VPN between a router from 1721 to a Juniper srx 240

Hello

Is it possible to set up a vpn tunnel on a 1721 router that uses the following ios:

C1700-y7 - mz.124 - 13b .bin

I thought I had read somewhere that the tunnels were not supported in the 1700s, but wanted to make sure. If they are I would like to know if they are supported in ios preceding.

Thank you.

Yes, 1721 supports the termination of VPN tunnels and you need IP/firewall and IPSec 56 or sets features IOS IP/firewall and IPSec 3DES.

Here is the Cisco1721 router for your reference data sheet:

http://www.Cisco.com/en/us/products/HW/routers/ps221/products_data_sheet09186a00800920ec.html

However, please note that Cisco1721 has reached EOL:

http://www.Cisco.com/en/us/prod/collateral/routers/ps221/prod_end-of-life_notice0900aecd8044473f.html

In addition, the current ios you have: c1700-y7 - mz.124 - 13b .bin does not support IPSec. You need to download IOS with IP/firewall and IPSec 56 OR / IP/firewall and IPSec 3DES IOS feature sets to support IPSec.

I hope this helps.

Tags: Cisco Security

Similar Questions

VPN between 878 router and ASA 5505

Hello world

I struggled for a few days now to get a VPN connection works.

The situation

Two offices needs to be connected to eachother with a VPN. The two parties have a WAN connection.

The tunnel between locations rises very well but the communication fails in almost any way.

The host cannot ping each other and also the inside of the router and ASA pings fail.

The only ping works is from inside Site2 to the inside interface of the router side 1 (192.168.1.100 to 192.168.0.250)

NAT works very well on both sites behind the router / asa.

I think I'm doing something wrong with the roads or access lists but after 7 days, many refills, restores, driving from one end of the State to the other to reset stupid moves break and resolder my cable from the console and things completely with default start for 10 times, I'm through, I honestly don't know where to look for more...

Tech Specs:

Site1: has a cable modem that gives a WAN IP with DHCP address

This modem connects to the Cisco 878 (Fastethernet0) router

The router acts as a DHCP server and NAT gateway for the office and offers vpn connectivity to the other office

Site2: has a cable-modem/router (Cisco 3925), which made the NAT, this modem/router gives an IP private class-C (192.168.178.x)

This modem/router connects to a Cisco ASA 5505 (Fastethernet0)

The ASA also server as a DHCP server and NAT gateway for the office and offers vpn connectivity to the other office.

Online, it looks like this:

Office 1--> Cisco878--> WAN Cloud<---cablemodemrouter><--- asa5505=""><--- office="">

IP address ranges:

Office 1

Network 192.168.0.0

Subnet mask 255.255.255.0

Gateway 192.168.0.250

IP WAN XXXX

Office 2

Network 192.168.1.0

Subnetmak 255.255.255.0

Gateway 192.168.1.1

IP WAN XXXX

On the location of office 2, there is a NAT between ASA and WAN router. between 192.168.178.x 255.255.255.0

The modemrouter is a Cisco 3925, on which IPSEC passthrough is enabled.

Configs:

Site 1:

CISCO 878 router

Site 2

ASA 5505

I hope someone has a chance to look through my config and tell me what I did wrong this week

Even if you can not help me but still read here: Thank YOU!

(As my problem has been resolved, I removed the configs of this post. If for any reason, you want to work for these devices configuration, please send me a PM)

Post edited by: taaa lijf - reason: problem solved, removed configs and stuff private for obvious reasons ;)

Hello

Ping client customer site 1 site2 and make sh crypto isakmp his and sh crypto ipsec his on the router.

If sh crypto isakmp gives QM_Idle and ping fails and you have no package in the HS cypto ipsec his and then do a debug crypto ipsec

If sh crypto isakmp gives MM_NoState can do a debug crypto isakmp

One note however, you should have ip addresses static at least on the side, initiating the tunnel, otherwise it will not work when ip address changes.

Kind regards.

Alain.

Routing over VPN between ISA550W and RV215W

Hello all I have a problem with the VPN between my two office

I have an ISA550W at the head office (chcnorth)

I have a RV215W to the remote desktop (chcsouth)

the VPN is up and running, I can connect from Headquarters to remote control (chcsouth-RV215W)

and vice versa however when client computers on the remote end are trying to connect to the

Main office to access the database, they can't.

the problem started last week I received a call from the remote desktop that they can connect to our database

on the main office, I tried to connect remotely to see what was going on, it turns out that the router has completely put back

at the plant, including the firmware

I reinstalled the latest firmware for the RV215W of installation all connections as they were, I could

get VPN to connect, I can ping to the interface of the RV215W from my seat and I ping the ISA550W

the remote desktop, however my remote clients still cannot access my server at the main office

I realized after I have everything set up, I had a backup of my original installation and thinking I had

just missed something I restored it to the firmware to factory upgraded to power and restored the backup of the

RV215W I've had. still no dice

So I am now at a loss, there were no other changes to the network on both ends, I've been on this som my eyes several times

are blurred,

any ideas, workarounds for solutions would be greatly appreciated

Thanks in advance

John G

John,

It doesn't look like your question is more DNS related, as you can access the server by its IP address if the "connection" allows you to set up this way. It is quite common, that you cannot resolve names through the tunnel because netbios broadcasts will not pass. The RV215W have shared DNS within the parameters of the tunnel, so this isn't an option more.

If the "connection" is a PC, you can work around this by editing the LMHOSTS file. Please see the following instructions:

http://www.JakeLudington.com/Windows_7/20100924_how_to_edit_windows_7_lmhosts_file.html

In your case, it might look more at:

192.168.1.200 sqlsvr

Now if you ping or try to access sqlsvr from the computer, it will automatically know that it should go to 192.168.1.200 without having to find the IP address.

Answer please if you have any questions.

-Marty

Tunnel GRE / IP Sec VPN firewall between the router Cisco and Fortigate

Hello

Can I do GRE Tunnel / VPN IP Sec between Cisco router and Fortigate Firewall?

Thank you

Hi zine,.

As long as the Fortigate device support GRE over IPSEC, you will be able to create the tunnel between these 2 devices.

Here is the config for the Cisco Site:

https://supportforums.Cisco.com/document/16066/how-configure-GRE-over-IPSec-tunnel-routers

Happy holidays!

-Randy-

Problem with IPsec VPN between ASA and router Cisco - ping is not response

Hello

I don't know because the IPsec VPN does not work. This is my setup (IPsec VPN between ASA and R2):

my network topology data:

LAN 1 connect ASA - 1 (inside the LAN)

PC - 10.0.1.3 255.255.255.0 10.0.1.1

ASA - GigabitEthernet 1: 10.0.1.1 255.255.255.0

-----------------------------------------------------------------

ASA - 1 Connect (LAN outide) R1

ASA - GigabitEthernet 0: 172.30.1.2 255.255.255.252

R1 - FastEthernet 0/0: 172.30.1.1 255.255.255.252

---------------------------------------------------------------------

R1 R2 to connect

R1 - FastEthernet 0/1: 172.30.2.1 255.255.255.252

R2 - FastEthernet 0/1: 172.30.2.2 255.255.255.252

R2 for lan connection 2

--------------------------------------------------------------------

R2 to connect LAN2

R2 - FastEthernet 0/0: 10.0.2.1 255.255.255.0

PC - 10.0.2.3 255.255.255.0 10.0.2.1

ASA configuration:

1 GigabitEthernet interface
nameif inside
security-level 100
IP 10.0.1.1 255.255.255.0
no downtime
interface GigabitEthernet 0
nameif outside
security-level 0
IP 172.30.1.2 255.255.255.252
no downtime
Route outside 0.0.0.0 0.0.0.0 172.30.1.1

------------------------------------------------------------

access-list scope LAN1 to LAN2 ip 10.0.1.0 allow 255.255.255.0 10.0.2.0 255.255.255.0
object obj LAN
subnet 10.0.1.0 255.255.255.0
object obj remote network
10.0.2.0 subnet 255.255.255.0
NAT (inside, outside) 1 static source obj-local obj-local destination obj-remote control remote obj non-proxy-arp static

-----------------------------------------------------------
IKEv1 crypto policy 10
preshared authentication
aes encryption
sha hash
Group 2
life 3600
Crypto ikev1 allow outside
crypto isakmp identity address

------------------------------------------------------------
tunnel-group 172.30.2.2 type ipsec-l2l
tunnel-group 172.30.2.2 ipsec-attributes
IKEv1 pre-shared-key cisco123
Crypto ipsec transform-set esp-aes-192 ASA1TS, esp-sha-hmac ikev1

