VPN through NAT

Similar Questions

• Easy VPN through nat

  Is there a trick to allow users to connect to a vpn server easy through their router domestic (dlink with nat, IE).

  There must be a way with cisco. I know it's possible with other software I've used.

  Thank you

  Dan

  Yes, for an outgoing connection from your dlink vpn client, it should be ok.

  If you have configured on your dlink firewall, this is where you need to allow UDP/500 and UDP/4500 out.

• RA - VPN through NAT - T troubleshooting

  Hello

  Currently, my vpn works great from the outside to the router. The problem, I'm not sure why the traffic inside is not finding its way to the outside (VPNclient). I tried to add interesting traffic acl on my DynamicMap, the vpn client lock did not close, but there is a created isakmp QM_IDLE session and an IPSEC tunnel. I also tried to add a static route on all my local routers (for test only) 10.0.12.0 to my router vpn 10.0.0.188 network routing, only my network device can communicate with my VPN client host when I do this, but the hosts that are part of the network cannot communicate.

  I have attached config and debug outputs.

  Any suggestions?

  TIA,

  -Fred

  Hello

  Can u please no nat acl, lan internal as source and as destination pool vpn.

  Make sure that your gw router has a route to the pool of vpn.

  r/g

• Cisco ASA5520 facing ISP with private IP address. How to get the IPSec VPN through the internet?

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-marge-top : 0 ; mso-para-marge-droit : 0 ; mso-para-marge-bas : 10.0pt ; mso-para-marge-left : 0 ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ;}

  Hello guys,.

  I have Cisco ASA5520 facing the ISP with private IP address. We don't have a router and how to get the IPSec VPN through the internet?

  The question statement not the interface pointing to ISP isn't IP address private and inside as well.

  Firewall configuration:

  Firewall outside interface Gi0 10.0.1.2 > ISP 10.0.1.1 with security-level 0

  Firewall inside the interface Ethernet0 192.168.1.1 > LAN switch 192.168.1.2 with security-level 100

  I have public IP block 199.9.9.1/28

  How can I use the public IP address to create the IPSec VPN tunnel between two sites across the internet?

  can I assign a public IP address on the Gig1 inside the interface with the security level of 100 and how to apply inside to carry on this interface?

  If I configure > firewall inside of the item in gi1 interface ip address 199.9.9.1/28 with security-level 100. How to make a safe lane VPN through this interface on the internet?

  I'm used to the public IP address allocation to the interface outside of the firewall and private inside the interface IP address.

  Please help with configuration examples and advise.

  Thank you

  Eric

  Unfortunately, you can only complete the VPN connection on the interface the VPN connection source, in your case the external interface.

  3 options:

  (1) connect a router in front of the ASA and assign your public ip address to the ASA outside interface.

  OR /.

  (2) If your ISP can perform static translation of 1 to 1, then you can always finish the VPN on the external interface and ask your provider what is the static ip address assigned to your ASA out of the IP (10.0.1.2) - this will launch the VPN of bidirectionally

  OR /.

  (3) If your ISP performs PAT (dynamic NAT), then you can only start the tunnel VPN on the side of the ASA and the other end of the tunnel must be configured to allow VPN LAN-to-LAN dynamics.

• From AnyConnect VPN through an RDP Session

  Hello

  We have AnyConnect (ver. 3.1.01065) set up on our ASA5520 boxes. VPN works well from the office, but I also need the ability to establish a VPN connection through a RDP connection (i.e. I use RDP to connect to a PC that has installed AnyConnect, then try to establish a VPN connection).

  I downloaded the Cisco VPN profile editor, chaned the option to 'AllowRemoteUsers '. Then the relevant group policy profile applied. Connected PC (and not via RDP) VPN, so that it downloads the new profile and then disconnected again.

  However, I can't yet start VPN through an RDP connection. (Error is "the ability to set up VPN for remote desktop is disabled.) A VPN connection cannot be established.")

  I checked the file XML on the local PC to confirm the profile was downloaded (and is, and I do not see the option AllowRemoteUsers.)

  This has also happened with the previous AnyConnect version (3.0.xxxx).

  Local routing tables of the PC look good, and I don't see any conflicts that would cause the RDP session to drop.

  Also - if I connect the VPN, then RDP on the PC, the VPN and the RDP sessions work fine.

  Any ideas would be appreciated!

  Thank you

  Tony

  Hi Tony,.

  To do this both the ASA and the client must have the same XML profile.

  I just tested this with AC 3.1 and ASA 8.4 and it works beautifully.

  I included the XML file.

  * BTW, make sure that the profile is assigned to the appropriate group strategy.

  HTH.

  Portu.

  Please note all useful posts

• How to allow access to the external network of VPN through PPTP

  Hi guys, this is probably a simple one, but I have not much firewall experience so any help is appreciated.

  We would like to have the opportunity to connect to a private network virtual to a company, we have recently acquired.  When you connect to it directly from the Internet (not), it is accessible.  However, behind our firewall, there is no access.  We use Cisco ASA 8.2 (2)

  Currently, we have an entry as follows:

  PPTP tcp service object-group

  EQ pptp Port object

  inside_access_in list extended access permit tcp any host object_name object-group PPTP

  Please can anyone advise what else are required to complete what I'm not sure of what else is needed?  Basically, we want any device within our network in order to access the VPN through PPTP.

  Your help is appreciated

  Kind regards

  Hi Angelo,.

  It should work when you make a pptp permitted and inspected. But will also Appreciate ACL with your firewall to the PPTP server.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080094a5a.shtml#pptpwith

  The above documents helps you better understand.

  Please assess whether the information provided is useful.

  By

  Knockaert

• Making the NAT for VPN through L2L tunnel clients

  Hi.I has the following situation in my network. We need for users who log on our site with the VPN clients to connect to another site via a tunnel L2L. The problem is that I need NAT addresses from the pool of VPN client in another beach before going on the L2L tunnel because on the other side, we have duplication of networks.

  I tried to do NAT with little success as follows:

  ACL for pool NAT of VPN:

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.0.0 255.255.255.0

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.5.0 255.255.255.0

  NAT:

  Global 172.20.105.1 - 172.20.105.254 15 (outdoor)

  NAT (inside) 15 TEST access-list

  CRYPTO ACL:

  allowed ro access list extended LAN ip 255.255.0.0 192.168.0.0 255.255.255.0

  allowed ro access list extended LAN ip 255.255.0.0 192.168.5.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.0.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.5.0 255.255.255.0

  permit same-security-traffic intra-interface

  Am I missing something here? Something like this is possible at all?

  Thanks in advance for any help.

