Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About sandervanloosbroek
Stats
Member since
07-22-2010
37
Posts
0
Helpful
0
Solutions
Created by
sandervanloosbr
in Security Documents
in Security Documents
07-31-2012
09:03 AM
07-31-2012
09:03 AM
Works great, did need to re-add ssl trustpoint to gateway, reload router and import certificate again but other than that no problems.
... View more
Created by
sandervanloosbr
in Security Management
12-14-2011
12:57 AM
12-14-2011
12:57 AM
Hi Fisher, Appreciate the thanks, please rate my answer if it helped you so others can also find it quickly. For this customer this wasn't an option as he doesn't run his own DNS. The network is too small to warrant that. That being said, your hint might prove useful in a different case. Thanks for the update! S.
... View more
Created by
sandervanloosbr
in VPN and AnyConnect
08-01-2011
06:30 AM
08-01-2011
06:30 AM
If you email your headend address to Steve (see the post above yours in this thread) he will confirm to you if your certificate is affected and if 3.0.3 will work for you. They are aware of an issue with some certificates and are working on it.
... View more
Created by
sandervanloosbr
in VPN and AnyConnect
07-06-2011
06:11 AM
07-06-2011
06:11 AM
I'm having trouble getting this to work, after my upgrade to Mac OS X Lion the Anyconnect client can no longer login. Reinstalling didn't work for me. What are other experiencing?
... View more
Labels:
Created by
sandervanloosbr
in Firewalls
12-22-2010
01:12 PM
12-22-2010
01:12 PM
Ok I fixed it. For some reason the class-default inspect action doesn't work when there's nothing to inspect. I created a class-map that inspects everything: class-map type inspect match-any UnrestrictedInternet match protocol tcp match protocol udp match protocol icmp That works perfectly. Thanks for all your help.
... View more
Created by
sandervanloosbr
in VPN and AnyConnect
12-14-2010
06:28 AM
12-14-2010
06:28 AM
Unfortunately I didn't. I had 3 different routers that all had the same problem. The EasyVPN setup simply wouldn't work. Downgrading to 12.4 solved it on 1 router but the other 2 would only work with 15.0. I'm sure they changed something but I never figured out what. In the end I upgraded the configs to SSL VPN (WebVPN) which works a lot better anyways. I wasn't getting paid for all this research after all and the customer was happy with the advantages of an SSL VPN. In your case I would downgrade if you don't have the time. I'm still curious why I never got it to work.
... View more
Created by
sandervanloosbr
in Firewalls
11-29-2010
07:27 AM
11-29-2010
07:27 AM
Thank you both for your feedback. I already had to take this router into production so I'll setup a new router somewhere this week and try out your suggestion. To be continued...
... View more
Created by
sandervanloosbr
in Firewalls
11-29-2010
05:29 AM
11-29-2010
05:29 AM
In that case I'm even more confused as I had this: class type inspect OpenInternet inspect class class-default drop log ! zone-pair security ilan2wan source ILAN destination WAN service-policy type inspect ilan2wan Why doesn't this work then?
... View more
Created by
sandervanloosbr
in Firewalls
11-29-2010
03:32 AM
11-29-2010
03:32 AM
Thank you for your reply Maykol, really appreciate it. Your answer sounds logical but it does make me wonder. I didn't have to define a WAN to LAN zone to allow traffic to flow back and still keep my internal network protected. How can I achieve the same for the ILAN zone? I assume defining a WAN to LAN zone-pair with pass will still expose open ports to the outside world while this now isn't the case for my LAN to WAN zone. Can you clarify this? Thanks in advance, S.
