VPN phone problem

Similar Questions

• AnyConnect VPN phone

  I'm working on the Anyconnect VPN configuration for a customer phone.  I created a separate group of tunnel and the group policy for both phones.  For the part of CM, I worked with one of our engineers to voice for the configured part.  However, when you try to connect a phone to the VPN, authentication fails.  I did a debug and see what follows:

  webvpn_allocate_auth_struct: net_handle = 0x00007ffecba268a0

  webvpn_portal.c:webvpn_determine_primary_username [6136]

  webvpn_portal.c:webvpn_determine_secondary_username [6204]

  webvpn_portal.c:ewaFormServe_webvpn_login [2258]

  webvpn_portal.c:http_webvpn_kill_cookie [1053]

  webvpn_free_auth_struct: net_handle = 0x00007ffecba268a0

  webvpn_allocate_auth_struct: net_handle = 0x00007ffecba268a0

  webvpn_free_auth_struct: net_handle = 0x00007ffecba268a0

  webvpn_allocate_auth_struct: net_handle = 0x00007ffecf386600

  webvpn_portal.c:ewaFormSubmit_webvpn_login [3600]

  webvpn_portal.c:webvpn_login_validate_net_handle [2514]

  webvpn_portal.c:webvpn_login_allocate_auth_struct [2534]

  webvpn_portal.c:webvpn_login_assign_app_next [2552]

  webvpn_portal.c:webvpn_login_cookie_check [2569]

  webvpn_portal.c:webvpn_login_set_tg_buffer_from_form [2626]

  webvpn_portal.c:webvpn_login_transcend_cert_auth_cookie [2660]

  webvpn_login_transcend_cert_auth_cookie: tg_cookie = 0CISCO-PHONES, tg_name =

  webvpn_portal.c:webvpn_login_set_tg_cookie_form [2722]

  webvpn_portal.c:webvpn_login_set_tg_cookie_querry_string [2774]

  webvpn_portal.c:webvpn_login_resolve_tunnel_group [2847]

  webvpn_login_resolve_tunnel_group: tgCookie = 0CISCO-PHONES

  webvpn_login_resolve_tunnel_group: url tunnel group name

  webvpn_login_resolve_tunnel_group: TG_BUFFER = CISCO-PHONES

  webvpn_portal.c:webvpn_login_negotiate_client_cert [2937]

  webvpn_portal.c:webvpn_login_check_cert_status [3035]

  webvpn_portal.c:webvpn_login_cert_only [3083]

  webvpn_portal.c:webvpn_login_primary_username [3105]

  webvpn_portal.c:webvpn_determine_primary_username [6136]

  webvpn_portal.c:webvpn_determine_secondary_username [6204]

  webvpn_portal.c:ewaFormServe_webvpn_login [2258]

  webvpn_portal.c:http_webvpn_kill_cookie [1053]

  webvpn_free_auth_struct: net_handle = 0x00007ffecf386600

  webvpn_allocate_auth_struct: net_handle = 0x00007ffecf386600

  webvpn_free_auth_struct: net_handle = 0x00007ffecf386600

  I can see the phone tent to connect through the display of the real-time log in ASDM, so he tries to connect.  I don't know why it fails however.

  TIA for any help.  If you need more information, let me know.

  Dan

  Hi deyster94

  'Anyconnect of Cisco VPN phone' you licensed?

  Load you the certificate into the call manager?

  Load the certificate on the SAA?

  Did you leave the phone register once inside company network until you tried conencting the VPN?

  You have the strategy of group tunnel for the authentication of the certificate?

• EasyVPN for VPN phones?

  Can I use a router 2911 like EasyVPN server for VPN phones or EasyVPN is only for the router-to-router VPN?

  EasyVPN server can stop sessions IPSec client.  I know not at all with native features of IPSec Cisco phones. There is version phone Cisco AnyConnect SSL VPN support including a 2911 can be dismissed to support.

  http://www.Cisco.com/en/us/customer/docs/voice_ip_comm/cucme/Admin/Configuration/Guide/cmevpn.html#wp1019169

  Todd

• VPN-ASA5505 problem

  Hi all

  I inherited this VPN and get slowly upward. At least users can connect to it now!  I had a few problems. Users can connect to the VPN, but cannot ping or access shared files on the server (192.168.2.3), but the VPN users must be able to make full use of the network.

