Hello,   the command:   show policy-map interface X   should tell you what your policy does and if packets are being dropped due to the policy being configured on your interface... ... View more

Hello,   on both the L2 and the L3 switch, try and unshut the Vlan 1 interface.   Also, on the access ports of your edge switch, configure 'spanning-tree portfast'.... ... View more

Hello,   check the post below (although it is related to the 829, the 809 should work the same way):   https://community.cisco.com/t5/cisco-iox-discussions/can-t-connect-to-iox-local-manager-15-6-3m2-ir829/td-p/3484238 ... View more

Hello,   I still don't see 'sysopt connection permit-vpn' in your configuration... ... View more

Hello,   you need to make sure that only the three lines in bold are in your config, and the rest gets deleted.   global (New_Outside) 1 interface nat (Inside) 0 access-list Inside_nat0_outbound_1 nat (Inside) 1 0.0.0.0 255.255.255.255 nat (Inside) 1 192.168.10.0 255.255.255.0 nat (Inside) 1 0.0.0.0 0.0.0.0   Also, change the NAT exemption access list to actually reflect VPN pool:   access-list Inside_nat0_outbound_1 extended permit ip 192.168.10.0 255.255.255.0 10.10.1.0 255.255.255.0   Also, configure:   RFHKASA(config)#sysopt connection permit-vpn RFHKASA(config)#no nat-control   ... View more

Hello,   post the full current running configuration again, with the changes you have implemented. ... View more

Hello,   you might have inadvertently removed the access list. Re-add it (I would use the actual IP address rather than the alias, for clarity):   access-list Inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 10.10.1.0 255.255.255.0 ... View more

Hello,   try and remove all NAT configuration except for the three lines below:   global (New_Outside) 1 interface nat (Inside) 0 access-list Inside_nat0_outbound nat (Inside) 1 192.168.10.0 255.255.255.0   I think 8.2 has nat-control enabled by default. You might want to enable the command below to bypass the interface access lists:   RFHKASA(config)#sysopt connection permit-vpn ... View more

Rick,   you are right, it is already in there...my bad.   I wonder if this could be simply a licensing issue. Make sure you have the AnyConnect Essentials license installed. The output of:   RFHKASA#sh ver | inc AnyConnect   should include the line:   AnyConnect Essentials : 25 perpetual ... View more

Hello,   I think you are missing the line in bold under the webvpn::   RFHKASA(config)# webvpn RFHKASA(config-webvpn)# enable New_Outside ... View more

Hello,   you need to enable BOTH of the options. Check both fields... ... View more

Hello,   try and change the NAT exemption access list you currently have from:   access-list Inside_nat0_outbound extended permit ip any VPN 255.255.255.0   to   access-list Inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 10.10.1.0 255.255.255.0   Also, although I am not sure if you need that in pre 8.3 versions, I think you also need to configure:   same-security-traffic permit intra-interface ... View more

Hello,   what is your 'other equipment', are these Cisco devices ?   Check the doc below for reference...   https://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie3X00/software/16_10/config/b_1610_IoT_scg/b_1610_IoT_scg_chapter_0100.pdf ... View more

Hello,   for the first question, it is answer 3:   bgp local-as no-prepend replace-as   This is used for eBGP peers, it removes the local AS, and replaces it with another AS number. The eBGP peer needs to peer with the replaced AS number and not the original AS. ... View more