VPN site to Site with client access VPN

Similar Questions

• Need help with the configuration of the Site with crossed on Cisco ASA5510 8.2 IPSec VPN Client (1)

  Need urgent help in the configuration of the Client VPN IPSec Site with crossed on Cisco ASA5510 - 8.2 (1).

  Here is the presentation:

  

  There are two leased lines for Internet access - a route 1.1.1.1 and 2.2.2.2, the latter being the default Standard, old East for backup.

  I was able to configure the Client VPN IPSec Site

  (1) with access to the outside so that the internal network (172.16.0.0/24) behind the asa

  (2) with Split tunnel with simultaneous assess internal LAN and Internet on the outside.

  But I was not able to make the tradiotional model Hairpinng to work in this scenario.

  I followed every possible suggestions made on this subject in many topics of Discussion but still no luck. Can someone help me here please?

  Here is the race-Conf with Normal Client to Site IPSec VPN configured with no access boarding:

  LIMITATION: Cannot boot into any other image ios for unavoidable reasons, must use 8.2 (1)

  race-conf - Site VPN Customer normal work without internet access/split tunnel

  : ASA Version 8.2 (1) ! ciscoasa hostname domain cisco.campus.com enable the encrypted password xxxxxxxxxxxxxx XXXXXXXXXXXXXX encrypted passwd names of ! interface GigabitEthernet0/0 nameif outside internet1 security-level 0 IP 1.1.1.1 255.255.255.240 ! interface GigabitEthernet0/1 nameif outside internet2 security-level 0 IP address 2.2.2.2 255.255.255.224 ! interface GigabitEthernet0/2 nameif dmz interface security-level 0 IP 10.0.1.1 255.255.255.0 ! interface GigabitEthernet0/3 nameif campus-lan security-level 0 IP 172.16.0.1 255.255.0.0 ! interface Management0/0 nameif CSC-MGMT security-level 100 the IP 10.0.0.4 address 255.255.255.0 ! boot system Disk0: / asa821 - k8.bin boot system Disk0: / asa843 - k8.bin passive FTP mode DNS server-group DefaultDNS domain cisco.campus.com permit same-security-traffic inter-interface permit same-security-traffic intra-interface object-group network cmps-lan the object-group CSC - ip network object-group network www-Interior object-group network www-outside object-group service tcp-80 object-group service udp-53 object-group service https object-group service pop3 object-group service smtp object-group service tcp80 object-group service http-s object-group service pop3-110 object-group service smtp25 object-group service udp53 object-group service ssh object-group service tcp-port port udp-object-group service object-group service ftp object-group service ftp - data object-group network csc1-ip object-group service all-tcp-udp access list INTERNET1-IN extended permit ip host 1.2.2.2 2.2.2.3 access-list extended SCC-OUT permit ip host 10.0.0.5 everything list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq www list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any https eq list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq ssh list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 no matter what eq ftp list of access CAMPUS-LAN extended permitted udp 172.16.0.0 255.255.0.0 no matter what eq field list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq smtp list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq pop3 access CAMPUS-wide LAN ip allowed list a whole access-list CSC - acl note scan web and mail traffic access-list CSC - acl extended permit tcp any any eq smtp access-list CSC - acl extended permit tcp any any eq pop3 access-list CSC - acl note scan web and mail traffic access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 993 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq imap4 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 465

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq www

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq https

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq smtp

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq pop3

  access-list extended INTERNET2-IN permit ip any host 1.1.1.2

  access-list sheep extended ip 172.16.0.0 allow 255.255.0.0 172.16.0.0 255.255.0.0

  access list DNS-inspect extended permit tcp any any eq field

  access list DNS-inspect extended permit udp any any eq field

  access-list extended capin permit ip host 172.16.1.234 all

  access-list extended capin permit ip host 172.16.1.52 all

  access-list extended capin permit ip any host 172.16.1.52

  Capin list extended access permit ip host 172.16.0.82 172.16.0.61

  Capin list extended access permit ip host 172.16.0.61 172.16.0.82

  access-list extended capout permit ip host 2.2.2.2 everything

  access-list extended capout permit ip any host 2.2.2.2

  Access campus-lan_nat0_outbound extended ip 172.16.0.0 list allow 255.255.0.0 192.168.150.0 255.255.255.0