  We use the ASA 5510 with software version 8.0 (3) 6.

  You need nat to the outside, not the inside.

  NAT (outside) 15 TEST access-list

• PAT/NAT and VPN through a PIX

  "PPTP through the PIX with Port address translation (PAT) does not work because there is no concept of ports in GRE"-this is an excerpt from a config PIX version 6.2 and below.

  1. how this problem has been fixed in 6.3? GRE is encapsulated in udp or tcp to use ports to follow the connection?

  2. is it "fixup protocol esp-ike" use the same technology - the source port created by the IKE protocol? -ISAKMP cannot be enabled when you use this command

  3. What is "isakmp nat-traversal? How is this different from fixup protocol esp-ike"

  Thank you

  RJ

  1. when the PIX sees outgoing PPTP (TCP 1723 port) packets it now opens holes for them to return, as well as opening a hole for the GRE packets, it has never done this before. The PPTP TCP packets can be PAT would be fine because they are TCP packets. GRE packets, I believe, are followed by the id field only tunnel in the package.

  2. we use the source port of the ISAKMP packet for ESP packets as well. The current limitation is that if you have this option, you cannot use the PIX to close the IPSec sessions, so you can not turn on ISAKMP any interface. You can also have only a single IPSec client internal to use this feature.

  3 NAT - T is a new standard for IPSec to work through a NAT device peers, because they detect changes of address during the negotiation of tunnel and automatically encapsulate packets in UDP 4500. This market allows the PIX and the other device (if it supports it) to automatically detect a NAT/PAT device between them. This differs from the "esp - ike correction '' that the PIX ends not in fact the IPSec tunnel with esp - ike, but it is the endpoint in nat - t.

• Site to SIte VPN through a NAT device

  I have, I am having trouble running a vpn site-to site between two 3725 routers running c3725-advsecurityk9-mz124 - 15 T 1, that I hope I can get some help with, I am probably missing something here. The VPN ran very well when both VPN routers were connected directly to the internet and had on WAN interfaces public IP addresses, but I had to move one of the firewall inside on a private IP address. Installation is now as below

  Router VPN one (192.168.248.253) - internal company network - Fortigate FW - internet-(217.155.113.179) router VPN B

  The fortigate FW is doing some translations address
  -traffic between 192.168.248.253 and 217.155.113.179 has its source in 37.205.62.5
  -traffic between 217.155.113.179 and 37.205.62.5 has its destination translated to 192.168.248.253
  -Firewall rules allow all traffic between the 2 devices, no port locking enabled.

  -The 37.205.62.5 address is used by anything else.

  I basically have a GRE tunnel between two routers, and I'm trying to encrypt it.

  The router shows below

  Card crypto SERVER-RTR #show
  "S2S_VPN" 10 ipsec-isakmp crypto map
  Peer = 217.155.113.179
  Expand the access IP 101 list
  access-list 101 permit gre 192.168.248.253 host 217.155.113.179
  Current counterpart: 217.155.113.179
  Life safety association: 4608000 Kbytes / 3600 seconds
  PFS (Y/N): N
  Transform sets = {}
  STRONG,
  }
  Interfaces using crypto card S2S_VPN:
  FastEthernet0/1

  SERVER-RTR #show crypto sessio
  Current state of the session crypto

  Interface: FastEthernet0/1
  The session state: down
  Peer: 217.155.113.179 port 500
  FLOW IPSEC: allowed 47 192.168.248.253 host 217.155.113.179
  Active sAs: 0, origin: card crypto

  Interface: FastEthernet0/1
  The session state: IDLE-UP
  Peer: 217.155.113.179 port 4500
  IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 Active
  IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 inactive
  IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 inactive

  Router B shows below

  Card crypto BSU - RTR #show
  "S2S_VPN" 10 ipsec-isakmp crypto map
  Peer = 37.205.62.5
  Expand the access IP 101 list
  access-list 101 permit gre 217.155.113.179 host 37.205.62.5
  Current counterpart: 37.205.62.5
  Life safety association: 4608000 Kbytes / 3600 seconds
  PFS (Y/N): N
  Transform sets = {}
  STRONG,
  }
  Interfaces using crypto card S2S_VPN:
  FastEthernet0/1

  BSU - RTR #show sess crypto
  Current state of the session crypto

  Interface: FastEthernet0/1
  The session state: down
  Peer: 37.205.62.5 port 500
  FLOW IPSEC: allowed 47 217.155.113.179 host 37.205.62.5
  Active sAs: 0, origin: card crypto

  Interface: FastEthernet0/1
  The session state: IDLE-UP
  Peer: 37.205.62.5 port 4500
  IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 Active
  IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 inactive
  IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 inactive

  I can see counters incrementing on the ACL on both routers, so I don't know the traffic free WILL is interesting.

  Here are a few debugs too
  --------------
  Router

  Debug crypto ISAKMP

  * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node 940426884
  * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node 1837874301
  * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node-475409474
  * 23:07:20.794 Mar 2: ISAKMP (0:0): received 217.155.113.179 packet dport 500 sport 500 SA NEW Global (N)
  * 23:07:20.794 Mar 2: ISAKMP: created a struct peer 217.155.113.179, peer port 500
  * 23:07:20.794 Mar 2: ISAKMP: new position created post = 0x64960C04 peer_handle = 0x80000F0E
  * 23:07:20.794 Mar 2: ISAKMP: lock struct 0x64960C04, refcount 1 to peer crypto_isakmp_process_block
  * 23:07:20.794 Mar 2: ISAKMP: 500 local port, remote port 500
  * 23:07:20.794 Mar 2: ISAKMP: find a dup her to the tree during the isadb_insert his 6464D3F0 = call BVA
  * 23:07:20.794 Mar 2: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 23:07:20.794 Mar 2: ISAKMP: (0): former State = new State IKE_READY = IKE_R_MM1

