WRT160NL WAN ICMP responses

Hello, I just bought a WRT160NL and im noticing that my WAN ip's ping'able is possible to disable ICMP responses on the WAN interface.

Thank you!

Hmmm... Are you ping command from a device on the local network / wireless or in fact of the Internet / WAN side?

I tried rattling from the outside and the setting works correctly as described.

Ping from the inside always gets responses regardless of the setting.

Tags: Linksys Routers

Similar Questions

ASA5540 - no ICMP response from inside subinterface

Hello guys,.

I need to monitor ping inside subinterface my ASA5540, is - it possible?

I get no replys but ICMP requests, out of the box.

I need to ping to the 192.168.10.250 of the 192.168.5.55:

ASA Version 8.0 (5)

interface GigabitEthernet0/1

nameif inside

security-level 100

IP 192.168.30.50 255.255.255.0

!

interface GigabitEthernet0/1.1

Description of voting

No vlan

No nameif

security-level 100

IP 192.168.10.250 255.255.255.0

permit access list extended ip host 192.168.10.250 inside_nat0_outbound 192.168.5.55

inside_access_in access list extended icmp permitted any any debug log

ICMP allow any inside

Thank you guys!

Hello

You cannot ping an ASA interface behind another interface.

One exception to this rule is for connections from a VPN connection. Then, you can use the command "access management" to enable the ICMP connections and management of an ASA interface behind another interface.

So I don't think you can get this to work.

The host of the poll with ICMP must be behind the interface being queried.

Although I suppose that the method for monitoring all interfaces on the SAA would use SNMP.

-Jouni

Cisco RV042G problems?

Hello

Im having a problem with a router cisco RV042G and im hoping that someone could give some advice.

I have two Cisco 1720 routers and router RV042G. I use the RV042G as a "border" router, which gives access WAN/internet outside of two 1720 routers.

The two 1720 routers are connected to each other (ports eth0 on both) with crossover. Also, each 1720 router is also connected to one of the 4 ports on the RV042G router switch. The fa0 on each 1720 router port is connected to its own switch with customer (s)

Logically, it is what is the page layout...

I have configured all interfaces whose IP correct using VLSM. The two LANs are on their own subnet, and each router to router connection is on its own subnet.

I have configured RIP version 2 on the two routers in 1720 and also on RIP on the RV042G and configure it to send and receive updates V2. RIP version 2 is working great between all three routers.

View the routing on the two routers in 1720 table is perfect. They RIP routes to each subnet and also received a route RIP of the border for the WAN to the outside router.

Both routers are also capable of ANYTHING, ping clients on both sides, each router interface, the border and outside addresses WAN router.

My problem is with the customers. Both Clients can ping EVERYTHING except the border router (RV042G). They can ping each other, they can ping all the interfaces on the routers of 1720, but they cannot ping the RV042G or whatever it is in addition to the WAN (where customers will receive their internet from)

Im a little confused. If it were another manageable router as the 1720 I could get this race. Throw the NAT on the router to border and move on with life. But because it is a router in the web interface, I can't seem to understand why clients cannot reach the border router when two routers have RIP routes and can ping it very well.

The firewall on the RV042G is completely right now, as well as client firewalls.

Here is the config of the two 1720 routers:
```
 outhfieldRouter#show run Building configuration... Current configuration : 799 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SouthfieldRouter ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 ip subnet-zero ip cef ! ! no ip dhcp use vrf connected ! ! ! ! ! ! interface Ethernet0 ip address 172.16.7.138 255.255.255.252 full-duplex ! interface Ethernet1 ip address 172.16.7.131 255.255.255.248 full-duplex ! interface FastEthernet0 ip address 172.16.7.65 255.255.255.192 speed 100 ! router rip version 2 passive-interface FastEthernet0 network 172.16.0.0 no auto-summary ! ip classless ! no ip http server ! ! control-plane ! ! line con 0 line aux 0 line vty 0 4 login ! end SouthfieldRouter#
```
```
 TroyRouter#copy run start Destination filename [startup-config]? Building configuration... [OK] TroyRouter#show run Building configuration... Current configuration : 792 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname TroyRouter ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 ip subnet-zero ip cef ! ! no ip dhcp use vrf connected ! ! ! ! ! ! interface Ethernet0 ip address 172.16.7.137 255.255.255.252 full-duplex ! interface Ethernet1 ip address 172.16.7.130 255.255.255.248 full-duplex ! interface FastEthernet0 ip address 172.16.7.1 255.255.255.192 speed 100 ! router rip version 2 passive-interface FastEthernet0 network 172.16.0.0 no auto-summary ! ip classless ! no ip http server ! ! control-plane ! ! line con 0 line aux 0 line vty 0 4 login ! end TroyRouter#
```
I had a model of plotter package physical layout that worked very well. Packet trace is not similar to the RV042G router, so I used three of the same routers.

Anyone have any ideas?

Thanks in advance

> Both Clients can ping EVERYTHING except the border router (RV042G).

based on this, I hope that RV042G did not know where to send the icmp response - i.e. RV042 is missing information on both client subnets. ICMP echo is received successfully by RV042G, but the response is sent to the wrong direction (default route to the internet?).

> RIP v2 is working great between all three routers.

How did you get this? can you show us routing table from at least RV042G router? for me, for some reason any RIP routing updates are not accepted/Treaty by RV042 router.

1720 routers configuration seems perfect, part of RIP configuration as well and routing updates to be sent out of all interfaces except Fa0 interfaces.

Dynamic L2L Tunnel - the Tunnel is up, will not pass the LAN traffic

Hello everyone. I am repurposing an ASA for my business at a remote site and must use a dynamic Configuration of L2L with Split tunneling active. We used these in the past and they work a lot, and I've referenced Cisco official documentation for the implementation. Currently, I am having a problem where I am unable to pass traffic on the local remote network over the VPN tunnel (it does even not raise the tunnel of form). However, if I run the following command in the ASA remote:

Ping inside the 192.168.9.1

I receive the ICMP responses. In addition, this traffic causes the VPN Tunnel to be created as indicated by show ISA SA:

1 peer IKE: xx.xx.xx.xx

Type: L2L role: initiator

Generate a new key: no State: MM_ACTIVE

Here is the IP addressing scheme:

Network remotely (with the ASA problem): 192.168.12.0/24

Basic network (Hub): 192.168.9.0/24

Other rays: 192.168.0.0/16

Config:

ASA Version 8.2 (1)
!
hostname xxxxxxxxx
domain xxxxxxxxxxx.local
activate the xxxxxxxx password
passwd xxxxxxxxx
names of
!
interface Vlan1
nameif inside
security-level 100
192.168.12.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone CST - 6
clock to summer time recurring CDT
DNS server-group DefaultDNS
domain xxxxxxxx.local
permit same-security-traffic intra-interface
to_hq to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
inside_nat0_outbound to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
pager lines 24
Within 1500 MTU
Outside 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.0.0 255.255.0.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto outside_map 10 correspondence address to_hq
crypto outside_map 10 card game CORE peers. ASA. WAN. INTELLECTUAL PROPERTY
outside_map crypto 10 card value transform-set ESP-3DES-SHA
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet 192.168.0.0 255.255.0.0 inside
Telnet timeout 5
SSH timeout 5
Console timeout 0
management-access inside
dhcpd 192.168.9.2 dns 208.67.222.222
!
dhcpd address 192.168.12.101 - 192.168.12.131 inside
rental contract interface 86400 dhcpd inside
dhcpd xxxxxxxxx.local area inside interface
dhcpd ip interface 192.168.9.50 option 66 inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
tunnel-group basis. ASA. WAN. Type of IP ipsec-l2l
tunnel-group basis. ASA. WAN. IPSec-attributes of intellectual property
pre-shared key xxxxxxxxxxxx
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname

Once the tunnel is in place, LAN to the Remote Site traffic won't pass through the VPN Tunnel any upward. On the side of ASA Core, I was able to Telnet in the ASA distance very well, but could not ping the Remote Access Point.