-------------------------------------------------------------
card crypto ASA1VPN 10 is the LAN1 to LAN2 address
card crypto ASA1VPN 10 set peer 172.30.2.2
card crypto ASA1VPN 10 set transform-set ASA1TS ikev1
card crypto ASA1VPN set 10 security-association life seconds 3600
ASA1VPN interface card crypto outside

R2 configuration:

interface fastEthernet 0/0
IP 10.0.2.1 255.255.255.0
no downtime
interface fastEthernet 0/1
IP 172.30.2.2 255.255.255.252
no downtime

-----------------------------------------------------

router RIP
version 2
Network 10.0.2.0
network 172.30.2.0

------------------------------------------------------
access-list 102 permit ahp 172.30.1.2 host 172.30.2.2
access-list 102 permit esp 172.30.1.2 host 172.30.2.2
access-list 102 permit udp host 172.30.1.2 host 172.30.2.2 eq isakmp
interface fastEthernet 0/1
IP access-group 102 to

------------------------------------------------------
crypto ISAKMP policy 110
preshared authentication
aes encryption
sha hash
Group 2
life 42300

------------------------------------------------------
ISAKMP crypto key cisco123 address 172.30.1.2

-----------------------------------------------------
Crypto ipsec transform-set esp - aes 128 R2TS

------------------------------------------------------

access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

------------------------------------------------------

R2VPN 10 ipsec-isakmp crypto map
match address 101
defined by peer 172.30.1.2
PFS Group1 Set
R2TS transformation game
86400 seconds, life of security association set
interface fastEthernet 0/1
card crypto R2VPN

I don't know what the problem

Thank you

If the RIP is not absolutely necessary for you, try adding the default route to R2:

IP route 0.0.0.0 0.0.0.0 172.16.2.1

If you want to use RIP much, add permissions ACL 102:

access-list 102 permit udp any any eq 520

SSL VPN may be configured on the router from Cisco 881/K9?

I'm now confused if SSL VPN can be configured on the router from Cisco 881/K9.

Please someone advise me.

If Yes, for only 5 users, what I need to buy the license or license is supplied with the router?

Thank you.

Yes, and you need a license:

FL-WEBVPN-10-K9

License SSL VPN functionality for up to 10 users (incremental), to 12.4 T based only IOS versions

FL-SSLVPN10-K9

License SSL VPN functionality for up to 10 users (incremental) for the only based 15.x IOS versions

VPN between ASA and cisco router [phase2 question]

Hi all

I have a problem with IPSEC VPN between ASA and cisco router

I think that there is a problem in the phase 2

Can you please guide me where could be the problem.
I suspect questions ACL on the router, but I cannot fix. ACL on the router is specified below

Looking forward for your help

Phase 1 is like that

Cisco_router #sh crypto isakmp his

IPv4 Crypto ISAKMP Security Association
status of DST CBC State conn-id slot
78.x.x.41 87.x.x.4 QM_IDLE 2006 0 ACTIVE

and ASA

ASA # sh crypto isakmp his

ITS enabled: 1
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 1

1 peer IKE: 78.x.x.41
Type: L2L role: initiator
Generate a new key: no State: MM_ACTIVE

Phase 2 on SAA

ASA # sh crypto ipsec his
Interface: Outside
Tag crypto map: Outside_map, seq num: 20, local addr: 87.x.x.4

Outside_cryptomap_20 ip 172.19.209.0 access list allow 255.255.255.0 172.
19.194.0 255.255.255.0
local ident (addr, mask, prot, port): (172.19.209.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (172.19.194.0/255.255.255.0/0/0)
current_peer: 78.x.x.41

#pkts program: 8813, #pkts encrypt: 8813, #pkts digest: 8813
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 8813, model of #pkts failed: 0, #pkts Dang failed: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : 87.x.x.4, remote Start crypto. : 78.x.x.41

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
current outbound SPI: C96393AB

SAS of the esp on arrival:
SPI: 0x3E9D820B (1050509835)
transform: esp-3des esp-md5-hmac no
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 7, crypto-card: Outside_map
calendar of his: service life remaining (KB/s) key: (4275000/3025)
Size IV: 8 bytes
support for replay detection: Y
outgoing esp sas:
SPI: 0xC96393AB (3378746283)
transform: esp-3des esp-md5-hmac no
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 7, crypto-card: Outside_map
calendar of his: service life remaining (KB/s) key: (4274994/3023)
Size IV: 8 bytes
support for replay detection: Y

Phase 2 on cisco router

protégé of the vrf: (none)
local ident (addr, mask, prot, port): (172.19.209.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (172.19.194.0/255.255.255.0/0/0)
current_peer 87.x.x.4 port 500
LICENCE, flags is {origin_is_acl},
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, #pkts compr. has failed: 0
#pkts not unpacked: 0, #pkts decompress failed: 0
Errors #send 0, #recv 0 errors

local crypto endpt. : 78.x.x.41, remote Start crypto. : 87.x.x.4
Path mtu 1452, ip mtu 1452, ip mtu BID Dialer0
current outbound SPI: 0x0 (0)

SAS of the esp on arrival:

the arrival ah sas:

SAS of the CFP on arrival:

outgoing esp sas:

outgoing ah sas:

outgoing CFP sas:

protégé of the vrf: (none)
local ident (addr, mask, prot, port): (172.19.194.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (172.19.209.0/255.255.255.0/0/0)
current_peer 87.x.x.4 port 500
LICENCE, flags is {origin_is_acl},
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 8947, #pkts decrypt: 8947, #pkts check: 8947
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, #pkts compr. has failed: 0
#pkts not unpacked: 0, #pkts decompress failed: 0
Errors #send 0, #recv 0 errors

local crypto endpt. : 78.x.x.41, remote Start crypto. : 87.x.x.4
Path mtu 1452, ip mtu 1452, ip mtu BID Dialer0
current outbound SPI: 0x3E9D820B (1050509835)

SAS of the esp on arrival:
SPI: 0xC96393AB (3378746283)
transform: esp-3des esp-md5-hmac.
running parameters = {Tunnel}
Conn ID: 29, flow_id: Motorola SEC 1.0:29, card crypto: mycryptomap
calendar of his: service life remaining (k/s) key: (4393981/1196)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE

the arrival ah sas:

SAS of the CFP on arrival:

outgoing esp sas:
SPI: 0x3E9D820B (1050509835)
transform: esp-3des esp-md5-hmac.
running parameters = {Tunnel}
Conn ID: 30, flow_id: Motorola SEC 1.0:30, card crypto: mycryptomap
calendar of his: service life remaining (k/s) key: (4394007/1196)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE

outgoing ah sas:

outgoing CFP sas:

VPN configuration is less in cisco router

access-list 101 permit ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
access-list 101 permit ip 172.19.206.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
access-list 101 permit ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
access-list 101 permit ip 172.19.203.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
access-list 101 permit ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect
access-list 101 permit ip 172.19.209.0 0.0.0.255 172.19.194.0 0.0.0.255 connect

access-list 105 deny ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
access-list 105 deny ip 172.19.206.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
access-list 105 deny ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
access-list 105 deny ip 172.19.203.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
access-list 105 deny ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect
access-list 105 deny ip 172.19.209.0 0.0.0.255 172.19.194.0 0.0.0.255 connect

sheep allowed 10 route map
corresponds to the IP 105

Crypto ipsec transform-set esp-3des esp-md5-hmac mytransformset

mycryptomap 100 ipsec-isakmp crypto map
the value of 87.x.x.4 peer
Set transform-set mytransformset
match address 101

crypto ISAKMP policy 100
BA 3des
md5 hash
preshared authentication
Group 2
ISAKMP crypto key xxx2011 address 87.x.x.4

Your permit for 105 ACL statement should be down is changed to match because it is the most general ACL.

You currently have:

Extend the 105 IP access list
5 permit ip 172.19.194.0 0.0.0.255 (18585 matches)
10 deny ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
30 deny ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
50 deny ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect

It should be:

Extend the 105 IP access list
10 deny ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
30 deny ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
50 deny ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect

IP 172.19.194.0 allow 60 0.0.0.255 (18585 matches)

To remove it and add it to the bottom:

105 extended IP access list

not 5

IP 172.19.194.0 allow 60 0.0.0.255 any

Then ' delete ip nat trans. "

and it should work now.

PPTP VPN between clients Windows and Cisco 2921 router

Hi all!

I have a problem with PPTP VPN between Windows clients and router Cisco 2921 with permission of RADIUS (IAS). When I try to connect to Cisco 2921 of Windows 7 by using MS-CHAP v2 I get the message 778: it was not possible to verify the identity of the server. Can I use PAP - power is OK. On Windows XP, the same situation.