  I removed the NAT rule.

  #no nat (inside) 1 0.0.0.0 0.0.0.0)

  And after removing that, VPN users have been able to navigate and access to internal resources. However, users in the office now had no internet. I went and added the rule of return and returned internet.

  Believe it is related to the split tunneling, what can I do to activate full VPN access and still have internet at Headquarters?

  ASA Version 7.2 (4)

  !

  ciscoasa hostname

  domain default.domain.invalid

  activate mI3N1CPoxB4FJhZg encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.2.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  209.124.X.X 255.255.255.252 IP address

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  passive FTP mode

  Server DNS 192.168.2.3 Group

  DNS server-group DefaultDNS

  domain default.domain.invalid

  the Exchange25 object-group network

  access-list standard split allow 192.168.2.0 255.255.255.0

  access-list extended sheep permit ip 192.168.2.0 255.255.255.0 192.168.2.0 255.255.255.0

  access-list extended sheep permit ip 192.168.2.0 255.255.255.0 192.168.10.0 255.255.255.0

  out_in of access allowed any ip an extended list

  outside_access_in list extended access permit tcp any eq smtp host 192.168.2.3 eq smtp

  outside_access_in list extended access permit tcp any host 192.168.2.3 eq https

  outside_access_in list extended access permit tcp any host 192.168.2.3 eq www

  outside-access allowed extended access list tcp no matter what interface outside eq 7000

  outside-access allowed extended access list tcp no matter what interface outside eq 3389

  outside-access allowed extended access list tcp no matter what interface outside eq 587

  outside-access allowed extended access list tcp no matter what interface outside eq https

  LAN_nat0_outbound list of allowed ip extended access any 192.168.10.0 255.255.255.0

  pager lines 24

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  IP local pool vpnpool 192.168.2.31 - 192.168.2.60

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow any inside

  ASDM image disk0: / asdm - 524.bin

  don't allow no asdm history

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access LAN_nat0_outbound

  NAT (inside) 1 0.0.0.0 0.0.0.0

  public static tcp (indoor, outdoor) interface 192.168.2.3 smtp smtp netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface 7000 192.168.2.80 7000 netmask 255.255.255.255

  public static interface 3389 192.168.2.3 (indoor, outdoor) tcp 3389 netmask 255.255.255.255

  public static interface 587 587 netmask 255.255.255.255 tcp (indoor, outdoor) 192.168.2.3

  public static tcp (indoor, outdoor) interface https 192.168.2.3 https netmask 255.255.255.255

  Access-group out_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 209.124.192.45 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  Enable http server

  http 0.0.0.0 255.255.255.255 outside

  http 192.168.2.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto-map dynamic dynmap 10 game of transformation-ESP-3DES-SHA

  map mymap 65000-isakmp ipsec crypto dynamic dynmap

  mymap outside crypto map interface

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Crypto isakmp nat-traversal 20

  Telnet 0.0.0.0 0.0.0.0 inside

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  management-access inside

  dhcpd dns 192.168.2.3

  !

