VPN on SAA on IOS 8.4 remote access (2)

Similar Questions

• VPN error 868 the name of the remote access server is not resolved

  I use Windows 7 Home Premium and you want to configure a VPN with my office network that uses the Check Point Safe@Office.  I am unable to log in and get the error that does not resolve the name of the remote access server and Windows cannot find the host using DNS name.  Any suggestions on what to try to fix the problem?  I set up the VPN connection according to the instructions of our network administrator.  We use XP in the office.

  Hello
  Welcome to the Microsoft answers site

  The question that you'd be better suited in the TechNet community. Please visit the link below to find a community that will provide the best support.
  http://social.technet.Microsoft.com/forums/en-us/ForefrontedgeVPN/threads

  It may be useful
  Thanks and greetings
  Support Microsoft-dieng
  Visit our Microsoft answers feedback Forum and let us know what you think
  http://social.answers.Microsoft.com/forums/en-us/answersfeedback/threads/

• AnyConnect VPN client can be used for IPSec remote access VPN connection?

  I think I heard it somewhere that AnyConnect VPN can be used for connections SSLvpn IPSec VPN. Is this possible? Thank you!

  No, the Anyconnect software cannot be used to establish the framework for a VPN IPSEC IKE.

• Bad VPN ASA injection road on OSPF when using remote access

  Has anyone ever seen the ASA by inserting a bad road in a connection that has been set up with it?  I'll explain more below:

  I'm using a reverse road Injection. When access remotely with IPSEC (CLIENT) connects to the camera ASA, ASA create a static route to the remote access to the closest router for the SAA to come to this remote access. This itinerary is distributed on OSPF. OK, it may be a normal situation. But, the problem is when I ask another participant of this OSPF area, which is the road to this remote access (CLIENT), the answer is the router closer to the ASA and don't have to ASA. Does anyone have a solution for this? I tried to create a roadmap but that you did not.

  If I understand your question, my question for you is whether the OSPF route to the remote VPN client is source by ASA or another device?

  Is the IP address in the space I wrote ASA_ROUTER_ID ASA router ID or it is the router from another device ID?  What I've listed below are an example of the output of "show ip route.  The value in bold must be ASA router ID, if she is from the road to the VPN client.  Other OSPF routers will forward packets destined to VPN to ASA client.

  #sh ip route 1.1.1.0
  Routing for 1.1.1.0/24 entry
  Known through the "ospf 1", metric 110, distance 310, type intra zone
  Last updated on GigabitEthernet0 1.2.2.2, 2w there
  Routing descriptor blocks:
  * 1.2.2.2, ASA_ROUTER_ID, there is, through GigabitEthernet0 2w
  Path metric is 310, number of shares of traffic 1

• Remote access VPN routing

  Hello

  I'm having a problem on the VPN routing.

  The VPN client is connected correctly to ASA5510, but cannot access inside ASA and the Internet or another network. What I want to achieve is.

  [email protected] / * / -> ASA5520 (public IP)-> Inside (172.16.1.0)

  The VPN address pool uses 172.168.10.0 (I also tried 172.16.1.100 - 120 with the same network from the inside).

  interface GigabitEthernet0/0

  nameif outside

  security-level 0

  IP address a.a.a.a 255.255.255.0

  !

  interface GigabitEthernet0/1

  nameif inside

  security-level 100

  IP 172.16.1.1 255.255.255.0

  IP local pool vpnpool 192.168.10.1 - 192.168.10.254 mask 255.255.255.0

  access extensive list ip 172.16.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 0.0.0.0 0.0.0.0

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  internal VPNstaff group strategy

  attributes of Group Policy VPNstaff

  4.2.2.2 DNS server value

  Protocol-tunnel-VPN IPSec

  type tunnel-group VPNstaff remote access

  attributes global-tunnel-group VPNstaff

  address vpnpool pool

  Group Policy - by default-VPNstaff

  IPSec-attributes tunnel-group VPNstaff

  pre-shared-key *.

  Hello

  A quick test, try this.

  -Turn on nat - t (if its disable)

  Command: crypto isakmp nat-traversal 20

  see if it helps.

  If not,

  -Run a continuous ping from the client to the ASA inside the interface, make sure that you run the command 'management-access to inside' before you start with the ping.

  -Time our RESPONSE ICMP or inside the interface... ?

  If time-out, then

  -Check the number of decrypts using the command "show crypto ipsec his"

  If ICMP response to inside interface is received by the VPN client.

  -Ping to an internal host behind the ASA.

  -"Show crypto ipsec his"

  IF you have received responses if first test then here you should see decrypts number increases.

  -Apply the catches on the inside of the interface

  You can consult the document below

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a0080a9edd6.shtml

  -If you see the package source as VPN client interface to reach the inside interface for the destination of the host behind the ASA, then its a problem with your routing internal.