Cisco config:

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

encryption password service

!

hostname gw.izmv

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

!

AAA new-model

!

AAA authentication ppp default local radius group of

!

AAA - the id of the joint session

!

clock timezone + 002 2

!

No ipv6 cef

IP source-route

IP cef

!

!

Authenticated MultiLink bundle-name Panel

!

Async-bootp Server dns 192.168.192.XX

VPDN enable

!

VPDN-Group 1

! PPTP by default VPDN group

accept-dialin

Pptp Protocol

virtual-model 1

echo tunnel PPTP 10

tunnel L2TP non-session timeout 15

PMTU IP

adjusting IP mtu

!

redundancy

!

interface Loopback0

IP 192.168.207.1 255.255.255.0

!

!

interface GigabitEthernet0/0

Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE $ 0/0

IP 192.168.192.XXX 255.255.255.0

IP 192.168.192.XX 255.255.255.0 secondary

IP nat inside

IP virtual-reassembly

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/1

no ip address

Shutdown

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/2

Description - Inet-

no ip address

NAT outside IP

IP virtual-reassembly

automatic duplex

automatic speed

PPPoE enable global group

PPPoE-client dial-pool-number 1

No cdp enable

!

!

interface virtual-Template1

IP unnumbered Loopback0

IP mtu 1492

IP virtual-reassembly

AutoDetect encapsulation ppp

by default PPP peer ip address pool

PPP mppe auto encryption required

PPP authentication ms-chap-v2

!

!

interface Dialer1

the negotiated IP address

NAT outside IP

IP virtual-reassembly

encapsulation ppp

Dialer pool 1

Dialer-Group 1

PPP authentication pap callin

PPP pap sent-username DSLUSERNAME password DSLPASSWORD

No cdp enable

!

!

IP local pool PPP 192.168.207.200 192.168.207.250

IP forward-Protocol ND

!

!

overload of IP nat inside source list NAT_ACL interface Dialer1

IP nat inside source static tcp 192.168.192.XX 25 expandable 25 82.XXX.XXX.XXX

IP nat inside source static tcp 192.168.192.XX 1352 82.XXX.XXX.XXX 1352 extensible

IP route 0.0.0.0 0.0.0.0 Dialer1

!

NAT_ACL extended IP access list

deny ip 192.168.192.0 0.0.0.255 192.168.YYY.0 0.0.0.255

deny ip 192.168.192.0 0.0.0.255 192.168.YYY.0 0.0.0.255

deny ip 192.168.192.0 0.0.0.255 192.168.YYY.0 0.0.0.255

deny ip 192.168.192.0 0.0.0.255 192.168.YYY.0 0.0.0.255

permit tcp 192.168.192.0 0.0.0.255 any eq www

permit tcp 192.168.192.0 0.0.0.255 any eq 443

permit tcp 192.168.192.0 0.0.0.255 any eq 1352

permit tcp host 192.168.192.XX no matter what eq smtp

permit tcp 192.168.192.0 0.0.0.255 any eq 22

permit tcp host 192.168.192.XX no matter what eq field

permit tcp host 192.168.192.XX no matter what eq field

permit tcp host 192.168.192.XX no matter what eq field

allowed UDP host 192.168.192.XX matter what eq field

allowed UDP host 192.168.192.XX matter what eq field

allowed UDP host 192.168.192.XX matter what eq field

!

host 192.168.192.XX auth-port 1645 1646 RADIUS server acct-port

Server RADIUS IASKEY key

!

control plan

!

!

!

Line con 0

line to 0

line vty 0 4

line vty 5 15

!

Scheduler allocate 20000 1000

end

Debugging is followed:

14:47:51.755 on 21 oct: PPP: Alloc context [294C7BC4]

14:47:51.755 on 21 oct: ppp98 PPP: Phase is

14:47:51.755 on 21 oct: ppp98 PPP: using AAA Id Unique = 8 b

14:47:51.755 on 21 oct: ppp98 PPP: permission NOT required

14:47:51.755 on 21 oct: ppp98 PPP: via vpn, set the direction of the call

14:47:51.755 on 21 oct: ppp98 PPP: treatment of connection as a callin

14:47:51.755 on 21 oct: ppp98 PPP: Session Session handle [62] id [98]

14:47:51.755 on 21 oct: ppp98 TPIF: State of the event [OPEN] [initial check]

14:47:51.755 on 21 oct: ppp98 PPP LCP: switch to passive mode, State [stopped]

14:47:53.759 on 21 oct: ppp98 PPP LCP: exit passive mode, State [departure]

14:47:53.759 on 21 oct: LCP ppp98: O CONFREQ [departure] id 1 len 19

14:47:53.759 on 21 oct: ppp98 TPIF: MRU 1464 (0x010405B8)

14:47:53.759 on 21 oct: ppp98 TPIF: AuthProto MS-CHAP-V2 (0x0305C22381)

14:47:53.759 on 21 oct: ppp98 TPIF: MagicNumber 0xF018D237 (0x0506F018D237)

14:47:53.759 on 21 oct: ppp98 TPIF: event [UP] State [departure at REQsent]

14:47:54.351 on 21 oct: ppp98 TPIF: I CONFREQ [REQsent] id 0 len 18

14:47:54.351 on 21 oct: ppp98 TPIF: MRU 1400 (0 x 01040578)

14:47:54.351 on 21 oct: ppp98 TPIF: MagicNumber 0x2F7C5F7E (0x05062F7C5F7E)

14:47:54.351 on 21 oct: ppp98 TPIF: PFC (0 x 0702)

14:47:54.351 on 21 oct: ppp98 TPIF: RAC (0 x 0802)

14:47:54.351 on 21 oct: LCP ppp98: O CONFNAK [REQsent] id 0 len 8

14:47:54.351 on 21 oct: ppp98 TPIF: MRU 1464 (0x010405B8)

14:47:54.351 on 21 oct: ppp98 TPIF: State of the event [receive ConfReq-] [REQsent to REQsent]

14:47:54.751 on 21 oct: ppp98 TPIF: I CONFACK [REQsent] id 1 len 19

14:47:54.751 on 21 oct: ppp98 TPIF: MRU 1464 (0x010405B8)

14:47:54.751 on 21 oct: ppp98 TPIF: AuthProto MS-CHAP-V2 (0x0305C22381)

14:47:54.751 on 21 oct: ppp98 TPIF: MagicNumber 0xF018D237 (0x0506F018D237)

14:47:54.751 on 21 oct: ppp98 TPIF: State of the event [receive ConfAck] [REQsent to ACKrcvd]

14:47:54.915 on 21 oct: ppp98 TPIF: I CONFREQ [ACKrcvd] id 1 len 18

14:47:54.915 on 21 oct: ppp98 TPIF: MRU 1400 (0 x 01040578)

14:47:54.915 on 21 oct: ppp98 TPIF: MagicNumber 0x2F7C5F7E (0x05062F7C5F7E)

14:47:54.915 on 21 oct: ppp98 TPIF: PFC (0 x 0702)

14:47:54.915 on 21 oct: ppp98 TPIF: RAC (0 x 0802)

14:47:54.915 on 21 oct: LCP ppp98: O CONFNAK [ACKrcvd] id 1 len 8

14:47:54.915 on 21 oct: ppp98 TPIF: MRU 1464 (0x010405B8)

14:47:54.915 on 21 oct: ppp98 TPIF: State of the event [receive ConfReq-] [ACKrcvd to ACKrcvd]

14:47:55.275 on 21 oct: ppp98 TPIF: I CONFREQ [ACKrcvd] id 2 len 18

14:47:55.275 on 21 oct: ppp98 TPIF: MRU 1464 (0x010405B8)

14:47:55.275 on 21 oct: ppp98 TPIF: MagicNumber 0x2F7C5F7E (0x05062F7C5F7E)

14:47:55.275 on 21 oct: ppp98 TPIF: PFC (0 x 0702)

14:47:55.275 on 21 oct: ppp98 TPIF: RAC (0 x 0802)

14:47:55.275 on 21 oct: LCP ppp98: O CONFACK [ACKrcvd] id 2 len 18

14:47:55.275 on 21 oct: ppp98 TPIF: MRU 1464 (0x010405B8)

14:47:55.275 on 21 oct: ppp98 TPIF: MagicNumber 0x2F7C5F7E (0x05062F7C5F7E)

14:47:55.275 on 21 oct: ppp98 TPIF: PFC (0 x 0702)

14:47:55.275 on 21 oct: ppp98 TPIF: RAC (0 x 0802)

14:47:55.275 on 21 oct: ppp98 TPIF: State of the event [receive ConfReq +] [ACKrcvd to open]

14:47:55.295 on 21 oct: ppp98 PPP: Phase is AUTHENTICATING,

14:47:55.295 on 21 oct: ppp98 MS-CHAP-V2: O CHALLENGE id 1 len 28 of 'gw.izmv '.