  attributes of Group Policy DfltGrpPolicy

  No banner

  WINS server no

  value of server DNS 192.168.2.3

  DHCP-network-scope no

  VPN-access-hour no

  VPN - 5 concurrent connections

  VPN-idle-timeout 30

  VPN-session-timeout no

  VPN-filter no

  Protocol-tunnel-VPN IPSec l2tp ipsec webvpn

  allow password-storage

  disable the IP-comp

  Re-xauth disable

  Group-lock no

  disable the PFS

  IPSec-udp disable

  IPSec-udp-port 10000

  Split-tunnel-policy tunnelall

  Split-tunnel-network-list no

  TMA.local value by default-field

  Split-dns no

  Disable dhcp Intercept 255.255.255.255

  disable secure authentication unit

  disable authentication of the user

  user-authentication-idle-timeout 10

  disable the IP-phone-bypass

  disable the leap-bypass

  disable the NEM

  Dungeon-client-config backup servers

  MSIE proxy server no

  MSIE-proxy method non - change

  Internet Explorer proxy except list - no

  Disable Internet Explorer-proxy local-bypass

  disable the NAC

  NAC-sq-period 300

  NAC-reval-period 36000

  NAC-by default-acl no

  address pools no

  enable Smartcard-Removal-disconnect

  the firewall client no

  rule of access-client-none

  WebVPN

  url-entry functions

  HTML-content-filter none

  Home page no

  4 Keep-alive-ignore

  gzip http-comp

  no filter

  list of URLS no

  value of customization DfltCustomization

  port - forward, no

  port-forward-name value access to applications

  SSO-Server no

  value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information

  SVC no

  SVC Dungeon-Installer installed

  SVC keepalive no

  generate a new key SVC time no

  method to generate a new key of SVC no

  client of dpd-interval SVC no

  dpd-interval SVC bridge no

  deflate compression of SVC

  internal TMAgroup group strategy

  attributes of Group Policy TMAgroup

  Split-tunnel-policy tunnelspecified

  Split-tunnel-network-list value split

  gene AzJFyGPWta7durW9 encrypted privilege 15 password username

  username admin privilege 15 encrypted password hLjunphNGLvrgsRP

  username TMAen encrypted password ojCI79mnpWOehEZC

  tunnel-group TMAgroup type ipsec-ra

  attributes global-tunnel-group TMAgroup

  address vpnpool pool

  Group Policy - by default-TMAgroup

  IPSec-attributes tunnel-group TMAgroup

  pre-shared-key *.

  !

  !

  context of prompt hostname

  Cryptochecksum:78c4838558d030ac964d2c331deed909

  : end

  Hello

  Please add the following to your configuration:

  nonat_inside ip access list allow any 192.168.2.0 255.255.255.0
  

  NAT (inside) 0-list of access nonat_inside
  

  You must keep the "nat (inside) 1 0.0.0.0 0.0.0.0 ' so that your users access to the Internet.

  "Nat (inside) 0 nonat_inside access-list" allows to bypass the above rule only for traffic destined to the VPN pool.

  In addition, it is to you if you want to use split tunneling or not.

  More information on tunneling split:

  ASA/PIX: Allow the tunneling split for the VPN Clients on the example of Configuration of ASA

  Let me know.

  Portu.

  Please note all useful posts

• UTM50 SSL VPN IE11 problem

  I use the SSL VPN in time. I just noticed that when I tried to pass by I logged in and tap on connect, but now I get the error: virtual failure of execution of the Passage. I tried another computer that is already running IE9 and I had no problem getting in and using my office remotely over SSL.

  IE11 isn't working? or what should I be looking at.
  router is the latest firmware.

  64-bit is IE only.

  IE10 and 11 are disasters, when it comes to compatibility and how it manages Active-X controls. I'm not aware of any SSL VPN with IE10/11 suppliers.

  You can try Firefox. I can get the java applet to install, but the roads do not work for me.

  Contact support directly and express your concerns.

  You can always use IPsec client software.

• VPN connection problem

  Hello

  We have a server to remote client, on which we need to connect via VPN. My VPN is able to connect. But any application that needs to connect via VPN does not work. I also can't ping on remote servers. While for others its works very well. I can't understand the problem, I tried to reinstall the VPN client.

  I am using windows XP pro and the client VPN CISCO 4.0.3.

  Hello

  Your Windows XP question is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please post your question in the forum TechNet for assistance:

  TechNet Windows XP Service Pack 3 (SP3)

  Hope the helps of information.