Someone at - it a glimpse of my problem?

Hello

Add:

NAT (inside) 0-list of access inside_nat0_outbound

Vista do not you answer ping - file sharing also stopped working

Greetings!

I have problems with my windows vista computer. It can access the internet, load the pages and other servers, ping, but he stopped answering the ping requests and file sharing has stopped working (other computers cannot access its actions).

-J' have already disabled the two firewalls (both windows and f-secure).

-If I run wireshark, I can see the Ping ICMP requests (as they arrive at the machine), but ignores them (no ICMP response).

-When I try to browse the computer from another windows (windows 7), he sees the computer (they are on the same workgroup), but it is impossible to browse. Try to access it from a mac also fails.

-J' tried to use direct ip address instead of the netbios name, with no luck (access to \\192.168.1.101, for example).

-Of course, I tried already reboot my router, computers, etc.

-sfc/scannow detected a few corrupted files (but says he fixed them). But it did not help.

-J' thought that it might be a problem with windows system files, so I uninstalled SP2 and then reinstalled with no luck at all.

-J' already tried to reset the tcp ip (netsh int ip reset) stack but also had no success.

-I'm clean of viruses; already run 3 different AVs (including boot from rescue CD to detect rootkits) and nothing came.

I'm almost reinstall my whole windows, but I'm afraid even if it cannot solve the problem and having to install from scratch and reinstall * all * my new aplications will be a last operation of the station. Clues as to what I could do? Is there a way manually reset/reinstall only the sectors/services windows network?

Thank you for your time,

Gustavo

Greetings!

Just the answer I finally had myself on this issue.

The problem was a malware removal tool called Combofix. I had an infection and several tools to clean, one of which was this tool. I ignored the warning to leave unattended a guru of malware removal, and I just let it do its job (I know, I was wrong... but desperate times require desperate measures). Apparently, he finished and my system was working fine... but not the file share and ping responses.

Finally, there is a way to reverse the changes made by the latter:
- Go to C:\WINDOWS\ERDNT\subs\erdnt.exe, double-click erdnt.exe , and then restart the machine.
- If this does not work, then navigate to C:\WINDOWS\ERDNT\Hiv-backup\erdnt.exe, double-click erdnt.exe and restart the machine.
By doing this, the reverse tool changes to the system registry and these two services that weren't previously returned to work normally.

The Trojan horse itself not worried anymore, because I ran Combofix all as precautionary measure, since I had already deleted the Trojan horse itself (ZeroAccess, by the way).

That being said, I would think twice before getting a Dell computer next time... The version of Vista that comes with it only allows a 'Clean Install' and not 'upgrade install', which seriously complicates to reinstall the system failure (since I have to reinstall * everything *). I wonder if other versions of windows to PC manufacturers have the same limitations...

Gustavo

ACE 8091 Load Balancing port

Hello

I need to balance the https port in port 8091, I already do this configuration in port 443 and works, but with port 8091, sessions are broken and users must constantly make connection

probe tcp KPalive_server_8091

port 8091

interval 10

faildetect 2

interval passdetect 10

County of passdetect 2

Open 1

Book host server01

IP 192.168.32.128

development

Book host server02

IP 192.168.32.129

Serverfarm host SRVfarm_server

probe KPalive_server_8091

Book server01

development

Book server02

development

Sticky layer4-load useful server_HTTPS

Serverfarm SRVfarm_server

answer post it

layer4-payload offset 43 length 64 begin-pattern "(\x20|\x00\xST).

class-map correspondence CLA4_HTTPS

2 corresponds to the virtual address 192.168.30.60 tcp eq 8091

Policy-map type generic balancing first match POL7_HTTPS

class class by default

post-it-serverfarm server_HTTPS

multi-game policy-map POL4_HTTPS

class CLA4_HTTPS

Balancing vip continues

policy of balancing POL7_HTTPS

active balancing vip icmp-response

Thank you

Fred

A faith editada por mensagem: Frederico Fred

Hi Fred,.

If I understand you correctly, you want traffic from VIP to 443 must be sent to the server on port 8091, then you should make a slight change in the config.

Serverfarm host SRVfarm_server

probe KPalive_server_8091

Book server01 8091

development

Book server02 8091

development

You must set the port in which ACE is to send traffic to the server after a decision LB.

Let me know if this helps.

Kind regards

Kanwal

Packet switching not EFC / what is 'classification of output EAC?

Hello

I noticed a 3945-DRY with fairly high CPU load without doing much, because there are more packages switching process that the CFR switched.

To study, I did the following:

Router #sh ip cef switching statistics feature

Input characteristics IPv4 CEF:

Feature road Drop consume Punt Punt2Host gave

Access the list 24911921 0 0 14678240 0

0 0 0 0 20433673 routing policy

24911921 0 0 14678240 20433673 total

Output features IPv4 CEF:

Feature Drop consume Punt Punt2Host new i / f

Class output EAC 715266717 0 0 0 0

Total 0 0 715266717 0 0

Characteristics of post-encap IPv4 CEF:

Feature Drop consume Punt Punt2Host new i / f

IPSEC Post-encap 1 655816389 0 0 0

Total 1 655816389 0 0 0

CEF IPv4 for us offers:

Feature Drop consume Punt Punt2Host new i / f

Total                            0          0          0          0          0

Features of punt IPv4 CEF:

Feature Drop consume Punt Punt2Host new i / f

Total                            0          0          0          0          0

Features local IPv4 CEF:

Feature road Drop consume Punt Punt2Host gave

Total                            0          0          0          0          0

Punted them (= "punted" another mechanism of switching, not switched cef) packages for the feature 'EAC exit class' increase of ~ 1000 per second.

This made me wonder, what exactly is the feature 'CEC output class'. As I can see in the following output, this feature is enabled on my Tunnel Interface:

Router ip int tu0 #sh

Tunnel0 is up, line protocol is up

The Internet address is x.x.x.x/xx

Broadcast address is x.x.x.x

Address determined by non-volatile memory

MTU is 1400 bytes

Support address is not set

Transfer of directed broadcast is disabled

Multicast reserved joined groups: 224.0.0.10

Outgoing access list is not defined

Inbound access list is not defined

Proxy ARP is disabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are never sent

ICMP unreachable is always sent

Mask the ICMP responses are never sent

IP fast switching is enabled

Fast on the same switching interface IP is disabled

IP stream switching is disabled

IP CEF switching is enabled

Vector turbo IP CEF switching

Turbo IP vector draw

Tunnel VPN routing/Forwarding "xxx".

