VPN deliver internet access

Similar Questions

• Even IOS VPN Interface Internet Access issue

  Hi all

  I was wondering if there was any equivalent to these orders of ASA 5510 to put on a cisco IOS router 2811.

  Split-tunnel-policy excludespecified

  value of Split-tunnel-network-list LOCAL_LAN_ACCESS

  What I want to achieve is to give internet access to my vpn users without creating a split tunnel, which means the vpn user turns off the Internet on the same interface on that their vpn router ends.

  Is a 2811 for this there docs? I could not find the doc for it...

  TIA,

  -Fred

  Try this link

  Public Internet on a stick

  http://www.Cisco.com/en/us/products/sw/secursw/ps2308/products_configuration_example09186a008073b06b.shtml#intro

  Rgds

  Jorge

• Termination of the client PIX VPN and Internet access from the same interface

  Hello

  VPN remote users connect to PIX (7.2) outside interface, but need to have these clients to access the Internet through the PIX outside interface as well. Need this because PIX IPs is registered and allowed access to some electronic libraries. One way would be to set up a proxy within the network and vpn users have access to the Internet through the proxy, but can it be done without proxy?

  Yes, public internet on a stick

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00805734ae.shtml

• Client VPN prevents internet access from other computers on the network

  Hello.

  I run Client ver 4.6.03.0021 from an office on a network of 11 computers via a hub 16-port. Internet access is through an ICS gateway to the cable modem. Once I changed the modem cable to test a backup and then switched back to the original modem. After this, only computers that have the VPN Client (running or not) could access the internet. Computers that have no customer VPN can access only certain sites. Commonly viewed sites would say "site found. Waiting for answer", but the answer would never come and IE 6.1 cling. When I would try ping sites, it would fail. However, some sites such as Google.com would work.

  On one of the computers, on a whim of head, I installed the VPN Client but have not set up a connection. Now, this computer will connect to any website I want.

  Is there a fix easier to get access to other computers on the network without installing the VPN Client on each of them?

  Thank you

  H. Adams

  Hello

  Looks like you are running in MTU problem. The reason I say it is, automatically reduces the MTU value to 1300 VPN client during the installation for the whole system. That is to say all the client computer installed VPN that have MTU from 1300.

  Try to cut down the MTU of other systems that have no VPN client installed to 1300. If it's a Windows system, you can use Dr. TCP (free).

  Vikas

• No Internet access after the connection of the cisco vpn client

  Hi Experts,

  Please check below config.the problem is vpn is connected but no internet access

  on the computer after the vpn connection

  ASA Version 8.0 (2)
  !
  ciscoasa hostname
  activate 8Ry2YjIyt7RRXU24 encrypted password
  names of
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 192.168.10.10 255.255.255.0
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  IP 192.168.14.12 255.255.255.0
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  2KFQnbNIdI.2KYOU encrypted passwd
  passive FTP mode
  standard access list dubai_splitTunnelAcl allow 192.168.14.0 255.255.255.0
  INSIDE_nat0_outbound list of allowed ip extended access all 192.168.14.240 255.255.2
  55.240
  pager lines 24
  Within 1500 MTU
  Outside 1500 MTU
  IP local pool testpool 192.168.14.240 - 192.168.14.250
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access INSIDE_nat0_outbound
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 192.168.10.12 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout, uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.14.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-md5-hmac setFirstSet
  Crypto-map dynamic dyn1 1 set transform-set setFirstSet
  Crypto-map dynamic dyn1 1jeu reverse-road
  dynamic mymap 1 dyn1 ipsec-isakmp crypto map
  mymap outside crypto map interface
  crypto ISAKMP allow outside
  crypto ISAKMP policy 1
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 43200
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  !
  global service-policy global_policy
  password encrypted user testuser IqY6lTColo8VIF24 name
  username password khans X5bLOVudYKsK1JS / encrypted privilege 15
  tunnel-group mphone type remote access
  tunnel-group mphone General attributes
  address testpool pool
  tunnel-group ipsec-attributes mphone
  pre-shared-key *.
  context of prompt hostname
  Cryptochecksum:059363cdf78583da4e3324e8dfcefbf0
  : end
  ciscoasa #.

  Hello

  Large.  Try adding the below to make it work

  vpn-sheep access list extended permits all ip 192.168.15.0 255.255.255.0

  NAT (inside) 0-list of access vpn-sheep

  Harish

• No internet access through VPN

  Hi, I have the router Cisco 881 (MPC8300) with c880data-universalk9 - mz.153 - 3.M4.bin when users establish a VPN connection to the corporate network, had access to all the resources but no internet access, please help me what else I need to configure to achieve my goal. I don't want to split the tunnel, internet via VPN, users must have. In my opinion, I have put an additional configuration for NAT, but my router not recognize u-Turn and NAT commands on the object on the network.

  My config:

  Building configuration...