  pager lines 24

  Enable logging

  debug logging in buffered memory

  asdm of logging of information

  Internet1-outside of MTU 1500

  Internet2-outside of MTU 1500

  interface-dmz MTU 1500

  Campus-lan of MTU 1500

  MTU 1500 CSC-MGMT

  IP local pool 192.168.150.2 - 192.168.150.250 mask 255.255.255.0 vpnpool1

  IP check path reverse interface internet2-outside

  IP check path reverse interface interface-dmz

  IP check path opposite campus-lan interface

  IP check path reverse interface CSC-MGMT

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 621.bin

  don't allow no asdm history

  ARP timeout 14400

  interface of global (internet1-outside) 1

  interface of global (internet2-outside) 1

  NAT (campus-lan) 0-campus-lan_nat0_outbound access list

  NAT (campus-lan) 1 0.0.0.0 0.0.0.0

  NAT (CSC-MGMT) 1 10.0.0.5 255.255.255.255

  static (CSC-MGMT, internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255

  Access-group INTERNET2-IN interface internet1-outside

  group-access INTERNET1-IN interface internet2-outside

  group-access CAMPUS-LAN in campus-lan interface

  CSC-OUT access-group in SCC-MGMT interface

  Internet2-outside route 0.0.0.0 0.0.0.0 2.2.2.5 1

  Route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  AAA authentication enable LOCAL console

  Enable http server

  http 10.0.0.2 255.255.255.255 CSC-MGMT

  http 10.0.0.8 255.255.255.255 CSC-MGMT

  HTTP 1.2.2.2 255.255.255.255 internet2-outside

  HTTP 1.2.2.2 255.255.255.255 internet1-outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs set group5

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  Crypto map internet2-outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  crypto internet2-outside_map outside internet2 network interface card

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as

  quit smoking

  ISAKMP crypto enable internet2-outside

  crypto ISAKMP policy 10

  preshared authentication

  aes encryption

  md5 hash

  Group 2

  life 86400

  Telnet 10.0.0.2 255.255.255.255 CSC-MGMT

  Telnet 10.0.0.8 255.255.255.255 CSC-MGMT

  Telnet timeout 5

  SSH 1.2.3.3 255.255.255.240 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet2-outside

  SSH timeout 5

  Console timeout 0

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal VPN_TG_1 group policy

  VPN_TG_1 group policy attributes

  Protocol-tunnel-VPN IPSec

  username ssochelpdesk encrypted password privilege 15 xxxxxxxxxxxxxx

  privilege of encrypted password username administrator 15 xxxxxxxxxxxxxx

  username vpnuser1 encrypted password privilege 0 xxxxxxxxxxxxxx

  username vpnuser1 attributes

  VPN-group-policy VPN_TG_1

  type tunnel-group VPN_TG_1 remote access

  attributes global-tunnel-group VPN_TG_1

  address vpnpool1 pool

  Group Policy - by default-VPN_TG_1

  IPSec-attributes tunnel-group VPN_TG_1

  pre-shared-key *.

  !

  class-map cmap-DNS

  matches the access list DNS-inspect

  CCS-class class-map

  corresponds to the CSC - acl access list

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  CCS category

  CSC help

  cmap-DNS class

  inspect the preset_dns_map dns

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y

  : end

  Adding dynamic NAT for 192.168.150.0/24 on the external interface works, or works the sysopt connection permit VPN

  Please tell what to do here, to pin all of the traffic Internet from VPN Clients.

  That is, that I need clients connected via VPN tunnel, when connected to the internet, should have their addresses IP NAT'ted against the address of outside internet2 network 2.2.2.2 interface, as it happens for the customers of Campus (172.16.0.0/16)

  I am well aware of all involved in here, so please be elaborative in your answers. Please let me know if you need more information about this configuration to respond to my request.

  Thank you & best regards

  MAXS

  
  

  Hello

  If possible, I'd like to see that a TCP connection attempt (e.g. http://www.google.com) in the ASDM logging of the VPN Client when you set up the dynamic NAT for the VPN Pool also.

  I'll try also the command "packet - trace" on the SAA, while the VPN Client is connected to the ASA.

  The command format is

  packet-tracer intput tcp

  That should tell what the SAA for this kind of package entering its "input" interface

  Still can not see something wrong with the configuration (other than the statement of "nat" missing Dynamics PAT)

  -Jouni

• ASA5505 VPN Site to site and limiting access - URGENT

  I'll admit knowledge limited to the front, so forgive me if I look like a fool.  The company that I work began recently to hosting our application for some of our customers. to do this, we are renting rack space, connections and equipment in a data center.  We must send data to our request for an application in the center of data of our customers.  They have an ASA 5505.