Quick change IP multicast is enabled

Fast switching of distributed IP multicast is disabled

Flags of IP route cache is fast, CEF

Router discovery is disabled

Output IP packet accounting is disabled

Accounting of IP access violation is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Policy routing is disabled

Network address translation is disabled

BGP policy mapping is disabled

Input characteristics: process Packet Capture, check MCI, TCP adjust MSS

Characteristics of the output: classification of output of EAC, PNDH redirect, adjust EAC ranking NAT, TCP MSS, QoS preclassification

Display the characteristics of encapsulation: IPSEC Post-encap output classification

WCCP redirect outgoing is disabled

WCCP redirect incoming is disabled

WCCP redirect exclude is disabled

Someone tell me, what is "CCE output ranking" and why this is receptive used by my router?

Hello Sebastian,.

EAC is the engine of common classification. I think that its used to "match" traffic for features like qos, nat, etc.. ". Based on the "HS in you ' out, some features on the direction of the output are originally be punted packets. You can try "debug ip cef drop" for a few seconds while the meter is incremented, usually it will give a reason to punt. The most common reasons are listed below.

ACL log or log-entry option (or)

An unreachable next hop for a route (or)

A missing arp entry for a next jump (or)

Entry to arp for outside nat... etc.

Please rate this post without fault if you found it useful. *

Thank you best regards &,.

Vignesh R P

AnyConnect VPN

Hello

I have configured AnyConnect VPN with split tunneling, so my internal networks is in the tunnel and get internet directly (not via an internal network).

But we want to access one of the public IP (8.8.8.8) through AnyConnect VPN tunnel.

When we check the capture of packets on an external interface, trying to ping 8.8.8.8 showing the icmp-request package but not get icmp-response packages.

Additional configuration required to access the ip address above by tunnel?

We have activated the below configuration as well.

permit same-security-traffic intra-interface

permit same-security-traffic inter-interface

Please find details of the capture below: 192.168.18.71 is my ip from the pool AnyConnect VPN system.

114 extended access-list allow ip host 192.168.18.71 8.8.8.8
115 extended access-list allow host 8.8.8.8 ip 192.168.18.71

output interface of capture within the list of access-114
Capture interface entering inside the access-list 115

See the capture of xxx - ASA (config) # outgoing

1: 22:13:24.001800 192.168.18.71 > 8.8.8.8: icmp: echo request
2: 22:13:28.986139 192.168.18.71 > 8.8.8.8: icmp: echo request
3: 22:13:33.970561 192.168.18.71 > 8.8.8.8: icmp: echo request
4: 22:13:38.971156 192.168.18.71 > 8.8.8.8: icmp: echo request
5: 22:13:44.080058 192.168.18.71 > 8.8.8.8: icmp: echo request
5 packs shown
XXX - ASA (config) #.
XXX - ASA (config) #.
XXX - ASA (config) # display incoming capture

0 packets captured

0 illustrated package
XXX - ASA (config) # display incoming capture

0 packets captured

0 illustrated package

Kindly help us solve the problem.

Thank you and best regards,

Ashok

I like to use the notation NAT object instead. So maybe try:
```
object network obj-192.168.18.0  nat (outside,outside) dynamic interface
```

AS-4710 same real servers, to various ports.

Hello! I have the question next, based on a new site requirement. The following sites are using the same back-end servers. Names have been changed to protect the innocent and my fingers fumbling with cute names for my real config.

I have two real servers in a load-balanced: 10.0.0.1 and 10.0.0.2

They have:

A site URL = www.testsite.com:80

B the site URL = www.newstuff.com:81

I want to Site B answer on port 81 for what either by reference to the URL matching for each port: 80, and: 81, and then redirect to: 81 anything on: 80.

I want to Site A answer on port 80 for what not to reference the URL of Site B.

How to split incoming traffic while also redirecting if only necessary for a single site?

In addition, how can another question, I manage the ports for each validation for the VIP of surveillance? If a port fails is that it will take both of them offline?

Hello

Since they are two different URLS, they would solve two different personalities. You can create both serverfarms with the same servers but listening on ports 81 and 80 and create a class map for a different IP address or even same IP, listening on port 81 and 80. Any client to come with port 80 as destination would be loadbalanced serverfarm_80 and any future client on port 81 as a destination would be loadbalanced to serverfarm_81.

class-map correspondence Test_80
2 corresponds to the virtual address 10.1.1.1 tcp eq www

class-map correspondence Test_81
3 corresponds to the virtual address 10.1.1.2 tcp eq 81

Book r1
IP 10.0.0.1
development

Book r2
IP 10.0.0.2
development

serverfarm_80
Book 80 r1
development
Book r2 80
development

serverfarm_81
Book r1 81
development
Book r2 81
development

Policy-map type balancing http first match http
class class by default
Serverfarm serverfarm_80

Policy-map type balancing http first match http_81
class class by default
Serverfarm serverfarm_81

multi-game policy-map Test
class Test_80
Balancing vip continues
Balancing policy http
active balancing vip icmp-response
class Test_81
Balancing vip continues
http_81 political balancing
active balancing vip icmp-response

Let me know if you have any questions.

Kind regards

Kanwal

Note: Please check if they are useful.

ASA 5505 as internet gateway (must reverse NAT)

Hi all the Cisco guru

I have this diet:

Office-> Cisco 877-> Internet-> ASA 5505-> remote network

Office network: 192.168.10.0/24

Cisco 877 IP internal: 192.168.10.200

Cisco 877 external IP: a.a.a.a

ASA 5505 external IP: b.b.b.b

ASA 5505 internal IP: 192.168.1.3 and 192.168.17.3

Remote network: 192.168.17.0/24 and 192.168.1.0/24

VPN tunnel is OK and more. I have the Office Access to the remote network and the remote network access to the bureau by the tunnel.

But when I try to access the network remotely (there are 2 VLANS: management and OLD-private) to the internet, ASA answer me:

305013 *. * NAT rules asymetrique.64.9 matched 53 for flows forward and backward; Connection for udp src OLD-Private:192.168.17.138/59949 dst WAN:*.*.64.9/53 refused due to path failure reverse that of NAT

Ping of OLD-private interface to google result:

110003 192.168.17.2 0 66.102.7.104 0 routing cannot locate the next hop for icmp NP identity Ifc:192.168.17.2/0 to OLD-Private:66.102.7.104/0

Result of traceroute

How can I fix reverse NAT and make ASA as internet gateway?