  In case you have an L3 device connected to the ASA inside the interface, make sure that you have a route for GW subnet 192.168.1.x as ASA inside the interface i.e. 172.16.1.1 score

  If his L2 or a dumb device, then as a quic test, make the following statement of the road using the command-line in windows on the host computer behind the asa participant in this test.

  route add 192.168.1.0 mask 255.255.255.0 172.16.1.1

  Please let me know if it helps.

  Concerning

  M

• ASA 5505 - remote access VPN to access various internal networks

  Hi all

  A customer has an ASA 5505 with a remote access vpn. They are moving their internal network to a new regime and that you would be the users who come on the vpn to access the existing and new networks. Currently can only access the existing. When users connect to access remote vpn, the asa gave them the address 192.168.199.x. The current internal network is 200.190.1.x and that they would reach their new network of 10.120.110.x.

  Here is the config:

  :

  ASA Version 8.2 (5)

  !

  ciscoasa hostname

  enable encrypted password xxx

  XXX encrypted passwd

  names of

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 200.190.1.15 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address 255.255.255.0 xxxxxxx

  !

  exec banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

  connection of the banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

  banner asdm the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

  passive FTP mode

  access extensive list ip 200.190.1.0 inside_access_in allow 255.255.255.0 any

  outside_access_in list extended access permit icmp any external interface

  access extensive list ip 192.168.199.0 outside_access_in allow 255.255.255.192 host 10.120.110.0

  Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 200.190.1.0 255.255.255.0

  MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0

  access extensive list ip 200.190.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192

  inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  mask 192.168.199.10 - 192.168.199.50 255.255.255.0 IP local pool Remote_IPSEC_VPN_Pool

  IP verify reverse path to the outside interface

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow any inside

  ICMP allow all outside

  don't allow no asdm history

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 200.190.1.0 255.255.255.0

  inside_access_in access to the interface inside group

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 190.213.43.1 1

  Route inside 10.120.110.0 255.255.255.0 200.190.1.50 1

  Route inside 192.168.50.0 255.255.255.0 200.190.1.56 1

  Route inside 192.168.60.0 255.255.255.0 200.190.1.56 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  http server enable 10443

  http server idle-timeout 5

  Server of http session-timeout 30

  HTTP 200.190.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

  (omitted)

  quit smoking

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Crypto isakmp nat-traversal 3600

  Telnet timeout 5

  SSH 200.190.1.0 255.255.255.0 inside

  SSH timeout 5

  SSH version 2

  Console timeout 5

  dhcpd outside auto_config

  !

  a basic threat threat detection

  scanning-threat shun threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  allow outside

  internal MD_SSL_Gp_Pol group strategy

  attributes of Group Policy MD_SSL_Gp_Pol

  VPN-tunnel-Protocol webvpn

  WebVPN

  list of URLS no

  disable the port forward

  hidden actions no

  disable file entry

  exploration of the disable files

  disable the input URL

  internal MD_IPSEC_Tun_Gp group strategy

  attributes of Group Policy MD_IPSEC_Tun_Gp

  value of banner welcome to remote VPN

  VPN - connections 1

  VPN-idle-timeout 5

  Protocol-tunnel-VPN IPSec webvpn

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list MD_IPSEC_Tun_Gp_splitTunnelAcl

  the address value Remote_IPSEC_VPN_Pool pools

  WebVPN

  value of the RDP URL-list

  attributes of username (omitted)

  VPN-group-policy MD_IPSEC_Tun_Gp

  type of remote access service

  type tunnel-group MD_SSL_Profile remote access

  attributes global-tunnel-group MD_SSL_Profile

  Group Policy - by default-MD_SSL_Gp_Pol

  type tunnel-group MD_IPSEC_Tun_Gp remote access

  attributes global-tunnel-group MD_IPSEC_Tun_Gp

  address pool Remote_IPSEC_VPN_Pool

  Group Policy - by default-MD_IPSEC_Tun_Gp

  IPSec-attributes tunnel-group MD_IPSEC_Tun_Gp

  pre-shared key *.

  !

  !

  context of prompt hostname

  : end

  The following ACL and NAT exemption ACL split tunnel is incorrect:

  MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0

  inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192

  It should have been:

  Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 10.120.110.0 255.255.255.0

  access extensive list ip 10.120.110.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192

  Then 'clear xlate' and reconnect with the VPN Client.

  Hope that helps.

• Remote access VPN for IOS router

  Hi all

  I'm trying to implement remote access with Split tunneling to a Cisco 2801.  I can connect to the VPN profile and access to the internet, but I am unable to ping/scope of devices (10.10.10.X) inside.  Vpn users receive assignments to correct addresses in the 172.15.10.X range.  I see that my PC remotely is sending packets to devices but receives nothing in return.  Here's what my Config looks like... any ideas on things to look at would be great!

