VPN via a natted router

Similar Questions

• Cisco IPsec VPn via a BT router

  Hi all

  A customer comes to buy a Cisco UC520 and is eager to VPN in the system with its IP communicator, do you know what are the settings that I have to configure it to allow the VPN through the BT router?

  Is this just a port before I need or is there some other parameters.

  Thank you

  Nathan

  Hi Nathan

  Do not have much with BT routers but what follows the document object should help

  http://btbusiness.custhelp.com/app/answers/detail/A_ID/9445/~/how-do-i-set-up-port-forwarding-on-the-BT-business-hub%3F

  Ports for VPN traffic are udp 500, 4500 & 10000

  It may be useful

• VPN bewtween 2 PIX - 1 behind a NAT router.

  Hello

  I created 2 PIX with a VPN tunnel between them and it worked. Small was during a test well before that of PIX has been shipped to the location where it has been implemented (with of course the new addresses IP etc.)

  Now this PIX is placed behind a Zyxel router running NAT, and the tunnel will not simply come to the top. It is never further than the State of 'mm_sa_setup '.

  I am aware that the only thing that is different from when he worked is the NAT router damn, so I should be aware of this router? I'm going nuts: 0)

  Oh and btw. I use ESP-3des-sha.

  Thanks in advance,

  Rasmus

  When you activate the NAT - T, Cisco PIX automatically opens port 4500 on all active IPSec interfaces so you should be sure that the UDP 4500 port is not blocked between two PIX.

  Kind regards

  Mehrdad

• Site to Site VPN of IOS - impossible route after VPN + NAT

  Hello

  I have problems with a VPN on 2 routers access 8xx: I am trying to set up a quick and dirty VPN Site to Site with a source NAT VPN tunnel endpoint. This configuration is only intended to run from one day only inter. I managed to do the work of VPN and I traced the translations of NAT VPN tunnel endpoint, but I couldn't make these translated packages which must move outside the access router, because intended to be VPN traffic network is not directly connected to leave the router. However, I can ping the hosts directly connected to the router for access through the VPN.

  Something done routing not to work, I don't think the NATing, because I tried to remove the NAT and I couldn't follow all outgoing packets that must be sent, so I suspect this feature is not included in the IOS of the range of routers Cisco 8xx.

  I'm that extends the features VPN + NAT + routing too, or is there a configuration error in my setup?

  This is the configuration on the router from Cisco 8xx (I provided only the VPN endpoint, as the works of VPN endpoint)

  VPN endpoints: 10.20.1.2 and 10.10.1.2

  routing to 192.168.2.0 is necessary to 192.168.1.2 to 192.168.1.254

  From 172.31.0.x to 192.168.1.x

  !

  version 12.4

  no service button

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  encryption password service

  !

  hostname INSIDEVPN

  !

  boot-start-marker

  boot-end-marker

  !

  enable secret 5 xxxxxxxxxxxxxxx

  !

  No aaa new-model

  !

  !

  dot11 syslog

  no ip cef

  !

  !

  !

  !

  IP domain name xxxx.xxxx

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  username root password 7 xxxxxxxxxxxxxx

  !

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  ISAKMP crypto key address 10.20.1.2 xxxxxxxxxxxxx

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac VPN-TRANSFORMATIONS

  !

  CRYPTOMAP 10 ipsec-isakmp crypto map

  defined by peer 10.20.1.2

  game of transformation-VPN-TRANSFORMATIONS

  match address 100

  !

  Archives

  The config log

  hidekeys

  !

  !

  LAN controller 0

  line-run cpe

  !

  !

  !

  !

  interface BRI0

  no ip address

  encapsulation hdlc

  Shutdown

  !

  interface FastEthernet0

  switchport access vlan 12

  No cdp enable

  card crypto CRYPTOMAP

  !

  interface FastEthernet1

  switchport access vlan 2

  No cdp enable

  !

  interface FastEthernet2

  switchport access vlan 2

  No cdp enable

  !

  interface FastEthernet3

  switchport access vlan 2

  No cdp enable

  !

  interface Vlan1

  no ip address

  !

  interface Vlan2

  IP 192.168.1.1 255.255.255.248

  NAT outside IP

  IP virtual-reassembly

  !

  interface Vlan12

  10.10.1.2 IP address 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  card crypto CRYPTOMAP

  !