There is my full config

!
ASA Version 8.2 (2)
!
hostname ASA2
domain default.domain.invalid
activate the encrypted password password
encrypted passwd password
names of
!
interface Vlan1
Description INTERNET
1234.5678.0002 Mac address
nameif WAN
security-level 100
IP address b.b.b.b 255.255.248.0
OSPF cost 10
!
interface Vlan2
OLD-PRIVATE description
1234.5678.0202 Mac address
nameif OLD-private
security-level 0
IP 192.168.17.3 255.255.255.0
OSPF cost 10
!
interface Vlan6
Description MANAGEMENT
1234.5678.0206 Mac address
nameif management
security-level 0
192.168.1.3 IP address 255.255.255.0
OSPF cost 10
!
interface Ethernet0/0
!
interface Ethernet0/1
Shutdown
!
interface Ethernet0/2
Shutdown
!
interface Ethernet0/3
Shutdown
!
interface Ethernet0/4
Shutdown
!
interface Ethernet0/5
Shutdown
!
interface Ethernet0/6
switchport trunk allowed vlan 2.6
switchport mode trunk
!
interface Ethernet0/7
Shutdown
!
connection of the banner * W A R N I N G *.
banner connect unauthorized access prohibited. All access is
connection banner monitored, and intruders will be prosecuted
connection banner to the extent of the law.
Banner motd * W A R N I N G *.
Banner motd unauthorised access prohibited. All access is
Banner motd monitored and trespassers will be prosecuted
Banner motd to the extent of the law.
boot system Disk0: / asa822 - k8.bin
passive FTP mode
DNS domain-lookup WAN
DNS server-group DefaultDNS
Server name dns.dns.dns.dns
domain default.domain.invalid
permit same-security-traffic intra-interface
object-group Protocol TCPUDP
object-protocol udp
object-tcp protocol
object-group service RDP - tcp
RDP description
EQ port 3389 object
Access extensive list ip 192.168.17.0 LAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Standard access list LAN_IP allow 192.168.17.0 255.255.255.0
WAN_access_in list of allowed ip extended access all any debug log
WAN_access_in list extended access permitted ip OLD-private interface WAN newspaper inactive debugging interface
WAN_access_in list extended access permit tcp any object-group RDP any RDP log debugging object-group
MANAGEMENT_access_in list of allowed ip extended access all any debug log
access-list extended OLD-PRIVATE_access_in any allowed ip no matter what debug log
access-list OLD-PRIVATE_access_in extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 inactive debug log
OLD-PRIVATE_access_in allowed extended object-group TCPUDP host 192.168.10.7 access-list no matter how inactive debug log
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.10.254 interface private OLD newspaper inactive debugging
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.17.155 interface private OLD newspaper debugging
access-list 101 extended allow host tcp 192.168.10.7 any eq 3389 debug log
Access extensive list ip 192.168.17.0 WAN_1_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_cryptomap_2 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
Capin list extended access permit ip host 192.18.17.155 192.168.10.7
Capin list extended access permit ip host 192.168.10.7 192.168.17.155
LAN_access_in list of allowed ip extended access all any debug log
Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Access extensive list ip 192.168.17.0 WAN_2_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0

permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0
pager lines 24
Enable logging
recording of debug trap
logging of debug asdm
Debugging trace record
Debug class auth record trap
MTU 1500 WAN
MTU 1500 OLD-private
MTU 1500 management
mask 192.168.1.150 - 192.168.1.199 255.255.255.0 IP local pool VPN_Admin_IP
no failover
ICMP unreachable rate-limit 1 burst-size 1
ICMP permitted host a.a.a.a WAN
ICMP deny any WAN
ICMP permitted host 192.168.10.7 WAN
ICMP permitted host b.b.b.b WAN
ASDM image disk0: / asdm - 631.bin
don't allow no asdm history
ARP timeout 14400
Global (OLD-private) 1 interface
Global interface (management) 1
NAT (WAN) 1 0.0.0.0 0.0.0.0

inside_nat0_outbound (WAN) NAT 0 access list
WAN_access_in access to the WAN interface group
Access-group interface private-OLD OLD-PRIVATE_access_in
Access-group MANAGEMENT_access_in in the management interface
Route WAN 0.0.0.0 0.0.0.0 b.b.b.185 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
local AAA authentication attempts 10 max in case of failure
Enable http server
http 192.168.1.0 255.255.255.0 WAN
http 0.0.0.0 0.0.0.0 WAN
http b.b.b.b 255.255.255.255 WAN
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Service resetoutside
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto WAN_map 1 corresponds to the address WAN_1_cryptomap
card crypto WAN_map 1 set peer a.a.a.a
WAN_map 1 transform-set ESP-DES-SHA crypto card game
card crypto WAN_map WAN interface
ISAKMP crypto enable WAN
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
the Encryption
sha hash
Group 1
life 86400
Telnet timeout 5
SSH a.a.a.a 255.255.255.255 WAN
SSH timeout 30
SSH version 2
Console timeout 0
dhcpd auto_config management
!

a basic threat threat detection
host of statistical threat detection
Statistics-list of access threat detection
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
NTP server 129.6.15.28 source WAN prefer
WebVPN
attributes of Group Policy DfltGrpPolicy
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
internal admin group strategy
group admin policy attributes
DNS.DNS.DNS.DNS value of DNS server
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list LAN_IP
privilege of encrypted password password username administrator 15
type tunnel-group admin remote access
tunnel-group admin general attributes
address pool VPN_Admin_IP
strategy-group-by default admin
tunnel-group a.a.a.a type ipsec-l2l
tunnel-group a.a.a.a general-attributes
strategy-group-by default admin
a.a.a.a group of tunnel ipsec-attributes
pre-shared-key *.
NOCHECK Peer-id-validate
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!

Thank you for your time and help

Why you use this NAT type?

Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 any
NAT (OLD-private) 0-list of access WAN_nat0_outbound

You are basically saying the ASA not NAT traffic. This private IP address range is not routed on the Internet. This traffic is destined to be sent over the Internet? If so, that LAC should then not be there.

If you want NAT traffic to one IP public outside the ASA, you must remove this line and let the NAT and GLOBAL work:

NAT (OLD-private) 1 0.0.0.0 0.0.0.0

Global (WAN) 1 interface

Remote access VPN routing

Hello

I'm having a problem on the VPN routing.

The VPN client is connected correctly to ASA5510, but cannot access inside ASA and the Internet or another network. What I want to achieve is.

[email protected] / * / -> ASA5520 (public IP)-> Inside (172.16.1.0)

The VPN address pool uses 172.168.10.0 (I also tried 172.16.1.100 - 120 with the same network from the inside).

interface GigabitEthernet0/0

nameif outside

security-level 0

IP address a.a.a.a 255.255.255.0

!

interface GigabitEthernet0/1

nameif inside

security-level 100

IP 172.16.1.1 255.255.255.0

IP local pool vpnpool 192.168.10.1 - 192.168.10.254 mask 255.255.255.0

access extensive list ip 172.16.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

internal VPNstaff group strategy

attributes of Group Policy VPNstaff

4.2.2.2 DNS server value

Protocol-tunnel-VPN IPSec

type tunnel-group VPNstaff remote access

attributes global-tunnel-group VPNstaff

address vpnpool pool

Group Policy - by default-VPNstaff

IPSec-attributes tunnel-group VPNstaff

pre-shared-key *.

Hello

A quick test, try this.

-Turn on nat - t (if its disable)

Command: crypto isakmp nat-traversal 20

see if it helps.

If not,

-Run a continuous ping from the client to the ASA inside the interface, make sure that you run the command 'management-access to inside' before you start with the ping.

-Time our RESPONSE ICMP or inside the interface... ?

If time-out, then

-Check the number of decrypts using the command "show crypto ipsec his"

If ICMP response to inside interface is received by the VPN client.

-Ping to an internal host behind the ASA.

-"Show crypto ipsec his"

IF you have received responses if first test then here you should see decrypts number increases.

-Apply the catches on the inside of the interface

You can consult the document below

http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a0080a9edd6.shtml

-If you see the package source as VPN client interface to reach the inside interface for the destination of the host behind the ASA, then its a problem with your routing internal.

In case you have an L3 device connected to the ASA inside the interface, make sure that you have a route for GW subnet 192.168.1.x as ASA inside the interface i.e. 172.16.1.1 score

If his L2 or a dumb device, then as a quic test, make the following statement of the road using the command-line in windows on the host computer behind the asa participant in this test.

route add 192.168.1.0 mask 255.255.255.0 172.16.1.1

Please let me know if it helps.