  Thank you

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key address x.x.x.x cisco123

  ISAKMP crypto key address x.x.x.x cisco123

  !

  Configuration group customer isakmp crypto VPN_Client

  key *.

  DNS 64.89.70.2 64.89.74.2

  pool SDM_POOL_1

  ACL 120

  Max-users 25

  netmask 255.255.255.0

  !

  !

  ISAKMP crypto sdm-ike-profile-1 profile

  match of group identity VPN_Client

  client authentication list sdm_vpn_xauth_ml_1

  ISAKMP authorization list sdm_vpn_group_ml_1

  client configuration address respond

  virtual-model 1

  Crypto isakmp SiteA profile

  Keychain myring

  function identity address 1.1.1.1 255.255.255.255

  address FastEthernet0/0

  Profile of crypto isakmp Site2

  key-Atlanta

  function identity address 2.2.2.2 255.255.255.255

  address FastEthernet0/0

  !

  !

  Crypto ipsec transform-set esp - aes 192 esp-sha-hmac AES192

  Crypto ipsec transform-set esp-3des esp-sha-hmac SDM_TRANSFORMSET_1

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set esp-3des esp-md5-hmac 3DES-MD5

  Crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac

  !

  Profile of crypto ipsec SDM_Profile1

  game of transformation-ESP-3DES-SHA1

  isakmp-profile sdm-ike-profile-1 game

  !

  !

  dynamic-map crypto RA - 10 card

  the value of the transform-set AES192 ESP - 3DES - SHA1 ESP - 3DES - SHA SDM_TRANSFORMSET_1 3DES-MD5

  market arriere-route

  !

  !

  map SDM_CMAP_1 1 ipsec-isakmp crypto

  Description Tunnel to 3.3.3.3

  defined peer 3.3.3.3

  the value of the transform-set AES192 ESP - 3DES - SHA1 ESP - 3DES - SHA SDM_TRANSFORMSET_1 3DES-MD5

  PFS group2 Set

  SiteA Set isakmp-profile

  match address 105

  map SDM_CMAP_1 2 ipsec-isakmp crypto

  Description Tunnel to 4.4.4.4

  defined peer 4.4.4.4

  the value of the transform-set AES192 ESP - 3DES - SHA1 ESP - 3DES - SHA SDM_TRANSFORMSET_1 3DES-MD5

  PFS group2 Set

  Set the SiteB isakmp-profile

  match address 106

  map SDM_CMAP_1 isakmp ipsec dynamic map RA 10 crypto

  !

  !

  !

  !

  !

  interface FastEthernet0/0

  Description * Outside ETH - LAN *.

  IP 174.1.1.2 255.255.255.224

  NAT outside IP

  IP virtual-reassembly

  automatic duplex

  automatic speed

  map SDM_CMAP_1 crypto

  !

  !

  interface FastEthernet0/1

  Description * inside the ETH - LAN *.

  10.10.10.254 IP address 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  !

  !

  interface Serial0/1/0

  no ip address

  Shutdown

  !

  !

  type of interface virtual-Template1 tunnel

  IP unnumbered FastEthernet0/0

  ipv4 ipsec tunnel mode

  Tunnel SDM_Profile1 ipsec protection profile

  !

  !

  local IP SDM_POOL_1 172.15.10.1 pool 172.15.10.50

  IP forward-Protocol ND

  !

  IP high speed-flyers

  Top 10

  Sorting bytes

  !

  IP http server

  IP http secure server

  IP nat source list 110 interface FastEthernet0/0 overload

  overload of IP nat inside source list 110 interface FastEthernet0/0

  IP route 0.0.0.0 0.0.0.0 174.1.1.1

  !

  access-list 105 allow ip 10.10.10.0 0.0.0.255 172.20.0.0 0.0.255.255

  access-list 105 allow ip 172.15.10.0 0.0.0.255 172.20.0.0 0.0.255.255

  access-list 106 allow ip 10.10.10.0 0.0.0.255 192.168.42.0 0.0.0.255

  access-list 110 deny ip 10.10.10.0 0.0.0.255 172.15.10.0 0.0.0.255

  access-list 110 deny ip 10.10.10.0 0.0.0.255 172.20.0.0 0.0.255.255

  access-list 110 deny ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 110 permit ip 172.15.10.0 0.0.0.255 any

  access-list 110 permit ip 10.10.10.0 0.0.0.255 any

  access-list 111 allow ip 10.10.10.0 0.0.0.255 any

  access-list 120 allow ip 10.10.10.0 0.0.0.255 172.15.10.0 0.0.0.255

  access-list 120 allow ip 172.20.0.0 0.0.255.255 172.15.10.0 0.0.0.255

  Note access-list 130 SDM_ACL category = 17

  access-list 130 permit udp host 4.2.2.2 eq field all

  access-list 130 allow esp 65.79.168.6 host 174.141.59.195

  access-list 130 allow ip host 65.79.168.6 174.141.59.195

  access-list 130 ip allow a whole

  VPN clients connecting to the F0/0 interface (where the card encryption is applied) or to the

  interface virtual-template?