  IP forward-Protocol ND

  IP route 192.168.2.0 255.255.255.0 192.168.1.254

  IP route 10.20.0.0 255.255.0.0 10.10.1.254

  Route IP 172.31.0.0 255.255.0.0 Vlan12

  !

  !

  no ip address of the http server

  no ip http secure server

  IP nat inside source static 172.31.0.2 192.168.1.11

  IP nat inside source 172.31.0.3 static 192.168.1.12

  !

  access-list 100 permit ip 192.168.1.0 0.0.0.255 172.31.0.0 0.0.255.255

  access-list 100 permit ip 192.168.2.0 0.0.0.255 172.31.0.0 0.0.255.255

  !

  !

  control plan

  !

  !

  Line con 0

  no activation of the modem

  line to 0

  line vty 0 4

  password 7 xxxxxxxxx

  opening of session

  !

  max-task-time 5000 Planner

  end

  Hi Jürgen,

  First of all, when I went through your config, I saw these lines,

  !
  

  interface Vlan2
  

  IP 192.168.1.1 255.255.255.248
  

  !

  !

  IP route 192.168.2.0 255.255.255.0 192.168.1.254
  

  !

  With 255.255.255.248 192.168.1.1 and 192.168.1.254 subnet will fall to different subnets. So I don't think you can join 192.168.2.0/24 subnet to the local router at this point. I think you should fix that first.

  Maybe have 192.168.1.2 255.255.255. 248 on the router connected (instead of 192.168.1.254)

  Once this has been done. We will have to look at routing.

  You are 172.31.0.2-> 192.168.1.11 natting

  
  

  Now, in order for that to work, make sure that a source addresses (192.168.1.11) NAT is outside the subnet router to router connected (if you go with 192.168.1.0/29 subnet router to router, with 192.168.1.1/29 on the local router and 192.168.1.2/29 on the connected router as suggested, it will be fine). So in this case 192.168.1.8/29 to the subnet that your NAT would be sources fall.

  Have a static route on the router connected (192.168.1.2) for the network 192.168.1.8/29 pointing 192.168.1.1,

  !

  IP route 192.168.1.8 255.255.255.248 192.168.1.1

  !

  If return packets will be correctly routed toward our local router.

  If you have an interface on the connected rotuer which includes the NAT would be source address range, let's say 192.168.1.254/24, even if you do your packages reach somehow 192.168.2.0/24, the package return never goes to the local router (192.168.1.1) because the connected router sees it as a connected subnet, so it will only expire

  I hope I understood your scenario. Pleae make changes and let me know how you went with it.

  Also, please don't forget to rate this post so useful.

  Shamal

• Nat router firewall

  I have connected a firewall to a linksys BEFSR41 router.

  I put the BEF on a separate subnet

  Re: static 192.168.1.2 (on the same subnet as firewall)

  Gateway: 192.168.1.1 (firewall inside address)

  DNS: 192.168.1.1

  LAN:

  192.168.2.1

  NAT is enabled.

  I have the ethernet cable between the firewall connected to the WAN port on the BEF

  It works very well to go through the firewall to the internet (which also has nat;-I'm not sure how it works with the two nats.)  )

  Problem: If I disable NAT on the BEF I can't through the internet.

  The question: is there a way to configure the BEF with NAT disabled and still get to the internet?

  I tried different settings for the WAN on the BEF (in addition to the above) but you have not hit to the right pair.

  Any suggestion would be appreciated.

  Hugh

  If you connect a second external via a router to a different LAN port (main) settings NAT is actually irrelevant. I don't know why talk of various FAQ to disable NAT (router mode switch). It makes not a difference. NAT applies only to packets that passes through the component routing, i.e. travel side LAN to the WAN port or back up. Thus, it is not relevant for a LAN - LAN configuration.

  The default setting for a normal router is active NAT because you use IP private addresses inside the local network that must be mapped to the public IP address on the WAN port. That's what NAT. Internally, you have private IP addresses. In the internet, we see only the public IP address.