14:47:55.295 on 21 oct: ppp98 TPIF: State is open

14:47:55.583 on 21 oct: ppp98 MS-CHAP-V2: I ANSWER id 1 len 71 of "domain\username".

14:47:55.583 on 21 oct: ppp98 PPP: Phase TRANSFER, tempting with impatience

14:47:55.583 on 21 oct: ppp98 PPP: Phase is AUTHENTICATING, unauthenticated user

14:47:55.587 on 21 oct: ppp98 PPP: request sent MSCHAP_V2 LOGIN

14:47:55.591 on 21 oct: ppp98 PPP: received LOGIN response PASS

14:47:55.591 on 21 oct: ppp98 PPP AUTHOR: author data NOT available

14:47:55.591 on 21 oct: ppp98 PPP: Phase TRANSFER, tempting with impatience

14:47:55.595 on 21 oct: Vi3 PPP: Phase is AUTHENTICATING, authenticated user

14:47:55.595 on 21 oct: Vi3: given msg No. MS_CHAP_V2

14:47:55.595 on 21 oct: Vi3 MS-CHAP-V2: SUCCESS O id 1 len 46 msg is "tG @ #QDD @(@B@ (@[email protected]/ ** / @I @:[email protected]/ ** / @@@ EJFDE)).

14:47:55.595 on 21 oct: Vi3 PPP: Phase is in PLACE

14:47:55.595 on 21 oct: Vi3 CPIW: protocol configured, start state cf. [original]

14:47:55.595 on 21 oct: Vi3 CPIW: State of the event [OPEN] [Initial report on startup]

14:47:55.595 on 21 oct: Vi3 CPIW: O CONFREQ [departure] id 1 len 10

14:47:55.595 on 21 oct: Vi3 CPIW: address of 192.168.207.1 (0x0306C0A8CF01)

14:47:55.595 on 21 oct: Vi3 CPIW: event [UP] State [begins to REQsent]

14:47:55.595 on 21 oct: Vi3 CCP: protocol configured, start state cf. [original]

14:47:55.595 on 21 oct: Vi3 CCP: State of the event [OPEN] [Initial report on startup]

14:47:55.595 on 21 oct: Vi3 CCP: O CONFREQ [departure] id 1 len 10

14:47:55.595 on 21 oct: Vi3 CCP: MS - PPC supported bits 0 x 01000060 (0 x 120601000060)

14:47:55.595 on 21 oct: Vi3 CCP: event [UP] State [begins to REQsent]

14:47:55.599 on 21 oct: % LINK-3-UPDOWN: Interface virtual-access.3, changed State to

14:47:55.603 on 21 oct: % LINEPROTO-5-UPDOWN: Line protocol on Interface virtual-access.3, changed State to

14:47:56.027 on 21 oct: Vi3 LCP: I have TERMREQ [open] id 3 len 16

14:47:56.027 on 21 oct: Vi3 LCP: (0x2F7C5F7E003CCD740000030A)

14:47:56.027 on 21 oct: Vi3 CPIW: event [BOTTOM] State [REQsent on startup]

14:47:56.027 on 21 oct: Vi3 CPIW: State of event [CLOSE] [begins with initial]

14:47:56.027 on 21 oct: Vi3 CCP: event [BOTTOM] State [REQsent on startup]

14:47:56.027 on 21 oct: Vi3 PPP DISC: MPPE required not negotiated

14:47:56.027 on 21 oct: Vi3 PPP: sending Acct event [low] id [8B]

14:47:56.027 on 21 oct: Vi3 CCP: State of event [CLOSE] [start with initial]

14:47:56.027 on 21 oct: Vi3 LCP: O TERMACK [open] id 3 len 4

14:47:56.027 on 21 oct: Vi3 LCP: event [receive TermReq] State [Open to stop]

14:47:56.027 on 21 oct: Vi3 PPP: Phase ENDS

14:47:56.027 on 21 oct: Vi3 LCP: event [CLOSE] [off status of closing]

14:47:56.675 on 21 oct: Vi3 PPP: block vaccess to be released [0x10]

14:47:56.675 on 21 oct: Vi3 LCP: event [CLOSE] State [closing closing]

14:47:56.679 on 21 oct: Vi3 LCP: event [BOTTOM] State [closing on Initial]

14:47:56.679 on 21 oct: Vi3 PPP: compensation AAA Id Unique = 8 b

14:47:56.679 on 21 oct: Vi3 PPP: unlocked by [0x10] always locked by 0 x [0]

14:47:56.679 on 21 oct: Vi3 PPP: free previously blocked vaccess

14:47:56.679 on 21 oct: Vi3 PPP: Phase is BROKEN

14:47:56.679 on 21 oct: % LINK-3-UPDOWN: Interface virtual-access.3, changed State to down

14:47:56.683 on 21 oct: % LINEPROTO-5-UPDOWN: Line protocol on Interface virtual-access.3, state change downstairs

I'll be very grateful for any useful suggestions

We had the same problem using MS-CHAP-V2 and 3945 router using IOS 15.2. When you add the same combination of username/password locally it worked fine but it wasn't no of course of the solution. We have solved this problem by adding the following line in the config file:

AAA authorization network default authenticated if

This is because Windows 2000 clients require the use of a statement of authorization aaa in the router config. Maybe it was default (and therefore not shown) previous iOS releases.

Success!

Wil Schenkeveld

Troubleshooting IPSec Site to Site VPN between ASA and 1841

Hi all

in the past I've implemented several VPN connections between the devices of the SAA. So I thought a site link between an ASA site and 1841 would be easier... But it seems I was mistaken.

I configured a VPN Site to Site, as it has been described in the Document ID: SDM 110198: IPsec Site to Site VPN between ASA/PIX and an example of IOS Router Configuration (I have not used SDM but CCP).

I have run the wizards on the ASA with ASDM and the current IOS version 15.1 1841, with CCP.

It seems to Phase 1 and 2 are coming although my ASA in ADSM reports (monitoring > VPN > VPN statistics > Sessions) a tunnel established with some of the Tx traffic but 0 Rx traffic),

On the ASA:

Output of the command: "sh crypto ipsec its peer 217.xx.yy.zz.

address of the peers: 217.86.154.120
Crypto map tag: VPN-OUTSIDE, seq num: 2, local addr: 62.aa.bb.cc

access extensive list ip 192.168.37.0 outside_2_cryptomap_1 allow 255.255.255.0 172.20.2.0 255.255.255.0
local ident (addr, mask, prot, port): (LAN-A/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (LAN-G/255.255.255.0/0/0)
current_peer: 217.xx.yy.zz

#pkts program: 400, #pkts encrypt: 400, #pkts digest: 400
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 400, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : 62.aa.bb.cc, remote Start crypto. : 217.xx.yy.zz

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
current outbound SPI: 39135054
current inbound SPI: B2E9E500

SAS of the esp on arrival:
SPI: 0xB2E9E500 (3001672960)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, PFS 2 group}
slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
calendar of his: service life remaining (KB/s) key: (4374000/1598)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
outgoing esp sas:
SPI: 0 x 39135054 (957567060)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, PFS 2 group}
slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
calendar of his: service life remaining (KB/s) key: (4373976/1598)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

Output of the command: "sh crypto isakmp his."