  What happens if you do the following:

  ISAKMP crypto sdm-ike-profile-1 profile

  No virtual-model 1

  Disconnection/reconnection.

  Federico.

• VPN remote access with router 2610

  Guys,

  A router Cisco 2610 series with IOS Version 11.3 (2) software version XA4 (fc1) will support a VPN remote access VPN Clients using standard Windows (LT2P on IPSec or PPTP) via a connection of Remote LAN-based access to wide band.

  I have bought this device and need an answer fast if possible.

  Thank you 1 million.

  Vito

  The navigation feature is the ideal tool for this:

  http://Tools.Cisco.com/ITDIT/CFN/JSP/index.jsp

  Search by function and enter PPTP and you will see he came to 12.2 code.

  Do the same for L2TP and you will see he came in 12.1 T code.

  The short answer is no.

• Remote access to the site to site VPN

  We currently have a VPN site-to-site set up on a direct line between our two data centers. Hosts on site one can speak to guests at site B, and talk to the hosts to site A to site B guests.

  I've recently implemented a site A. VPN VPN remote access clients can access all of the resources behind the ASA at A site without problem. However, strange things happen when they try to contact the site B.

  I have set up corresponding exemptions of NAT on each side of the connection. The remote site reported no abnormalities. When you attempt to connect to a remote VPN client to site B, the only errors that appear are on the SAA to site A. When a remote client attempts to connect to a host at site B, the following errors appear in the log:

  % ASA-3-305005: no group of translation not found for tcp src outside:10.3.0.1/60851 dst ds3:10.0.1.42/22

  I have the exemption following NAT set up on site A:

  access-list sheep; 3 items

  access-list 1 permit line sheep extended ip 10.1.0.0 255.255.0.0 10.0.0.0 255.255.0.0 (hitcnt = 0)

  allowed to Access-list sheep lengthened 2 ip line 10.1.0.0 255.255.0.0 10.3.0.0 255.255.255.0 (hitcnt = 0)

  allowed to Access-list sheep line 3 extended ip 10.3.0.0 255.255.255.0 10.0.0.0 255.255.0.0 (hitcnt = 0)

  I work on it for a few days now and hesitate to open a ticket of TAC. I've seen a few similar questions on the forums, but have found zero with a working solution. I tried to follow the technical notes on Cisco's Web site for a configuration similar to, but had no luck.

  Also, I enabled same-security-traffic on intra and inter-interface interface.

  Any help would be appreciated.

  HUB of the ASA, is this your topology? If so try below suggestions.

  Inside 10.1.1.0/16 Net

  Net 172.16.0.0/28 - net through Tunnel L2L 10.0.0.0/16 end DS3

  VPN RA Net 10.3.0.0/24

  To RA to access the L2L tunnel end hosting you will need to exempt sheep rule applied to the ds3 interface.

  based on the journal

  % ASA-3-305005: no group of translation not found for tcp src outside:10.3.0.1/60851 dst ds3:10.0.1.42/22

  Try this

  no scope list ip 10.3.0.0 access test allow 255.255.255.0 10.0.0.0 255.255.0.0

  test the ip 10.0.0.0 allowed extended access list 255.255.0.0 10.3.0.0 255.255.255.0

  test access list 0 Tan (ds3)

  on the end of the tunnel (spoke), to allow the network of RA from the FOCUS of the ASA in the interesting traffic.

  Let us know how it works

  Concerning

• Configuring remote access VPN

  Hi all

  I need help with remote access vpn configuration. I want to some remote users who have access to the internet on their system to connect and access an application server in my seat social cisco vpn client user. I use Cisco 881. I am unable to use the SDM configuration because it seems that SDM is not supported by the router so I'm using command line. I'd appreciate any help I can get. Thank you.

  This is the configuration I have:

  VPNROUT #sho run
  Building configuration...