  It is true that with active NAT side LAN is inaccessible from the side WAN (with the exception of redirects to port etc.). Is only a precondition not to do a side fully accessible side LAN WAN turn off NAT. That NAT is now disabled the LAN IP addresses are routed to the side WAN. This means that the side WAN must understand and also forward these IP addresses correctly. In your case, with NAT disabled the computers and router WAN side need to know where to route the packets 192.168.2. *. If you do not set a road for 192.168.2.0/255.255.255.0 on the main router all the packages of 192.168.2. * will be sent to the default gateway, which is in the internet where they are quickly eliminated.

  To make a computer connected to the accessible BEF from the internet you have to options:

  1. you can expose some ports through port forwarding and NAT enabled on the BEF. You must pass these ports on the firewall and the BEF. The firewall forwards to the WAN IP 192.168.1.2 the BEF. The BEF transmits to the address of the LAN computer, for example 192.168.2.50.

  2. If you want to disable the NAT on the BEF, you must configure a static route on the firewall to route 192.168.2.0/255.255.255.0 Gateway 192.168.1.2. In addition, you may need to adjust the NAT rules to include 192.168.2.0/255.255.255.0 for NAT (NAT rules define which IP addresses are mapped to the public IP address and which not).

  If you want the computer to be accessible from the internet, you still have to implement the translation of port on the firewall (the firewall because no NAT and thus makes the side LAN firewall inaccessible from the internet). The firewall is not possible: some barrier-lights/routers allow you to set up port forwarding to arbitrary IP addresses and their own LAN IP subnet, i.e. the firewall might not only to transmit not 192.168.1. * but * 192.168.2.

  Perhaps you could explain why you must have some computers on a different subnet.

• Problems with VPN on a PAT router

  Hello

  I have problems to make my VPN to work. I read through various examples of configuration, but don't always have it work properly.

  Scenario: connection with the Cisco VPN Client to my router from outside.

  Router works like NAT/PAT overload. Internet: Internal FA0/1 network: FA0/0

  Problems: connection is working without problem, but I can't access anything in the network behind the router. Some hosts ping sometimes works, sometimes doesn't.

  Does anyone have an idea of what could be the problem and what wrong with my setup?

  Thanks in advance!

  Here is my configuration:

  Current configuration: 5817 bytes
  !
  ! Last modification of the configuration at 14:41:13 CEST Saturday, July 3, 2010
  !
  version 12.3
  horodateurs service debug uptime
  Log service timestamps uptime
  no password encryption service
  !
  router01 hostname
  !
  boot-start-marker
  boot-end-marker
  !
  enable secret 5 - CENSORED-

  activate the password - CENSORED-

  !
  clock timezone THIS 1
  clock to summer time it IS recurring
  AAA new-model
  !
  !
  local USERLIST of AAA authentication login.
  local GROUP AAA authorization network
  AAA - the id of the joint session
  IP subnet zero
  IP cef
  !
  !
  !
  Max-events of po verification IP 100
  IPv6 unicast routing
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  username password 0 - CENSORED - TEST

  !
  !
  !
  !
  crypto ISAKMP policy 10
  BA aes 256
  preshared authentication
  Group 2
  the local address ADDRESSPOOL pool-crypto isakmp client configuration
  ISAKMP xauth timeout 60 crypto
           