  Current configuration: 13562 bytes
  !
  ! Last configuration change at 09:52:38 PCTime Saturday, May 16, 2015, by admin
  version 15.3
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  XXX host name
  !
  boot-start-marker
  start the flash system: c880data-universalk9 - mz.153 - 3.M4.bin
  boot-end-marker
  !
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login ciscocp_vpn_xauth_ml_1 local
  AAA authentication login ciscocp_vpn_xauth_ml_2 local
  AAA authorization exec default local
  AAA authorization ciscocp_vpn_group_ml_1 LAN
  AAA authorization ciscocp_vpn_group_ml_2 LAN
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  iomem 10 memory size
  clock timezone PCTime 1 0
  PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
  !
  Crypto pki trustpoint TP-self-signed-1751279470
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1751279470
  revocation checking no
  rsakeypair TP-self-signed-1751279470
  !
  !
  TP-self-signed-1751279470 crypto pki certificate chain
  certificate self-signed 01
  XXXX
  !
  !
  Protocol-IP port-map user - 2 tcp 8443 port
  user-Protocol IP port-map - 1 tcp 3389 port
  !

  !
  !
  !
  IP domain name dmn.local
  8.8.8.8 IP name-server
  IP-server names 8.8.4.4
  IP cef
  No ipv6 cef
  !
  !
  license udi pid CISCO881-K9 sn FCZ174992C8
  !
  !
  username privilege 15 secret 5 xxxx xxxx
  username secret VPNUSER 5 xxxx
  !
  !
  !
  !
  !
  !
  type of class-card inspect sdm-nat-user-protocol--2-1 correspondence
  game group-access 105
  corresponds to the user-Protocol - 2
  type of class-card inspect entire game SDM_AH
  match the name of group-access SDM_AH
  type of class-card inspect entire game PAC-skinny-inspect
  Skinny Protocol game
  type of class-card inspect entire game SDM_IP
  match the name of group-access SDM_IP
  type of class-card inspect entire game PAC-h323nxg-inspect
  match Protocol h323-nxg
  type of class-card inspect entire game PAC-cls-icmp-access
  match icmp Protocol
  tcp protocol match
  udp Protocol game
  type of class-card inspect entire game PAC-h225ras-inspect
  match Protocol h225ras
  type of class-card inspect entire game SDM_ESP
  match the name of group-access SDM_ESP
  type of class-card inspect entire game PAC-h323annexe-inspect
  match Protocol h323-annex
  type of class-card inspect entire game PAC-cls-insp-traffic
  match Protocol pptp
  dns protocol game
  ftp protocol game
  https protocol game
  match icmp Protocol
  match the imap Protocol
  pop3 Protocol game
  netshow Protocol game
  Protocol shell game
  match Protocol realmedia
  match rtsp Protocol
  smtp Protocol game
  sql-net Protocol game
  streamworks Protocol game
  tftp Protocol game
  vdolive Protocol game
  tcp protocol match
  udp Protocol game
  type of class-card inspect the correspondence SDM_GRE
  match the name of group-access SDM_GRE
  type of class-card inspect entire game PAC-h323-inspect
  h323 Protocol game
  type of class-card inspect correspondence ccp-invalid-src
  game group-access 103
  type of class-card inspect entire game PAC-sip-inspect
  sip protocol game
  type of class-card inspect correspondence sdm-nat-https-1
  game group-access 104
  https protocol game
  type of class-card inspect all match mysql
  match the mysql Protocol
  type of class-card inspect correspondence ccp-Protocol-http
  http protocol game
  type of class-card inspect entire game CCP_PPTP
  corresponds to the SDM_GRE class-map
  inspect the class-map match PAC-insp-traffic type
  corresponds to the class-map PAC-cls-insp-traffic
  type of class-card inspect entire game SDM_EASY_VPN_SERVER_TRAFFIC
  match Protocol isakmp
  match Protocol ipsec-msft
  corresponds to the SDM_AH class-map
  corresponds to the SDM_ESP class-map
  type of class-card inspect correspondence ccp-icmp-access
  corresponds to the class-ccp-cls-icmp-access card
  type of class-card inspect the correspondence SDM_EASY_VPN_SERVER_PT
  corresponds to the SDM_EASY_VPN_SERVER_TRAFFIC class-map
  !
  type of policy-map inspect PCB - inspect
  class type inspect PCB-invalid-src
  Drop newspaper
  class type inspect mysql
  inspect
  class type inspect PCB-Protocol-http
  inspect
  class type inspect PCB-insp-traffic
  inspect
  class type inspect PCB-sip-inspect
  inspect
  class type inspect PCB-h323-inspect
  inspect
  class type inspect ccp-h323annexe-inspect
  inspect
  class type inspect ccp-h225ras-inspect
  inspect
  class type inspect ccp-h323nxg-inspect
  inspect
  class type inspect PCB-skinny-inspect
  inspect
  class class by default
  drop
  type of policy-card inspect sdm-license-ip
  class type inspect SDM_IP
  Pass
  class class by default
  Drop newspaper
  type of policy-card inspect sdm-pol-NATOutsideToInside-1
  class type inspect sdm-nat-https-1
  inspect
  class type inspect sdm-nat-user-protocol--2-1
  inspect
  class type inspect CCP_PPTP
  Pass
  class class by default
  Drop newspaper
  type of policy-card inspect PCB-enabled
  class type inspect SDM_EASY_VPN_SERVER_PT
  Pass
  class class by default
  drop
  type of policy-card inspect PCB-permits-icmpreply
