will gave the 8.8.3.5 ip address.

  -Im running the application that needs to open a page on the web server, located at 8.8.2.120

  -l'asa receive my tcp syn datagram and forward it directly to the directly connected interface fa0/1 (based on the routing table)

  -the web server returns the response, but he sends on its default gateway which is the cisco 6509.

  -6509 it sends its vlan svi 2000

  - and finally the ASA it receives on its interface fa0/2 but seems he falls as she opened a tcp on fa0/1 connection and receives the response on fa0/2.

  I want it's traffic by tunnel to bypass the connected roads and transmit it to a default gateway of tunnel. This would ensure that the path for the request and the response would be the same.

  I would like to know if there are orders of debugging for routing decisions validate my theory?

  Do you know of any response to solve this problem?

  Thanks a lot for your help.

  When you configure the TCP State derivation always think ' which way is the SYN package coming?

  Routing failed messages always have source and destination, are of course copied the entire message?

  BTW, instead of letting clients SSL addresses attributed to vlan2000? Why not give them a separate subnet and the road back via correct interface?

  I would also check your config and the routing :-) table

  Marcin

• Access to resources on the inside and DMZ problem

  Hi Techies,

  I have a pix515 do remoteaccess VPN. People are able successfully to VPN in the box but are not able to access resources on the DMZ or the Interior. DMZ is directly connected to the PIX and inside is behind a CSS.

  Could you people point me in the right direction please.

  Thank you

  Abdul, is solved your problem, have you tried suggested missing statements in your config... Let us know if any questions.

  Concerning

• VPN and DMZ

  Dear Sir

  I want to go to the DMZ to remote locations via VPN Tunnel in ASA. Please see the diagram and give me your comment.

  Thanks in advance.

  If the R1 tunnels to other routers work so I think these are the things you need to do:

  -Make sure that each of the remote routers has a route to the subnet of the demilitarized zone that points through the tunnel.

  n ' forget not that the R1 has a route to the subnet of the demilitarized zone.

  -Configure ASA security policy that allows the circulation of all routers networks to access the demilitarized zone.

  -set up on the roads of the SAA for all networks to routers.

  HTH

  Rick

• Service issues cell phone iPhone, update errors and activation problems.

  So I just returned from a stay in Germany yesterday. I got home and when I got my iPhone 5 s out, my iPhone would not connect to my carrier that is EE. It shows that «in search...» ", in the upper left corner, where it should display my carrier. I have enabled updates of the carrier, but did not find anything. I also removed and re-inserted my SIM card, but when I took it out it still showed the message "Search"... ». However, I found that it was and to update the iOS, 9.3.3. Immediately I thought this would be a solution to my problem except when I tried to install this update, I had "a software update cannot be installed at this time. Try again later"message. I then deleted apps, so I had 4 GB of data in case I didn't have enough space to install it. It did not work. Then I deleted the update and re-uploaded. Still nothing. I was frustrated now then searched the Internet for fixes, but for me, those difficult sites never really work, and of course, they did not. In the end, I decided to back up my data and content and do a reset. Now I begin to set up my iPhone and get to the part where I choose a Wifi hotspot, so I chose the connection of my house which is strong and should be able to maintain a connection to the whole upward. But after I click Next, it says 'iPhone activation', but then he says: "your iPhone could not be activated because activation sever is temporarily unavailable. Try again in a few minutes. "I tried again 10 minutes later and it still does not work. All I want is a solution, because I am now left with a useless phone and I am due to go to Spain in 6 days and will not be able to ring or text anyone. Help, please!

  A difficult here. Ultimately, this looks like a problem of free Wi - Fi connection. Try restarting your router. Also coincidentally, you might have a Wi - Fi chip or the faulty antenna.

  Here's a tip for the user on the problems of Wi - Fi. Many of them does not apply in your situation but worth the drive just in case.

  (1) perform a forced reboot: hold the Home and Sleep/Wake buttons simultaneously for about 15-20 seconds, until the Apple logo appears. Leave the device to reboot.

  (2) resetting the network settings: settings > general > reset > reset network settings. Join the network again.

  (3) reboot router/Modem: unplug power for 2 minutes and reconnect. Update the Firmware on the router (support Web site of the manufacturer for a new FW check). Also try different bands (2.4 GHz and 5 GHz) and different bandwidths (recommended for 2.4 to 20 MHz bandwidth). Channels 1, 6 or 11 are recommended for 2.4 band.

  (4) change of Google DNS: settings > Wi - Fi > click the network, delete all the numbers under DNS and enter 8.8.8.8 or otherwise 8.8.4.4

  (5) disable the prioritization of device on the router if this feature is available. Also turn off all apps to VPN and retest the Wi - Fi.