  !
  Configuration group customer isakmp crypto GROUP
  -UNCENSORED - key

  pool ADDRESSPOOL
  ACL 150
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac SET
  !
  crypto dynamic-map 10 DYNMAP
  Set transform-set
  market arriere-route
  !
  !
  list of authentication of card crypto client DYNMAP USERLIST
  list of crypto isakmp DYNMAP card authorization GROUP
  crypto card for the DYNMAP client configuration address respond
  card crypto DYNMAP 10-isakmp dynamic ipsec DYNMAP
  !
  !
  !
  !
  !
  !
  interface FastEthernet0/0
  IP 172.16.0.250 255.255.252.0
  IP nat inside
  automatic speed
  full-duplex
  !
  interface FastEthernet0/0.93
  encapsulation dot1Q 93
  IP 172.20.2.5 255.255.255.252
  !
  interface Serial0/0
  no ip address
  Shutdown
  no fair queue
  !
  interface FastEthernet0/1
  DHCP IP address
  NAT outside IP
  automatic duplex
  automatic speed
  No cdp enable
  card crypto DYNMAP
  !
  interface Serial0/1
  no ip address
  Shutdown
  No cdp enable
  !
  !
  local IP ADDRESSPOOL 172.17.0.100 pool 172.17.0.150
  IP nat inside source list 1 interface FastEthernet0/1 overload
  IP nat inside source static tcp 172.16.1.51 80 interface FastEthernet0/1 81
  IP nat inside source static tcp 172.16.2.4 2909 interface FastEthernet0/1 2909
  IP nat inside source static tcp 172.16.2.1 3389 3389 FastEthernet0/1 interface
  IP nat inside source static tcp 172.16.1.51 50000 interface FastEthernet0/1 50000
  IP nat inside source static tcp 172.16.1.51 52000 interface FastEthernet0/1 52000
  IP nat inside source static tcp 172.16.1.51 52001 interface FastEthernet0/1 52001
  IP nat inside source static tcp 172.16.1.51 52002 interface FastEthernet0/1 52002
  IP nat inside source static tcp 172.16.1.51 52003 interface FastEthernet0/1 52003
  IP nat inside source static tcp 172.16.1.51 52004 interface FastEthernet0/1 52004
  IP nat inside source static tcp 172.16.1.51 52005 interface FastEthernet0/1 52005
  IP nat inside source static tcp 172.16.1.51 52006 interface FastEthernet0/1 52006
  IP nat inside source static tcp 172.16.1.51 52007 interface FastEthernet0/1 52007
  IP nat inside source static tcp 172.16.1.51 52008 interface FastEthernet0/1 52008
  IP nat inside source static tcp 172.16.1.51 52009 interface FastEthernet0/1 52009
  IP nat inside source static tcp 172.16.1.51 52010 interface FastEthernet0/1 52010
  IP nat inside source static tcp 172.16.1.51 52011 interface FastEthernet0/1 52011
  IP nat inside source static tcp 172.16.1.51 52012 interface FastEthernet0/1 52012
  IP nat inside source static tcp 172.16.1.51 52013 interface FastEthernet0/1 52013
  IP nat inside source static tcp 172.16.1.51 52014 interface FastEthernet0/1 52014
  IP nat inside source static tcp 172.16.1.51 52015 interface FastEthernet0/1 52015
  IP nat inside source static tcp 172.16.1.51 52016 interface FastEthernet0/1 52016
  IP nat inside source static tcp 172.16.1.51 52017 interface FastEthernet0/1 52017
  IP nat inside source static tcp 172.16.1.51 52018 interface FastEthernet0/1 52018
  IP nat inside source static tcp 172.16.1.51 52019 interface FastEthernet0/1 52019
  IP nat inside source static tcp 172.16.1.51 52020 interface FastEthernet0/1 52020
  IP nat inside source static tcp 172.16.1.11 80 interface FastEthernet0/1 80
  IP nat inside source static tcp 172.16.1.11 443 interface FastEthernet0/1 443
  IP nat inside source static tcp 172.16.1.1 25 interface FastEthernet0/1 25
  no ip address of the http server
  no ip http secure server
  IP classless
  !
  enable IP pim Bennett
  !
  access-list 1 permit 172.16.0.0 0.0.3.255
  access-list 101 permit tcp any any eq 50000
  access-list 101 permit tcp everything any 52000 52020 Beach
  access-list 101 permit tcp any any eq www
  access-list 101 permit tcp any any eq 443
  access-list 101 permit tcp any any eq smtp
  access-list 101 permit tcp any any eq 3389
  access-list 101 permit tcp any any eq 2909
  access-list 150 permit ip 172.16.0.0 0.0.3.255 172.17.0.0 0.0.0.255
  access-list 151 allow ip 172.16.0.0 0.0.3.255 all
  !
  SHEEP allowed 10 route map
  corresponds to the IP 151

  !
  public RO SNMP-server community
  !
  !
  !
  !
  !
  Line con 0
  exec-timeout 0 0
  line to 0
  line vty 0 4
  password - CENSORED-

  !
  NTP-period clock 17180405
  source NTP FastEthernet0/1
  NTP 162.23.41.34 Server
  NTP 162.23.41.56 Server
  NTP 162.23.41.55 Server
  !
  end

  Jenny,

  The NAT config is a little weird, you list 1.

  List 1 is everything inside. (so all traffic inside subnet must be natted).