  Our data center will support VPN site-to-site and nothing else.  Our client find it unacceptable, citing security and the inability to restrict access to only the small number of servers, our application needs to access.  I have to be able to talk intelligently and with the facts (and, preferably, examples of configuration on hand) with their staff of the IOC and network in the next day or so.

  The ASA 5505 can be configured for a VPM from site to site with our data center which limits our application server to access a limited set of IP addresses within their network?  If so, this is quite easily possible?  Anyone done this?

  Thank you

  Leighton Wingerd

  Leighton,

  Sounds complicated problem - but are simple actuall.  Remember that a VPN ensures the transmission from site A to site B on a precarious environment - internet.  For example, you can DEFINE the traffic that goes through the VPN, you also DEFINE the traffic that will launch the VPN tunnel in the first place.  With these statements said - using your supposed information you would create valuable traffic as the exact traffic you want to allow through the vpn;

  access-list permits datacentre_2_client tcp host 1.2.3.4 host 192.168.1.2 eq 1521

  And you will use the same ACL to set which can cross traffic.  However, I know for a fact that an ODBC Oracle connection uses more than one TCP port!

  The confidentiality of data is something else - that your customer needs to define requirements.  An SSL connection is fine and dandy - you will just be to encrypt the traffic twice!

• Cisco Asa vpn site-to-site with nat

  Hi all

  I need help
  I want to make a site from the site with nat vpn
  Site A = 10.0.0.0/24
  Site B = 10.1.252.0/24

  I want when site A to site B, either by ip 172.26.0.0/24

  Here is my configuration

  inside_nat_outbound to access ip 10.0.0.0 scope list allow 255.255.255.0 10.1.252.0 255.255.255.0

  tunnel-group x.x.x.x type ipsec-l2l
  tunnel-group ipsec-attributes x.x.x.x
  pre-shared-key!

  ISAKMP retry threshold 10 keepalive 2

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  card crypto outside_map 2 match address inside_nat_outbound

  card crypto outside_map 2 pfs set group5
  card crypto outside_map 2 peers set x.x.x.x

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  NAT (inside) 10 inside_nat_outbound

  Global 172.26.0.1 - 172.26.0.254 10 (outside)

  but do not work.

  Can you help me?

  Concerning

  Frédéric

  You must ensure that there is no NAT 0 ACL statement because it will take precedence over the static NAT.

  You don't need:

  Global 172.26.0.1 - 172.26.0.254 10 (outside)

  NAT (inside) 10 access-list nattoyr

  Because it will be replaced by the static NAT.

  In a Word is enough:

  nattoyr to access ip 10.0.0.0 scope list allow 255.255.255.0 10.1.252.0 255.255.255.0

  access extensive list ip 172.26.0.0 vpntoyr allow 255.255.255.0 10.1.252.0 255.255.255.0

  public static 172.26.0.0 (inside, outside) - nattoyr access list

  card crypto outside_map 2 match address vpntoyr

  card crypto outside_map 2 pfs set group5

  card crypto outside_map 2 defined peer "public ip".

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  outside_map interface card crypto outside

  tunnel-group "public ip" type ipsec-l2l

  tunnel-group "public ip" ipsec-attributes

  pre-shared key *.

  -Make sure that it not there no NAT ACL 0 including the above statements and check if NAT happening (sh xlate) and the

  traffic is being encryption (sh cry ips its)

  Federico.

• VPN site to Site with an ASA behind Port Forwarding device

  Hi, I want to configure a VPN from Site to site with an ASA with a public static IP adress and other ASA located behind a device with a public IP address that can forward ports to the ASA.

  I have found no documentation for this configuration in the Cisco KB, anyone have a link for me or a brief description of the requirements?

  Thank you

  Tobias

  Hello

  Take a look at this documentation

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094ecd.shtml

  Hope this helps

  -Jouni

• ASA (v9.1) VPN from Site to Site with IKEv2 and certificates CEP/NDE MS

  Hi all

  I am currently a problem with VPN Site to Site with IKEv2 and certifiactes as an authentication method.

  Here is the configuration:

  We have three locations with an any to any layer 2 connection. I created each ASA (ASA5510 worm 9.1) to establish one VPN of Site connection to the other for the other two places. Setting this up with pre shared keys and certificates that are signed by the CA MS administrator manually work correctly.

  But when we try to enroll these certificates through the Protocol, CEP/NDE his does not work.