  (6) determine if other wireless network devices work well (other iOS devices, Mac, PC).

  (7) try the device on another network, i.e., neighbors, the public coffee house, etc.

  (8) backup and restore the device using iTunes. Try to restore as New first and test it. If ok try to restore the backup (the backup may be corrupted).

  https://support.Apple.com/en-us/HT201252

  (9) go to the Apple Store for the evaluation of the material. The Wi - Fi chip or the antenna could be faulty.

  Council: https://discussions.apple.com/docs/DOC-9892

• site2site distance-VPN and access-PIX - no way?

  I have,

  I have a problem wrt site2site & VPN remote access on a PIX:

  My setup is as follows: PIX (6.3) puts an end to two a site2-site VPN and also should the remote access service clients using the client VPN Cisco (4.0.x).

  The problem is with remote access VPN clients, obtain an IP address on their VPN interface, but customers cannot reach anything. (Please note that the site2site VPN runs without problem)

  To be precise (see config-excerpts below):

  The customer, who has 212.138.109.20 as its IP address gets an IP 10.0.100.1 on his card-VPN which comes from the "vpnpool of the pool.

  configured on the PIX. This customer relationships to reach servers on interface 'inside' of the PIX as 10.0.1.28.

  However, the client cannot achieve * nothing *-a server on the inside or anything like that (e.g. Internet) outside!

  Using Ethereal traces, I discovered that the packets arrive inside interface coming 10.0.100.1 (IP address of the)

  VPN - client). I also see the response from the server (10.0.1.28) to 10.0.100.1. However for some reason any package does not thanks to

  the PIX to the customer. PIX-newspapers also show packets to and from the VPN client to the inside interface - and * no. * drops. So to my knowledge the packets from server to the VPN client really should be done through the PIX.

  I have attached the following as separate files:

  (o) the parts of the PIX config

  (o) packets showing PIX-log between the VPN client and the server (s) on the interface inside

  (o) ethereal-trace done inside the watch interface also packets between VPN client and server (s)

  I have really scratched my head for a while on this one, tested a lot of things, but I really don't know what could be a problem with my

  config.

  After all, it really should be possible to run site2site - and on the same PIX VPN remote access, shouldn't it?

  Thank you very much in advance for your help,.

  -ewald

  I think that your problem is in your ACL and your crypto card:

  access-list 101 permit ip 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

  access-list 101 permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0

  access-list 101 permit ip 10.0.3.0 255.255.255.0 10.0.2.0 255.255.255.0

  access-list 101 permit ip 10.0.1.0 255.255.255.0 10.0.100.0 255.255.255.0

  correspondence address 1 card crypto loc2rem 101

  This means that this map correspond to these addresses. But your dynamic map is one that must match 10.0.100.0, 10.0.1.0 traffic because your pool local ip is 10.0.100.x. I think what is happening is that the return traffic from the lan to vpn clients trying to get out of the static tunnel, which probably does not exist (for the netblocks - you probably have a security association for each pair of netblocks, but not for vpn clients) and so do not.

  I would recommend adding these lines:

  access-list 105 allow ip 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

  access-list 105 allow ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0

  access-list 105 permit 10.0.3.0 ip 255.255.255.0 10.0.2.0 255.255.255.0

  no correspondence address 1 card crypto loc2rem 101

  correspondence address 1 card crypto loc2rem 105

  Then reapply:

  loc2rem interface card crypto outside

• Mac, VM XP Pro, Cisco VPN and printing.

  I have an end-user running a Mac with a virtual XP Pro Machine that connects to our VPN corperate machine. This part works fine. Problems happen when he tries to print to a network printer. The job is just until it disconnects from the VPN and then it prints very well. No one knows what to do to fix this? I have little or no knowledge of MAC.

  Kind regards

  Dan

  This could be the reason why printing does not work. To print traffic really vpn tunnel as split tunnel is not configured.

• AnyConnect vpn and a tunnel vpn Firewall even outside of the interface.

  I have a (no connection) remote access vpn and ipsec tunnel connection to return to our supplier is on the same firewall outside interface.

  The problem is when users remote vpn in they are not able to ping or join the provider above the tunnel network.

  now, I understand that this is a Bobby pin hair or u turn due to traffic but I'm still not able to understand how the remote vpn users can reach the network of the provider on the tunnel that ends on the same interface where remote access vpn is also configured.

  The firewall is asa 5510 worm 9.1

  Any suggestions please.