  You must create an extended access list and create the entry

  IP access-l ext 195

  10 deny ip LOCAL_ADDRESS LOCAL_MASK VPN_POOL VPN_MASK

  1000 ip LOCAL_ADDRESS LOCAL_MASK perm all

  and apply that list to NAT overload.

  This gives a try and let me know.

  Edit: Ouch, 12.3 Mainline... Ollllllllllllld

• AnyConnect VPN Client on IOS router

  Hi guys, I configured AnyConnect SSL VPN on Cisco 2811 router. It works perfectly when I login via web and customer execution of secure mobility. However, when I connect directly from the mobility client connection fails. He does not even ask me user name and password.

  ----------------------------------------------------------------------------------------------------

  Mar 7 21:36:47.613: % SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: VPN_GATEWAY i_vrf: 0 f_vrf: 0 status: successful with SSL/TLS connection distance

  21:36:47.617 7 March: WV: sslvpn rcvd context process queue event

  21:36:47.621 7 March: WV: sslvpn rcvd context process queue event

  21:36:47.745 7 March: WV: sslvpn rcvd context process queue event

  21:36:47.749 7 March: WV: entering APPL with framework: 0 x 49233618,

  Buffer (buffer: 0x4925DA18, data: 0x3F57ED98, len: 1,)

  offset: 0, area: 0)

  21:36:47.749 7 March: WV: fragmented data App - stamped

  21:36:47.749 7 March: WV: entering APPL with framework: 0 x 49233618,

  Buffer (buffer: 0x4925D818, data: 0x3F2033F8, len: 242,)

  offset: 0, area: 0)

  21:36:47.749 7 March: WV: Appl. Treatment failure: 2

  21:36:47.749 7 March: WV: server-side not ready to send.

  21:36:47.749 7 March: WV: server-side not ready to send.

  21:36:47.749 7 March: WV: server-side not ready to send.

  21:36:47.753 7 March: WV: sslvpn rcvd context process queue event

  21:36:47.753 7 March: WV: server-side not ready to send.

  --------------------------------------------------------------------------------------------

  ====================

  Here is the config:

  =====================

  Crypto pki trustpoint VPN_TRUSTPOINT

  enrollment selfsigned

  Serial number

  name of the object CN = Academy-certificate

  crl revocation checking

  rsakeypair RSA_KEY

  !

  !

  VPN_TRUSTPOINT crypto pki certificate chain

  !

  local IP VPN_POOL 192.168.7.100 pool 192.168.7.150

  !

  WebVPN gateway VPN_GATEWAY

  IP address

  trustpoint SSL VPN_TRUSTPOINT

  Enable logging

  development

  !

  WebVPN install svc flash:/webvpn/anyconnect-win-3.1.02040-k9.pkg sequence 1

  !

  WebVPN context VPN_CONTEXT

  title ".

• Cisco ASA Site to Site VPN IPSEC and NAT question

  Hi people,

  I have a question about the two Site to Site VPN IPSEC and NAT. basically what I want to achieve is to do the following:

  ASA2 is at HQ and ASA1 is a remote site. I have no problem setting a static static is a Site to IPSEC VPN between sites. Guests residing in 10.1.0.0/16 are able to communicate with hosts in 192.168.1.0/24, but what I want is to configure the NAT with IPSEC VPN for this host to 10.1.0.0/16 will communicate with hosts in 192.168.1.0/24 with translated addresses

  Just an example:

  N2 host (10.1.0.1/16) contacted N1 192.168.1.5 with destination host say 10.23.1.5 No 192.168.1.5 (notice the last byte is the same in the present case,.5)

  The translation still for the rest of the communication (host pings ip destination host 10.23.1.6 N3 N2 not 192.168.1.6 new last byte is the same)

  It sounds a bit confusing to me, but I've seen this type of configuration before when I worked for the supplier of managed services where we have given our customers (Ipsec Site to Site VPN with NAT, don't know how it was setup)

  Basically we contact the customer via site-to-site VPN hosts but their real address were hidden and we used as translated address more high 10.23.1.0/24 instead of (real) 192.168.1.0/24, last byte must be the same.

  Grateful if someone can shed some light on this subject.