  * 2 Mar 23:07:20.794: ISAKMP: (0): treatment ITS payload. Message ID = 0
  * 2 Mar 23:07:20.794: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.794: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T RFC 3947
  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 245
  * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T v7
  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 157
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v3
  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v2
  * 23:07:20.798 Mar 2: ISAKMP: (0): pair found pre-shared key matching 217.155.113.179
  * 2 Mar 23:07:20.798: ISAKMP: (0): pre-shared key local found
  * 23:07:20.798 Mar 2: ISAKMP: analysis of the profiles for xauth...
  * 23:07:20.798 Mar 2: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
  * 23:07:20.798 Mar 2: ISAKMP: DES-CBC encryption
  * 23:07:20.798 Mar 2: ISAKMP: SHA hash
  * 23:07:20.798 Mar 2: ISAKMP: default group 1
  * 23:07:20.798 Mar 2: ISAKMP: pre-shared key auth
  * 23:07:20.798 Mar 2: ISAKMP: type of life in seconds
  * 23:07:20.798 Mar 2: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
  * 23:07:20.798 Mar 2: ISAKMP: (0): atts are acceptable. Next payload is 0
  * 23:07:20.798 Mar 2: ISAKMP: (0): Acceptable atts: real life: 0
  * 23:07:20.798 Mar 2: ISAKMP: (0): Acceptable atts:life: 0
  * 23:07:20.798 Mar 2: ISAKMP: (0): fill atts in his vpi_length:4
  * 23:07:20.798 Mar 2: ISAKMP: (0): fill atts in his life_in_seconds:86400
  * 23:07:20.798 Mar 2: ISAKMP: (0): return real life: 86400
  * 23:07:20.798 Mar 2: ISAKMP: (0): timer life Started: 86400.

  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T RFC 3947
  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 245
  * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T v7
  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 157
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v3
  * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
  * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v2
  * 23:07:20.798 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  * 23:07:20.798 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM1

  * 2 Mar 23:07:20.802: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
  * 2 Mar 23:07:20.802: ISAKMP: (0): lot of 217.155.113.179 sending my_port 500 peer_port 500 (R) MM_SA_SETUP
  * 23:07:20.802 Mar 2: ISAKMP: (0): sending a packet IPv4 IKE.
  * 23:07:20.802 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  * 23:07:20.802 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM2

  * 23:07:20.822 Mar 2: ISAKMP (0:0): received 217.155.113.179 packet 500 Global 500 (R) sport dport MM_SA_SETUP
  * 23:07:20.822 Mar 2: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 23:07:20.822 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM2 = IKE_R_MM3

  * 2 Mar 23:07:20.822: ISAKMP: (0): processing KE payload. Message ID = 0
  * 2 Mar 23:07:20.850: ISAKMP: (0): processing NONCE payload. Message ID = 0
  * 23:07:20.854 Mar 2: ISAKMP: (0): pair found pre-shared key matching 217.155.113.179
  * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
  * 2 Mar 23:07:20.854: ISAKMP: (1027): provider ID is the unit
  * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
  * 2 Mar 23:07:20.854: ISAKMP: (1027): provider ID is DPD
  * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
  * 2 Mar 23:07:20.854: ISAKMP: (1027): addressing another box of IOS!
  * 23:07:20.854 Mar 2: ISAKMP: receives the payload type 20
  * 23:07:20.854 Mar 2: ISAKMP (0:1027): NAT found, the node inside the NAT
  * 23:07:20.854 Mar 2: ISAKMP: receives the payload type 20
  * 23:07:20.854 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  * 23:07:20.854 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM3 = IKE_R_MM3

  * 2 Mar 23:07:20.854: ISAKMP: (1027): lot of 217.155.113.179 sending my_port 500 peer_port 500 (R) MM_KEY_EXCH
  * 23:07:20.854 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
  * 23:07:20.858 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  * 23:07:20.858 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM3 = IKE_R_MM4

  * 23:07:20.898 Mar 2: ISAKMP: (1024): serving SA., his is 64D5723C, delme is 64D5723C
  * 23:07:20.902 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) MM_KEY_EXCH sport
  * 23:07:20.902 Mar 2: ISAKMP: (1027): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 23:07:20.902 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM4 = IKE_R_MM5

  * 2 Mar 23:07:20.902: ISAKMP: (1027): payload ID for treatment. Message ID = 0
  * 23:07:20.902 Mar 2: ISAKMP (0:1027): payload ID
  next payload: 8
  type: 1
  address: 217.155.113.179
  Protocol: 17
  Port: 0
  Length: 12
  * 2 Mar 23:07:20.902: ISAKMP: (0): peer games * no * profiles
  * 2 Mar 23:07:20.906: ISAKMP: (1027): HASH payload processing. Message ID = 0
  * 2 Mar 23:07:20.906: ISAKMP: (1027): treatment protocol NOTIFIER INITIAL_CONTACT 1
  SPI 0, message ID = 0, a = 6464D3F0
  * 23:07:20.906 Mar 2: ISAKMP: (1027): SA authentication status:
  authenticated
  * 23:07:20.906 Mar 2: ISAKMP: (1027): SA has been authenticated with 217.155.113.179
  * 23:07:20.906 Mar 2: ISAKMP: (1027): port detected floating port = 4500
  * 23:07:20.906 Mar 2: ISAKMP: try to find found and existing peer 192.168.248.253/217.155.113.179/4500/ peer 648EAD00 to reuse existing, free 64960 04
  * 23:07:20.906 Mar 2: ISAKMP: Unlocking counterpart struct 0x64960C04 Reuse existing peer count 0
  * 23:07:20.906 Mar 2: ISAKMP: delete peer node by peer_reap for 217.155.113.179: 64960 04
  * 23:07:20.906 Mar 2: ISAKMP: lock struct 0x648EAD00, refcount 2 for peer peer reuse existing
  * 23:07:20.906 Mar 2: ISAKMP: (1027): SA authentication status:
  authenticated
  * 2 Mar 23:07:20.906: ISAKMP: (1027): process of first contact.
  lowering existing phase 1 and 2 with local 192.168.248.253 217.155.113.179 remote remote port 4500
  * 23:07:20.906 Mar 2: ISAKMP: (1026): received first contact, delete SA
  * 23:07:20.906 Mar 2: ISAKMP: (1026): peer does not paranoid KeepAlive.

  * 23:07:20.906 Mar 2: ISAKMP: (1026): deletion of 'Initial of receive Contact' State HIS reason (R) QM_IDLE (post 217.155.113.179)
  * 23:07:20.906 Mar 2: ISAKMP: (0): cannot decrement IKE Call Admission Control incoming_active stat because he's already 0.
  * 23:07:20.906 Mar 2: ISAKMP: (1027): UDP ENC parameter counterpart struct 0x0 his = 0x6464D3F0
  * 23:07:20.906 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  * 23:07:20.906 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM5 = IKE_R_MM5

  * 23:07:20.910 Mar 2: ISAKMP: node set-98987637 to QM_IDLE
  * 2 Mar 23:07:20.910: ISAKMP: (1026): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
  * 23:07:20.910 Mar 2: ISAKMP: (1026): sending a packet IPv4 IKE.
  * 23:07:20.910 Mar 2: ISAKMP: (1026): purge the node-98987637
  * 23:07:20.910 Mar 2: ISAKMP: (1026): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
  * 23:07:20.910 Mar 2: ISAKMP: (1026): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