  Hello

  You are on the right track. Turning U will be required to allow vpn clients access to resources in the L2L VPN tunnel.

  The essence is that the split tunneling to access list must include subnets of the remote VPN to peer once the user connects they have directions pertaining to remote resources on anyconnect VPN

  Please go through this post and it will guide you how to set up the u turn on the SAA.
  https://supportforums.Cisco.com/document/52701/u-turninghairpinning-ASA

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/100918-ASA-sslvpn-00.html

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• You try to run a Site to site VPN and remote VPN from the same IP remotely

  We currently have a site to site VPN configuration between our offices call center and a 3rd party that allows them to access our training to their employees to use environment while being trained on our systems. This tunnel is running between our ASA and their ASA without problem; However, when we have managers come out to the call center, they are unable to use remote VPN to access our office.

  Apparently the same IP peer remote that we use for our site to the other tunnel is the same IP that our managers use to access the internet when they are on-site with the customer. When I look at the logs it shows the VPN attempt and then I get treatment Information Exchange has failed. So from what I can understand when our managers are trying to connect to our firewall from the same IP address as the counterpart of site to site it automatically tries to create a tunnel, according to the information of the site to the other tunnel. If our managers are anywhere else, they can connect through remote VPN with no problems.

  My question is if anyone knows of a way to make the firewall allow VPN site to site and remote connections with the same remote IP address.

  Hi John,.

  Basically, in older versions, when you hit a static encryption card and you does not match this static encryption completely map the connection continues until the dynamic encryption card. For this reason, you can connect your IPSec clients before. A bug has been opened on this vulnerability.

  CSCuc75090  Details of bug

  The crypto IPSec Security Association are created by dynamic crypto map to static peers

  Symptom:

  When a static VPN peer adds all traffic to the ACL crypto, a surveillance society is based even if the pair IP is not allowed in the acl to the main façade encryption. Are these SA finally put in correspondence and commissioning the dynamic crypto map instance.

  Conditions:

  It was a planned design since the first day that allowed customers to fall through in the case of static crypto map did not provide a necessary cryptographic services.

  The SA must be made from a peer configured statically and a dynamic crypto map instance must be configured on the receiving end.

  Workaround solution:

  N/A

  Some possible workarounds are:

  Configure a static nat device when you try to use the remote VPN if the firewall remotely will be hit with a different public IP address. It would be a good solution, but it will depend on how many ip addresses public you have available, if you really want one of these ip addresses for that access.

  Also, I thought you could use AnyConnect instead of the IPSec VPN client. I don't know how many users need to connect from your PC to the remote site, but the ASA has 2 licenses SSL available that you could use. Because Anyconnect uses the SSL protocol, it won't have a problem on your environment.

  Below some information:

  http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa84/configuration/guide/asa_84_cli_config/vpn_anyconnect.html

  Hope this helps,

  Luis.

• NET writing DMZ problem

  Hi all

  I had the problem is image NET copy running-config DMZ writing to the laptop, but does not, my order is:

  WR net 172.16.2.1:test

  That the error message is below:

  Write TFTP to 172.16.2.1 on interface1 test

  Time out, trying to connect

  [not]

  But I cannot ping terminal the 172.16.2.1, after that I have to copy the running-config LAN (172.16.1.1) can made, using the same notebook.

  Is - not the dregs interface1, interface2 DMZ problem? should I change it? pls advise

  Stanley

  What is the global configuration or static access-list and nat for that 2 interfaces?

  sincerely

  Patrick

• Cisco Anyconnect VPN and IPSEC coexist on ASA 5520?

  Can a Cisco ASA 5520 which has been configured as IPSEC VPN gateway and also be configured as a gateway ANYCONNECT VPN and vpn IPSEC service anyconnect vpn clients clients maintenance at the same time? Any negative impact on the performance or any other problem that everyone knows?

  I guess that by 2 connection limit, you are referring to the 2 licenses for anyconnect?  You should consider using the anyconnect essentials license, which is relatively cheap (100-200 dollars I think) and will take you to the edge of the platform with anyocnnect.

  You shouldn't have any problem using IPSEC with LDAP client.  It is quite common - my company is IPSEC as Anyconnect off the coast of the same interface using authentication ldap (even same-group policy) for the two.