  class type inspect PCB-icmp-access
  inspect
  class class by default
  Pass
  !
  safety zone-to-zone
  security of the area outside the area
  ezvpn-safe area of zone
  zone-pair security PAC-zp-self-out source destination outside zone auto
  type of service-strategy inspect PCB-permits-icmpreply
  zone-pair security PAC-zp-in-out source in the area of destination outside the area
  type of service-strategy inspect PCB - inspect
  source of PAC-zp-out-auto security area outside zone destination auto pair
  type of service-strategy inspect PCB-enabled
  sdm-zp-NATOutsideToInside-1 zone-pair security source outside the area of destination in the area
  type of service-strategy inspect sdm-pol-NATOutsideToInside-1
  in the destination box source sdm-zp-in-ezvpn1 ezvpn-pairs area security
  type of service-strategy inspect sdm-license-ip
  source of sdm-zp-out-ezpn1 of security area outside zone ezvpn-zone time pair of destination
  type of service-strategy inspect sdm-license-ip
  safety zone-pair sdm-zp-ezvpn-out1-source ezvpn-zone of destination outside the area
  type of service-strategy inspect sdm-license-ip
  safety zone-pair source sdm-zp-ezvpn-in1 ezvpn-area destination in the area
  type of service-strategy inspect sdm-license-ip
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA aes 256
  preshared authentication
  Group 2
  !
  Configuration group customer crypto isakmp Domena
  key XXXXXX
  DNS 192.168.1.2
  Dmn.local field
  pool SDM_POOL_1
  Save-password
  Max-users 90
  netmask 255.255.255.0
  banner ^ Cwelcome ^ C
  ISAKMP crypto ciscocp-ike-profile-1 profile
  match of group identity Domena
  client authentication list ciscocp_vpn_xauth_ml_2
  ISAKMP authorization list ciscocp_vpn_group_ml_2
  client configuration address respond
  virtual-model 1
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac ESP_AES-256_SHA
  tunnel mode
  !
  Profile of crypto ipsec CiscoCP_Profile1
  game of transformation-ESP_AES-256_SHA
  set of isakmp - profile ciscocp-ike-profile-1
  !
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.9.1 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  no ip address
  !
  interface FastEthernet3
  no ip address
  !
  interface FastEthernet4
  Description $ETH - WAN$ $FW_OUTSIDE$
  IP x.x.x.x 255.255.255.248
  NAT outside IP
  IP virtual-reassembly in
  outside the area of security of Member's area
  automatic duplex
  automatic speed
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ezvpn-safe area of Member's area
  ipv4 ipsec tunnel mode
  Tunnel CiscoCP_Profile1 ipsec protection profile
  !
  interface Vlan1
  Description $ETH_LAN$ $FW_INSIDE$
  IP 192.168.1.1 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly in
  Security members in the box area
  IP tcp adjust-mss 1452
  !
  local IP SDM_POOL_1 192.168.10.10 pool 192.168.10.100
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  The dns server IP
  IP nat inside source list 3 interface FastEthernet4 overload
  IP nat inside source static tcp 192.168.1.3 interface FastEthernet4 443 443
  IP nat inside source static tcp 192.168.1.2 8443 interface FastEthernet4 8443
  IP route 0.0.0.0 0.0.0.0 X.x.x.x
  !
  SDM_AH extended IP access list
  Note the category CCP_ACL = 1
  allow a whole ahp
  SDM_ESP extended IP access list
  Note the category CCP_ACL = 1
  allow an esp
  SDM_GRE extended IP access list
  Note the category CCP_ACL = 1
  allow a gre
  SDM_IP extended IP access list
  Note the category CCP_ACL = 1
  allow an ip
  !
  not run cdp
  !
  Note access-list 3 INSIDE_IF = Vlan1
  Note CCP_ACL category in the list to access 3 = 2
  access-list 3 Let 192.168.1.0 0.0.0.255
  Note access-list 23 category CCP_ACL = 17
  access-list 23 permit 192.168.1.0 0.0.0.255
  access-list 23 allow 10.10.10.0 0.0.0.7
  Note access-list 100 Auto generated by SDM management access feature
  Note access-list 100 category CCP_ACL = 1
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 22
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq www
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 443
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq cmd
  access-list 100 tcp refuse any host 192.168.1.1 eq telnet
  access-list 100 tcp refuse any host 192.168.1.1 eq 22
  access-list 100 tcp refuse any host 192.168.1.1 eq www
  access-list 100 tcp refuse any host 192.168.1.1 eq 443
  access-list 100 tcp refuse any host 192.168.1.1 eq cmd
  access-list 100 deny udp any host 192.168.1.1 eq snmp
  access ip-list 100 permit a whole
  Note access-list 101 category CCP_ACL = 1
  access-list 101 permit ip 192.168.1.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 1
  access-list 102 permit ip 192.168.1.0 0.0.0.255 any
  Note access-list 103 CCP_ACL category = 128
  access-list 103 allow the ip 255.255.255.255 host everything
  access-list 103 allow ip 127.0.0.0 0.255.255.255 everything
  access-list 103 allow ip 93.179.203.160 0.0.0.7 everything
  Note 104 CCP_ACL category = 0 access-list
  IP access-list 104 allow any host 192.168.1.3
  Note access-list 105 CCP_ACL category = 0
  IP access-list 105 allow any host 192.168.1.2