• VPN connection problem: keep connection

  I'm having a problem with the maintenance of VPN connection. I connect okay but the line VPN disconnects after about 2 minutes each time.  I use XP Professional V2002, Service Pack 3.  I have disabled the WIndows firewall, as I have F-Secure software suite with its active firewall.  I connect laptop wireless via a Belkin router.  I had no problem for months up until August when suddenly this problem appeared.  I have disabled firewall F-secure, but that did not help. I also disabled the firewall on the router, but again without success.  Can you please help?

  Hi Rashmis,

  Thanks for visiting the site of the community of Microsoft Windows XP. The question you have posted is related to VPN issues and would be better suited to the Technet community. Please visit the link below to find a community that will provide the support you want. http://social.technet.Microsoft.com/forums/en/categories/

  Shawn - Support Engineer - MCP, MCDST
  Microsoft Answers Support Engineer
  Visit our Microsoft answers feedback Forum and let us know what you think

• HP LJ 1563 phone problem

  1536 HP all-in-One, using a printer connected via a USB, cabling running Win 7 and a fax machine.

  I have run the Fax test report and past all active phone line, telephone line current of the correct port test, and tone detected.

  The problem - telephone wire coming out of the wall in the 1536 and from 1536 to my phone. By replacing and playing with the son, I determine that the 1536 is not passing any signal through it, incoming or outgoing phone. I can't get a dial tone on the land line. If I don't ignore the 1536, with the phone, no problem.

  Well, I don't know what I did or what happened, but it is now fixed.

  I download and installed the new firmware (2014) and ran a utility (I don't think that that has nothing), but the problem is now solved.

• BlackBerry Torch 9800 blackBerry smart phones problems

  Sorry guys, but I couldn't find the answers I can.

  In any case, RIM published an update on the so-called lock button on the top phones? I noticed this isn't only this model which is affected. I have heaps of times 'Pocket call' people, texts sent to people and remove apps because the button is so sensative that phone unlocked.

  Also having problems with the appworld keep crashing, this happens every time others.

  Last thing is that I noticed an update for the 9800, but does it include British customers. I checked the phone and he said: I'm updating.

  Thanks in advance

  Do not touch the button is all you need to do to stop unwanted calls and texts.  Unfortunately, it is the easiest thing so much the thing more difficult to do, all at once.

  If accidental pressure on the button there's a problem, I suggest putting your phone in a Holster.  In doing so, the magnets in the case will be aligned with the inner workings of the phone and will stop at your screen, essentially to put your phone to sleep.  (Note that this is applicable only if the case is specially designed for your phone model, i.e. do not try to use a "BOLD" case on a torch.)  It is impossible to access the phone while it is in the case, thus making the accidental presses of the lock button a thing of the past.

  I hope that helps you.

• Client VPN connectivity problems

  I use the cisco VPN client to connect to our network, located behind a 515E. The client is authenticated and gets an ip address but cannot ping or connect with one of the hosts. The connection is to a network of customers that is also behind a 515E. I have successfully connected using the same policy to other places and have had no problem. What confuses me, is that we have used to have a Netscreen firewall before and he had a netscreen vpn client which connected since their network with a problem. Is that something they need for their firewall so that we can get through the traffic?

  Try to turn on NAT - T on your pix, by setting up:

  ISAKMP nat-traversal 20

  and configure the client vpn accordingly:

  http://www.Cisco.com/warp/public/471/cvpn_3k_nat.html#conf_client

  I think these discussions are useful:

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=virtual%20Private%20Networks&topic=General&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd7dda4

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=virtual%20Private%20Networks&topic=General&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd7fe80

• VPN Client problem

  A remote user on our network has problems with the Cisco VPN. They are using Win XP, Cisco Client 3.5.2 and connect via a router of Compaq Ipaq into a modem cable. When they VPN in our 3000 VPN concentrator works very well. When they try to VPN in the PIX on our network, it indicates that the client is no longer. If they use a Microsoft VPN to connect to the network with the 3000 (we run both MS and Cisco VPN) with it set to use the remote control, the default gateway, the Cisco VPN will connect to the PIX, see the network behind PIX, ping stuff behind the PIX, but not map a drive. The remote user can ping the PIX of their unVPNed in the remote location. No other user is a problem connecting to the PIX (except those with the bad remote access or broadband satellite which cannot VPN into anything anyway). We have even a few AOLer connect to it. Help me please.