HIS active: 4
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 4

IKE Peer: 217.xx.yy.zz
Type: L2L role: initiator
Generate a new key: no State: MM_ACTIVE

On the 1841

1841 crypto isakmp #sh its
IPv4 Crypto ISAKMP Security Association
DST CBC conn-State id
217.86.154.120 62.153.156.163 QM_IDLE 1002 ACTIVE

1841 crypto ipsec #sh its

Interface: Dialer1
Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

protégé of the vrf: (none)
local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
current_peer 62.153.156.163 port 500
LICENCE, flags is {origin_is_acl},
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, #pkts compr. has failed: 0
#pkts not unpacked: 0, #pkts decompress failed: 0
Errors #send 0, #recv 0 errors

local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
current outbound SPI: 0xB2E9E500 (3001672960)
PFS (Y/N): Y, Diffie-Hellman group: group2

SAS of the esp on arrival:
SPI: 0 x 39135054 (957567060)
transform: esp-3des esp-sha-hmac.
running parameters = {Tunnel}
Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
calendar of his: service life remaining (k/s) key: (4505068/1306)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE

the arrival ah sas:

SAS of the CFP on arrival:

outgoing esp sas:
SPI: 0xB2E9E500 (3001672960)
transform: esp-3des esp-sha-hmac.
running parameters = {Tunnel}
Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
calendar of his: service life remaining (k/s) key: (4505118/1306)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE

outgoing ah sas:

outgoing CFP sas:

Interface: virtual Network1
Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

protégé of the vrf: (none)
local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
current_peer 62.153.156.163 port 500
LICENCE, flags is {origin_is_acl},
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, #pkts compr. has failed: 0
#pkts not unpacked: 0, #pkts decompress failed: 0
Errors #send 0, #recv 0 errors

local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
current outbound SPI: 0xB2E9E500 (3001672960)
PFS (Y/N): Y, Diffie-Hellman group: group2

SAS of the esp on arrival:
SPI: 0 x 39135054 (957567060)
transform: esp-3des esp-sha-hmac.
running parameters = {Tunnel}
Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
calendar of his: service life remaining (k/s) key: (4505068/1306)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE

the arrival ah sas:

SAS of the CFP on arrival:

outgoing esp sas:
SPI: 0xB2E9E500 (3001672960)
transform: esp-3des esp-sha-hmac.
running parameters = {Tunnel}
Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
calendar of his: service life remaining (k/s) key: (4505118/1306)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE

outgoing ah sas:

outgoing CFP sas:

It seems that the routing on the 1841 is working properly as I can tear down the tunnel and relaunch in scathing a host on the network of 1841, but not vice versa.

Trounleshoot VPN of the 1841 report shows a message like "the following sources are forwarded through the interface card crypto. (172.20.2.0 1) go to "Configure-> routing" and correct the routing table.

I have not found an error on the 1841 config so if one of the guys reading this thread has an idea I appreciate highly suspicion!

It's the running of the 1841 configuration

!
version 15.1
horodateurs service debug datetime msec
Log service timestamps datetime msec
encryption password service
!
host name 1841
!
boot-start-marker
start the system flash c1841-adventerprisek9 - mz.151 - 1.T.bin
boot-end-marker
!
logging buffered 51200 notifications
!
AAA new-model
!
!
AAA authentication login default local
!
AAA - the id of the joint session
!
iomem 20 memory size
clock timezone PCTime 1
PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
dot11 syslog
IP source-route
!
No dhcp use connected vrf ip
!
IP cef
no ip bootp Server
IP domain name test
name of the IP-server 194.25.2.129
name of the IP-server 194.25.2.130
name of the IP-server 194.25.2.131
name of the IP-server 194.25.2.132
name of the IP-server 194.25.2.133
No ipv6 cef
!
Authenticated MultiLink bundle-name Panel
!
!
object-group network phone
VoIP phone description
Home 172.20.2.50
Home 172.20.2.51
!
redundancy
!
!
controller LAN 0/0/0
atm mode
Annex symmetrical shdsl DSL-mode B
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
isakmp encryption key * address 62.aa.bb.cc
!
!
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
!
map SDM_CMAP_1 1 ipsec-isakmp crypto
Description Tunnel to62.aa.bb.cc
the value of 62.aa.bb.cc peer
game of transformation-ESP-3DES-SHA
PFS group2 Set
match address 100
!
!
!
interface FastEthernet0/0
DMZ description $ FW_OUTSIDE$
10.10.10.254 IP address 255.255.255.0
IP nat inside
IP virtual-reassembly
automatic duplex
automatic speed
!
interface FastEthernet0/1
Description $ETH - LAN$ $FW_INSIDE$
IP 172.20.2.254 255.255.255.0
IP access-group 100 to
IP nat inside
IP virtual-reassembly
IP tcp adjust-mss 1412
automatic duplex
automatic speed
!
ATM0/0/0 interface
no ip address
No atm ilmi-keepalive
!
point-to-point interface ATM0/0/0.1
PVC 1/32
PPPoE-client dial-pool-number 1
!
!
interface Dialer1
Description $FW_OUTSIDE$
the negotiated IP address
IP mtu 1452
NAT outside IP
IP virtual-reassembly
encapsulation ppp
Dialer pool 1
Dialer-Group 2
PPP authentication chap callin pap
PPP chap hostname xxxxxxx
PPP chap password 7 xxxxxxx8
PPP pap sent-name of user password xxxxxxx xxxxxxx 7
map SDM_CMAP_1 crypto
!
IP forward-Protocol ND
IP http server
local IP http authentication
IP http secure server
!
!
The dns server IP
IP nat inside source static tcp 10.10.10.1 808 interface Dialer1 80
IP nat inside source static tcp 10.10.10.1 25 25 Dialer1 interface
IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
IP nat inside source overload map route SDM_RMAP_2 interface Dialer1
IP route 0.0.0.0 0.0.0.0 Dialer1 permanent
!
logging trap notifications
Note category of access list 1 = 2 CCP_ACL
access-list 1 permit 172.20.2.0 0.0.0.255
Note access-list category 2 CCP_ACL = 2
access-list 2 allow 10.10.10.0 0.0.0.255
Note access-list 100 category CCP_ACL = 4
Note access-list 100 IPSec rule
access-list 100 permit ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
Note CCP_ACL the access list 101 = 2 category
Note access-list 101 IPSec rule
access-list 101 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
access-list 101 permit ip 172.20.2.0 0.0.0.255 any
Note access-list 102 CCP_ACL category = 2
Note access-list 102 IPSec rule
access-list 102 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
access-list 102 permit ip 10.10.10.0 0.0.0.255 any
!

!
allowed SDM_RMAP_1 1 route map
corresponds to the IP 101
!
allowed SDM_RMAP_2 1 route map
corresponds to the IP 102
!
!
control plan
!
!
Line con 0
line to 0
line vty 0 4
length 0
transport input telnet ssh
!
Scheduler allocate 20000 1000
NTP-Calendar Update
NTP 172.20.2.250 Server prefer
end

As I mentioned previously: suspicion is much appreciated!

Best regards

Joerg

Joerg,

ASA receives not all VPN packages because IOS does not send anything.

Try to send packets to the 1841 LAN to LAN of the ASA and see is the "sh cry ips its" on the 1841 increments the encrypted packets (there not)

The problem seems so on the side of the router.

I think that is a routing problem, but you only have one default gateway (no other channels on the router).

The ACL 100 is set to encrypt the traffic between the two subnets.

It seems that the ACL 101 is also bypassing NAT for VPN traffic.

Follow these steps:

Try running traffic of LAN router inside IP (source of ping 192.168.37.x 172.20.2.254) and see if the packages are not through the translation and obtaining encrypted.

I would also like to delete 100 ACL from the inside interface on the router because it is used for the VPN. You can create an another ACL to apply to the interface.

Federico.

Impossible to travel from the LAN computers through a router from cisco 887vdsl

Hi I installed a router CISCO v887 to the Amsterdam Office

I set up a VPN between AMS and Edinburg Office tunnel.

1. the VPN is running

2. I am unable to see anything of the LAN computers at the office in Amsterdam.

3 from computers LAN I can traceroute to yahoo.com but the browser I impossible to navigate on yahoo.com and web page hanged in this situation (Web site waiting for response). But nothing comes and LAN users are unable to use internet.

Help, please

My configurations are

IP source-route

!

!

!

!

IP cef

IP domain name xxxxxx.com

8.8.8.8 IP name-server

No ipv6 cef

!

username xxxxxxxxxxxxxxxxx

username xxxxxxxxxxxxxxxxxxx

!

!

VDSL controller 0

!

property intellectual ssh version 1

property intellectual ssh pubkey-string

username xxxxxxx

ssh - rsa xxxxxxxxxxxxxxxxxxx key hash

quit smoking

!

!

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

ISAKMP crypto key xxxxxxxxxx address 94.xx.xx.xx

!

!

Crypto ipsec transform-set esp - esp-sha-hmac AMS - SET

!

map AMS - R 10 ipsec-isakmp crypto

the value of 94.xx.xx.xx peer

AMS - Set transform-set

match address 102

!

!

!

!

!

interface Ethernet0

no ip address

PPPoE-client dial-pool-number 10

!

!

interface Ethernet0.6

encapsulation dot1Q 6

PPPoE-client dial-pool-number 10

!

interface BRI0

no ip address

encapsulation hdlc

Shutdown

Multidrop ISDN endpoint

!

!

interface FastEthernet0

load-interval 30

Speed 100

PPPoE-client dial-pool-number 10

!

!

interface FastEthernet1

!

!

interface FastEthernet2

!

!

interface FastEthernet3

!

!

interface Vlan1

10.0.12.1 IP address 255.255.255.0

IP nat inside

activate nat IP

IP virtual-reassembly

!

!

interface Dialer0

no ip address

Shutdown

!