  * 23:07:20.910 Mar 2: ISAKMP: (1027): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
  * 23:07:20.910 Mar 2: ISAKMP (0:1027): payload ID
  next payload: 8
  type: 1
  address: 192.168.248.253
  Protocol: 17
  Port: 0
  Length: 12
  * 23:07:20.910 Mar 2: ISAKMP: (1027): the total payload length: 12
  * 2 Mar 23:07:20.914: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) MM_KEY_EXCH
  * 23:07:20.914 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
  * 23:07:20.914 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  * 23:07:20.914 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

  * 23:07:20.914 Mar 2: ISAKMP: (1026): deletion of 'Initial of receive Contact' State HIS reason (R) QM_IDLE (post 217.155.113.179)
  * 23:07:20.914 Mar 2: ISAKMP: Unlocking counterpart struct 0x648EAD00 for isadb_mark_sa_deleted(), count 1
  * 23:07:20.914 Mar 2: ISAKMP: (1026): error suppression node 334747020 FALSE reason 'IKE deleted.
  * 23:07:20.914 Mar 2: ISAKMP: (1026): node-1580729900 error suppression FALSE reason 'IKE deleted.
  * 23:07:20.914 Mar 2: ISAKMP: (1026): node-893929227 error suppression FALSE reason 'IKE deleted.
  * 23:07:20.914 Mar 2: ISAKMP: (1026): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 23:07:20.914 Mar 2: ISAKMP: (1026): former State = new State IKE_DEST_SA = IKE_DEST_SA

  * 23:07:20.914 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
  * 23:07:20.914 Mar 2: ISAKMP: (1027): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  * 23:07:20.930 Mar 2: ISAKMP (0:1026): received 217.155.113.179 packet dport 4500 4500 Global (R) MM_NO_STATE sport
  * 23:07:20.934 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) QM_IDLE sport
  * 23:07:20.934 Mar 2: ISAKMP: node set 1860263019 to QM_IDLE
  * 2 Mar 23:07:20.934: ISAKMP: (1027): HASH payload processing. Message ID = 1860263019
  * 2 Mar 23:07:20.934: ISAKMP: (1027): treatment ITS payload. Message ID = 1860263019
  * 23:07:20.934 Mar 2: ISAKMP: (1027): proposal of IPSec checking 1
  * 23:07:20.934 Mar 2: ISAKMP: turn 1, ESP_AES
  * 23:07:20.934 Mar 2: ISAKMP: attributes of transformation:
  * 23:07:20.934 Mar 2: ISAKMP: program is 3 (Tunnel-UDP)
  * 23:07:20.934 Mar 2: ISAKMP: type of life in seconds
  * 23:07:20.934 Mar 2: ISAKMP: life of HIS (basic) 3600
  * 23:07:20.934 Mar 2: ISAKMP: type of life in kilobytes
  * 23:07:20.934 Mar 2: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
  * 23:07:20.934 Mar 2: ISAKMP: key length is 128
  * 23:07:20.934 Mar 2: ISAKMP: (1027): atts are acceptable.
  * 2 Mar 23:07:20.934: ISAKMP: (1027): IPSec policy invalidated proposal with error 32
  * 2 Mar 23:07:20.934: ISAKMP: (1027): politics of ITS phase 2 is not acceptable! (local 192.168.248.253 remote 217.155.113.179)
  * 23:07:20.938 Mar 2: ISAKMP: node set 1961554007 to QM_IDLE
  * 23:07:20.938 Mar 2: ISAKMP: (1027): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
  SPI 1688526152, message ID = 1961554007
  * 2 Mar 23:07:20.938: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
  * 23:07:20.938 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
  * 23:07:20.938 Mar 2: ISAKMP: (1027): purge the node 1961554007
  * 23:07:20.938 Mar 2: ISAKMP: (1027): error suppression node 1860263019 REAL reason "QM rejected."
  * 23:07:20.938 Mar 2: ISAKMP: (1027): entrance, node 1860263019 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  * 23:07:20.938 Mar 2: ISAKMP: (1027): former State = new State IKE_QM_READY = IKE_QM_READY
  * 23:07:24.510 Mar 2: ISAKMP: set new node 0 to QM_IDLE
  * 2 Mar 23:07:24.510: ITS a exceptional applications (100.100.213.56 local port 4500, 100.100.213.84 remote port 4500)
  * 2 Mar 23:07:24.510: ISAKMP: (1027): sitting IDLE. From QM immediately (QM_IDLE)
  * 23:07:24.510 Mar 2: ISAKMP: (1027): start Quick Mode Exchange, M - ID 670698820
  * 23:07:24.510 Mar 2: ISAKMP: (1027): initiator QM gets spi
  * 2 Mar 23:07:24.510: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
  * 23:07:24.510 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
  * 23:07:24.514 Mar 2: ISAKMP: (1027): entrance, node 670698820 = IKE_MESG_INTERNAL, IKE_INIT_QM
  * 23:07:24.514 Mar 2: ISAKMP: (1027): former State = new State IKE_QM_READY = IKE_QM_I_QM1
  * 23:07:24.530 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) QM_IDLE sport
  * 23:07:24.534 Mar 2: ISAKMP: node set 1318257670 to QM_IDLE
  * 2 Mar 23:07:24.534: ISAKMP: (1027): HASH payload processing. Message ID = 1318257670
  * 2 Mar 23:07:24.534: ISAKMP: (1027): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
  SPI 3268378219, message ID = 1318257670, a = 6464D3F0
  * 2 Mar 23:07:24.534: ISAKMP: (1027): removal of spi 3268378219 message ID = 670698820
  * 23:07:24.534 Mar 2: ISAKMP: (1027): node 670698820 REAL reason error suppression "remove larval.
  * 23:07:24.534 Mar 2: ISAKMP: (1027): error suppression node 1318257670 FALSE reason 'informational (en) State 1.
  * 23:07:24.534 Mar 2: ISAKMP: (1027): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
  * 23:07:24.534 Mar 2: ISAKMP: (1027): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-238086324
  * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-1899972726
  * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-321906720