  Current configuration: 6832 bytes
  !
  ! Last configuration change at 10:50:45 UTC Saturday, May 30, 2015, by thomas
  version 15.2
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname VPNROUT
  !
  boot-start-marker
  boot-end-marker
  !
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login userauthen1 local
  AAA authorization groupauthor1 LAN
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  iomem 10 memory size
  !
  Crypto pki trustpoint TP-self-signed-1632305899
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1632305899
  revocation checking no
  rsakeypair TP-self-signed-1632305899
  !
  !
  TP-self-signed-1632305899 crypto pki certificate chain
  certificate self-signed 01
  3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
  69666963 31363332 33303538 6174652D 3939301E 170 3134 30313233 31323132
  33325A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
  4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 36333233 65642D
  30353839 3930819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
  8100BC0C 341CD79B A38572CE 1F0F9A91 F96B133C A889B564 E8352034 1CF5EE4B
  B505616B 6014041B EC498C0A F6C5CD2B F5BF62DA BD6E1C44 0C7B9089 1FD0C6E5
  299CEB40 28CD3F3B ADE3468A B07AAA9F AC42F0A7 4087172A 33C4013D 9A50884D
  5778727E 53A4940E 6E622460 560C F597DD53 3B 261584 E45E8776 A848B73D 5252
  92 50203 010001A 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355 D
  551 2304 18301680 14E85AD0 DEF133D8 E09516FD 0AA5FDAD E10EAB1A FA301D06
  03551D0E E85AD0DE 04160414 F133D8E0 9516FD0A A5FDADE1 0EAB1AFA 300 D 0609
  2A 864886 818100A 5 05050003 5B23ED5B 9A380E1F 467ABB03 BAB1070B F70D0101
  7A 218377 73089DC1 D32DA585 C5FD7ECE 0D000F96 7F3AB6CC 71509E8F 3F1C55AE
  E37536A3 1008FBF9 A29329D5 6F76DDC0 AA1C70AE 958AAE5D 32388BE4 2C1C6839
  0369 D 533 027B612C 8D199C35 C008FE00 F7E1DF62 9C73E603 85C3240A 63611D 93
  854A61E2 794F8EF5 DA535DCC B209DA
  quit smoking
  !
  !
  !
  no record of conflict ip dhcp
  DHCP excluded-address IP 10.10.10.1
  DHCP excluded-address IP 172.20.0.1 172.20.0.50
  !
  DHCP IP CCP-pool
  import all
  Network 10.10.10.0 255.255.255.248
  default router 10.10.10.1
  Rental 2 0
  !
  IP dhcp pool 1
  network 172.20.0.0 255.255.240.0
  domain meogl.net
  router by default - 172.20.0.1
  172.20.0.4 DNS server 41.79.4.11 4.2.2.2 8.8.8.8
  8 rental
  !
  !
  !
  no ip domain search
  IP domain name meogl.net
  name of the IP-server 172.20.0.4
  name of the IP-server 41.79.4.11
  IP-server names 4.2.2.2
  8.8.8.8 IP name-server
  IP cef
  No ipv6 cef
  !
  !
  license udi pid CISCO881-K9 sn FCZ1804C3SL
  !
  !
  username secret privilege 15 thomas 4 JXSizd1r/hMqPpGz94vKBb5somtpZLy03k50rJvHO6c
  username privilege 15 secret 4 mowe hlfv/rdDRCAeTUzRXbOIfdaKhJCl1onoGdaQeaQsAnw
  !
  !
  !
  !
  !
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  !
  ISAKMP crypto client configuration group moweclients
  XXXXXXX key
  DNS 172.20.0.4
  meogl.net field
  pool mowepool
  !
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac moweset
  tunnel mode
  !
  !
  !
  Dynmap crypto dynamic-map 1
  Set transform-set moweset
  market arriere-route
  !
  !
  card crypto client mowemap of authentication list userauthen1
  card crypto isakmp authorization list groupauthor1 mowemap
  client configuration address card crypto mowemap answer
  mowemap 1 card crypto ipsec-isakmp dynamic dynmap
  !
  !
  !
  !
  !
  interface Loopback0
  IP 172.30.30.1 255.255.255.0
  IP nat inside
  IP virtual-reassembly in
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  switchport access vlan 100
  no ip address
  !
  interface FastEthernet3
  no ip address
  !
  interface FastEthernet4
  IP 41.7.8.13 255.255.255.252
  NAT outside IP
  IP virtual-reassembly in
  intellectual property policy map route VPN-CLIENT
  Shutdown
  automatic duplex
  automatic speed
  mowemap card crypto
  !
  interface Vlan1
  Description $ETH_LAN$
  IP 10.10.10.1 255.255.255.248
  IP tcp adjust-mss 1452
  !
  interface Vlan100
  IP 172.20.0.1 255.255.240.0
  IP nat inside
  IP virtual-reassembly in
  !
  local pool IP 192.168.1.1 mowepool 192.168.1.100
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  IP nat inside source overload map route interface FastEthernet4 LAT
  IP route 0.0.0.0 0.0.0.0 41.7.8.12
  !
  access-list 23 allow 10.10.10.0 0.0.0.7
  access-list 23 allow 172.20.0.0 0.0.15.255
  access-list 100 permit ip 172.20.0.0 0.0.15.255 everything
  access-list 144 allow ip 192.168.1.0 0.0.0.255 any
  not run cdp
  !
  LAT route map permit 1
  corresponds to the IP 100
  IP 41.7.8.12 jump according to the value
  !
  route VPN-CLIENT map permit 1
  corresponds to the IP 144
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 23 in
  privilege level 15
  transport input telnet ssh
  line vty 5 15
  access-class 23 in
  privilege level 15
  transport input telnet ssh
  !
  !
  end

  Please the configuration above, give me the desired output.