  Hello

  OK so went with the old format of NAT configuration

  It seems to me that you could do the following:

  • Configure the ASA1 with static NAT strategy
    • access-list L2LVPN-POLICYNAT allowed ip 192.168.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    • public static 10.23.1.0 (inside, outside) access-list L2LVPN-POLICYNAT
  • Because the above is a static NAT of the policy, this means that the translation will be made only when the destination network is 10.1.0.0/16
  • If you have for example a PAT basic configuration to inside-> external traffic, the above NAT configuration and the custom of the actual configuration of PAT interfere with eachother
  • ASA2 side, you can normally configure NAT0 / NAT Exemption for the 10.1.0.0/16 network
    • Note of the INTERIOR-SHEEP access-list SHEEP L2LVPN
    • the permitted INSIDE SHEEP 10.1.0.0 ip access list 255.255.0.0 10.23.1.0 255.255.255.0
    • NAT (inside) 0-list of access to the INTERIOR-SHEEP
  • You will need to consider that your access-list defining the VPN encrypted L2L traffic must reflect the new NAT network
    • ASA1: allowed to access-list L2LVPN-ENCRYPTIONDOMAIN ip 10.23.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    • ASA2: list L2LVPN-ENCRYPTIONDOMAIN allowed ip 10.1.0.0 access 255.255.0.0 10.23.1.0 255.255.255.0

  I could test this configuration to work tomorrow but I would like to know if it works.

  Please rate if this was helpful

  -Jouni

• How can I secure my laptop when I surf the internet via a public router at work?

  How can I secure my laptop when I surf the internet via a public router at work? I mean if I use a router to work and others use too and I use a private laptop! I heard that someone hase the knoladge he can enter my laptop the couscous that he uses the same router I do. you have a special program for that, or is there a place in my computer that I need to enable to avoid the unwanted entries?

  If your Windows is updated and your Windows Firewall is enabled and that you have updated anti-virus, that would be fine. In Windows 7, you must check Action Center in Control Panel to see your security status, if something is wrong that it will show a message in Windows XP and Windows Vista, he calls the center of security.

  They may only enter your laptop or hack, if your firewall is disabled or there is a vulnerability in your system or a Malware would cause of vulnerability, and in all cases to ensure that your Windows updates and anti-virus is running, you are protected.

  Another thing is that if your router requires the password, then choose strong password and change it regularly, if it is public without password or authentication, then you need to careful when visiting Web sites because they could be monitor and publicly display information. Some websites have encryption that in Internet Explorer, it shows as a lock icon pad indicating that your transaction is encrypted and you're safe.

  It depends also wireless encryption in your company that will be in service by admin or SOUND Department if it's WPA2 which is good but for WEP or WPA, you should be very careful. I suggest to discuss this issue with your COMPUTER service too.

• I have a laptop Windows XP and win7, connected via a wireless router.

  I have a portable desktop and win7 winXP connected via a wireless router.  Can see the XP machine with the file full access Win 7 but not vice versa.  On XP, clicking on C: of the laptop gives error "C: is not accessible. You have no permissions... "How can I fix it?  As far as I can tell all together relevant upward is correct on Win7.  No password have been set.

  Hello

  Maybe this can help.

  Win7 when configured on the peer-to-peer network has three types of configurations of sharing.

  Homegroup = only works between Win 7 computers. This type of configuration, it is very easy to entry level users to start sharing network.

  Network of home or work = fundamentally similar (and better) to the previous Working Group sharing methods which allow you to control what, how and to whom the records would be shared with.
  
  Public share = network Public (as Internet Café) in order to reduce security risks.

  To get best results connect to each computer system screen and set all the computers to be on a bearing the same name of Working Group , while each computer has its own unique name.

  http://www.ezlan.NET/Win7/net_name.jpg

  Make sure that the software firewall, AV, or other security components allow free local traffic on all network computers. If you use the 3rd group of security, firewall native Vista/XP must be disabled, and the active firewall has adjusted to your network numbers IP on what is sometimes called the Zone of confidence (see part 3 firewall instructions

  General example, http://www.ezlan.net/faq.html#trusted
  Please Note that some 3rd party software firewall/AV/security costumes continue to block aspects of the Local traffic even it they are off (off). If possible, configure the firewall correctly or completely uninstall to allow a clean flow of local network traffic.

  If you end up with the 3rd party software uninstalled or disabled, make sure that Windows native firewall is active .

  -----------------

  Network Win 7 with another version of Windows as a work network (works very well if all computers are Win 7 also).