  Here are my steps:

  1 configure the CA Turstpoint to apply to the certification authority

  2. request that the CA through the SCEP protocol works fine

  3. set up a Trustpoint and a pair of keys for the S2S - VPN connection

  4. registration form identity certificate CA via the SCEP Protocol with a one time password works fine

  5. set the trustpoint created as for the S2S - VPN IKEv2 authentication method.

  Now I did it also for the other site of the VPN Tunnel. But when I ping on a host that is on a different location to make appear the Tunnel VPN - the VPN session is not established. In the debugs I see that there are a few problems during authentication of the remote peer.

  On the MS that I see that the certifactes of identity for both ASAs are communicated and not revoked or pending state. The certificate based on the model of the "IPSec (Offline).

  When the CA-Admin and a certificate me manually based on a copy of the model of "Domaincontroller" connection is successfully established.

  So I would like to know which is the correct certificate for IP-Sec peers template to use for the Protocol, CEP and MS Enterprise CA (its server 2008R2 of Microsoft Enterprise)?

  Anyone done this before?

  ASA requires that the local and Remote certificate contains EKU IP Security Tunnel Endpoint (1.3.6.1.5.5.7.3.6) (aka IP Security Tunnel termination). You can create a Microsoft CA model to add.

  If you absolutely must go with the 'bad' cert, there is a command

  ignore-ipsec-keyusage

  but it is obsolete and not recommended.

  Meanwhile at the IETF:

  RFC 4809

  3.1.6.3 extended Key use

  Extended Key Usage (EKU) indications are not required.  The presence
  or lack of an EKU MUST NOT cause an implementation to fail an IKE
  connection.
  

• VPN site-to-site with pppoe ADSL connection

  Dear

  I would like to know - is it possible to connect two 5505 ASA in VPN site-to-site with 1 site using the pppoe ADSL connection?

  A (static IP) site

  Site B (ADSL pppoe, DHCP)

  Site has < site="" to="" site="" vpn=""> > Site B

  Best regards

  Alan.

  Configuration of site B should be the same as all the other side than peers with static end.

  The different configuration would be on Site A as he will accept a VPN to a dynamic counterpart.

  Unfortunately, I have no configuration example to show you on ASDM.

• Tunnel VPN site to Site with DDNS

  I have a hub site that has a static ip address and a remote site with DDNS.  I am building a Site to Site tunnel between them, I can do this with the static ip address, but when he changes the tunnel breaks down, so I need a way to the ASA to know when this ip address changes.  How can I do this?

  Thank you

  To my knowledge, DDNS for VPN is supported only on router IOS not on ASA.

  If you use ASA on the head of network, you may need to use EasyVPN

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a0080912cfd.shtml

  EasyVPN VPN must be started from the remote site.

• I am trying to access a site with videos on a daily basis, but there is no playback picture, only sound.

  When I try to access the web page, everything goes smooth, but when I get to video playback, it does not show an image, you can hear the sound of the video playback. I accessed this web site with other web browsers, and it works beautifully, with the image and audio playback. On the same site web, videos work sometimes, but it's very rare, and I don't know what determines this kind of behavior.

  Try disabling hardware acceleration in Flash Player.

  See the videos in Flash will not play in full screen

  • http://www.YouTube.com/swf_test.html (right click on the player: settings)

  Blink the window "display settings":

  • http://www.Macromedia.com/support/documentation/en/flashplayer/help/help01.html

• I don't understand why I can't login my account using mozilla but with googlechrome fb, I am able to do... Mozilla can load the fb site but cannot access my fb account... I'm uncomfortable with the use of mozilla as my browser... pls help thanks

  I don't understand why I can't login my account using mozilla but with googlechrome fb, I am able to do... Mozilla can load the fb site but cannot access my fb account... I'm uncomfortable with the use of mozilla as my browser... pls help thanks

  • "Clear the Cache": Tools > Options > advanced > network > storage (Cache) offline: 'clear now '.
  • 'Delete Cookies' of sites that cause problems: Tools > Options > privacy > Cookies: "show the Cookies".

  Start Firefox in Firefox to solve the issues in Safe Mode to check if one of the Add-ons is the cause of the problem (switch to the DEFAULT theme: Tools > Modules > themes).

  • Makes no changes on the start safe mode window.

  See:

  • Troubleshoot extensions, themes, and issues of hardware acceleration to resolve common problems of Firefox

• Some Web sites can not access, screen goes white with http 500 errors

  Original title: http 500 errors

  Salvation; Please forgive my PC literacy is near the bottom of the range, but I recently started getting errors. I can browse the Web, but when I log on say Web site common CBSSports and try opening a session I did a million times - the screen blanks out and tells me unable to access Web pages and when I ask for more info... I'm getting http 500 Internal Server Error. It seems to get worse and unable to access less Web sites. Can someone please help?