  If the compaq ipaq router makes a PAT, that might be the problem. PIX is unable to manage the ipsec clients who crossed pat. The vpn3000 has some mechanism to deal with this. PPTP is different to ipsec.

  You must ensure that the ipsec client has its own public routable ip address.

  Kind regards

• Transfer calls to SIP phones problem

  Hello.

  When a user with a Cisco 3905 tries to transfer a call to another IP phone, the call successfully diversion; However, the new beneficiary do not hear anything. If he speaks, the original caller can listen to it, but the recipient cannot.

  Is there anything us missing in our setup in the router of the CMF? All I could do to fix this?

  I attach the run-config and a message from ccsip debugging I extracted by a call that had been transferred.

  Whatever that either would be appreciated. Thank you!.

  Just to give more information on why this solves the problem, some devices/carriers do not manage the call for sendonly to switching sendrcv after a hold event and continue to stay in rcvonly.  This workaround lets the other side think that the call is in sendrcv mode all the time.

• Windows app and phone problems

  Hi, I'm trying to transfer music from itunes to my nokia lumia 920. I do that all the time with the application of windows for desktop phone but tonight, it has stopped working, it says something about an ATL100. DLL is missing? I don't know what it is. PLEASE HELP ME

  Hi Jordan,.

  Please answer these questions:

  1. You have McAfee installed on your computer?
  2. Were there any windows updates installed prior to this problem?

  Looks like the Windows Phone app installation is corrupted, I suggest that you completely uninstall the application from your desktop. Restart your computer, and then reinstall the Windows Phone application. Please do not forget to download a new installation file.

  We look forward to your response. An update with the status of the issue.

• AnyConnect VPN setup problem

  Hi all, I'm going to have bad configure anyconnect VPN on my router. I'm CCENT pre level and especially followed a tutorial, but feel I'm missing something simple here.

  It's a fairly simple installation on a Cisco No. 2851 - faces of a single interface my LAN 192.168.1.0/24, the other has a public IP address.

  I created a network 192.168.2.0/24 VPN users, mainly to have phones Android connection of their mobile phone networks, and have access to the servers/security cameras/etc by using their local IP addresses. When my phone connects, it gets an IP address and is connected, but is not communicating with my LAN correctly.

  The VPN client can ping 192.168.1.254 (the router's LAN IP) - but not the other devices on the network. However, the devices on my LAN can ping the VPN clients to their address 192.168.2.x.

  Here's a copy of my current config, I have reorganized some elements with #s. Also pasted my ip sh road under him. Do not forget that I am a novice, please forgive the hack :)

  Router (config) #do sh run
  Building configuration...

  Current configuration: 5782 bytes
  !
  ! Last modification of the configuration at 02:24:24 UTC Sat Sep 5 2015 by #.
  !
  version 15.1
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  host name #.
  !
  boot-start-marker
  boot-end-marker
  !
  !
  enable secret $5 1$ 0 #.
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login local sslvpn
  AAA authorization exec default local
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  !
  !
  dot11 syslog
  no ip source route
  !
  !
  IP cef
  !
  DHCP excluded-address 192.168.1.200 IP 192.168.1.254
  DHCP excluded-address 192.168.1.1 IP 192.168.1.10
  !
  pool of dhcp IP LAN
  network 192.168.1.0 255.255.255.0
  Server DNS 192.168.1.254
  by default-router 192.168.1.254
  !
  !
  IP domain name # '.com'
  host IP Switch 192.168.1.253
  8.8.8.8 IP name-server
  block connection-for 2000 tent 4 within 60
  connection access silencer-class SSH_MGMT
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  voice-card 0
  !
  Crypto pki token removal timeout default 0
  !
  Crypto pki trustpoint TRUSTPOINT-MY
  enrollment selfsigned
  Serial number
  name of the object CN = 117-certificate
  crl revocation checking
  rsakeypair my-rsa-keys
  !
  !
  MY-TRUSTPOINT crypto pki certificate chain
  certificate self-signed 01
  ##########################