  In the center of the network, by clicking on the type of network opens the window to the right.

  Choose your network type. Note the check box at the bottom and check/uncheck depending on your needs.

  http://www.ezlan.NET/Win7/net_type.jpg

  Win 7 - http://windows.microsoft.com/en-us/windows7/Networking-home-computers-running-different-versions-of-Windows

  Win 7 network sharing folder specific work - http://www.onecomputerguy.com/windows7/windows7_sharing.htm

  Vista file and printer sharing - http://technet.microsoft.com/en-us/library/bb727037.aspx

  Windows XP file sharing - http://support.microsoft.com/default.aspx?scid=kb;en-us;304040

  In Win XP Pro with simple sharing Off, you can visually see the Permission/security level and set them up at your convenience.

  http://www.Microsoft.com/windowsxp/using/security/learnmore/AccessControl.mspx#securityTab

  Sharing printer XP - http://www.microsoft.com/windowsxp/using/networking/expert/honeycutt_july2.mspx

  Setting Windows native firewall for sharing XP - http://support.microsoft.com/kb/875357
  Windows XP Patch for sharing with Vista (no need for XP - SP3) - http://support.microsoft.com/kb/922120

  When you have finished the configuration of the system, it is recommended to restart everything the router and all computers involved.

  -------------

  If you have permission and security issues with Vista/Win7, check the following settings.

  Point to a folder that wants to share do right click and choose Properties.

  In the properties

  Click on the Security tab shown in the bellows of the photo on the right) and verify that users and their permissions (see photo below Centre and left) are configured correctly. Then do the same for the authorization tab.

  This screen shot is to Win 7, Vista menus are similar.

  http://www.ezlan.NET/Win7/permission-security.jpg

  The Security Panel and the authorization Panel, you need to highlight each user/group and consider that the authorization controls are verified correctly.

  When everything is OK, restart the network (router and computer).

  * Note . The groups and users listed in the screen-shoot are just an example. Your list will focus on how your system is configured.

  * Note . All the users who are allowed to share need to have an account onall computers that they are allowed to connect to.

  Everyone is an account, that means a group of all users who already have an account now as users. It is available to avoid the need to configure permission for each on its own, it does not mean all those who feel that they would like to connect.

• Print from ipad to printer usb via a wireless router

  Is it possible to print from the ipad to DeskJet 882c via a wireless router that supports usb (like Linksys EA3500) print?

  Thank you

  Hi Ralph51,

  Welcome to the Forums of HP's Support. I understand that you would like to know if you can print from your iPad to your printer Deskjet 882c.

  I've included the document on the Part of your printer on a network with Apple AirPort . It would be the only option available to print from your iPad.

• DSL via a wireless router: slow XP, fast on Vista

  DSL via a wireless router: slow XP, fast on Vista

  Hello, I just moved into a new House that has DSL service. My Vista laptop connects seamlessly to the network, but my XP machine trickles in at 50-150 Kbps and is flaky. I rebooted everything, power all pedaled, verified and updated the drivers. (Maybe I missed something?)  The specs are all lower. Any thoughts on what is happening?

  Thank you!
  Brian

  EarthLink DSL
  VisionNet Modem
  Linksys wireless router (router broadband wireless - b)
  -BEFW11S4

  2 wireless laptops

  Get about 1 Mbps on a Vista Machine (which I believe is the expected rate).
  (Dell XPS M1210)
  Works with either ethernet or wireless connection to router

  Get about 50 Kbps on the XP Machine
  (Dell Latitude D830)
  Works with no wireless or ethernet connection to the router
  Intel Wireless Wifi Link 4965AGN,
  Driver: 12.4.3.9, Date: 28/05/2009

  Two laptop computers were working well 4 days ago in my previous House, sharing a connection to broadband Charter via a linksys wireless router.  The works of XP machine still work well pick up public Wi - Fi in coffee shops, etc.

  Under the name Vista computer works fine... I suggest to check again the Xp computer and disable the firewall and antivirus on the computer and try... You can try changing the wireless channel on the router... Also keep the mixed mode network mode.

• Multiple VPN connections using 871 router

  Hello

  I have the cisco router 871 at the site of the retail that connects to the corporate site. I also want to connect a device to the sharing network partner, but it needs to connect to their virtual private network.  Is it possible to configure the 2 VPN connection to 2 different company sites in this scenario?