  Hello

  Thanks for posting your question in the community of Microsoft Windows. I understand that you are unable to browse Web sites with http 500 errors. Correct me if I'm wrong.

  I imagine the inconvenience that you are experiencing. I will definitely help you with this.

  To help you suggest several steps to solve the problem, I would appreciate it if you could answer the following questions:

  1. what web browser do you use?

  2. have you made any recent hardware or exchange of software on your computer before the show?

   

   

  Please follow the methods below if you use Internet Explorer and check the number:

  Method 1:

   

  Can't access some Web sites in Internet Explorer:

  http://support.Microsoft.com/kb/967897

  Note: Reset the Internet Explorer settings can reset security settings or privacy settings that you have added to the list of Trusted Sites. Reset the Internet Explorer settings can also reset parental control settings. We recommend that you note these sites before you use the reset Internet Explorer settings.

  Method 2:

   

   

  Why are some pages blank or incorrectly displayed in Internet Explorer? :

  http://Windows.Microsoft.com/en-us/Windows7/webpages-look-incorrect-in-Internet-Explorer

   

   

  Method 3:

   

  Get help with website (HTTP error) error messages:

  http://Windows.Microsoft.com/en-us/Windows7/get-help-with-website-error-messages-HTTP-errors

   

  I hope that the information above helps you.

• Hello I would like to create a Muse site with homepage and a member area with access code to access the other page of the site is possible this? Thank you

  Hello I would like to create a Muse site with homepage and a member area with access code to access the other page of the site is possible this? Thank you

  No. you're looking completely in the wrong place. These things requires a dynamic system that is appropriate like Wordpress, Joomla and so on. That or a paid Business Catalyst Pro account.

  Mylenium

• Is it possible to set up a site with a read-only ftp access

  I have a production server and a development server and work on a project with the non - DW users. Often, I need to download files from the production server, but never need to download to it (it's someone other responsibility).
  
  I have two FTP accounts for the production server, one with unlimited access with read-only. I would like to implement a DW site that uses the read-only account to get the files from the server. It would also prevent me from accidentally upload on this server.
  
  Unfortunately, I get permission denied errors when accessing the account read-only. I guess that's because the account does not write permission. I checked that the credentials work by FTPing the site using FileZilla and uploading a file.
  
  The DW FTP requires write to a GET operation on a file?

  Nevermind, answered this myself. It is possible, but the user must configure the site with the correct host directory.

• PIX v6.3 Site-to-Site with policy NAT

  Hi guys,.

  I need to set up a site to site with nat because we have overlapping subnet at the other end.

  They need access to both servers on our network with IP static.

  Site A: 192.168.100.0/24

  Site b: 192.168.200.128/25

  The other site has chosen this network for NAT: 10.200.50.0/28

  I need to translate

  192.168.100.10 > 10.200.50.2

  192.168.100.20 > 10.200.50.3

  through the tunnel

  That's what I've done so far, will this work? Any problem that may appear with this config?

  Crypto ACL:

  VPN ip 10.200.50.0 access list allow 255.255.255.240 192.168.200.128 255.255.255.128

  Policy_NAT1 list of allowed access host ip of 192.168.100.10 192.168.200.128 255.255.255.128

  Policy_NAT2 list of allowed access host ip 192.168.100.20 192.168.200.128 255.255.255.128

  NAT (inside) 10 access-list Policy_NAT1 0 0

  NAT (inside) 11 access-list Policy_NAT2 0 0

  overall 10 10.200.50.2 (outside)

  Overall 11 10.200.50.3 (outside)

  Thanks in advance!

  Hello

  Your configuration looks very good.

  Although I guess it's a dynamic configuration policy NAT/PAT.

  Incase you want to configure static policy NAT, you need to change a bit. I mean if you wanted a NAT configuration allowing to form bidirectional connection. Both from your site to the remote site and the remote site to your side. You can always use the same ACL you have configured, but you would use the "static" configurations.

  public static 10.200.50.2 (inside, outside) - Policy_NAT1 access list

  public static 10.200.50.3 (inside, outside) - Policy_NAT2 access list

  Review with the static NAT to politics and the dynamic policy NAT/PAT which would be if these hosts have static NAT configured at the direction of the 'outside' interface while static NAT would cancel both of these configurations.