  #########################
  quit smoking
  !
  !
  license udi pid CISCO2851 sn FTX1026A54Y
  # 5 secret username $1$ yv # E9.
  # 5 secret username $1$ X0nL ###kO.
  !
  redundancy
  !
  !
  property intellectual ssh version 2
  !
  !
  !
  !
  !
  !
  !
  !
  interface GigabitEthernet0/0
  LAN description
  IP 192.168.1.254 255.255.255.0
  IP nat inside
  No virtual-reassembly in ip
  automatic duplex
  automatic speed
  !
  interface GigabitEthernet0/1
  WAN description
  No dhcp client ip asks tftp-server-address
  No dhcp ip client application-domain name
  DHCP IP address
  IP access-group ACL-WAN_INTERFACE in
  no ip redirection
  no ip proxy-arp
  NAT outside IP
  No virtual-reassembly in ip
  automatic duplex
  automatic speed
  No cdp enable
  !
  interface Serial0/0/0
  no ip address
  Shutdown
  !
  interface virtual-Template1
  !
  local IP 192.168.2.100 WEBVPN-POOL pool 192.168.2.110
  IP forward-Protocol ND
  no ip address of the http server
  no ip http secure server
  !
  !
  The dns server IP
  IP nat inside source list INSIDE_NAT_ADDRESSES interface GigabitEthernet0/1 overload
  !
  IP access-list standard INSIDE_NAT_ADDRESSES
  permit 192.168.1.0 0.0.0.255
  permit 192.168.2.0 0.0.0.255
  IP access-list standard SSH_MGMT
  permit 192.168.1.0 0.0.0.255
  permit 207.210.0.0 0.0.255.255
  !
  IP extended ACL-WAN_INTERFACE access list
  deny udp any any eq snmp
  TCP refuse any any eq field
  TCP refuse any any eq echo
  TCP refuse any any day eq
  TCP refuse any any eq chargen
  TCP refuse any any eq telnet
  TCP refuse any any eq finger
  deny udp any any eq field
  deny ip 127.0.0.0 0.255.255.255 everything
  deny ip 192.168.0.0 0.0.255.255 everything
  permit any any eq 443 tcp
  allow an ip
  !
  exploitation forest esm config
  NLS RESP-timeout 1
  CPD cr id 1
  !
  !
  !
  !
  !
  !
  !
  control plan
  !
  !
  !
  !
  profile MGCP default
  !
  !
  !
  !
  !
  access controller
  Shutdown
  !
  !
  !
  Line con 0
  exec-timeout 0 0
  Synchronous recording
  line to 0
  exec-timeout 0 0
  Synchronous recording
  line vty 0 4
  exec-timeout 0 0
  Synchronous recording
  entry ssh transport
  line vty 5 15
  exec-timeout 0 0
  Synchronous recording
  entry ssh transport
  !
  Scheduler allocate 20000 1000
  !
  Gateway Gateway-WebVPN-Cisco WebVPN
  IP interface GigabitEthernet0/1 port 443
  SSL rc4 - md5 encryption
  SSL trustpoint TRUSTPOINT-MY
  development
  !
  WebVPN install svc flash:/webvpn/anyconnect-linux-3.1.03103-k9.pkg sequence 1
  !
  WebVPN context Cisco WebVPN
  title "Firewall.cx WebVPN - powered by Cisco"
  SSL authentication check all
  !
  list of URLS "rewrite".
  !
  ACL "ssl - acl.
  ip permit 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
  permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
  Licensing ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
  !
  login message "Cisco Secure WebVPN"
  !
  webvpnpolicy political group
  functions required svc
  filter tunnel ssl - acl
  SVC-pool of addresses 'WEBVPN-POOL' netmask 255.255.255.0
  generate a new key SVC new-tunnel method
  SVC split include 192.168.1.0 255.255.255.0
  Group Policy - by default-webvpnpolicy
  AAA authentication list sslvpn
  Gateway Cisco WebVPN bridge
  Max-users 5
  development
  !
  end