  Router B
  ----------
  Debug crypto ISAKMP

  1d23h: ISAKMP: (0): profile of THE request is (NULL)
  1d23h: ISAKMP: created a struct peer 37.205.62.5, peer port 500
  1d23h: ISAKMP: new position created post = 0x652C3B54 peer_handle = 0x80000D8C
  1d23h: ISAKMP: lock struct 0x652C3B54, refcount 1 to peer isakmp_initiator
  1d23h: ISAKMP: 500 local port, remote port 500
  1d23h: ISAKMP: set new node 0 to QM_IDLE
  1d23h: ISAKMP: find a dup her to the tree during the isadb_insert his 652CBDC4 = call BVA
  1d23h: ISAKMP: (0): cannot start aggressive mode, try the main mode.
  1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
  1d23h: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
  1d23h: ISAKMP: (0): built the seller-07 ID NAT - t
  1d23h: ISAKMP: (0): built of NAT - T of the seller-03 ID
  1d23h: ISAKMP: (0): built the seller-02 ID NAT - t
  1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
  1d23h: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

  1d23h: ISAKMP: (0): Beginner Main Mode Exchange
  1d23h: ISAKMP: (0): lot of 37.205.62.5 sending my_port 500 peer_port 500 (I) MM_NO_STATE
  1d23h: ISAKMP: (0): sending a packet IPv4 IKE.
  1d23h: ISAKMP (0:0): received 37.205.62.5 packet dport 500 sport Global 500 (I) MM_NO_STATE
  1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  1d23h: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

  1d23h: ISAKMP: (0): treatment ITS payload. Message ID = 0
  1d23h: ISAKMP: (0): load useful vendor id of treatment
  1d23h: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  1d23h: ISAKMP (0:0): provider ID is NAT - T RFC 3947
  1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
  1d23h: ISAKMP: (0): pre-shared key local found
  1d23h: ISAKMP: analysis of the profiles for xauth...
  1d23h: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
  1d23h: ISAKMP: DES-CBC encryption
  1d23h: ISAKMP: SHA hash
  1d23h: ISAKMP: default group 1
  1d23h: ISAKMP: pre-shared key auth
  1d23h: ISAKMP: type of life in seconds
  1d23h: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
  1d23h: ISAKMP: (0): atts are acceptable. Next payload is 0
  1d23h: ISAKMP: (0): Acceptable atts: real life: 0
  1d23h: ISAKMP: (0): Acceptable atts:life: 0
  1d23h: ISAKMP: (0): fill atts in his vpi_length:4
  1d23h: ISAKMP: (0): fill atts in his life_in_seconds:86400
  1d23h: ISAKMP: (0): return real life: 86400
  1d23h: ISAKMP: (0): timer life Started: 86400.

  1d23h: ISAKMP: (0): load useful vendor id of treatment
  1d23h: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  1d23h: ISAKMP (0:0): provider ID is NAT - T RFC 3947
  1d23h: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  1d23h: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

  1d23h: ISAKMP: (0): lot of 37.205.62.5 sending my_port 500 peer_port 500 (I) MM_SA_SETUP
  1d23h: ISAKMP: (0): sending a packet IPv4 IKE.
  1d23h: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  1d23h: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

  1d23h: ISAKMP (0:0): received 37.205.62.5 packet dport 500 sport Global 500 (I) MM_SA_SETUP
  1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  1d23h: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

  1d23h: ISAKMP: (0): processing KE payload. Message ID = 0
  1d23h: ISAKMP: (0): processing NONCE payload. Message ID = 0
  1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
  1d23h: ISAKMP: (1034): load useful vendor id of treatment
  1d23h: ISAKMP: (1034): provider ID is the unit
  1d23h: ISAKMP: (1034): load useful vendor id of treatment
  1d23h: ISAKMP: (1034): provider ID is DPD
  1d23h: ISAKMP: (1034): load useful vendor id of treatment
  1d23h: ISAKMP: (1034): addressing another box of IOS!
  1d23h: ISAKMP: receives the payload type 20
  1d23h: ISAKMP: receives the payload type 20
  1d23h: ISAKMP (0:1034): NAT found, the node outside NAT
  1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  1d23h: ISAKMP: (1034): former State = new State IKE_I_MM4 = IKE_I_MM4

  1d23h: ISAKMP: (1034): send initial contact
  1d23h: ISAKMP: (1034): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
  1d23h: ISAKMP (0:1034): payload ID
  next payload: 8
  type: 1
  address: 217.155.113.179
  Protocol: 17
  Port: 0
  Length: 12
  1d23h: ISAKMP: (1034): the total payload length: 12
  1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) MM_KEY_EXCH
  1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
  1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  1d23h: ISAKMP: (1034): former State = new State IKE_I_MM4 = IKE_I_MM5

  1d23h: ISAKMP: (1031): serving SA., his is 652D60C8, delme is 652D60C8
  1d23h: ISAKMP (0:1033): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
  1d23h: ISAKMP: node set 33481563 to QM_IDLE
  1d23h: ISAKMP: (1033): HASH payload processing. Message ID = 33481563
  1d23h: ISAKMP: receives the payload type 18
  1d23h: ISAKMP: (1033): treatment remove with load useful reason
  1d23h: ISAKMP: (1033): remove the doi = 1
  1d23h: ISAKMP: (1033): remove Protocol id = 1
  1d23h: ISAKMP: (1033): remove spi_size = 16
  1d23h: ISAKMP: (1033): remove the spis num = 1
  1d23h: ISAKMP: (1033): delete_reason = 11
  1d23h: ISAKMP: (1033): load DELETE_WITH_REASON, processing of message ID = 33481563, reason: Unknown delete reason!
  1d23h: ISAKMP: (1033): peer does not paranoid KeepAlive.

  1d23h: ISAKMP: (1033): deletion of 'Initial of receive Contact' State HIS reason (I) QM_IDLE (post 37.205.62.5)
  1d23h: ISAKMP: (1033): error suppression node 33481563 FALSE reason 'informational (en) State 1.
  1d23h: ISAKMP: node set 1618266182 to QM_IDLE
  1d23h: ISAKMP: (1033): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
  1d23h: ISAKMP: (1033): sending a packet IPv4 IKE.
  1d23h: ISAKMP: (1033): purge the node 1618266182
  1d23h: ISAKMP: (1033): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
  1d23h: ISAKMP: (1033): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

  1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) MM_KEY_EXCH
  1d23h: ISAKMP: (1034): payload ID for treatment. Message ID = 0
  1d23h: ISAKMP (0:1034): payload ID
  next payload: 8
  type: 1
  address: 192.168.248.253
  Protocol: 17
  Port: 0
  Length: 12
  1d23h: ISAKMP: (0): peer games * no * profiles
  1d23h: ISAKMP: (1034): HASH payload processing. Message ID = 0
  1d23h: ISAKMP: (1034): SA authentication status:
  authenticated
  1d23h: ISAKMP: (1034): SA has been authenticated with 37.205.62.5
  1d23h: ISAKMP: try to insert a 217.155.113.179/37.205.62.5/4500/ peer and found existing in a 643BCA10 to reuse, free 652C3B54
  1d23h: ISAKMP: Unlocking counterpart struct 0x652C3B54 Reuse existing peer count 0
  1d23h: ISAKMP: delete peer node by peer_reap for 37.205.62.5: 652C3B54
  1d23h: ISAKMP: lock struct 0x643BCA10, refcount 2 for peer peer reuse existing
  1d23h: ISAKMP: (1034): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  1d23h: ISAKMP: (1034): former State = new State IKE_I_MM5 = IKE_I_MM6