... View more
Created by
sandervanloosbr
in Firewalls
11-27-2010
09:20 AM
11-27-2010
09:20 AM
I have set up a ZBF on a Cisco 1801 with 4 zones: - LAN: The internal network - WAN: The ADSL dialup - VPN: The DMVPN tunnel - ILAN: A separate network for unrestricted internet access The communication between the LAN and VPN is unrestricted and works fine. The restrictive LAN to WAN policy also works as planned but it's the ILAN to WAN connection that's blocking everything. I set this policy to allow all traffic to go out but the FW drops all the traffic. Removing the WAN and ILAN zones allows traffic to flow again. Initially I defined the following class map for this zone like this: policy-map type inspect ilan2wan class class-default pass This, for some reason unknown to me, doesn't work at all. I played around a bit (thinking the pass all didn't work) and ended up with the following config but still no go. Any takers? version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec service timestamps log datetime msec service password-encryption service sequence-numbers no service password-recovery ! hostname ! boot-start-marker boot system flash:c180x-adventerprisek9-mz.124-24.T4.bin boot-end-marker ! dot11 syslog no ip source-route ip options drop ! ip cef no ip bootp server ip name-server 213.x.x.x ip name-server 213.x.x.x no ipv6 cef ! class-map type inspect match-any InternetVerkeer match protocol icmp match protocol http match protocol https class-map type inspect match-all NaarInternet match class-map InternetVerkeer match access-group name Webservices class-map type inspect match-any OpenInternet match access-group 101 class-map type inspect match-all NaarKPN match protocol dns match access-group name KPN-DNS class-map type inspect match-all NaarAlarmcentrale match protocol udp match access-group name Alarmcentrale ! policy-map type inspect lan2wan class type inspect NaarInternet inspect class type inspect NaarKPN inspect class type inspect NaarAlarmcentrale inspect class class-default drop log policy-map type inspect lan2vpn class class-default pass policy-map type inspect vpn2lan class class-default pass policy-map type inspect ilan2wan class type inspect OpenInternet inspect class class-default drop log ! zone security LAN description Internal LAN zone security WAN description Internet zone security VPN description VPN Tunnel zone security ILAN description Internet-only LAN zone-pair security lan2wan source LAN destination WAN service-policy type inspect lan2wan zone-pair security lan2vpn source LAN destination VPN service-policy type inspect lan2vpn zone-pair security vpn2lan source VPN destination LAN service-policy type inspect vpn2lan zone-pair security ilan2wan source ILAN destination WAN service-policy type inspect ilan2wan ! interface Tunnel0 bandwidth 1000 ip address 172.16.1.4 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip mtu 1400 ip nhrp authentication ip nhrp map multicast 217.x.x.x ip nhrp map 172.16.1.13 217.115.195.99 ip nhrp network-id 100000 ip nhrp holdtime 360 ip nhrp nhs 172.16.1.13 zone-member security VPN ip tcp adjust-mss 1360 delay 1000 tunnel source Dialer0 tunnel mode gre multipoint tunnel key 100000 tunnel protection ipsec profile ! interface Null0 no ip unreachables ! interface ATM0 no ip address load-interval 30 no atm ilmi-keepalive ! interface ATM0.1 point-to-point pvc 2/32 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 no ip address duplex auto speed auto ! interface FastEthernet0.1 encapsulation dot1Q 4 ip address 192.168.4.100 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly zone-member security LAN ip tcp adjust-mss 1452 no cdp enable ! interface FastEthernet0.2 encapsulation dot1Q 5 ip address 192.168.5.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly zone-member security ILAN ip tcp adjust-mss 1452 no cdp enable ! interface Vlan1 no ip address ! interface Dialer0 ip address 92.x.x.x 255.255.255.248 ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly zone-member security WAN encapsulation ppp dialer pool 1 dialer-group 1 no cdp enable ppp authentication pap callin ppp pap sent-username ! router eigrp 113 network 172.16.1.0 0.0.0.255 network 192.168.4.0 no auto-summary ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Dialer0 no ip http server no ip http secure-server ! ip nat inside source list 1 interface Dialer0 overload ! ip access-list extended Alarmcentrale permit udp any host 87.x.x.x ip access-list extended KPN-DNS permit ip any host 213.x.x.x permit ip any host 213.x.x.x ip access-list extended Webservices permit ip any host 217.x.x.x permit ip any 66.x.x.x 0.0.255.255 ! access-list 1 remark NAT ACL 4 internet access-list 1 permit 192.168.4.0 0.0.0.255 access-list 1 permit 192.168.5.0 0.0.0.255 access-list 101 permit ip any any dialer-list 1 protocol ip permit I know one solution is to put the FastEthernet 0.2 interface in the same zone as Dialer 0 but that would leave the devices unprotected. Thanks in advance for your ideas. S.