  -----------------------------------------------------------------------
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 102 in
  transport input telnet ssh
  line vty 5 15
  access class 101 in
  transport input telnet ssh
  !
  !
  end

  I'd be grateful for help

  concerning

  Hello

  Enter the subnet pool VPN to access-list 3 for source NAT

  You may need to check the firewall also rules to allow the connection based on areas you

  HTH,

  Averroès

• Internet access without split tunneling VPN PIX

  I have a PIX 515E with code 6.31. I installed a VPN to allow access to the internal network from the Internet using the Cisco VPN client. It does not work properly. We have some sellers who demand that we come from our Internet IP range to allow us access to their database on the Internet. This works very well for our internal users, but I will allow users VPN for this also.

  Is there a way to allow the user from the VPN client to use the Internet for business access to the internet instead of use the split tunneling to access the internet through their own connection? I would like users to vpn to be NAT would have réécrirait Internet and seeming come from our pool of Internet addresses. What I found references by using the split tunneling, but this won't work for me. Am I stuck getting a VPN concentrator to achieve?

  Thank you

  Josh

  [email protected] / * /.

  The PIX cannot route a package back on the same interface, he entered the, which includes a customer entering the interface external and routed VPN package back on the same interface.

  A router or a VPN concentrator would be able to do this, but not a PIX, sorry.

• The remote VPN Clients and Internet access

  I apologize in advance if this question has already been addressed. I am currently using a PIX Firewall Version 6.1 520 (2) running. I have several remote users that VPN for the PIX. Once the VPN tunnel is started, they are more able to connect to internet from their local computers. Is there a configuation on the PIX that allows remote users to have access to the internet when you are connected to the PIX.

  TIA,

  Jeff Gulick

  The Pix does not allow traffic enter and exit on the same interface. Therefore, a VPN user cannot access the Internet through the tunnel. If you use the Cisco client, enable tunneling split so that all traffic through the tunnel.

  If you use PPTP, you can turn off the option that makes the remote network, the default gateway. However, local routes should be added to these clients when they connect.

  Or you can use an additional interface on the firewall. One that puts an end to VPN tunnels and another providing for Internet connectivity. In this way the traffic is not enter/leave on the same interface.

  Of course, it is preferable if the customer Internet traffic does not go through the tunnel. It wastes your bandwidth and has security problems as well. I suggest you use the client to Cisco and the split tunneling.

• R8000 Open VPN drops Internet connection

  I have a router R8000 and sometimes when I go to connect by using the open VPN connection that it will show as connected but I don't have any internet access more. My connection log is below. The XXX is corresponding to my external IP address of the router.

  I have the service defined on the port UDP 12970 type. Firmware version: V1.0.3.4_1.1.2

  Journal will be in the next post, because there is a limit of 20,000 characters.

  In fact, I found a way around the problem. If you change the Protocol to TCP UDP everything works fine. Don't know what the problem is with UDP though.

• Parental controls does not block the proxy or VPN servers for access to *.

  Our teenage son found a way around Parental controls by using proxy servers or a personal VPN. I tried to add more sites to the list of blocked sites, but there seems to be hundreds of them. Is there a way to stop this exception taking internet access completely? He also said that all he has to do is ask a friend for some and they will send email * to him.

  Hello

  I suggest you try to fine the following Microsoft articles and check if it helps.

  What can I control with Parental controls? :

  http://Windows.Microsoft.com/en-us/Windows-Vista/what-can-I-control-with-parental-controls

  Change Internet Explorer Content settings:

  http://Windows.Microsoft.com/en-us/Windows-Vista/change-Internet-Explorer-content-settings

  How does the web Parental control filter? :

  http://Windows.Microsoft.com/en-us/Windows-Vista/how-does-the-parental-controls-Web-filter-work

  Hope the information is useful.

• Internet access AnyConnect SSL - U Turn

  Hi team,

  I'm not great when it comes to VPN and SSL on the SAA, so I'm looking for assistance please. At the moment we have anyconnect deployed for laptops. The idea is that they SSL VPN to ASA and then have access to the resources of the company as well as internet. But we want internet access through the ASA, which is the bit that has stopped working. Maybe a change in configuration or something, don't know yet. I checked the NAT and the rules, the habit, and he seems to agree. Apparently, some users are working, but some are not. I have a laptop with the client and it does not work. Config is attached.

  Help with configuring and troubleshooting would be much appreciated.