  Thank you.

  Hello Thomas,.

  I'm glad to hear that you have found useful in the example configuration.

  I checked your configuration and everything seems ok with him, especially the statements of nat.

   ip local pool mowepool 192.168.1.1 192.168.1.100 access-list 100 deny ip 172.20.0.0 0.0.15.255 192.168.1.0 0.0.0.255 access-list 100 permit ip 172.20.0.0 0.0.15.255 any route-map LAT permit 1 match ip address 100 ip nat inside source route-map LAT interface FastEthernet4 overload interface Vlan100 ip address 172.20.0.1 255.255.240.0 ip nat inside ip virtual-reassembly in 

  Try to generate ICMP traffic behind your 100 VLANS to the client VPN in order to answer the following questions:

  -The router receives this traffic between VLAN100 unit?

  -The router is encrypt this traffic, after receiving the ICMP packet?

  #show crypto ipsec router its can help you with this question. Look for the program/decaps counters.

  -The same, but the other way around (from VPN client to device behind VLAN100) try to locate the problem.

  The following document explains more this crypto commands and debugs if necessary.

  http://www.Cisco.com/c/en/us/support/docs/security-VPN/IPSec-negotiation-IKE-protocols/5409-IPSec-debug-00.html#iosdbgs

• On 1861 VPN remote access

  Hello

  I'd like to set up remote access VPN on an 1861 for teleworkers who use the Cisco VPN client to access head office, where the 1861.

  I was hoping to use SDM or CCA to point and click my way through the installer because I'm not a security guru, but the 1861 is not supported it is still. Someone at - it a Setup to configure guide these on IOS. I don't know how to configure them on a PIX, but the config is not 'translate '.

  Hi, this could be useful for you:

  http://www.Cisco.com/en/us/products/HW/routers/ps274/products_configuration_example09186a0080819289.shtml

  NOTE: regardless of a "different" platform, it applies to all ios routers.

• Road of default remote access VPN session

  ASA version 8.2.2

  How do you assign remote access VPN sessions a single default route?  Other than the default route assigned to ASA.  For example, my VPN ASA (handles vpn sessions), defaults to the Internet.  I wish that sessions VPN for remote access by default internal network first, then follow the default route to the Internet on another firewall.

  The SAA outside the IP address of the interface is a public.  Inside is a private 10.x.x.x.  VPN clients receive 172.17.x.x.

  Thank you

  After the command 'road' added keyword "tunnel".

  in the tunnel

  Specifies the route as the default gateway of tunnel for the VPN traffic.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/QR.html#wp1767323

• Cisco ASA 8.4 (3) remote access VPN - client connects but cannot access inside the network

  I have problems to access the resources within the network when connecting with the Cisco VPN client for a version of 8.4 (3) operation of the IOS Cisco ASA 5510. I tried all new NAT 8.4 orders but cannot access the network interior. I can see traffic in newspapers when ping. I can only assume I have NAT evil or it's because the inside interface of the ASA is on the 24th of the same subnet as the network interior? Please see config below, any suggestion would be appreciated. I configured a VPN site to another in this same 5510 and it works well

  Thank you

  interface Ethernet0/0

  Speed 100

  full duplex

  nameif outside

  security-level 0

  IP x.x.x.x 255.255.255.240

  !

  interface Ethernet0/1

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.88.10.254 255.255.255.0

  !

  interface Management0/0

  Shutdown

  nameif management

  security-level 0

  no ip address

  !

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  network of the PAT_to_Outside_ClassA object

  10.88.0.0 subnet 255.255.0.0

  network of the PAT_to_Outside_ClassB object

  subnet 172.16.0.0 255.240.0.0

  network of the PAT_to_Outside_ClassC object

  Subnet 192.168.0.0 255.255.240.0

  network of the LocalNetwork object

  10.88.0.0 subnet 255.255.0.0

  network of the RemoteNetwork1 object

  Subnet 192.168.0.0 255.255.0.0

  network of the RemoteNetwork2 object

  172.16.10.0 subnet 255.255.255.0

  network of the RemoteNetwork3 object

  10.86.0.0 subnet 255.255.0.0

  network of the RemoteNetwork4 object

  10.250.1.0 subnet 255.255.255.0

  network of the NatExempt object

  10.88.10.0 subnet 255.255.255.0

  the Site_to_SiteVPN1 object-group network

  object-network 192.168.4.0 255.255.254.0

  object-network 172.16.10.0 255.255.255.0

  object-network 10.0.0.0 255.0.0.0

  outside_access_in deny ip extended access list a whole

  inside_access_in of access allowed any ip an extended list

  11 extended access-list allow ip 10.250.1.0 255.255.255.0 any

  outside_1_cryptomap to access extended list ip 10.88.0.0 255.255.0.0 allow object-group Site_to_SiteVPN1

  mask 10.250.1.1 - 10.250.1.254 255.255.255.0 IP local pool Admin_Pool

  NAT static NatExempt NatExempt of the source (indoor, outdoor)