!

interface Dialer10

the negotiated IP address

NAT outside IP

IP virtual-reassembly

encapsulation ppp

Dialer pool 10

Dialer-group 10

PPP authentication pap callin

PPP chap hostname xxx@xxx-ZDSL

PPP chap password 0 xxx

PPP pap sent-username@xxx-ZDSL password 0 xxx xxxx

No cdp enable

AMS - R-crypto card

!

!

IP forward-Protocol ND

IP http server

no ip http secure server

!

!

IP nat inside source overload map route sheep interface Dialer10

IP route 0.0.0.0 0.0.0.0 Dialer10

!

access-list 102 permit ip 10.0.12.0 0.0.0.255 10.0.0.0 0.0.3.255

access-list 102 permit ip 10.0.12.0 0.0.0.255 172.16.0.0 0.0.255.255

access-list 102 permit ip 10.0.12.0 0.0.0.255 172.17.0.0 0.0.255.255

access-list 102 deny ip any one

access-list 175 deny ip 10.0.12.0 0.0.0.255 10.0.0.0 0.0.3.255

access-list 175 deny ip 10.0.12.0 0.0.0.255 172.16.0.0 0.0.255.255

access-list 175 deny ip 10.0.12.0 0.0.0.255 172.17.0.0 0.0.255.255

access-list 175 allow ip 10.0.12.0 0.0.0.255 any

Dialer-list 10 ip protocol allow

Dialer-list 1 ip protocol allow

!

!

!

sheep allowed 10 route map

corresponds to the IP 175

!

!

control plan

!

!

!

Line con 0

no activation of the modem

line to 0

line vty 0 4

access-class 1

exec-timeout 30 0

privilege level 15

password xxxxxx

local connection

preferred transport ssh

entry ssh transport

!

max-task-time 5000 Planner

end

Hi Marc,

Please add these lines highlighted below on both interfaces.

interface Vlan1

IP tcp adjust-mss 1412

interface Dialer10

IP mtu 1452

Please update.

Thank you

IPSec VPN between Cisco and ScreenOS

Hello

I'm trying to set up a simple IPSec VPN between a Cisco 2911 router and a Juniper Netscreen ScreenOS (not exactly now the model) device. Initially the debbuging seems good (QM_IDLE), but the ISAKMP Security Association is deleted.

The guy managing the Juniper device send me an extract from his diary:

###########################################################################

2012-08-28 10:24:16 info 00536 IKE Phase 2 msg ID System

9b 839579: negotiations failed.

2012-08-28 10:24:16 info system 00536 rejected a package of IKE loopback.11

of : 500 to

217.150.152.45:500 with cookies

87960e39d074ca49 and 9302d26c7ce324a5

because there is no acceptable Phase

2 proposals...

It has defined the following phase 2 proposals:

IKE the value p2-proposal "G2_esp_aes256_sha_1800s" group2 esp aes256-sha-1, 1800 second

###########################################################################

And I use these:

###########################################################################

crypto ISAKMP policy 1

BA aes 256

preshared authentication

Group 2

!

ISAKMP crypto key address 217.150.152.45

Crypto ipsec transform-set esp - aes esp - aes 256 esp-sha-hmac

card crypto ipsec vpn 2 isakmp

Description * VPN Anbindung nach PKI in Magdeburg *.

defined by peer 217.150.152.45

define security-association life seconds 1800

the value of the transform-set esp - aes

match address PKI-TRAFFIC

!

###########################################################################

Here is my Log:

#################################################################################################################

28 August 08:23:46.416: ISAKMP: (0): profile of THE request is (NULL)

28 August 08:23:46.416: ISAKMP: created a struct peer 217.150.152.45, peer port 500

28 August 08:23:46.416: ISAKMP: new position created post = 0x2A2D7150 peer_handle = 0x8000003A

28 August 08:23:46.416: ISAKMP: lock struct 0x2A2D7150, refcount 1 to peer isakmp_initiator

28 August 08:23:46.416: ISAKMP: 500 local port, remote port 500

28 August 08:23:46.416: ISAKMP: set new node 0 to QM_IDLE

28 August 08:23:46.416: ISAKMP: (0): insert his with his 31627E04 = success

28 August 08:23:46.416: ISAKMP: (0): cannot start aggressive mode, try the main mode.

28 August 08:23:46.416: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.416: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID

28 August 08:23:46.416: ISAKMP: (0): built the seller-07 ID NAT - t

28 August 08:23:46.416: ISAKMP: (0): built of NAT - T of the seller-03 ID

28 August 08:23:46.416: ISAKMP: (0): built the seller-02 ID NAT - t

28 August 08:23:46.416: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

28 August 08:23:46.416: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

28 August 08:23:46.416: ISAKMP: (0): Beginner Main Mode Exchange

28 August 08:23:46.416: ISAKMP: (0): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_NO_STATE

28 August 08:23:46.416: ISAKMP: (0): sending a packet IPv4 IKE.

28 August 08:23:46.448: ISAKMP (0): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_NO_STATE

28 August 08:23:46.448: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.448: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

28 August 08:23:46.448: ISAKMP: (0): treatment ITS payload. Message ID = 0

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 239

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID is DPD

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): IKE frag vendor processing id payload

28 August 08:23:46.448: ISAKMP: (0): IKE Fragmentation support not enabled

28 August 08:23:46.448: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.448: ISAKMP: (0): pre-shared key local found

28 August 08:23:46.448: ISAKMP: analysis of the profiles for xauth...

28 August 08:23:46.448: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1

28 August 08:23:46.448: ISAKMP: AES - CBC encryption

28 August 08:23:46.448: ISAKMP: SHA hash

28 August 08:23:46.448: ISAKMP: group by default 2

28 August 08:23:46.448: ISAKMP: pre-shared key auth

28 August 08:23:46.448: ISAKMP: keylength 256

28 August 08:23:46.448: ISAKMP: type of life in seconds

28 August 08:23:46.448: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80

28 August 08:23:46.448: ISAKMP: (0): atts are acceptable. Next payload is 0

28 August 08:23:46.448: ISAKMP: (0): Acceptable atts: real life: 0

28 August 08:23:46.448: ISAKMP: (0): Acceptable atts:life: 0

28 August 08:23:46.448: ISAKMP: (0): fill atts in his vpi_length:4

28 August 08:23:46.448: ISAKMP: (0): fill atts in his life_in_seconds:86400

28 August 08:23:46.448: ISAKMP: (0): return real life: 86400

28 August 08:23:46.448: ISAKMP: (0): timer life Started: 86400.

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 239

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID is DPD

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): IKE frag vendor processing id payload

28 August 08:23:46.448: ISAKMP: (0): IKE Fragmentation support not enabled

28 August 08:23:46.448: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.448: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

28 August 08:23:46.448: ISAKMP: (0): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_SA_SETUP

28 August 08:23:46.448: ISAKMP: (0): sending a packet IPv4 IKE.

28 August 08:23:46.452: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.452: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

28 August 08:23:46.484: ISAKMP (0): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_SA_SETUP

28 August 08:23:46.484: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.484: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

28 August 08:23:46.484: ISAKMP: (0): processing KE payload. Message ID = 0

28 August 08:23:46.508: ISAKMP: (0): processing NONCE payload. Message ID = 0

28 August 08:23:46.508: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.508: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.508: ISAKMP: (1049): former State = new State IKE_I_MM4 = IKE_I_MM4

28 August 08:23:46.508: ISAKMP: (1049): send initial contact

28 August 08:23:46.508: ISAKMP: (1049): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

28 August 08:23:46.508: ISAKMP (1049): payload ID

next payload: 8

type: 1

address: 92.67.80.237

Protocol: 17

Port: 500

Length: 12

28 August 08:23:46.508: ISAKMP: (1049): the total payload length: 12

28 August 08:23:46.508: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_KEY_EXCH

28 August 08:23:46.508: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.508: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.508: ISAKMP: (1049): former State = new State IKE_I_MM4 = IKE_I_MM5

28 August 08:23:46.540: ISAKMP (1049): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_KEY_EXCH

28 August 08:23:46.540: ISAKMP: (1049): payload ID for treatment. Message ID = 0

28 August 08:23:46.540: ISAKMP (1049): payload ID

next payload: 8

type: 1

address: 217.150.152.45

Protocol: 17

Port: 500

Length: 12

28 August 08:23:46.540: ISAKMP: (0): peer games * no * profiles

28 August 08:23:46.540: ISAKMP: (1049): HASH payload processing. Message ID = 0

28 August 08:23:46.540: ISAKMP: (1049): SA authentication status:

authenticated

28 August 08:23:46.540: ISAKMP: (1049): SA has been authenticated with 217.150.152.45

28 August 08:23:46.540: ISAKMP: try inserting a peer /217.150.152.45/500/ and inserted 2A2D7150 successfully.

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM5 = IKE_I_MM6

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM6 = IKE_I_MM6

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

28 August 08:23:46.540: ISAKMP: (1049): start Quick Mode Exchange, M - ID of 1582159006

28 August 08:23:46.552: ISAKMP: (1049): initiator QM gets spi

28 August 08:23:46.552: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) QM_IDLE

28 August 08:23:46.552: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.552: ISAKMP: (1049): entrance, node-1582159006 = IKE_MESG_INTERNAL, IKE_INIT_QM