  Thanks for your help.

  Umesh.

  Hello

  You can configure multiple VPN tunnels on the router (whether on the same interface or different interfaces).

  You can then perform the traffic from a tunnel in another tunnel, if you must do the same.

  Federico.

• LAN to lan vpn between ASA and router 7200

  Hi friends,

  I need to configure the lan to lan between ASA vpn (remote location) and router 7200 (on our network).

  <7200 router="" (ip="" add:="" 10.10.5.2)="">-(Internet) -<(IP add:="" 192.168.12.2)="" asa(5510)="">---192.135.5.0/24 network

  I will have the following configuration:

  7200 router:

  crypto ISAKMP policy 80

  the enc

  AUTH pre-shared

  Group 1

  life 3600

  ISAKMP crypto key cisco123 address 192.168.12.2

  Cryto ipsec transform-set esp - esp-md5-hmac VPNtrans

  map VPNTunnel 80 ipsec-isakmp crypto

  defined by peer 192.168.12.2

  game of transformation-VPNtrans

  match address 110

  int fa0/0

  IP add 10.10.5.2 255.255.255.192

  IP virtual-reassembly

  no ip route cache

  Speed 100

  full duplex

  card crypto VPNTunnel

  access-list 110 permit ip any 192.135.5.0 0.0.0.255

  ASA:

  int e0/0

  nameif inside

  security-level 100

  192.135.5.254 Add IP 255.255.255.0

  int e0/1

  nameif outside

  security-level 0

  IP add 192.168.12.2 255.255.255.240

  access-list ACL extended ip 192.135.5.0 allow 255.255.255.0 any

  Route outside 0.0.0.0 0.0.0.0.0 192.168.12.3 1

  "pre-shared key auth" ISAKMP policy 10

  ISAKMP policy 10-enc

  ISAKMP policy 10 md5 hash

  10 1 ISAKMP policy group

  ISAKMP duration strategy of life 10-3600

  Crypto ipsec transform-set esp - esp-md5-hmac VPNtran

  card crypto VPN 10 matches the ACL address

  card crypto VPN 10 set peer 10.10.5.2

  card crypto VPN 10 the transform-set VPNtran value

  tunnel-group 10.10.5.2 type ipsec-l2l

  IPSec-attributes of type tunnel-group 10.10.5.2

  cisco123 pre-shared key

  card crypto VPN outside interface

  ISAKMP allows outside

  dhcpd address 192.135.5.1 - 192.135.5.250 inside

  dhcpd dns 172.15.4.5 172.15.4.6

  dhcpd wins 172.15.76.5 172.15.74.5

  dhcpd lease 14400

  dhcpd ping_timeout 500

  dhcpd allow inside

  Please check the configuration, please correct me if I missed something. I'm in a critical situation at the moment...

  Please advise...

  Thank you very much...

  Where it fails at the present time?

  Can you share out of after trying to establish the VPN tunnel:

  See the isa scream his

  See the ipsec scream his

  Please also run the following debug to see where it is a failure:

  debugging cry isa

  debugging ipsec cry

• Network problem between Windows 7 laptop with the Windows XP desktop computer via Linksys WRT54 router.

  Original title: network problem!

  How can I get my laptop with Windows 7 Home Edition to connect to my desktop with Windows XP on it. I have a router Linksys WRT54 plugged directly to the desktop via ethernet and my laptop has an excellent signal but I can't access programs or the printer with it. I know the 'host group' on 7 but XP isn't that. Are there alternative than to put 7 on my desktop? Any suggestions?

  Thank you!

  Hello

  Thanks for posting your query in Microsoft Community and we give the opportunity to help you.

  According the description of the problem face you connection problems in Windows 7 laptop with the Windows XP desktop computer via Linksys WRT54 router.

  Residential group option is available on Windows 7 and Windows 8 operating systems. However, you can see the following article for more information on the connection of Windows 7 and Windows XP computers:

  Networking of computers running different versions of Windows

  http://Windows.Microsoft.com/en-in/Windows7/networking-home-computers-running-different-versions-of-Windows

  Hope this information helps. For any other corresponding Windows help, do not hesitate to contact us and we will be happy to help you.