About fanheuser

fanheuser · 05-23-2007

Hi all,I am looking for help in setting up address translation on an ASA (version 7.2) with the following scenario:-- four network interfaces: inside, DMZ1, DMZ2, outside-- inside and DMZ1 have limited number of subnets, DMZ2 has many subnets (routin...

fanheuser · 01-05-2006

On a VPN client configured for mutual group authentication to a VPN 3000 headend, is it possible to restrict which root certificate is matched against the VPN concentrator's identity certificate?Background: multiple CA root certificates are installed...

fanheuser · 07-08-2005

Hi all,can anybody help me with the following problem: a Cisco VPN client (4.0.5D) connects to different VPN 3000 concentrators (all on 4.1.7A) using certificate based authentication. During IKE negotiation (main mode), the payload with which the cli...

fanheuser · 06-08-2007

Hi,I've seen that, too -- my guess is that this indeed is a bug: the ASA 5505 internally has switch ports only, which are kept separate by using VLANs. Apparently, the 5505 SNMP agent is smart enough to show the VLAN interface names and addresses, bu...

fanheuser · 05-24-2007

Hello zulgurnain,thank you, basically this would work. Unfortunately, DMZ2 has a couple of hundreds of subnets, which also change frequently (this is why I use a routing protocol on that interface). Therefore, I am looking for a configuration where I...

fanheuser · 01-13-2006

Ordering the list does not help, because I want only to match against certain of all installed root certificates.Thanks nevertheless ... in the meantime, I found something:-- VPN client version 4.0.5: no restriction possible, only the certificate sto...

fanheuser · 01-05-2006

The CA trustpoint cannot be used for this purpose. But you can create another trustpoint on the CA router, where you give all enrollment parameters.

fanheuser · 07-12-2005

Hello "ehirsel",the client is running on Windows XP Professional SP1. In both cases, "IPSec over NAT-T" is configured, which does a NAT detection and uses the UDP port 4500 if NAT is required. In all test cases, client side NAT was detected, and no N...

Member Since	‎12-04-2002 11:20 PM
Date Last Visited	‎08-18-2017 03:50 AM
Posts	9

User Statistics

User Activity

How to achieve PAT for one of two outside interfaces only?

VPN client mutual group authentication -- restrict root cert

VPN client to VPN 3000: how to use IKE fragmentation?

Re: ASA 5505 - snmp not working

Re: How to achieve PAT for one of two outside interfaces only?

Re: VPN client mutual group authentication -- restrict root cert

Re: DMVPN Hub as it's own CA Server?

Re: VPN client to VPN 3000: how to use IKE fragmentation?