  Bilal

  Hello Bilal,

  There seems to be a cause of problem, I'm not able to see your message when I login, but he returned without connection.

  Please add this command and let me know how it rates: -.

  NAT (DMZ-6) 1 172.26.255.0 255.255.255.0

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• It would work for a WLAN internet access?

  Hi, everyone, I have a few questions about how to implement public access to Internet in our workplace that would not allow access to our local network.  We have several access points 2702 and 2504 WLAN controller.  Two of the four interfaces on the 2504 have intellectual property in the ranks of our LAN subnets.  I assigned a VLAN for public access to the Internet, but do not know how I would implement on our infrastructure past.  Instead, I was thinking about a cable connected to one of the unused interfaces on the 2504 to a port on our DMZ switch and having traffic for the public Internet, out across the demilitarized zone.  If I had to do this way, but also created a scope DHCP for the public Internet, and the DHCP scope were on an interface that had an address on the local corporate network, customers would always get the address?  What is the best way to do it?

  A second question I have is about how the traffic between the access points and the controller is managed.  When a client connects to the access point, their traffic get dug to the controller and then thrown on the LAN, or the traffic goes to the local network directly from the access point?  The reason why I ask is that we have a remote office that we would like to manage the access point of the controller in the Office at home, but we do not want necessarily all their traffic going back or the office, if it was intended for office network at home, or if it is intended for the Internet.  The remote desktop has its own local internet connection and is just VPN'ing to the desktop at home for internal network traffic.  DHCP for clients at the remote office is managed by a DHCP server on the router on this effect.  A remote desktop access point connected to the controller in the head office would be able to use the DHCP server on the router to the remote desktop?  I test that out in a lab environment and I couldn't get it to work this way.  Remote desktop access point is currently running in mode independent and done a good job.  In the future, this site will also get on our MPLS and finally all traffic going to get dug towards the Home Office, including Internet access, so perhaps at that time, attach the remote AP to the controller would be better.

  Thank you!

   A second question I have is regarding to how traffic is handled between the access points and the controller. When a client connects to the access point, does their traffic get tunnelled to the controller and then dumped onto the LAN, or does the traffic go to the LAN directly from the access point? 

  In local mode APs switch always centralized traffic, that is to say CAPWAP tunnel established between AP & WLC. If all traffic comments terminate at WLC connected switch.

  In your case, if you map the traffic comments-SSID to the physical port connects to the DMZ switch, guest SSID users end traffic to DMZ switch. You must ensure that traffic vlan is not go on any other connected WLC trunk ports.

  If AP mode FlexConnect, then traffic will end at the switch where AP connected locally.

  HTH

  Rasika

  Pls note all useful responses *.

• VPN; list of access on the external interface allowing encrypted traffic

  Hi, I have a question about the access list on the external interface of a router 836. We have several routers on our clients site, some are lan2lan, some are client2router vpn.

  My question is; Why should I explicitly put the ip addresses of the client vpn or tunnel lan to the access list. Because the encrypted traffic to already allowing ESPs & isakmp.

  The access list is set to the outgoing interface with: ip access-group 102 to

  Note access-list 102 incoming Internet via ATM0.1

  Note access-list 102 permit IP VPN range

  access-list 102 permit ip 192.123.32.0 0.0.0.255 192.123.33.0 0.0.0.255

  access-list 102 permit ip 14.1.1.0 0.0.0.255 any

  access-list 102 permit esp a whole

  Note access-list 102 Open VPN Ports and other

  access-list 102 permit udp any host x.x.x.x eq isakmp newspaper

  I have to explicitly allow 192.123.32.0 (range of lan on the other side) & 14.1.1.0 (range of vpn client) because if I'm not I won't be able to reach the network.

  The vpn connection is not the problem, all traffic going through it.

  As far as I know, allowing ESPs & isakmp should be sufficient.

  Can anyone clarify this for me please?

  TNX

  Sebastian

  This has been previously answered on this forum. See http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.ee9f970/0#selected_message for more details.

• VPN Local lan access

  I have set up a cisco 861 as a vpn server. Could I help you if someone can tell what is the problem? Clients can connect, but cannot access local resources from lan for subnet 10.0.10.0

  Building configuration...

  Current configuration: 9770 bytes
  !
  version 12.4
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime msec localtime

  Show time-zone
  Log service timestamps datetime localtime show msec.

  time zone
  encryption password service
  sequence numbers service
  !
  hostname RT861W
  !
  boot-start-marker
  start the flash c860-universalk9 - mz.124 - 24.T3.bin system
  boot-end-marker
  !
  forest-meter operation of syslog messages
  logging buffered 4096 warnings
  recording console critical
  enable secret 5 xxxxxxxx
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login userauthen local
  AAA authorization groupauthor LAN
  !
  !
  AAA - the id of the joint session
  iomem 10 memory size
  clock timezone IS - 4
  clock save interval 24
  !
  Crypto pki trustpoint TP-self-signed-3796206546
  enrollment selfsigned
  name of the object cn = IOS-Self-signed-certificate-

  3796206546
  revocation checking no
  rsakeypair TP-self-signed-3796206546
  !
  !
  chain pki crypto TP-self-signed certificates.