  1d23h: ISAKMP: (1033): deletion of 'Initial of receive Contact' State HIS reason (I) QM_IDLE (post 37.205.62.5)
  1d23h: ISAKMP: (0): cannot decrement IKE Call Admission Control outgoing_active stat because he's already 0.
  1d23h: ISAKMP: Unlocking counterpart struct 0x643BCA10 for isadb_mark_sa_deleted(), count 1
  1d23h: ISAKMP: (1033): error suppression node 1267924911 FALSE reason 'IKE deleted.
  1d23h: ISAKMP: (1033): error suppression node 1074093103 FALSE reason 'IKE deleted.
  1d23h: ISAKMP: (1033): node-183194519 error suppression FALSE reason 'IKE deleted.
  1d23h: ISAKMP: (1033): error suppression node 33481563 FALSE reason 'IKE deleted.
  1d23h: ISAKMP: (1033): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  1d23h: ISAKMP: (1033): former State = new State IKE_DEST_SA = IKE_DEST_SA

  1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  1d23h: ISAKMP: (1034): former State = new State IKE_I_MM6 = IKE_I_MM6

  1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  1d23h: ISAKMP: (1034): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

  1d23h: ISAKMP: (1034): start Quick Mode Exchange, M - ID 1297417008
  1d23h: ISAKMP: (1034): initiator QM gets spi
  1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
  1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
  1d23h: ISAKMP: (1034): entrance, node 1297417008 = IKE_MESG_INTERNAL, IKE_INIT_QM
  1d23h: ISAKMP: (1034): former State = new State IKE_QM_READY = IKE_QM_I_QM1
  1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
  1d23h: ISAKMP: (1034): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
  1d23h: ISAKMP: node set-874376893 to QM_IDLE
  1d23h: ISAKMP: (1034): HASH payload processing. Message ID =-874376893
  1d23h: ISAKMP: (1034): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
  SPI 56853244, message ID =-874376893, his 652CBDC4 =
  1d23h: ISAKMP: (1034): removal of spi 56853244 message ID = 1297417008
  1d23h: ISAKMP: (1034): node 1297417008 REAL reason error suppression "remove larval.
  1d23h: ISAKMP: (1034): node-874376893 error suppression FALSE reason 'informational (en) State 1.
  1d23h: ISAKMP: (1034): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
  1d23h: ISAKMP: (1034): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
  1d23h: ISAKMP: node set 439453045 to QM_IDLE
  1d23h: ISAKMP: (1034): HASH payload processing. Message ID = 439453045
  1d23h: ISAKMP: (1034): treatment ITS payload. Message ID = 439453045
  1d23h: ISAKMP: (1034): proposal of IPSec checking 1
  1d23h: ISAKMP: turn 1, ESP_AES
  1d23h: ISAKMP: attributes of transformation:
  1d23h: ISAKMP: program is 3 (Tunnel-UDP)
  1d23h: ISAKMP: type of life in seconds
  1d23h: ISAKMP: life of HIS (basic) 3600
  1d23h: ISAKMP: type of life in kilobytes
  1d23h: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
  1d23h: ISAKMP: key length is 128
  1d23h: ISAKMP: (1034): atts are acceptable.
  1d23h: ISAKMP: (1034): IPSec policy invalidated proposal with error 32
  1d23h: ISAKMP: (1034): politics of ITS phase 2 is not acceptable! (local 217.155.113.179 remote 37.205.62.5)
  1d23h: ISAKMP: node set 1494356901 to QM_IDLE
  1d23h: ISAKMP: (1034): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
  SPI 1687353736, message ID = 1494356901
  1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
  1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
  1d23h: ISAKMP: (1034): purge the node 1494356901
  1d23h: ISAKMP: (1034): error suppression node 439453045 REAL reason "QM rejected."
  1d23h: ISAKMP: (1034): entrance, node 439453045 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  1d23h: ISAKMP: (1034): former State = new State IKE_QM_READY = IKE_QM_READY
  1d23h: ISAKMP: (1032): purge the node 1513722556
  1d23h: ISAKMP: (1032): purge the node-643121396
  1d23h: ISAKMP: (1032): purge the node 1350014243
  1d23h: ISAKMP: (1032): purge the node 83247347

  Hi Nav,

  I'm happy it's working now. Your interpretation is correct. Transport mode IPSEC encrypts the payload, while tunnel mode figure the whole ip packet (original header / payload) and inserts a new ip header. Thus, the tunnel mode is used for ipsec site to site VPN and transport is used for point to point VPN ipsec. GRE is used with ipsec, all packages will be encapsulated with a GRE header first, so, essentially, this is a point to point VPN ipsec.

  The problem that you are having with tunnel mode, the router's package is going to be wrapped with the header 192.168.248.253 GRE source 217.155.113.179 destination. The whole package is then encrypted and a new header is added with the same source/destination. This new header will be coordinated by the FW, but not incorporated or encrypted GRE header. When the packet arrives at Router B, after decrypt them the package, router B will see the GRE header, which is different from that of source/destination tunnel she uses. This breaks the GRE tunnel and the routing between router A and router B Protocol.

  HTH,

  Lei Tian

• Obtain the Cisco VPN to work through NAT (guest OS Windows xp)

  Dear experts,

  For some strange reason I got this job, updated for VMware player 3 and now it doesn't work anymore. I downgraded VMware player 2.5.1 version again, but no dice.

  For intimate them with this VPN, I can enter my username and password, but then nothing happens when it begins to negotiate secure channel.

  I'm stuck now essentially.

  Any help is greatly appreciated!

  See you soon,.

  Jeroen

  I have no success on this. You can try to upgrade your cisco client. Check the following KB: http://kb.vmware.com/kb/1445

  Marcelo Soares

  VMWare Certified Professional 310/410

  Master virtualization technology

  Globant Argentina

  Review the allocation of points for "useful" or "right" answers.