28 August 08:23:46.552: ISAKMP: (1049): former State = new State IKE_QM_READY = IKE_QM_I_QM1

28 August 08:23:46.552: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

28 August 08:23:46.552: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

28 August 08:23:46.584: ISAKMP (1049): received 217.150.152.45 packet dport 500 sport Global 500 (I) QM_IDLE

28 August 08:23:46.584: ISAKMP: node set-452721455 to QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): HASH payload processing. Message ID =-452721455

28 August 08:23:46.584: ISAKMP: (1049): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 1

SPI 0, message ID =-452721455, his 0x31627E04 =

28 August 08:23:46.584: ISAKMP: (1049): peer does not paranoid KeepAlive.

28 August 08:23:46.584: ISAKMP: (1049): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (post 217.150.152.45)

28 August 08:23:46.584: ISAKMP: (1049): node-452721455 error suppression FALSE reason 'informational (en) State 1.

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

28 August 08:23:46.584: ISAKMP: node set 494253780 to QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.584: ISAKMP: (1049): purge the node 494253780

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

28 August 08:23:46.584: ISAKMP: (1049): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (post 217.150.152.45)

Intertoys_Zentrale_Waddinxveen_01 #.

28 August 08:23:46.584: ISAKMP: Unlocking counterpart struct 0x2A2D7150 for isadb_mark_sa_deleted(), count 0

28 August 08:23:46.584: ISAKMP: delete peer node by peer_reap for 217.150.152.45: 2A2D7150

28 August 08:23:46.584: ISAKMP: (1049): node-1582159006 error suppression FALSE reason 'IKE deleted.

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_DEST_SA = IKE_DEST_SA

#################################################################################################################

Is there something special that needs to be addressed when creating a VPN for Juniper devices?

Greetings

Thomas

The peer IPSec a PFS enabled, do the same in your crypto-map:

card crypto ipsec vpn 2 isakmp

PFS group2 Set

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

L2l VPN between two ASA5505 works not

Let me start who I know a thing or two about networks. VPN not so much.

I am trying to configure a Site-toSite VPN between two ASA 5505. I am building this in a laboratory of the Office before I deploy it to the end sites. I are the indications on this very informative forum and think I have it set up correctly. I can see the tunnel is being built and I see same incrementation of the traffic counters. But the real user sessions do not seem to work. For example, ping and telnet does not work.

An excerpt from the syslog for a ping test on a computer on the remote end.

(10.1.10.5 is the local computer, 10.1.11.5 is the remote computer. 10.1.11.1 is the interface of the ASA remote interior)

6. January 20, 2012 | 01:04:12 | 302021 | 10.1.11.1 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0 ICMP
6. January 20, 2012 | 01:04:10 | 302020 | 10.1.10.5 | 1. 10.1.11.1 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0
6. January 20, 2012 | 01:04:07 | 302021 | 10.1.11.1 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0 ICMP
6. January 20, 2012 | 01:04:05 | 302020 | 10.1.10.5 | 1. 10.1.11.1 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0
6. January 20, 2012 | 01:04:02 | 302021 | 10.1.11.1 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0 ICMP
6. January 20, 2012 | 01:04:00 | 302020 | 10.1.10.5 | 1. 10.1.11.1 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0
6. January 20, 2012 | 01:03:57 | 302021 | 10.1.11.1 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0 ICMP
6. January 20, 2012 | 01:03:55 | 302020 | 10.1.10.5 | 1. 10.1.11.1 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.1/0
6. January 20, 2012 | 01:03:48 | 302021 | 10.1.11.5 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.5/0 ICMP
6. January 20, 2012 | 01:03:46 | 302020 | 10.1.10.5 | 1. 10.1.11.5 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.5/0
6. January 20, 2012 | 01:03:43 | 302021 | 10.1.11.5 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.5/0 ICMP
6. January 20, 2012 | 01:03:41 | 302020 | 10.1.10.5 | 1. 10.1.11.5 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.5/0
6. January 20, 2012 | 01:03:38 | 302021 | 10.1.11.5 | 0 | 10.1.10.5 | 1. Connection of disassembly for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.5/0 ICMP
6. January 20, 2012 | 01:03:36 | 302020 | 10.1.10.5 | 1. 10.1.11.5 | 0 | Built of outbound ICMP connection for faddr gaddr laddr 10.1.10.5/1 10.1.10.5/1 10.1.11.5/0
5. January 20, 2012 | 01:03:32 | 713041 | IP = 192.168.24.211, initiator of IKE: New Phase 1, Intf inside, IKE Peer 192.168.24.211 address local proxy 10.1.10.0, address remote Proxy 10.1.11.0, Card Crypto (outside_map)

This is the configuration for one of them. The other is configured in the same way with the usual across settings.

ASA Version 8.2 (1)
!
hostname ASATWDS
!

names of
name 10.1.11.0 remote control-network
!
interface Vlan1
nameif inside
security-level 100
IP 10.1.10.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP 192.168.24.210 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
access extensive list ip 10.1.10.0 outside_1_cryptomap allow 255.255.255.0 255.255.255.0 network-remote control
access extensive list ip 10.1.10.0 inside_nat0_outbound allow 255.255.255.0 255.255.255.0 network-remote control
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 0.0.0.0 0.0.0.0 192.168.24.1 1
course outside remote control-network 255.255.255.0 192.168.24.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 10.1.10.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto outside_map 1 match address outside_1_cryptomap
card crypto outside_map 1 set pfs
peer set card crypto outside_map 1 192.168.24.211
card crypto outside_map 1 set of transformation-ESP-3DES-SHA
card crypto outside_map 1 phase 1-mode of aggressive setting
card crypto outside_map 1 the value reverse-road
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
dhcpd outside auto_config
!
dhcpd address 10.1.10.5 - 10.1.10.36 inside
dhcpd dns 209.18.47.61 209.18.47.62 interface inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
tunnel-group 192.168.24.211 type ipsec-l2l
IPSec-attributes tunnel-group 192.168.24.211
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:b4bea5393489da3aa83f281d3107a32e

The Configuration looks good to me, but I think that you don't need next: -.

card crypto outside_map 1 phase 1-mode of aggressive setting

card crypto outside_map 1 the value reverse-road

Anyway,.

1 > can you please check if the computer you are trying to Ping or Telnet isn't the Machine based Firewall or anti-virus or iptables (Linux)?

2 > dough out of the

a > sh crypto ipsec his

b > sh crypto isakmp his

Manish

Help! Static route between two router WRT160NL

Hi all

I have my internet connection to connect to my main router from Linksys WRT160NL (192.168.1.1) with 192.168.1.x.

My 2nd Linksys router to connect to the first gateway as well.
The 2nd router has the ip 192.168.1.100 WAN and it's a local subnet as 192.168.2.x.

My 192.168.2.x machines can access the internet and connect to all the machines in the network 192.168.1.x.

However, the 1.x network cannot access the machines on the network of the 2. And because of that, I can't share or print between two networks.

I try to add static routes on my main router (192.168.1.1) with the road: 192.168.2.0 mask 255.255.255.0 and default gateway 192.168.1.100

However, the road does not work yet.

in any case to ensure that the 1.x network able to access the network 2.x and 2.x access 1.x file and print sharing.

Thanks for your help!

Gateway of the router does NAT who made the side inaccessible side LAN WAN, unless you configure port forwarding automatic or similar. If she would not make your LAN 192.168.1 would be accessible from the internet. Static routing will not change that.

You will need to disable NAT (aka switch to router mode) on the second router. You must configure a static route on the main router then. However, most likely your network 192.168.2 * will not have Internet more because the main router will NAT for 192.168.1. * and no 192.168.2. *.

If possible set up the second router as access point only and run a LAN.

VPN between RV120W and ISA550W

Hi guys,.

Wonder if you can shed some light on my problem until I loose all my hair!

I'm trying to create a VPN between a RV120W at a remote site and our ISA500W in our offices... I can't it connect!

I'll put up an IPsec tunnel between the sites, but it does not want to connect.