  NAT (inside, outside) static source any any static destination RemoteNetwork4 RemoteNetwork4-route search

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork1 RemoteNetwork1

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork2 RemoteNetwork2

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork3 RemoteNetwork3

  NAT (inside, outside) static source LocalNetwork LocalNetwork static destination RemoteNetwork4 RemoteNetwork4-route search

  !

  network of the PAT_to_Outside_ClassA object

  NAT dynamic interface (indoor, outdoor)

  network of the PAT_to_Outside_ClassB object

  NAT dynamic interface (indoor, outdoor)

  network of the PAT_to_Outside_ClassC object

  NAT dynamic interface (indoor, outdoor)

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

  dynamic-access-policy-registration DfltAccessPolicy

  Sysopt connection timewait

  Service resetoutside

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-ikev1 esp-md5-hmac bh-series

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto-map dynamic dynmap 10 set pfs

  Crypto-map dynamic dynmap 10 set transform-set bh - set ikev1

  life together - the association of security crypto dynamic-map dynmap 10 28800 seconds

  Crypto-map dynamic dynmap 10 kilobytes of life together - the association of safety 4608000

  Crypto-map dynamic dynmap 10 the value reverse-road

  card crypto mymap 1 match address outside_1_cryptomap

  card crypto mymap 1 set counterpart x.x.x.x

  card crypto mymap 1 set transform-set ESP-AES-256-SHA ikev1

  card crypto mymap 86400 seconds, 1 lifetime of security association set

  map mymap 1 set security-association life crypto kilobytes 4608000

  map mymap 100-isakmp ipsec crypto dynamic dynmap

  mymap outside crypto map interface

  crypto isakmp identity address

  Crypto isakmp nat-traversal 30

  Crypto ikev1 allow outside

  IKEv1 crypto ipsec-over-tcp port 10000

  IKEv1 crypto policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 1

  life 86400

  IKEv1 crypto policy 50

  preshared authentication

  the Encryption

  md5 hash

  Group 2

  life 86400

  IKEv1 crypto policy 60

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 70

  preshared authentication

  aes-256 encryption

  sha hash

  Group 1

  life 86400

  IKEv1 crypto policy 90

  preshared authentication

  aes encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  Console timeout 0

  management-access inside

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal BACKDOORVPN group policy

  BACKDOORVPN group policy attributes

  value of VPN-filter 11

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelall

  BH.UK value by default-field

  type tunnel-group BACKDOORVPN remote access

  attributes global-tunnel-group BACKDOORVPN

  address pool Admin_Pool

  Group Policy - by default-BACKDOORVPN

  IPSec-attributes tunnel-group BACKDOORVPN

  IKEv1 pre-shared-key *.

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group ipsec-attributes x.x.x.x

  IKEv1 pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  Excellent.

  Evaluate the useful ticket.

  Thank you

  Rizwan James

• A Site to remote access VPN behind the same public IP address

  Got a problem quite stupid.  We have a VPN from Site to Site configured for a new data center, which will be responsible for general traffic management.  In addition, some users need to use use a VPN client to access certain areas.  The firewall at the Office only has a public IP address, so the two will come to the Site to Site VPN for remote access from the same source.

  This seems a problem with legacy Cisco VPN clients because encryption card matches the entry VPN site-to-site, even if they use VPN clients.  A good/simple solution to solve this problem?

  Some newspapers (198.18.85.23) is the address public IP for the office and the tom.jones is the user.  192.168.1.0/24 is the pool of the VPN client.

  January 7, 2014 19:12:52 ASA5515: % 713130-5-ASA: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, transaction mode attribute unhandled received: 5

  January 7, 2014 19:12:52 ASA5515: % 737003-5-ASA: PISG: DHCP not configured, no viable servers found for tunnel-group "Corp-VPN.

  January 7, 2014 19:12:52 ASA5515: % 713119-5-ASA: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, PHASE 1 COMPLETED

  January 7, 2014 19:12:52 ASA5515: % ASA-3-713061: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, IPSec tunnel rejecting: no entry for crypto for proxy card remote proxy 192.168.1.4/255.255.255.255/0/0 local 0.0.0.0/0.0.0.0/0/0 on the interface outside

  January 7, 2014 19:12:52 ASA5515: % ASA-3-713902: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, error QM WSF (P2 struct & 0x00007fff28dab560, mess id 0x37575f3c).