  3796206546
  certificate self-signed 01
  30820259 308201 2 A0030201 02020101 300 D 0609

  2A 864886 F70D0101 04050030
  2 060355 04031326 494F532D 53656 C 66 31312F30

  2 536967 6E65642D 43657274
  69666963 33373936 32303635 6174652D 3436301E

  170 3130 30363130 32323534
  33395A 17 0D 323030 31303130 30303030 305A 3031

  06035504 03132649 312F302D
  65642 43 65727469 5369676E 656C662D 4F532D53

  66696361 74652 33 37393632
  3630819F 30363534 300 D 0609 2A 864886 F70D0101

  01050003 818 0030 81890281
  81009C 68 0509FEBA BA0D4251 52AA3F1C DBB7CACB

  138D0D3D 8017AB75 04AABD97
  16DE7A44 31B18A6C 5DE8F289 CF5D71EA AF9BA2F6

  EB32858B 4385DE6C 3ED11616
  2B997D14 C6C86431 9A 956161 2D0581F4 767D60E1

  82FF426A 911D503E 8995A69B
  6F7A4D9A 9AEA14DE 8A62570E C9C3A913 25E5E464

  E6DA7E06 44F94B16 3EA57809
  5B 710203 010001 HAS 3 8180307E 300F0603 551D 1301

  01FF0405 FF302B06 30030101
  11 04243022 82205254 38363157 2E636F6C 03551D

  6C696E73 2E316661 6D696C79
  756E6974 65642E63 6F6D301F 0603551D 23041830

  1680142C 21E7314B D28AFE1A
  26115A1B F53AFB03 1 060355 1D0E0416 0ED1A830

  04142C 21 E7314BD2 8AFE1A26
  115A1BF5 3AFB030E D1A8300D A 06092, 86 4886F70D

  01010405 00038181 008CC48F
  6A1BFB52 0F268B05 B977AE8E CA450936 8272 D 889

  B46DE9FB 5680782C 59DA2354
  04CE6AD2 F280FB20 32B3897B CF0919F9 C0719F22

  C7BED922 73C35C32 54696F37
  89E424C2 561FFF54 99573AC6 713E58D8 E3B67064

  295 4331 845FCDEC F6CD8017 D
  58006 58 F94A8771 78217788 FE63AA11 0E5DF6B1

  1A8D0111 CDD87A1D CC
  quit smoking
  no ip source route
  no ip free-arps
  chip-Relay IP dhcp
  ignore the IP dhcp bootp
  DHCP excluded-address IP 10.0.1.1 10.0.1.10
  DHCP excluded-address IP 10.0.10.1 10.0.10.10
  !
  dhcp VLAN_10 IP pool
  Network 10.0.10.0 255.255.255.224
  router by default - 10.0.10.1
  Domain xxxxxx
  10.0.10.1 DNS server
  !
  dhcp VLAN_1 IP pool
  Network 10.0.1.0 255.255.255.224
  default router 10.0.1.1
  Domain xxxxxx
  10.0.1.1 DNS server
  !
  !
  IP cef
  inspect the IP log drop-pkt
  IP inspect high 1100 max-incomplete
  IP inspect 1100 max-incomplete bass
  IP inspect a high minute 1100
  IP inspect a minute low 1100
  inspect the IP udp idle time 60
  inspect the IP dns-timeout 10
  inspect the name firewall tcp timeout IP 3600
  inspect the name firewall udp timeout 15 IP
  inspect the name firewall ftp queue time 3600 IP
  inspect the name firewall rcmd timeout IP 3600
  IP inspect alert firewall smtp name on timeout 3600
  inspect the name firewall sqlnet timeout IP 3600
  inspect the IP name firewall tftp timeout 30
  inspect the name firewall icmp time 15 IP
  inspect the name firewall ssh timeout 15 IP
  IP inspect name Connection Firewall audit trail on
  inspect the name webster firewall IP
  IP inspect skinny firewall name
  inspect the router IP firewall name
  inspect the IP firewall cifs name
  inspect the name cuseeme firewall IP
  IP inspect the dns name of the firewall
  inspect the name realaudio firewall IP
  inspect the name firewall rtsp IP
  inspect the name streamworks firewall IP
  inspect the name vdolive firewall IP
  inspect the IP sip firewall name
  inspect the name firewall pop3 alert on reset IP
  inspect the name ftps firewall IP
  inspect the name isakmp firewall IP
  inspect the IP name of firewall ipsec-msft
  inspect the name ntp FIREWALL IP
  inspect the IP name firewall imap
  inspect the name imaps firewall IP
  inspect the name imap3 FIREWALL IP
  inspect the name pop3s firewall IP
  no ip bootp Server
  IP domain name xxxxxxxxx
  8.8.8.8 IP name-server
  IP-server names 8.8.4.4
  name-server IP 208.67.222.222
  IP-server names 208.67.220.220
  name of the IP-server 74.128.19.102
  name of the IP-server 74.128.17.114
  !
  !
  notify licensing agent