  -Jason

• IPsec vpn and Anyconnect is denied by the ACL (unknown)

  I am trying to configure IPsec VPN and I used the wizard of asdm (asdm version 8.4, ASA version 8.4). At the moment he is not in production and is in a test environment. Whenever I try to VPN in I get an error on the asdm syslog saying "TCP access denied by ACL from x.x.x.122 to outside:x.x.x.225/443. So I allowed all VPN traffic to this IP address that is currently the IP address as the external interface. My acl is as follows:

  outside_in list extended access permit tcp any interface outside eq https

  outside_in list extended access permit tcp any host x.x.x.225 eq https

  Access-group outside_in in external interface

  Yet, I still get the same exact error. The strange thing about this error is that it does not give me the specific ACL that denies access. There is no other access lists that could possibly block this traffic.

  No idea what could be the cause this problem because I am confused.

  So far, if you have configured following does not require an acl.

  ciscoasa(config)#webvpn
  ciscoasa(config-webvpn)#enable outside
  ciscoasa(config-webvpn)#svc enable
  You can post configuration here someone can have a look on that.
  Thanks
  Ajay
  
  
  
  

• GPS, Wifi and Bluetooth problems

  So I have an iPhone 6 running on IOS 9.3.4 and have had problems with the GPS and the strength of wifi connectivity and bluetooth for a while now.

  First of all, the GPS.  It does not work.  When I run the maps or google maps on my device and the input an address the app can give me a written plan, location, but will not show me on a map.  He'll start road to everywhere where I go and tell me to start position, for example, to the North on the road on that I am, but the arrow does not follow me and tell me when the turn or where I am.  Occasionally, he has a message of guidance down with a spinning wheel and then, after a few seconds, disappears.  I tried to reboot my device several times, I have reset the network setting, I reset all of the settings, I backed up my phone, reset it and recovered save him.  Nothing has worked.  I was at my local verizon store and received a 'new' (its definitely refurbished) phone and the problem persists on the new phone.  I reset the phone to factory setting without content, set up as a new phone and tried the cards again, thinking it might be a problem with the back to the top.  It still does not work.  I'm perplexed right now and do not know what to do/try.

  Second, wifi and bluetooth connectivity is terrible.  I can only receive a wireless signal so that in very close proximity with the router.  I tried to different houses/companies and it is the same question.  However, bluetooth is just as bad.  I use headphones wireless, and go to the gym/go for the route with them.  I used to be able to walk around the gym without my phone and have connected the headphones, but now I can't have my phone 2 feet of the appliance without the music being agitated (bad connection).  I'm really irritated that I cannot understand this point and that he can't seem to find a fixed solution online.

  If you have just updated to iOS 9.3.4, which I didn't even know still shone, so maybe it's a bug that comes with the update. However, your problems seem to follow a trend, you can not far from a source of connection and now a signal. It is perhaps because the necessary components for the Bluetooth, GPS and WiFi signal are damaged or defective. Have you dropped or spilled liquid on your iPhone recently?

• My Firefox exit and gives a "not responding" message once I used Google Mail. I tried to boot into "safe" mode and the problem persists.

  I have a question where Firefox wont ' quit and give a message "not responding" after I've been using Google Mail. It works fine when I'm not using this program. I tried Safe Mode and the problem still happens when I go on Google Mail, so it is not connected with modules, extensions, etc.

  Hello

  The reset Firefox feature can solve a lot of problems in restaurant Firefox to its factory default condition while saving your vital information.
  
  Note: This will make you lose all the Extensions and preferences.

  • Sites Web open is not recorded in less than 25 versions of Firefox.

  To reset Firefox, perform the following steps:

  1. Go to Firefox > help > troubleshooting information.
  2. Click on the button 'Reset Firefox'.
  3. Firefox will close and reset. After Firefox is finished, it will display a window with the imported information. Click Finish.
  4. Firefox opens with all the default settings applied.

  Information can be found in the article Firefox Refresh - reset the settings and Add-ons .

  This solve your problems? Please report to us!

  Thank you.

• Fields on several Internet sites have been changed in another language. The browser is set to English, and this problem does not occur with Chrome.

  Fields on several Internet sites have been changed in another language. The browser is set to English, and this problem does not occur with Chrome. Specifically, a large part of Tumblr and Facebook menu has been changed in another language (Russian, I think). I tried reinstall Firefox, clear the cache and reset firefox to its default state. None of them helped. Any suggestions on how to fix this?

  Hey again,

  Sometimes a problem with Firefox can be a result of malware installed on your computer, you may not be aware of.

  You can try these free programs to search for malicious software that work with your existing anti-virus software:

  • Microsoft safety scanner
  • MalwareBytes' Anti-Malware
  • TDSSKiller - AntiRootkit utility
  • Hitman Pro
  • ESET Online Scanner

  Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP, if you do not already have one.

  More information can be found in the article troubleshooting Firefox problems caused by malware .

  I hope this helps!

  Curtis