• Split of static traffic between the VPN and NAT

  Hi all

  We have a VPN from Site to Site that secures all traffic to and from 10.160.8.0/24 to/from 10.0.0.0/8.  It's for everything - including Internet traffic.  However, there is one exception (of course)...

  The part that I can't make it work is if traffic comes from the VPN (10.0.0.0/8) of 10.160.8.5 (on 80 or 443), then the return traffic must go back through the VPN.  BUT, if traffic 80 or 443 comes from anywhere else (Internet via X.X.X.X which translates to 10.160.8.5), so there need to be translated réécrirait Internet via Gig2.

  I have the following Setup (tried to have just the neccessarry lines)...

  interface GigabitEthernet2

  address IP Y.Y.Y.Y 255.255.255.0! the X.X.X.X and Y.Y.Y.Y are in the same subnet

  address IP X.X.X.X 255.255.255.0 secondary

  NAT outside IP

  card crypto ipsec-map-S2S

  interface GigabitEthernet4.2020

  Description 2020

  encapsulation dot1Q 2020

  IP 10.160.8.1 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  IP nat inside source list interface NAT-output GigabitEthernet2 overload

  IP nat inside source static tcp 10.160.8.5 80 80 X.X.X.X map route No. - NAT extensible

  IP nat inside source static tcp 10.160.8.5 443 443 X.X.X.X map route No. - NAT extensible

  NAT-outgoing extended IP access list

  refuse 10.160.8.5 tcp host 10.0.0.0 0.0.0.255 eq www

  refuse 10.160.8.5 tcp host 10.0.0.0 0.0.0.255 eq 443

  permit tcp host 10.160.8.5 all eq www

  permit tcp host 10.160.8.5 any eq 443

  No. - NAT extended IP access list

  refuse 10.160.8.5 tcp host 10.0.0.0 0.0.0.255 eq www

  refuse 10.160.8.5 tcp host 10.0.0.0 0.0.0.255 eq 443

  allow an ip

  route No. - NAT allowed 10 map

  corresponds to the IP no. - NAT

  With the above configuration, we can get to the Internet 10.160.8.5, but cannot cross it over the VPN tunnel (from 10.200.0.0/16).  If I remove the two commands «ip nat inside source static...» ', then the opposite that happens - I can get then to 10.160.8.5 it VPN tunnel but I now can't get to it from the Internet.

  How can I get both?  It seems that when I hit the first NAT instruction (overload Gig2) that 'decline' in the list of ACL-NAT-outgoing punts me out of this statement of NAT.  It can process the following statement of NAT (one of the 'ip nat inside source static... ") but does not seem to"deny"it in the NON - NAT ACL me punt out of this statement of NAT.  That's my theory anyway (maybe something is happening?)

  If this work like that or I understand something correctly?  It's on a router Cisco's Cloud Services (CSR 1000v).

  Thank you!

  Your netmask is bad for your 10.0.0.0/8. I worry not about the port/protocol or since that can screw you up. A better way to do it would be to deny all IP vpn traffic.

  NAT-outgoing extended IP access list

  deny ip 10.160.8.0 0.0.0.0.255 10.0.0.0 0.255.255.255

  ...

  No. - NAT extended IP access list

  deny ip 10.160.8.0 0.0.0.0.255 10.0.0.0 0.255.255.255

  allow an ip

  Doc:

  Router to router IPSec with NAT and Cisco Secure VPN Client overload

  Thank you

  Brendan

• SSL vpn through the same internet connection to another site

  Hi, I have a network with a box of Juniper SSL that connect to port DMZ ASA5510, wher outside the ASA is the same outside the box of SSL vpn.

  To access issues eno hav network internal at all.

  Now, I need VPN SSL Juniper box remote users and internal conenct o my remote sites, who take the client connection through an internet router (Cisco throug site to site vpn IPSec) again to the th eremote site.

  Is it possible, my hunch is Yes "can be done."

  Currently, I'm fitting get no where, I get no hits ASA DMZ ACL if I try to access the remote site of the SSL vpn client resources.

  Schema attached

  Any help would be appreciated

  Shouldn't be a problem.

  On the Juniper SSL, you must check if the roads has been added to the remote IPSec LAN point to the ip address DMZ ASA instead of pointing to the internet through the Juniper SSL box.

  You need to configure NAT exemption on the ASA box between the pool SSL subnet to the Remote LAN of IPSec. As a result, you must also include the SSL subnet to Remote LAN subnets in the crypto ACL and mirror image ACL on the remote site ACL Cryptography.

  Hope that helps.

• IOS VPN with NAT need help with ACL?

  What I forget? I have tried other positions, studied bugs known with 12.2 (13) T1, etc. workaround solutions, but perhaps my other choice of configuration interfere with my VPN configuration.

  I can connect, authenticate locally, very well. Stats of Cisco VPN client 3.6.3 show I'm Encrypting traffic on the protected networks, but I can not all traffic through internal hosts once I've connected.

  I removed security tags and replaced all the public IP addresses to fake in hope that someone can point me to what is obvious!

  Thank you very much.

  ----------

  Current configuration: 5508 bytes

  !

  ! 22:24:38 PST configuration was last modified Thursday February 20, 2003 by kevin

  !

  version 12.2

  horodateurs service debug uptime

  Log service timestamps uptime

  encryption password service

  !

  AAA new-model

  !

  AAA authentication login userauthen local

  AAA authorization groupauthor LAN

  AAA - the id of the joint session

  IP subnet zero

  !

  IP domain name mondomaine.fr

  name of the IP-server 199.13.28.12

  name of the IP-server 199.13.29.12

  !

  IP inspect the audit trail

  IP inspect high 1100 max-incomplete

  IP inspect a high minute 1100

  inspect the tcp IP Ethernet_0_1 name

  inspect the IP udp Ethernet_0_1 name

  inspect the IP name Ethernet_0_1 cuseeme

  inspect the IP name Ethernet_0_1 ftp

  inspect the IP h323 Ethernet_0_1 name

  inspect the IP rcmd Ethernet_0_1 name

  inspect the IP name Ethernet_0_1 realaudio

  inspect the IP name smtp Ethernet_0_1

  inspect the name Ethernet_0_1 streamworks IP

  inspect the name Ethernet_0_1 vdolive IP

  inspect the IP name Ethernet_0_1 sqlnet

  inspect the name Ethernet_0_1 tftp IP

  inspect the IP name Ethernet_0_1 http java-list 99

  inspect the name Ethernet_0_1 rtsp IP

  inspect the IP name Ethernet_0_1 netshow

  inspect the tcp IP Ethernet_0_0 name

  inspect the IP name Ethernet_0_0 ftp

  inspect the IP udp Ethernet_0_0 name

  audit of IP notify Journal

  Max-events of po verification IP 100

  !