Concerning

M

NVI0 got a wrong address

Hello

I hope that someone knows better than me:

Sometimes I address of 'bad' on the NVI0 Interface. I use the 'old' Setup nat with nat inside and outside. Sometimes the address of the NVI is that of a local loop (then everything works, as ospf between two routers) and the next router has the address of the external interface on the NVI. How that decision is made?

----------------------------------------

NVI0 is up, line protocol is up

The interface is unnumbered. Using the address of Loopback10 (10.51.2.10)

Broadcast address is 255.255.255.255

MTU is 1 514 bytes

Support address is not set

Transfer of directed broadcast is disabled

Multicast reserved joined groups: 224.0.0.5

Outgoing access list is not defined

Inbound access list is not defined

Proxy ARP is enabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are always sent

ICMP unreachable is always sent

Mask the ICMP responses are never sent

IP fast switching is disabled

Fast on the same switching interface IP is disabled

IP stream switching is disabled

IP CEF switching is disabled

Turbo IP vector draw

Quick change IP multicast is enabled

Fast switching of distributed IP multicast is disabled

Flags of IP route cache is fast, CEF

Router discovery is disabled

Output IP packet accounting is disabled

Accounting of IP access violation is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Policy routing is disabled

Network address translation is disabled

BGP policy mapping is disabled

WCCP redirect outgoing is disabled

WCCP redirect incoming is disabled

WCCP redirect exclude is disabled

----------------------------------------

NVI0 is up, line protocol is up

The interface is unnumbered. Using FastEthernet0/0 address (87.193. *. *)

Broadcast address is 255.255.255.255

MTU is 1 514 bytes

Support address is not set

Transfer of directed broadcast is disabled

Outgoing access list is not defined

Inbound access list is not defined

Proxy ARP is enabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are always sent

ICMP unreachable is always sent

Mask the ICMP responses are never sent

IP fast switching is disabled

Fast on the same switching interface IP is disabled

IP stream switching is disabled

IP CEF switching is disabled

Turbo IP vector draw

Quick change IP multicast is enabled

Fast switching of distributed IP multicast is disabled

Flags of IP route cache is fast, CEF

Router discovery is disabled

Output IP packet accounting is disabled

Accounting of IP access violation is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Policy routing is disabled

Network address translation is disabled

BGP policy mapping is disabled

WCCP redirect outgoing is disabled

WCCP redirect incoming is disabled

WCCP redirect exclude is disabled

--------------------------------------

Thanks in advance

NVI is a new feature in IOS 12.3 and later versions.

It is activated using 'ip nat enable' on interfaces and we do not 'ip nat inside' or 'ip nat outside '.

If you want to understand how translation and routing differs verifying implementation following the link:

http://blog.internetworkexpert.com/2008/02/15/the-inside-and-outside-of-NAT/

VPN site-to-site between ASA 5505 and 2911

Hi all

I'm trying to setup VPN S2S. A.a.a.a of ip for the router 2911 office, remote office ASA 5505 8.4 (3) with ip b.b.b.b, but no luck.

2911 config:

version 15.2

horodateurs service debug datetime msec

Log service timestamps datetime msec

encryption password service

host name 2911

boot-start-marker

Boot system flash c2900-universalk9-mz. Spa. 152 - 2.T.bin

boot-end-marker

Min-length 10 Security passwords

logging buffered 51200 warnings

No aaa new-model

min-threshold queue spd IPv6 62

Max-threshold queue spd IPv6 63

No ipv6 cef

the 5 IP auth-proxy max-login-attempts

max-login-attempts of the IP 5 admission

DHCP excluded-address IP 192.168.10.1 192.168.10.99

DHCP excluded-address IP 192.168.22.1 192.168.22.99

DHCP excluded-address IP 192.168.33.1 192.168.33.99

DHCP excluded-address IP 192.168.44.1 192.168.44.99

DHCP excluded-address IP 192.168.55.1 192.168.55.99

192.168.10.240 IP dhcp excluded-address 192.168.10.254

DHCP excluded-address IP 192.168.22.240 192.168.22.254

DHCP excluded-address IP 192.168.33.240 192.168.33.254

DHCP excluded-address IP 192.168.44.240 192.168.44.254

DHCP excluded-address IP 192.168.55.240 192.168.55.254

desktop IP dhcp pool

import all

network 192.168.33.0 255.255.255.0

router by default - 192.168.33.254

192.168.10.10 DNS server 202.50.246.41 202.50.246.42

local domain name

-192.168.10.10 NetBIOS name server

h-node NetBIOS node type

wi - fi IP dhcp pool

import all

network 192.168.44.0 255.255.255.0

192.168.10.10 DNS server 202.50.246.41 202.50.246.42

local domain name

router by default - 192.168.44.254

-192.168.10.10 NetBIOS name server

h-node NetBIOS node type

DMZ IP dhcp pool

import all

network 192.168.55.0 255.255.255.0

192.168.10.10 DNS server 202.50.246.41 202.50.246.42

local domain name

router by default - 192.168.55.254

-192.168.10.10 NetBIOS name server

h-node NetBIOS node type

IP dhcp pool voip

import all

network 192.168.22.0 255.255.255.0

192.168.10.10 DNS server 202.50.246.41 202.50.246.42

local domain name

router by default - 192.168.22.254

-192.168.10.10 NetBIOS name server

h-node NetBIOS node type

IP dhcp pool servers

import all

network 192.168.10.0 255.255.255.0

default router 192.168.10.254

192.168.10.10 DNS server 202.50.246.41 202.50.246.42

local domain name

-192.168.10.10 NetBIOS name server

h-node NetBIOS node type

IP domain name of domain

name-server IP 192.168.10.10

IP cef

connection-for block 180 tent 3-180

Timeout 10

VLAN ifdescr detail

Authenticated MultiLink bundle-name Panel

Crypto pki token removal timeout default 0

Crypto pki trustpoint TP-self-signed-3956567439

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 3956567439

revocation checking no

rsakeypair TP-self-signed-3956567439

TP-self-signed-3956567439 crypto pki certificate chain

certificate self-signed 01 nvram:IOS - Self-Sig #1.cer

license udi pid sn CISCO2911/K9

the FULL_NET object-group network

full range of the network Description

192.168.10.0 255.255.255.0

192.168.11.0 255.255.255.0

192.168.22.0 255.255.255.0

192.168.33.0 255.255.255.0

192.168.44.0 255.255.255.0

object-group network limited

description without servers and router network

192.168.22.0 255.255.255.0

192.168.33.0 255.255.255.0

192.168.44.0 255.255.255.0

VTP version 2

password username admin privilege 0 password 7

redundancy

no passive ftp ip

crypto ISAKMP policy 10

BA aes 256

sha512 hash

preshared authentication

ISAKMP crypto key admin address b.b.b.b

invalid-spi-recovery crypto ISAKMP

Crypto ipsec transform-set esp - aes esp-sha-hmac SET

10 map ipsec-isakmp crypto map

the value of b.b.b.b peer

Set transform-set

match address 160

Interface Port - Channel 1

no ip address

waiting-150 to

Interface Port - channel1.1

encapsulation dot1Q 1 native

IP 192.168.11.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

Interface Port - channel1.10

encapsulation dot1Q 10

IP address 192.168.10.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

Interface Port - channel1.22

encapsulation dot1Q 22

IP 192.168.22.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

Interface Port - channel1.33

encapsulation dot1Q 33

IP 192.168.33.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

Interface Port - channel1.44

encapsulation dot1Q 44

IP 192.168.44.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

Interface Port - channel1.55

encapsulation dot1Q 55

IP 192.168.55.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

the Embedded-Service-Engine0/0 interface

no ip address

Shutdown

interface GigabitEthernet0/0

Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE $ 0/0

no ip address

Shutdown

automatic duplex

automatic speed

interface GigabitEthernet0/1

no ip address

automatic duplex

automatic speed

channel-group 1

interface GigabitEthernet0/2

Description $ES_LAN$

no ip address

automatic duplex

automatic speed

channel-group 1

interface GigabitEthernet0/0/0

IP address a.a.a.a 255.255.255.224

NAT outside IP

IP virtual-reassembly in

automatic duplex

automatic speed

crypto map

IP forward-Protocol ND

no ip address of the http server

23 class IP http access

local IP http authentication

IP http secure server

IP http timeout policy slowed down 60 life 86400 request 10000

overload of IP nat inside source list NAT_INTERNET interface GigabitEthernet0/0/0