... View more
Labels:
Created by
sandervanloosbr
in Switching
10-29-2010
08:45 AM
10-29-2010
08:45 AM
Thanks Chris, that worked flawlessly!
... View more
Created by
sandervanloosbr
in Switching
10-26-2010
09:20 AM
10-26-2010
09:20 AM
I have a Cisco 1900 router configured with 3 subinterfaces. I want one subinterface to only access the internet and not the other 2 interfaces. When I use access-group 130 in on the interface my users don't even get a DHCP lease, when I use access-group 130 out my clients can't reach any network. Any ideas on when I'm overlooking? interface GigabitEthernet0/0.3 encapsulation dot1Q 240 ip address 192.168.240.1 255.255.255.0 ip access-group 130 in ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 no cdp enable ! access-list 130 deny ip any 192.168.20.0 0.0.0.255 access-list 130 deny ip any 192.168.33.0 0.0.0.255 access-list 130 permit ip 192.168.240.0 0.0.0.255 any Any help is much appreciated.
... View more
Labels:
Created by
sandervanloosbr
in Routing
10-19-2010
03:06 PM
10-19-2010
03:06 PM
Seems I was overcomplicating things, the fix is as obvious as this: 1) Create 2 ip routes ip route 255.255.255.255 dialer 1 10 ip route 0.0.0.0 0.0.0.0 dialer 0 20 2) Declare the tunnel source to be the correct interface No need for route maps. Done.
... View more
Created by
sandervanloosbr
in Routing
10-14-2010
12:46 PM
10-14-2010
12:46 PM
Here we go: version 15.0 service config service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ew38 ! boot-start-marker boot-end-marker ! enable secret 5 $ ! aaa new-model aaa local authentication attempts max-fail 3 ! ! aaa authorization exec default local ! ! ! ! ! aaa session-id common ! ! ! ! no ipv6 cef no ip source-route ip cef ! ! ip dhcp excluded-address 192.168.20.1 192.168.20.20 ip dhcp excluded-address 192.168.20.250 192.168.20.254 ip dhcp excluded-address 192.168.20.112 ip dhcp excluded-address 192.168.33.1 192.168.33.50 ip dhcp excluded-address 192.168.33.254 ! ip dhcp pool local-pool import all network 192.168.20.0 255.255.255.0 dns-server 213.75.63.36 213.75.63.70 default-router 192.168.20.1 ! ip dhcp pool remote-pool import all network 192.168.33.0 255.255.255.0 dns-server 213.75.63.36 213.75.63.70 default-router 192.168.33.254 ! ip dhcp pool guests-pool import all network 192.168.240.0 255.255.255.0 dns-server 213.75.63.36 213.75.63.70 default-router 192.168.240.1 ! ! ! multilink bundle-name authenticated ! ! ! license udi pid CISCO1921/K9 sn ! ! username ciscoadmin privilege 15 secret 5 $ ! redundancy ! ! controller SHDSL 0/1/0 dsl-group 0 pairs 0 ! ! ! ! ! ! ! ! ! interface GigabitEthernet0/0 no ip address duplex auto speed auto no cdp enable ! ! interface GigabitEthernet0/0.1 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 no cdp enable ! interface GigabitEthernet0/0.2 encapsulation dot1Q 33 ip address 192.168.33.254 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 no cdp enable ! interface GigabitEthernet0/0.3 encapsulation dot1Q 240 ip address 192.168.240.1 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 no cdp enable ! interface GigabitEthernet0/1 no ip address ip virtual-reassembly shutdown duplex auto speed auto no cdp enable no mop enabled ! ! interface ATM0/0/0 no ip address load-interval 30 no atm ilmi-keepalive ! ! interface ATM0/0/0.1 point-to-point pvc 2/32 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface ATM0/1/0 no ip address load-interval 30 no atm ilmi-keepalive ! ! interface ATM0/1/0.1 point-to-point pvc 2/32 encapsulation aal5mux ppp dialer dialer pool-member 2 ! ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.248 ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication pap callin ppp pap sent-username password 0 no cdp enable ! ! interface Dialer1 ip address xxx.xxx.xxx.201 255.255.255.248 ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 2 dialer-group 2 ppp authentication pap callin ppp pap sent-username password 0 no cdp enable ! ! ip forward-protocol nd ! no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ! ip access-list extended dmvpn permit ip 192.168.20.0 0.0.0.255 any deny ip any any ! access-list 100 permit ip 192.168.20.0 0.0.0.255 any access-list 100 permit ip 192.168.33.0 0.0.0.255 any access-list 100 permit ip 192.168.240.0 0.0.0.255 any access-list 110 permit ip 192.168.20.0 0.0.0.255 any access-list 110 permit ip 192.168.13.0 0.0.0.255 any dialer-list 1 protocol ip permit dialer-list 2 protocol ip permit ! no cdp run ! ! ! route-map dmvpn-out-sdsl permit 10 match ip address dmvpn set ip default next-hop xxx.xxx.xxx.201 <-- gateway IP of dialer 1 interface ! ! ! control-plane ! ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 access-class 110 in privilege level 15 transport input telnet ssh transport output none ! scheduler allocate 20000 1000 no process cpu extended no process cpu autoprofile hog end
... View more
Re: Cisco 877W Switchport as WAN interf...