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto nat keepalive 20

  !

  ISAKMP crypto client configuration group vpngroup

  xxxxxxxxx key

  DNS 199.13.28.12 199.13.29.12

  domain mydomain.com

  pool vpnpool

  ACL 110

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  !

  !

  map clientmap client to authenticate crypto list userauthen

  card crypto clientmap isakmp authorization list groupauthor

  client configuration address map clientmap crypto answer

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  !

  MTA receive maximum-recipients 0

  !

  !

  interface Ethernet0/0

  Description connected to the Internet

  IP 199.201.44.198 255.255.255.248

  IP access-group 101 in

  NAT outside IP

  inspect the IP Ethernet_0_0 in

  no ip route cache

  no ip mroute-cache

  Half duplex

  clientmap card crypto

  !

  interface Serial0/0

  no ip address

  Shutdown

  !

  interface Ethernet0/1

  Connected to the private description

  IP 192.168.1.254 255.255.255.0

  IP access-group 100 to

  IP nat inside

  inspect the IP Ethernet_0_1 in

  Half duplex

  !

  IP local pool vpnpool 192.168.2.201 192.168.2.210

  period of translation nat IP 119

  !!

  !! -removed the following line for VPN configuration

  !! IP nat inside source list 1 interface Ethernet0/0 overload

  !! -replaced by the next line...

  IP nat inside source map route sheep interface Ethernet0/0 overload

  IP nat inside source 192.168.1.1 static 199.201.44.197

  IP classless

  IP route 0.0.0.0 0.0.0.0 199.201.44.193 permanent

  IP http server

  7 class IP http access

  local IP http authentication

  !

  access-list 1 permit 192.168.1.0 0.0.0.255

  access-list 5 permit 192.5.41.40

  access-list 5 permit 192.5.41.41

  access-list 5 refuse any

  access-list 7 permit 192.168.1.0 0.0.0.255

  access-list 7 refuse any

  access-list 99 refuse any

  access-list 100 permit udp any eq rip all rip eq

  access-list 100 permit tcp 192.168.1.1 host any eq www

  access-list 100 permit ip 192.168.1.1 host everything

  access list 100 permit tcp host 192.168.1.2 any eq www

  access-list 100 permit ip 192.168.1.2 host everything

  access-list 100 deny ip 192.168.1.253 host everything

  access ip-list 100 permit a whole

  access-list 101 deny host ip 199.201.44.197 all

  access-list 101 permit tcp any host 199.201.44.197 eq 22

  access-list 101 permit tcp any host 199.201.44.197 eq www

  access-list 101 permit tcp any host 199.201.44.197 eq 115

  access-list 101 permit icmp any host 199.201.44.197

  access list 101 ip allow any host 199.201.44.198

  access-list 101 permit tcp any host 199.201.44.197 eq 8000

  access-list 101 permit tcp any host 199.201.44.197 eq 8080

  access-list 101 permit tcp any host 199.201.44.197 eq 9090

  access-list 101 permit udp any host 199.201.44.197 eq 7070

  access-list 101 permit udp any host 199.201.44.197 eq 554

  access-list 110 permit ip 192.168.1.0 0.0.0.255 any

  access-list 115 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

  access-list 115 permit ip 192.168.1.0 0.0.0.255 any

  !

  sheep allowed 10 route map

  corresponds to the IP 115

  !

  Line con 0

  exec-timeout 0 0

  password 7 XXXXXXXXXXXXXXX

  line to 0

  line vty 0 4

  password 7 XXXXXXXXXXXXXXXX

  !

  NTP-period clock 17208655

  source NTP Ethernet0/0

  peer NTP access-Group 5

  NTP 7 use only group-access

  NTP master 3

  NTP 192.5.41.41 Server

  NTP 192.5.41.40 Server

  !

  end

  ----------

  Config looks OK, you should be able to get for each internal host EXCEPT 192.168.1.1 with this configuration. If you do a ' sho cry ipsec his 'you see Pkts Decaps increment, indicating that you see the traffic of the remote client? " Do you not see Pkts Encaps increment, indicating that you send a response réécrirait the client to the internal host.

  For what is 192.168.1.1, because you have this:

  > ip nat inside source 192.168.1.1 static 199.201.44.197

  It substitutes for this:

  > ip nat inside source map route sheep interface Ethernet0/0 overload

  for this host traffic only and therefore back for just this host is always NAT would have even if you don't want it to be. To work around to send traffic to this host through an interface of closure with no NAT enabled on it, that it is NAT would have stops and allows you to connect via VPN. You can see http://www.cisco.com/warp/public/707/static.html for a detailed explanation, but basically, we must add this:

  loopback interface 0

  IP 1.1.1.1 255.255.255.0

  interface ethernet0/1

  Static IP policy route map

  permissible static route map 10

  match address 120

  set ip next-hop 1.1.1.2

  access-list 120 allow host ip 192.168.1.1 192.168.2.0 0.0.0.255

• Customer Cisco VPN through PIX

  I have a PIX 501. I would use the Cisco VPN Client through the PIX to connect to a PIX on another site. The client will connect, but there is no traffic through the connection. What can I do?

  On the remote PEER PIX, add the following line.

  ISAKMP nat-traversal 20

  sincerely

  Patrick

• Problem with the VPN and NAT configuration

  Hi all

  I have a VPN tunnel and NATing participates at the remote site.

  I have the VPN tunnel from the absolutely perfect traffic from users, but I am struggling to manage the device via SNMP through the VPN tunnel.

  Remote subnet is 192.168.10.0/24

  That subnet gets PAT'd to 192.168.4.254/32

  The subnet to HQ is 10.0.16.0/24

  IP address of the ASA remote is 192.168.10.10

  Of course, as this subnet is NAT would have I created a static NAT so that the 192.168.4.253 translates 192.168.10.10.

  I can see that packets destined to the 192.168.4.253 device address comes to the end of the tunnel as long as the number of packets decrypted increases when you run a continuous ping to the device.

  However, the unit will not return these packages. The wristwatch that 0 packets encrypted.

  Please let me know if you need more information, or the output of the configuration complete.

  When I start a capture on the ASA remote, I don't see ICMP packets to reach the ASA REAL ip (192.168.10.10). Maybe I set my NAT evil?

  Also, there is no Interface inside, only an Interface outside. And the default route points to the next router ISP Hop on the external Interface.

  Hope that all of the senses.

  Thank you

  Mario Rosa

  No, unfortunately you can not NAT the ASA outside the IP of the interface itself.