  http://10.0.10.11:9710 / clm/servlet/HttpListenServlet

  dummy dummy 2.0
  !
  !
  username privilege 15 secret 5 xxxx xxxxxx
  username xxxxx xxxxx secret 5
  !
  !
  crypto ISAKMP policy 3
  BA aes 256
  preshared authentication
  Group 2
  ISAKMP crypto nat keepalive 3600
  !
  ISAKMP crypto client configuration group xxxxx
  key xxxxxx
  DNS 10.0.10.5
  domain xxxxxxxx
  pool vpnpool
  include-local-lan
  netmask 255.255.255.224
  !
  !
  Crypto ipsec transform-set esp esp - aes 256 RIGHT-

  model of hmac-SHA-lzs
  !
  Crypto-map dynamic dynmap 10
  Set transform-set RIGHT
  market arriere-route
  !
  !
  list of card crypto clientmap client authentication

  userauthen
  card crypto clientmap isakmp authorization list

  groupauthor
  client configuration address map clientmap crypto

  initiate
  client configuration address map clientmap crypto

  answer
  10 ipsec-isakmp crypto map clientmap Dynamics dynmap
  !
  Crypto ctcp port 6000
  Archives
  The config log
  hidekeys
  !
  !
  synwait-time of tcp IP 10
  property intellectual ssh time 60
  property intellectual ssh authentication-2 retries
  Bridge IRB
  !
  !
  !
  interface Loopback0
  IP 10.100.100.1 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  !
  Null0 interface
  no ip unreachable
  !
  interface FastEthernet0
  switchport access vlan 10
  !
  interface FastEthernet1
  switchport access vlan 10
  !
  interface FastEthernet2
  switchport access vlan 10
  !
  interface FastEthernet3
  switchport access vlan 10
  switchport mode trunk
  !
  interface FastEthernet4
  WAN description $ FW_OUTSIDE$
  address IP dhcp client id FastEthernet4
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  stream IP output
  inspect the firewall on IP
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  clientmap card crypto
  !
  wlan-ap0 interface
  description of the Service interface module to manage the

  Embedded AP
  IP unnumbered Vlan1
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  IP virtual-reassembly
  ARP timeout 0
  !
  interface GigabitEthernet0 Wlan
  description of the Service interface module to manage the

  Embedded AP
  switchport mode trunk
  !
  interface Vlan1
  VLAN_1 description $ FW_INSIDE$
  IP 10.0.1.1 255.255.255.224
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  IP nat inside
  IP virtual-reassembly
  IP tcp adjust-mss 1452
  !
  interface Vlan10
  VLAN_10 description $ FW_INSIDE$
  IP 10.0.10.1 255.255.255.224
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  IP nat inside
  IP virtual-reassembly
  IP tcp adjust-mss 1452
  !
  interface BVI1
  Description $FW_INSIDE$
  in the form of address IP WAPB dhcp host name
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  penetration of the IP stream
  no ip-cache cef route
  no ip route cache
  !
  router RIP
  version 1
  10.0.0.0 network
  !
  IP local pool vpnpool 197.0.0.1 197.0.0.5
  no ip forward-Protocol nd
  IP route 0.0.0.0 0.0.0.0 dhcp
  IP route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp
  IP http server
  access-class 2 IP http
  local IP http authentication
  IP http secure server
  !
  The dns server IP
  IP nat inside source list 1 interface FastEthernet4

  Overload
  IP nat inside source list 2 interface FastEthernet4

  Overload
  IP nat inside source static tcp 10.0.10.3 3389

  interface FastEthernet4 3389
  IP nat inside source static tcp 10.0.10.3 1723

  interface FastEthernet4 1723
  IP nat inside source static tcp 10.0.10.3 80

  interface FastEthernet4 80
  !
  record 10.0.10.1
  access-list 1 permit 10.0.1.0 0.0.0.31
  access-list 2 permit 10.0.10.0 0.0.0.31
  access-list 199 permit any one
  access-list 199 permit tcp any any eq 1723
  access-list 199 permit tcp a whole Workbench
  access-list 199 permit udp any any eq 3389
  access-list 199 permit udp any any eq ntp
  access-list 199 permit udp any any gt 1023
  access-list 199 tcp refuse a whole
  access-list 199 tcp 10.0.0.0 refuse 0.255.255.255 everything
  access-list 199 tcp 172.16.0.0 refuse 0.15.255.255

  any
  access-list 199 tcp 192.168.0.0 refuse 0.0.0.255 any
  access-list 199 refuse udp 10.0.0.0 0.255.255.255 everything
  access-list 199 refuse udp 172.16.0.0 0.15.255.255

  any
  access-list 199 refuse udp 192.168.0.0 0.0.0.255 any
  access-list 199 refuse icmp no echo
  access-list 199 deny udp any how any eq 135
  access-list 199 deny udp any any eq netbios-ns
  access-list 199 deny udp any any eq netbios-ss
  access-list 199 deny udp any any eq isakmp
  access-list 199 tcp refuse any any eq telnet
  access-list 199 tcp refuse any any eq smtp
  access-list 199 tcp refuse any any eq nntp
  access-list 199 tcp refuse any any eq 135
  access-list 199 tcp refuse any any eq 137
  access-list 199 tcp refuse any any eq 139
  access-list 199 tcp refuse any any eq www
  access-list 199 tcp refuse any any eq 443
  access-list 199 tcp refuse any any eq 445
  access-list 199 refuse an entire ip
  not run cdp