  January 7, 2014 19:12:52 ASA5515: % ASA-3-713902: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, peer table correlator Removing failed, no match!

  January 7, 2014 19:12:52 ASA5515: % 713259-5-ASA: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, Session is be demolished. Reason: political crypto card not found

  January 7, 2014 19:12:52 ASA5515: % ASA-4-113019: Group = Corp-VPN, Username = tom.smith, IP = 198.18.85.23, disconnected Session. Session type: IKEv1, duration: 0 h: 00 m: 02s, xmt bytes: 0, RRs bytes: 0, right: not found card crypto policy

  January 7, 2014 19:12:53 ASA5515: % 713904-5-ASA: IP = 198.18.85.23, encrypted packet received with any HIS correspondent, drop

  Hello

  Don't know if this will work, but you can try the following configuration (with the rest of the VPN configuration)

  list-access CLIENT VPN ip enable any 192.168.1.0 255.255.255.0

  card crypto OUTSIDE_map 4 is the VPN CLIENT address

  card crypto OUTSIDE_map 4 set peer 198.18.85.23

  card crypto OUTSIDE_map 4 set ikev1 transform-set ESP-AES-128-SHA ESP-3DES-SHA

  The idea would be to have the ACL matches the VPN full Tunnel that the Client attempts to establish. (destination "any" from the point of view of the customer, the ASAs view source)

  I tested briefly on my own SAA by connecting from an IP address to which the ASA offers free VPN in L2L. But as I don't have the operational L2L VPN, I can't really verify the VPN L2L at the moment. Thus, certain risks may be involved if you can afford it.

  -Jouni

• Problems with remote access IPSec VPN

  Dear Experts,

  Kindly help me with this problem of access VPN remotely.

  I have configured remote access VPN IPSec using the wizard. The remote client connects to fine enough seat, gets the defined IP address, sends the packets and bytes, BUT do not receive all the bytes or decrypt packets. On the contrary, the meter to guard discarded rising.

  What could be possibly responsible or what another configuration to do on the SAA for the connection to be fully functional?

  It can help to say that Anyconnect VPN is configured on the same external Interface on the ASA, and it is still functional. What is the reason?

  AnyConnect VPN is used by staff for remote access.

  Kindly help.

  Thank you.

  Hello

  So if I understand correctly, you have such an interface for LAN and WAN and, naturally, the destination networks you want to reach via the VPN Client connection are all located behind the LAN interface.

  In this case the NAT0 configuration with your software most recent could look like this

  object-group, LAN-NETWORKS-VPN network

  network-object

  network-object

  network-object

  network of the VPN-POOL object

  subnet

  destination of LAN-NETWORKS-VPN VPN-NETWORKS-LAN static NAT (LAN, WAN) 1 static source VPN-VPN-POOL

  Naturally, the naming of interfaces and objects might be different. In this case its just meant to illustrate the purpose of the object or interface.

  Naturally I'm not sure if the NAT0 configuration is the problem if I can't really say anything for some that I can't see the configuration.

  As for the other question,

  I have not implemented an ASA to use 2 interfaces so WAN in production environments in the case usually has separate platforms for both or we may be hosting / providing service for them.

  I imagine that there are ways to do it, but the main problem is the routing. Essentially, we know that the VPN Client connections can come from virtually any public source IP address, and in this case we would need to default route pointing to the VPN interface since its not really convenient to set up separate routes for the IP address where the VPN Client connections would come from.

  So if we consider that it should be the default route on the WEBSITE of the ASA link, we run to the problem that we can not have 2 default routes on the same active device at the same time.

  Naturally, with the level of your software, you would be able to use the NAT to get the result you wanted.

  In short, the requirements would be the following

  • VPN interface has a default route, INTERNET interface has a default route to value at the address below
  • NAT0 between LAN and VPN interface configuration to make sure that this traffic is passed between these interface without NAT
  • Interfaces to special NAT configuration between LAN and INTERNET which would essentially transfer all traffic on the INTERNET interface (except for VPN traffic that we have handled in the previous step)

  The above things would essentially allow the VPN interface have the default route that would mean that no matter what the VPN Client source IP address it should be able to communicate with the ASA.

  The NAT0 configuration application would be to force ASA to pass this traffic between the LAN and VPN (pools) for VPN traffic.

  The special configuration of NAT then match the traffic from LAN to ANY destination address and send to the INTERNET interface. Once this decision is made the traffic would follow the lower value default route on this interface.

  I would say that this isn't really the ideal situation and the configuration to use in an environment of productin. It potentially creates a complex NAT configuration such that you use to manipulate the traffic instead of leave the mark of table routing choice in the first place.

  Of course, there could be other options, but I have to test this configuration before I can say anything more for some.

  -Jouni