IP nat inside source udp 500 interface GigabitEthernet0/0/0 500 a.a.a.a static

IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx

NAT_INTERNET extended IP access list

refuse the object-group ip FULL_NET 192.168.17.0 0.0.0.255

refuse the object-group ip FULL_NET 192.168.1.0 0.0.0.255

permit ip FULL_NET object-group everything

access-list 1 permit 192.168.44.100

access-list 23 allow 192.168.10.7

access-list 23 permit 192.168.44.0 0.0.0.255

access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

access-list 160 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

control plan

Line con 0

password password 7

opening of session

line to 0

line 2

no activation-character

No exec

preferred no transport

transport of entry all

transport output pad rlogin lapb - your MOP v120 udptn ssh telnet

StopBits 1

line vty 0 4

access-class 23 in

privilege level 15

local connection

entry ssh transport

line vty 5 15

access-class 23 in

privilege level 15

local connection

entry ssh transport

Scheduler allocate 20000 1000

end

The ASA config:

: Saved : ASA Version 8.4(3) ! hostname C domain-name domain enable password password encrypted passwd passwd encrypted names ! interface Ethernet0/0 ! interface Ethernet0/1 shutdown ! interface Ethernet0/2 shutdown ! interface Ethernet0/3 shutdown ! interface Ethernet0/4 shutdown ! interface Ethernet0/5 switchport access vlan 100 ! interface Ethernet0/6 switchport trunk allowed vlan 2,6 switchport mode trunk ! interface Ethernet0/7 shutdown ! interface Vlan1 description INTERNET mac-address 1234.5678.0001 nameif WAN security-level 0 ip address b.b.b.b 255.255.255.248 standby c.c.c.c ospf cost 10 ! interface Vlan2 description OLD-PRIVATE mac-address 1234.5678.0102 nameif OLD-Private security-level 100 ip address 192.168.17.2 255.255.255.0 standby 192.168.17.3 ospf cost 10 ! interface Vlan6 description MANAGEMENT mac-address 1234.5678.0106 nameif Management security-level 100 ip address 192.168.1.2 255.255.255.0 standby 192.168.1.3 ospf cost 10 ! interface Vlan100 description LAN Failover Interface ! boot system disk0:/asa843-k8.bin ftp mode passive clock timezone NZST 12 clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 2:00 dns domain-lookup WAN dns server-group DefaultDNS name-server 208.67.222.222 domain-name domain same-security-traffic permit intra-interface object network obj-192.168.17.0 subnet 192.168.17.0 255.255.255.0 object network obj-192.168.10.0 subnet 192.168.10.0 255.255.255.0 object network obj-192.168.2.0 subnet 192.168.2.0 255.255.255.0 object network obj-192.168.9.0 subnet 192.168.9.0 255.255.255.0 object network obj-192.168.33.0 subnet 192.168.33.0 255.255.255.0 object network obj-192.168.44.0 subnet 192.168.44.0 255.255.255.0 object network obj_any object network obj_any-01 object network NETWORK_OBJ_192.168.10.0_24 subnet 192.168.10.0 255.255.255.0 object network NETWORK_OBJ_192.168.17.0_24 subnet 192.168.17.0 255.255.255.0 object network subnet-00 subnet 0.0.0.0 0.0.0.0 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service RDP tcp description RDP port-object eq 3389 object-group network DM_INLINE_NETWORK_1 network-object 192.168.17.0 255.255.255.0 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network DM_INLINE_NETWORK_2 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network subnet-17 network-object 192.168.17.0 255.255.255.0 object-group network subnet-2 network-object 192.168.2.0 255.255.255.0 object-group network subnet-9 network-object 192.168.9.0 255.255.255.0 object-group network subnet-10 network-object 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP standard permit 192.168.17.0 255.255.255.0 access-list WAN_access_in extended permit ip any any log debugging access-list WAN_access_in extended permit tcp any object-group RDP any object-group RDP log debugging access-list WAN_access_in extended permit icmp x.x.x.x 255.255.255.248 192.168.10.0 255.255.255.0 access-list MANAGEMENT_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit icmp any object-group DM_INLINE_NETWORK_1 access-list 101 extended permit tcp host 192.168.10.7 any eq 3389 log debugging access-list WAN_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_1_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list CiscoVPNClient_splitTunnelAcl standard permit 192.168.17.0 255.255.255.0 access-list LAN_access_in extended permit ip any any log debugging access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP_inbound standard permit 192.168.10.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 access-list vpnusers_splitTunnelAcl extended permit ip 192.168.17.0 255.255.255.0 any access-list nonat-in extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 52000 logging monitor informational logging trap informational logging asdm informational logging from-address syslog logging recipient-address admin level errors logging host OLD-Private 192.168.17.110 format emblem logging debug-trace logging permit-hostdown mtu WAN 1500 mtu OLD-Private 1500 mtu Management 1500 ip local pool VPN_Admin_IP 192.168.1.150-192.168.1.199 mask 255.255.255.0 ip local pool vpnclient 192.168.2.1-192.168.2.5 mask 255.255.255.0 failover failover lan unit primary failover lan interface failover Vlan100 failover polltime interface 15 holdtime 75 failover key ***** failover interface ip failover 192.168.100.1 255.255.255.0 standby 192.168.100.2 icmp unreachable rate-limit 1 burst-size 1 icmp permit 192.168.10.0 255.255.255.0 WAN icmp permit host x.x.x.x WAN icmp permit 192.168.17.0 255.255.255.0 WAN icmp permit host c.c.c.c WAN icmp permit host a.a.a.a WAN icmp deny any WAN icmp permit 192.168.10.0 255.255.255.0 OLD-Private icmp permit 192.168.17.0 255.255.255.0 OLD-Private icmp permit host a.a.a.a OLD-Private icmp permit host 192.168.10.0 Management icmp permit host 192.168.17.138 Management icmp permit 192.168.1.0 255.255.255.0 Management icmp permit host 192.168.1.26 Management icmp permit host a.a.a.a Management asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-10 subnet-10 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-2 subnet-2 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-9 subnet-9 no-proxy-arp nat (Management,WAN) source static NETWORK_OBJ_192.168.17.0_24 NETWORK_OBJ_192.168.17.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup ! object network subnet-00 nat (OLD-Private,WAN) dynamic interface access-group WAN_access_in in interface WAN access-group OLD-PRIVATE_access_in in interface OLD-Private access-group MANAGEMENT_access_in in interface Management route WAN 0.0.0.0 0.0.0.0 x.x.x.x 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa local authentication attempts max-fail 10 http server enable http b.b.b.b 255.255.255.255 WAN http 0.0.0.0 0.0.0.0 WAN no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart service resetoutside crypto ipsec ikev1 transform-set OFFICE esp-aes esp-sha-hmac crypto map WAN_map 1 match address WAN_1_cryptomap crypto map WAN_map 1 set pfs crypto map WAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map Office 2 match address WAN_1_cryptomap crypto map Office 2 set peer a.a.a.a crypto map Office interface WAN crypto map MAP 10 set peer a.a.a.a crypto map MAP 10 set ikev1 transform-set OFFICE crypto ikev2 enable WAN crypto ikev1 enable WAN crypto ikev1 policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption des hash sha group 1 lifetime 86400 telnet timeout 5 ssh a.a.a.a 255.255.255.255 WAN ssh timeout 30 ssh version 2 console timeout 0 dhcpd auto_config OLD-Private ! threat-detection basic-threat threat-detection statistics host threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 129.6.15.28 source WAN prefer webvpn group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ssl-client ssl-clientless group-policy admin internal group-policy admin attributes dns-server value 208.67.222.222 156.154.70.1 vpn-tunnel-protocol ikev1 group-policy GroupPolicy_a.a.a.a internal group-policy GroupPolicy_a.a.a.a attributes vpn-tunnel-protocol ikev1 ikev2 group-policy CiscoVPNClient internal group-policy CiscoVPNClient attributes vpn-idle-timeout 30 vpn-session-timeout none vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value CiscoVPNClient_splitTunnelAcl username admin password password encrypted privilege 15 tunnel-group admin type remote-access tunnel-group admin general-attributes address-pool vpnclient authorization-server-group LOCAL default-group-policy admin tunnel-group a.a.a.a type ipsec-l2l tunnel-group a.a.a.a general-attributes default-group-policy GroupPolicy_a.a.a.a tunnel-group a.a.a.a ipsec-attributes ikev1 pre-shared-key ***** ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** tunnel-group CiscoVPNClient type remote-access tunnel-group CiscoVPNClient general-attributes address-pool vpnclient default-group-policy CiscoVPNClient tunnel-group CiscoVPNClient ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp ! service-policy global_policy global smtp-server 192.168.17.10 prompt hostname context no call-home reporting anonymous call-home contact-email-addr admin contact-name admin profile CiscoTAC-1   no active : end asdm image disk0:/asdm-647.bin asdm location c.c.c.c 255.255.255.255 WAN asdm location 192.168.17.2 255.255.255.255 WAN asdm location a.a.a.a 255.255.255.255 OLD-Private no asdm history enable