  !
  control plan
  !
  Bridge Protocol ieee 1
  1 channel ip bridge
  bridge 10 Protocol ieee
  IP route 10 bridge
  connection of the banner ^ CAuthorized access only!
  Unplug IMMEDIATELY if you are not authorized

  user! ^ C
  !
  Line con 0
  no activation of the modem
  telnet output transport
  line to 0
  telnet output transport
  line 2
  no activation-character
  No exec
  preferred no transport
  transport of entry all
  transportation out all
  line vty 0 4
  access-class 104 in
  transport input telnet ssh
  !
  max-task-time 5000 Planner
  Scheduler allocate 4000 1000
  Scheduler interval 500
  Server NTP 192.43.244.18
  end

  Hello

  The problem is due to NAT configurations. Please, try the following:

  no nat ip within the source list 1 interface FastEthernet4 overload

  no nat ip inside the source list 2 interface FastEthernet4 overload

  access-list 101 deny ip 10.0.0.0 0.0.255.31 197.0.0.0 0.0.0.7

  access-list 101 deny ip 10.0.0.0 0.0.255.31 10.0.0.0 0.0.255.255

  access-list 101 permit ip 10.0.0.0 0.0.255.31 all

  Internet route map

  corresponds to the IP 101

  output

  IP nat inside source overload map route Internet interface FastEthernet4

  This will ensure that the VPN clients can access all internal

  resources. However, they will not be able to access to the 10.0.10.3 Server

  using its private IP address that you can not use the roadmap, when you use the

  keyword "interface." If you have a static IP address assigned to your FastEthernet4

  You can then use the interface by the ISP, the configuration below:

  access-list 102 refuse host ip 10.0.10.3 197.0.0.0 0.0.0.7

  access-list 102 refuse 10.0.10.3 ip host 10.0.0.0 0.0.255.255

  access-list 102 permit ip 10.0.10.3 host everything

  route server map

  corresponds to the IP 101

  output

  no nat ip inside source static tcp 10.0.10.3 interface FastEthernet4 3389

  3389

  no nat ip inside the source static tcp 10.0.10.3 1723 interface FastEthernet4

  1723

  no nat ip inside the 80 tcp static 10.0.10.3 source FastEthernet4 80 interface

  IP nat inside source static tcp 10.0.10.3 3389 "FastEthernet4 IP" 3389

  route server map

  IP nat inside source static tcp 10.0.10.3 1723 "FastEthernet4 ip" 1723

  route server map

  IP nat inside source static tcp 10.0.10.3 80 'FastEthernet4 ip' 80-route map

  Server

  I hope this helps.

  Kind regards

  NT

• AnyConnect VPN users cannot access remote subnets?

  I googled this until blue in the face without result.  I don't understand why Cisco this so difficult?  When clients connect to the anyconnect vpn, they can access the local subnet, but cannot access the resources in remote offices.  What should I do to allow my anyconnect vpn clients access to my remote sites?

  Cisco 5510 8.4

  Hello

  What are remote sites using as Internet gateway? Their default route here leads to the ASA or have their own Internet gateway? If they use this ASA for their Internet connection while they should already have a default route that leads traffic to the VPN to the pool, even if they had no specific route for the VPN itself pool. If they use their own local Internet gateway and the default route is not directed to this ASA then you would naturally have a route on the remote site (and anything in between) indicating the remote site where to join the pool of 10.10.224.0/24 VPN network.

  In addition to routing, you must have configured for each remote site and the VPN pool NAT0

  Just a simple example of NAT0 configuration for 4 networks behind the ASA and simple VPN field might look like this

  object-group network to REMOTE SITES

  object-network 10.10.10.0 255.255.255.0

  object-network 10.10.20.0 255.255.255.0

  object-network 10.10.30.0 255.255.255.0

  object-network 10.10.40.0 255.255.255.0

  network of the VPN-POOL object

  10.10.224.0 subnet 255.255.255.0

  NAT static destination DISTANCE-SITES SITES source (indoor, outdoor) REMOTE static VPN-VPN-POOL

  The above of course assumes that the remote site are located behind the interface 'inside' (although some networks, MPLS) and naturally also the remote site networks are made for the sake of examples.

  Since you are using Full Tunnel VPN should be no problem to the user VPN transfer traffic to this ASA in question.

  My first things to check would be configuring NAT0 on the ASA and routing between remote sites and this ASA (regarding to reach the VPN pool, not the ASA network IP address)

  Are you sure that the configuration above is related to this? Its my understanding that AnyConnect uses only IKEv2 and the foregoing is strictly defined for IKEv1?

  -Jouni