  Gateway of last resort is #. ###. ###. # network 0.0.0.0

  S * 0.0.0.0/0 [254/0] via #. ###. ###.1
  (###ISP))) is divided into subnets, subnets 1
  S (# #ISP #) [254/0] via (# publicgateway #) GigabitEthernet0/1
  ###.###.0.0/16 is variably divided into subnets, 2 subnets, 2 masks
  C ###.###.###.0/23 is directly connected, GigabitEthernet0/1
  The ###.###.###.###/32 is directly connected, GigabitEthernet0/1
  192.168.1.0/24 is variably divided into subnets, 2 subnets, 2 masks
  C 192.168.1.0/24 is directly connected, GigabitEthernet0/0
  The 192.168.1.254/32 is directly connected, GigabitEthernet0/0
  192.168.2.0/32 is divided into subnets, subnets 1
  S 192.168.2.100 [0/0] via 0.0.0.0, Virtual Network1

  can you try to disable the FW on your internal lan hosts and then try and ping from users of vpn client

• VPN Tunnel problem. external interface has private IP

  Hi all

  I don't know if it is wired or not!

  When our ISP provide us an Internet connection our real IP is configured on the ethernet interface, while the serial interfaces have a private IP address.

  The problem here is when I'm trying to configure a VPN tunnel to another router.

  Anything in the configuration is smooth, except for the part where I put the serial interface is my outside.

  The tunnel is still low coz the IP address will be my private (serial interface) during the configuration on the router counterpart is my public IP address.

  So I am woundering is there a way I can force the VPN tunnel to take the IP address configured on the side LAN? Or any other work around?

  Building configuration...

  Current configuration: 2372 bytes

  !

  version 12.4

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  boot-start-marker

  start the flash c1841-advsecurityk9 - mz.124 - 23.bin system

  boot-end-marker

  !

  property intellectual auth-proxy max-nodata-& 3

  property intellectual admission max-nodata-& 3

  !

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 2

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  isakmp encryption key * address 144.254.x.y

  !

  !

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  !

  map SDM_CMAP_1 1 ipsec-isakmp crypto

  Description Tunnel to144.254.x.y

  the value of 144.254.x.y peer

  game of transformation-ESP-3DES-SHA

  match address VPN_Traffic

  !

  !

  !

  interface FastEthernet0/0

  address IP 10.55.218.1 255.255.255.0 secondary (My internal subnet)

  IP address 196.219.a.b 255.255.255.224 (my public IP)

  IP nat inside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  No keepalive

  !

  interface FastEthernet0/1

  no ip address

  automatic duplex

  automatic speed

  !

  interface Serial0/0/0

  no ip address

  frame relay IETF encapsulation

  frame-relay lmi-type q933a

  !

  point-to-point interface Serial0/0/0.16

  IP 172.16.133.2 255.255.255.252

  NAT outside IP

  IP virtual-reassembly

  SNMP trap-the link status

  dlci 16 frame relay interface

  map SDM_CMAP_1 crypto

  !

  interface Serial0/0/1

  no ip address

  frame relay IETF encapsulation

  ignore the dcd

  frame-relay lmi-type q933a

  !

  point-to-point interface Serial0/0/1.16

  IP 172.16.134.2 255.255.255.252

  NAT outside IP

  IP virtual-reassembly

  SNMP trap-the link status

  dlci 16 frame relay interface

  map SDM_CMAP_1 crypto

  !

  IP forward-Protocol ND

  IP route 0.0.0.0 0.0.0.0 Serial0/0/1.16

  IP route 0.0.0.0 0.0.0.0 Serial0/0/0.16

  !

  VPN_Traffic extended IP access list

  Note Protect traffic Local to any Destination subnet

  Remark SDM_ACL = 4 category

  IP 10.55.218.0 allow 0.0.0.255 any

  !

  Scheduler allocate 20000 1000

  end

  This should do the trick.

  map SDM_CMAP_1 crypto local-address FastEthernet0/0

  See you soon