ASA:

# show crypto ipsec his

There is no ipsec security associations

# show crypto isakmp his

There are no SAs IKEv1

There are no SAs IKEv2

2911:

#show crypto ipsec his

Interface: GigabitEthernet0/0/0

Tag crypto map: map, addr a.a.a.a local

protégé of the vrf: (none)

local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (192.168.17.0/255.255.255.0/0/0)

current_peer b.b.b.b port 500

LICENCE, flags is {origin_is_acl},

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, #pkts compr. has failed: 0

#pkts not unpacked: 0, #pkts decompress failed: 0

Errors of #send 4, #recv errors 0

local crypto endpt. : a.a.a.a, remote Start crypto. : b.b.b.b

Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0/0

current outbound SPI: 0x0 (0)

PFS (Y/N): N, Diffie-Hellman group: no

SAS of the esp on arrival:

-Other - arrival ah sas:

-More-

-More - CFP sas on arrival:

-More-

-More - outgoing esp sas:

-More-

-More - out ah sas:

-More-

-More - out CFP sas:

Thanks for your time,

Nick

Please add

map Office 2 set transform-set OFFICE ikev1 crypto

If it is not helpful, please enable debug crypto ipsec 255 and paste here.

HTH. Please rate if it was helpful. "Correct answer" will be also pleasant.

VPN Site-to-Site - cannot ping the router's internal IP address

Hi guys,.

I configured a VPN site-to site between two routers, everything works well except ping the internal (LAN) IP of a router.

Everything works fine: ping the hosts through the tunnel in both feel.

Routers that I use:

-IOS 1841: M3 15.0 (1)

-2811 IOS: 15.0 (1) M5-> here is the problem. I can't ping the inside interface of the router.

I checked its ipsec counters and it seems that it does not send packets through the tunnel when I ping from the LAN interface.

#pkts program is not incrementing.

Anyone had this problem before?

Thank you very much.

Best regards

I think that happens because when the router responds to icmp request he gets is outside interface IP (not the IP Address of the inside interface, wich you are trying to ping) as the source of a package. If icmp-response does not go in the tunnel, because the IP address in the router's external interface is not included in the crypto-acl.

Solution to this, if it's correct guess, is to add the router's external IP to the crypto-acl.

Cisco VPN client put in place

Hi guru of cisco

Help me please to configure VPN access on ASA 5505 for Cisco VPN Client. I want to let the customers gateway, but access remote 192.168.17.0/24 and 192.168.10.0/24 (connected through site-to-site) networks.

Will be much appreciated for your help.

My config:

Output from the command: 'display conf '.