in Routing
10-13-2010
03:43 AM
10-13-2010
03:43 AM
I had the same problem and made a simpler solution. I created a VLAN on one of the switchports: interface FastEthernet0 switchport access vlan 100 interface Vlan100 description Cable internet ip address 188.xxx.xxx.xxx 255.255.255.xxx //this is your client IP address ip nat outside ip virtual-reassembly And then ip route 0.0.0.0 0.0.0.0 You're using DHCP but I found this to be unreliable. I suggest you try your setup with static IP's first and then try to implement DHCP.
... View more
07-31-2012
Works great, did need to re-add ssl trustpoint to gateway, reload router
and import certificate agai...
Created by
sandervanloosbroek
in Security Management
12-14-2011
12-14-2011
Hi Fisher,Appreciate the thanks, please rate my answer if it helped you
so others can also find it q...
Created by
sandervanloosbroek
in VPN and AnyConnect
08-01-2011
08-01-2011
If you email your headend address to Steve (see the post above yours in
this thread) he will confirm...
Created by
sandervanloosbroek
in VPN and AnyConnect
07-06-2011
07-06-2011
I'm having trouble getting this to work, after my upgrade to Mac OS X
Lion the Anyconnect client can...
Created by
sandervanloosbroek
in Firewalls
12-22-2010
12-22-2010
Ok I fixed it. For some reason the class-default inspect action doesn't
work when there's nothing to...
Created by
sandervanloosbroek
in VPN and AnyConnect
12-14-2010
12-14-2010
Unfortunately I didn't. I had 3 different routers that all had the same
problem. The EasyVPN setup s...
Created by
sandervanloosbroek
in Firewalls
11-29-2010
11-29-2010
Thank you both for your feedback. I already had to take this router into
production so I'll setup a ...
Created by
sandervanloosbroek
in Firewalls
11-29-2010
11-29-2010
In that case I'm even more confused as I had this:class type inspect
OpenInternet inspectclass class...
Created by
sandervanloosbroek
in Firewalls
11-29-2010
11-29-2010
Thank you for your reply Maykol, really appreciate it.Your answer sounds
logical but it does make me...
Created by
sandervanloosbroek
in Firewalls
11-27-2010
11-27-2010
I have set up a ZBF on a Cisco 1801 with 4 zones:- LAN: The internal
network- WAN: The ADSL dialup- ...
Created by
sandervanloosbroek
in Switching
10-29-2010
10-29-2010
Thanks Chris, that worked flawlessly!
Created by
sandervanloosbroek
in Switching
10-26-2010
10-26-2010
I have a Cisco 1900 router configured with 3 subinterfaces. I want one
subinterface to only access t...
10-19-2010
Seems I was overcomplicating things, the fix is as obvious as this:1)
Create 2 ip routesip route 255...
10-14-2010
Here we go:version 15.0service configservice timestamps debug datetime
msecservice timestamps log da...
Public Statistics
| Date Registered | 07-22-2010 11:34 AM |
| Date Last Visited | 07-27-2018 12:07 AM |
| Total Messages Posted | 37 |