Remote site - RV120W

The IKE policy table

Management / time type

Main mode Exchange

3DES encryption

AUTH - SHA-1

DH group 2

Pre-Shared Key AUTH

HIS life 28800

Xauth no

VPN

Type Auto policy

IP of remote endpoint address

Local IP subnet

Remote IP subnet

Auto policy settings

Life 3600 seconds

Encryption algorithm 3DES

SHA-1 integrity algorithm

Key Enable PFS group

DH-group 2 (1024 bits)

Headquarters - ISA550W

IPsec policy

Static IP address of remote Type

AUTH Type pre-shared Key

Local ID (empty)

Remote ID (empty)

IKE

SHA1 hash

Pre-shared Key

D0H group group 2 (1024 bits)

Lifetime 8 hours

Transform

integrity ESP_MD5_HMAC

Encryption ESP_3DES

Errors, I'm getting in the newspapers

Remote RV120W (note! I changed the external IP to protect the innocent!)

2013-10-29 14:39:20: [rv120w] [IKE] INFO: respond to the negotiation of the new phase 2: 69.193.0.0 [0]<=>80.4.0.0 [0]

2013-10-29 14:39:20: [rv120w] [IKE] INFO: configuration using IPsec SA: 192.168.3.0/24<->192.168.1.0/24

2013-10-29 14:39:20: [rv120w] [IKE] INFO: setting encmode 3 (3)-> Tunnel peer (1)

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: proposal of the peer:

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: (proto_id = spisize ESP = 4 spi = spi_p 8846693d = encmode = 00000000 Tunnel reqid = 0:0)

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: (trns_id = 3DES encklen = 0 authtype = hmac-md5)

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: Local proposal:

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: (proto_id = spisize ESP = 4 spi = 00000000 spi_p 00000000 encmode = Tunnel reqid = 5:5 =)

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: (trns_id = 3DES encklen = 0 authtype = hmac-sha)

2013-10-29 14:39:20: [rv120w] [IKE] WARNING: proposal for Phase 2 of 80.4.0.0 [0] does not.

2013-10-29 14:39:20: [rv120w] [IKE] ERROR: no adequate policy not found for 80.4.0.0 [0]

2013-10-29 14:39:20: [rv120w] [IKE] INFO: sending of information Exchange: Notify payload [NON-PROPOSITION-SELECTED]

2013-10-29 14:39:20: [rv120w] [IKE] INFO: purged-with proto_id = ISAKMP and spi = c8d68f74af9dfa9a:b4137fd6e0666914 ISAKMP Security Association.

2013-10-29 14:39:29: [rv120w] [IKE] INFO: accept a request to establish IKE - SA: 80.4.0.0

2013-10-29 14:39:29: [rv120w] [IKE] INFO: Configuration found for 80.4.0.0

2013-10-29 14:39:29: [rv120w] [IKE] INFO: opening new phase 1 negotiation: 69.193.0.0 [500]<=>80.4.0.0 [500]

2013-10-29 14:39:29: [rv120w] [IKE] INFO: Start Identity Protection mode.

2013-10-29 14:39:29: [rv120w] [IKE] INFO: [ident_i1send:180]: XXX: NUMNATTVENDORIDS: 3

2013-10-29 14:39:29: [rv120w] [IKE] INFO: [ident_i1send:184]: XXX: definition of vendorid: 4

2013-10-29 14:39:29: [rv120w] [IKE] INFO: [ident_i1send:184]: XXX: definition of vendorid: 8

2013-10-29 14:39:29: [rv120w] [IKE] INFO: [ident_i1send:184]: XXX: definition of vendorid: 9

2013-10-29 14:39:30: [rv120w] [IKE] INFO: received unknown Vendor ID

2013-10-29 14:39:30: [rv120w] [IKE] INFO: received Vendor ID: DPD

2013-10-29 14:39:30: [rv120w] [IKE] INFO: received Vendor ID: RFC 3947

2013-10-29 14:39:30: [rv120w] [IKE] INFO: for 80.4.0.0 [500], version selected NAT - T: RFC 3947

2013-10-29 14:39:30: [rv120w] [IKE] INFO: payload NAT - D corresponds to 69.193.0.0 [500]

2013-10-29 14:39:30: [rv120w] [IKE] INFO: NAT - D payload does not match for 80.4.0.0 [500]

2013-10-29 14:39:30: [rv120w] [IKE] INFO: NAT detected: PEER

2013-10-29 14:39:30: [rv120w] [IKE] INFO: for debugging: change ports2013-10-29 14:39:30: [rv120w] [IKE] INFO: change port!

2013-10-29 14:39:30: [rv120w] [IKE] INFO: received unknown Vendor ID

2013-10-29 14:39:30: [rv120w] [IKE] INFO: ISAKMP Security Association established for 69.193.0.0 [4500] - 80.4.0.0 [4500] with spi: 740e6a59f02eca3a:820460c448a5b74b

2013-10-29 14:39:30: [rv120w] [IKE] INFO: sending of information Exchange: prevent the load [INITIAL CONTACT]

2013-10-29 14:39:31: [rv120w] [IKE] INFO: new phase 2 negotiation: 69.193.0.0 [500]<=>80.4.0.0 [0]

2013-10-29 14:39:31: [rv120w] [IKE] INFO: setting encryption mode to use UDP encapsulation

2013-10-29 14:39:31: [rv120w] [IKE] ERROR: Unknown notify message from the 80.4.0.0 [4500]. No found handful of phase2.

2013-10-29 14:39:41: [rv120w] [IKE] ERROR: Unknown notify message from the 80.4.0.0 [4500]. No found handful of phase2.

2013-10-29 14:39:51: [rv120w] [IKE] ERROR: Unknown notify message from the 80.4.0.0 [4500]. No found handful of phase2.

2013-10-29 14:40:01: [rv120w] [IKE] ERROR: Unknown notify message from the 80.4.0.0 [4500]. No found handful of phase2.

2013-10-29 14:40:02: [rv120w] [IKE] ERROR: Phase 2 negotiation failed due to upward. c8d68f74af9dfa9a:b4137fd6e0666914:f6cdeead

2013-10-29 14:40:02: [rv120w] [IKE] INFO: a calendar of undead has been removed: "quick_i1prep".

Head Office ISA550

2013-10-29 15:25:29 - WARNING - IPsec VPN: msg = "PixelNY" #4765: quick mode attempt fails, please check if IKE/transformation/PFS local are the same as remote site; (pluto)

2013-10-29 15:25:29 - WARNING - IPsec VPN: msg = "PixelNY" #4765: max number of retransmissions (2) reached STATE_MAIN_I1. No answer (or no acceptable answer) to our first post IKE. (pluto)

2013-10-29 15:22:38 - WARNING - IPsec VPN: msg = "PixelNY" #4763: quick mode attempt fails, please check if IKE/transformation/PFS local are the same as remote site; (pluto)

2013-10-29 15:22:38 - WARNING - IPsec VPN: msg = "PixelNY" #4763: max number of retransmissions (2) reached STATE_MAIN_I1. No answer (or no acceptable answer) to our first post IKE. (pluto)

2013-10-29 15:20:28 - WARNING - IPsec VPN: msg = "PixelNY" #4761: quick mode attempt fails, please check if IKE/transformation/PFS local are the same as remote site; (pluto)

2013-10-29 15:20:28 - WARNING - IPsec VPN: msg = "PixelNY" #4761: max number of retransmissions (2) reached STATE_MAIN_I1. No answer (or no acceptable answer) to our first post IKE. (pluto)

2013-10-29 15:20:12 - WARNING - Firewall: type = ACL

If someone could shed some light it would be fantastic!

Configuration items you listed, it's what I see. Transformations do not match between the AIS and the change integrity RV RV MD5 or change the game to transform ISA SHA1. I would recommend changing the ISA in well SHA1As, you don't mention what is IKE ISA policy encryption, but there's 3DES in the RV, so you'll need to ensure its 3DES in ISA. Also note that you are life spans SA do not match. Technically, this should be ok, but it's really best to match as well. The ISA is 8 hours and the RV is 1 hour (3600 seconds)

Shawn Eftink
CCNA/CCDA

Please note all useful messages and mark the correct answers to help others looking for solutions in the community.

IPSec tunnel on router from closure

Is it possible to get a VPN IPSec tunnel on a router from the loopback interface? If so, how?

Hello

Yes it is possible. The command is:

card crypto-address loopback

Please make sure that the loopback interface has a public IP address that is accessible.

http://www.Cisco.com/univercd/CC/TD/doc/product/software/ios124/124tcr/tsec_r/sec_c3ht.htm#wp1274324

HTH,

* Please rate if this helps,

Kind regards

Kamal

VPN between a router from 1721 to a Juniper srx 240

Similar Questions

Maybe you are looking for