!
ASA Version 8.2 (2)
!
name of host host1
domain domain name
activate the encrypted password password
encrypted passwd password
names of
!
interface Vlan1
Description INTERNET
0000.0000.0001 Mac address
nameif WAN
security-level 0
IP address a.a.a.a 255.255.255.248 watch a1.a1.a1.a1
OSPF cost 10
!
interface Vlan2
OLD-PRIVATE description
0000.0000.0102 Mac address
nameif OLD-private
security-level 100
IP 192.168.17.2 255.255.255.0 watch 192.168.17.3
OSPF cost 10
!
interface Vlan6
Description MANAGEMENT
0000.0000.0106 Mac address
nameif management
security-level 100
IP 192.168.1.2 255.255.255.0 ensures 192.168.1.3
OSPF cost 10
!
interface Vlan100
Failover LAN Interface Description
!
interface Ethernet0/0
!
interface Ethernet0/1
Shutdown
!
interface Ethernet0/2
Shutdown
!
interface Ethernet0/3
Shutdown
!
interface Ethernet0/4
Shutdown
!
interface Ethernet0/5
switchport access vlan 100
!
interface Ethernet0/6
switchport trunk allowed vlan 2.6
switchport mode trunk
!
interface Ethernet0/7
Shutdown
!
boot system Disk0: / asa822 - k8.bin
passive FTP mode
DNS domain-lookup WAN
DNS server-group DefaultDNS
Server name dns.dns.dns.dns
domain domain name
permit same-security-traffic intra-interface
object-group Protocol TCPUDP
object-protocol udp
object-tcp protocol
object-group service RDP - tcp
RDP description
EQ port 3389 object
object-group Protocol DM_INLINE_PROTOCOL_1
ip protocol object
icmp protocol object
object-protocol udp
object-tcp protocol
Access extensive list ip 192.168.17.0 LAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Standard access list LAN_IP allow 192.168.17.0 255.255.255.0
WAN_access_in list of allowed ip extended access all any debug log
WAN_access_in list extended access allowed icmp a.a.a.a 255.255.255.248 192.168.10.0 255.255.255.0 inactive debug log
WAN_access_in list extended access permit tcp any object-group RDP any RDP log debugging object-group
WAN_access_in list extended access allowed icmp a.a.a.a 255.255.255.248 a.a.a.a 255.255.255.248 debug log
MANAGEMENT_access_in list of allowed ip extended access all any debug log
access-list extended OLD-PRIVATE_access_in any allowed ip no matter what debug log
access-list OLD-PRIVATE_access_in allowed extended object-group DM_INLINE_PROTOCOL_1 interface OLD-private 192.168.10.0 255.255.255.0 inactive debug log
access-list OLD-PRIVATE_access_in allowed extended object-group TCPUDP interface OLD-private no matter what inactive debug log
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.10.254 interface private OLD newspaper inactive debugging
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.17.155 interface private OLD newspaper debugging
access-list 101 extended allow host tcp 192.168.10.7 any eq 3389 debug log
Access extensive list ip 192.168.17.0 WAN_1_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_cryptomap_2 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
Capin list extended access permit ip host 192.18.17.155 192.168.10.7
Capin list extended access permit ip host 192.168.10.7 192.168.17.155
LAN_access_in list of allowed ip extended access all any debug log
Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_nat0_outbound list of allowed ip extended access all 192.168.17.240 255.255.255.252
WAN_nat0_outbound to access extended list ip 192.168.2.0 allow 255.255.255.0 192.168.2.0 255.255.255.248
Access extensive list ip 192.168.17.0 WAN_2_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0
permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0
LAN_IP_inbound list standard access allowed 192.168.10.0 255.255.255.0
Standard access list IPSec_VPN_splitTunnelAcl allow a
access extensive list ip 192.168.17.0 vpnusers_splitTunnelAcl allow 255.255.255.0 any
sheep - in extended Access-list allow IP 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0
vpn_ipsec_splitTunnelAcl list standard access allowed 192.168.2.0 255.255.255.0
pager lines 24
Enable logging
logging trap information
asdm of logging of information
Debugging trace record
MTU 1500 WAN
MTU 1500 OLD-private
MTU 1500 management
mask 192.168.1.150 - 192.168.1.199 255.255.255.0 IP local pool VPN_Admin_IP
IP local pool vpnclient 192.168.2.1 - 192.168.2.5 mask 255.255.255.0
failover
primary failover lan unit
failover lan interface failover Vlan100
15 75 holdtime interface failover pollTime
key changeover *.
failover interface ip failover 192.168.100.1 255.255.255.0 ensures 192.168.100.2
ICMP unreachable rate-limit 1 burst-size 1
ICMP permitted host b.b.b.b WAN
ICMP allow 192.168.10.0 255.255.255.0 WAN
ICMP permitted host c.c.c.c WAN
ICMP allow 192.168.17.0 255.255.255.0 WAN
ICMP deny any WAN
ICMP permitted host OLD-private b.b.b.b
ICMP allow 192.168.10.0 255.255.255.0 OLD-private
ICMP allow 192.168.17.0 255.255.255.0 OLD-private
ICMP permitted host c.c.c.c OLD-private
ICMP permitted host b.b.b.b management
ICMP permitted host 192.168.10.0 management
ICMP permitted host 192.168.17.138 management
ICMP permit 192.168.1.0 255.255.255.0 management
ICMP permitted host 192.168.1.26 management
ASDM image disk0: / asdm - 631.bin
don't allow no asdm history
ARP timeout 14400
Global (WAN) 1 interface
Global (OLD-private) 1 interface
Global interface (management) 1
NAT (OLD-private) 0-list of access WAN_nat0_outbound
NAT (OLD-private) 1 0.0.0.0 0.0.0.0
WAN_access_in access to the WAN interface group
Access-group interface private-OLD OLD-PRIVATE_access_in
Access-group MANAGEMENT_access_in in the management interface
Route WAN 0.0.0.0 0.0.0.0 a.a.a.185 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
local AAA authentication attempts 10 max in case of failure
Enable http server
http 192.168.1.0 255.255.255.0 WAN
http 0.0.0.0 0.0.0.0 WAN
http a.a.a.a 255.255.255.255 WAN
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Service resetoutside
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto WAN_map 1 corresponds to the address WAN_1_cryptomap
card crypto WAN_map 1 set peer b.b.b.b
WAN_map 1 transform-set ESP-DES-SHA crypto card game
card crypto WAN_map WAN interface
ISAKMP crypto enable WAN
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
the Encryption
sha hash
Group 1
life 86400
Telnet timeout 5
SSH b.b.b.b 255.255.255.255 WAN
SSH timeout 30
SSH version 2
Console timeout 0
dhcpd auto_config OLD-private
!

a basic threat threat detection
host of statistical threat detection
Statistics-list of access threat detection
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
NTP server 129.6.15.28 source WAN prefer
WebVPN
attributes of Group Policy DfltGrpPolicy
Protocol-tunnel-VPN IPSec svc webvpn
internal admin group strategy
group admin policy attributes
DNS.DNS.DNS.DNS value of DNS server
Protocol-tunnel-VPN IPSec
internal vpn_ipsec group policy
attributes of the strategy of group vpn_ipsec
value 192.168.17.80 DNS server dns.dns.dns.dns
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list vpn_ipsec_splitTunnelAcl
the address value vpnclient pools
username admin password encrypted password privilege 15
n1ck encrypted password privilege 15 password username
type tunnel-group admin remote access
tunnel-group admin general attributes
address pool IPSec_VPN_pool
vpnclient address pool
LOCAL authority-server-group
strategy-group-by default admin
tunnel-group admin ipsec-attributes
pre-shared-key *.
tunnel-group b.b.b.b type ipsec-l2l
tunnel-group b.b.b.b General-attributes
strategy-group-by default admin
b.b.b.b tunnel ipsec-attributes group
pre-shared-key *.
NOCHECK Peer-id-validate
type tunnel-group vpn_ipsec remote access
tunnel-group vpn_ipsec General-attributes
vpnclient address pool
Group Policy - by default-vpn_ipsec
vpn_ipsec group of tunnel ipsec-attributes
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp

Thanks a lot for the confirmation. There is some lack of configurations and also some configuration errors.

They are here:

(1) Split tunnel-access list is incorrect:

vpn_ipsec_splitTunnelAcl list standard access allowed 192.168.2.0 255.255.255.0

It should be allowed in your internal network. Please, add and remove the following:

standard access list vpn_ipsec_splitTunnelAcl allow 192.168.17.0 255.255.255.0

No vpn_ipsec_splitTunnelAcl of the standard access list only allowed 192.168.2.0 255.255.255.0

(2) NAT 0-list of access should also include the traffic between the local subnet to the Pool of IP VPN:

Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 192.168.2.0 255.255.255.0

(3) dynamic-map has not been created and assigned to crypto card:

Crypto-map dynamic dynmap 10 game of transformation-ESP-3DES-SHA

card crypto ipsec WAN_map 65000-isakmp dynamic dynmap

(4) Finally, you have not enabled protocol IPSec in your group strategy:

attributes of the strategy of group vpn_ipsec

Protocol-tunnel-VPN IPSec

Hope that helps.

If it still does not after the changes described above, please kindly share the latest config and also the output of the following debugs when you try to connect:

debugging cry isa

debugging ipsec cry

WRT160NL WAN ICMP responses

Similar Questions

Maybe you are looking for