  If you use the political dynamic NAT and had also a static NAT for the host, then you would have to change from the above static NAT in a policy to override the static NAT.

  And with the foregoing in mind possible existing static NAT and new static NAT of policy might have some problems as a whole. In this case the scheduling of NAT rules would determine if static NAT of the policy has been applied already. If you already had the configured static NAT then it would nullify the political new static NAT:. The solution would be to remove the static NAT and enter it again. This would move the static NAT once the static NAT to policy in the order that they appear on the CLI format configuration and, therefore, static political NAT would work for the specified destination and addresses the static NAT for all other destination addresses.

  Hope I made any sense

  Feel free to ask more if necessary while

  -Jouni

• Site to Site with the subnets overlap

  Hi all

  Search for comfirmation on what is / is not possible. In short, we have a requirement of site but our local LAN varies from conflict. I am aware of how this get up and running with the help of a pool of IP addresses that is a basic ASA/IOS device can NAT behind but I wonder if it is possible to NAT behind a single IP address. NAT is also in place for the general internet traffic, but I hope that the image attached best describes our scenario.

  Any help / advice appreciated.

  Kind regards

  Martyn

  Hello

  You will need to do NAT on both ends to get the installation work.

  With these types of configurations, I more often just a 24 natted network to 24 another network on both sites.

  You can configure one of the sites use a PAT address towards the other end, but the other end must have protected by some sort of NAT static between the hosts unique or equal to 24 networks.

  If you would happen to configure both sites with a PAT translation, you couldn't really initiate connections between the site because no real host on networks 192.168.1.0/24 would have their own specific NAT IP to connect to.

  So in short

  • Both sites need NAT network
  • Use 1:1 NAT static is between host addresses or complete networks on both sites
    • The two sites could start the connection to any host on the remote end every single host has its own IP NAT staticly assigned address
  • Use of PAT for site and other NAT static 1:1 with the addresses of host or complete networks on the other site
    • Site with unique PAT IP address can connect to all hosts of remote sites, since they have staticly NAT IP addresses assigned.
    • Homepage is not able to connect to any host at his remote site that the remote site has only a PAT address facing their way.

  If you had 2 ASAs with 8.2 or UNDER software your static NAT configurations could be e.g.

  Basic information

  • Site1: 192.168.1.0/24
  • Site1 NAT: 10.10.1.0/24
  • Site2: 192.168.1.0/24
  • Site2 NAT: 10.10.2.0/24

  Static configuration NAT of policy site1

  permit L2L-VPN-POLICYNAT from the list of access ip 192.168.1.0 255.255.255.0 10.10.2.0 255.255.255.0

  public static (inside, outside) 10.10.1.0 - L2L-VPN-POLICYNAT access list

  Static configuration NAT of policy site2

  permit L2L-VPN-POLICYNAT from the list of access ip 192.168.1.0 255.255.255.0 10.10.1.0 255.255.255.0

  public static (inside, outside) 10.10.2.0 - L2L-VPN-POLICYNAT access list

  PAT configuration at each end

  permit L2L-VPN-POLICYPAT from the list of access ip 192.168.1.0 255.255.255.0 10.10.x.0 255.255.255.0

  Global 10.10.x.1 of xxx (outside)

  NAT (inside) xxx access-list L2L-VPN-POLICYPAT

  If you had 2 ASAs with 8.3 or above software your static NAT configurations could be for example (same information base)

  Static configuration NAT of policy site1
  

  the object of the LAN network

  subnet 192.168.1.0 255.255.255.0

  network of the LAN - NAT object

  10.10.1.0 subnet 255.255.255.0

  network of the REMOTE object

  255.255.255.0 subnet 10.10.2.0

  static (inside, outside) 1 static source LAN LAN - NAT static destination REMOTE

  Static configuration NAT of policy site2

  the object of the LAN network

  subnet 192.168.1.0 255.255.255.0

  network of the LAN - NAT object

  255.255.255.0 subnet 10.10.2.0

  network of the REMOTE object

  10.10.1.0 subnet 255.255.255.0

  static (inside, outside) 1 static source LAN LAN - NAT static destination REMOTE

  PAT configuration at each end

  the object of the LAN network

  subnet 192.168.1.0 255.255.255.0

  network of the LAN-PAT object

  Home 10.10.x.1

  network of the REMOTE object

  10.10.x.0 subnet 255.255.255.0

  static (inside, outside) 1 dynamic source LAN LAN-PAT destination static REMOTE

  -Jouni