Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About shamimakhtar
Stats
Member since
09-08-2006
6
Posts
0
Helpful
0
Solutions
Created by
shamimakhtar
in VPN and AnyConnect
in VPN and AnyConnect
09-16-2010
02:16 PM
09-16-2010
02:16 PM
i just took out AH as you mentioned, unfortunately it still does not work.
... View more
Created by
shamimakhtar
in VPN and AnyConnect
in VPN and AnyConnect
09-16-2010
01:48 PM
09-16-2010
01:48 PM
I am trying to set up an IPsec VPN tunnel between a Cisco 1711 and Netgear FVS318 router/firewall. Phase1 is establishing but Phase2 is not. Debug output is provided below. Netgear Settings: Encryption: 3DES SHA-1 with Pre-share key, DH Group 2(1024 Bit), SA Lifetime 86400sec ESP Configuration: 3DES SHA-1 Cisco Configuration: ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp key ciscotest address REMOTE_IP ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set vpn ah-sha-hmac esp-3des esp-sha-hmac ! crypto map vpn 10 ipsec-isakmp set peer REMOTE_IP set transform-set vpn match address 110 reverse-route ! interface FastEthernet0 crypto map vpn ! access-list 110 permit ip 10.50.50.0 0.0.0.255 172.16.0.0 0.0.0.255 Cisco Debug: ISAKMP (0:268435457): received packet from REMOTE_IP dport 500 sport 500 Global (R) QM_IDLE ISAKMP: set new node -425808973 to QM_IDLE ISAKMP:(0:1:HW:2): processing HASH payload. message ID = -425808973 ISAKMP:(0:1:HW:2): processing SA payload. message ID = -425808973 ISAKMP:(0:1:HW:2):Checking IPSec proposal 1 ISAKMP: transform 1, ESP_3DES ISAKMP: attributes in transform: ISAKMP: authenticator is HMAC-SHA ISAKMP: encaps is 1 (Tunnel) ISAKMP: SA life type in seconds ISAKMP: SA life duration (VPI) of 0x0 0x1 0x51 0x80 ISAKMP:(0:1:HW:2):atts are acceptable. IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= WAN_IP, remote= REMOTE_IP, local_proxy= 10.50.50.0/255.255.255.0/0/0 (type=4), remote_proxy= 172.16.0.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 Crypto mapdb : proxy_match src addr : 10.50.50.0 dst addr : 172.16.0.0 protocol : 0 src port : 0 dst port : 0 IPSEC(validate_transform_proposal): transform proposal not supported for identity: {esp-3des esp-sha-hmac } ISAKMP:(0:1:HW:2): IPSec policy invalidated proposal ISAKMP:(0:1:HW:2): phase 2 SA policy not acceptable! (local WAN_IP remote REMOTE_IP) ISAKMP: set new node -2125033073 to QM_IDLE ISAKMP:(0:1:HW:2):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 2215118544, message ID = -2125033073 ISAKMP:(0:1:HW:2): sending packet to REMOTE_IP my_port 500 peer_port 500 (R) QM_IDLE ISAKMP:(0:1:HW:2):purging node -2125033073 ISAKMP:(0:1:HW:2):deleting node -425808973 error TRUE reason "QM rejected" ISAKMP (0:268435457): Unknown Input IKE_MESG_FROM_PEER, IKE_QM_EXCH: for node -425808973: state = IKE_QM_READY ISAKMP:(0:1:HW:2):Node -425808973, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH ISAKMP:(0:1:HW:2):Old State = IKE_QM_READY New State = IKE_QM_READY Sep 16 10:43:44 EST: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode failed with peer at REMOTE_IP ISAKMP:(0:1:HW:2):purging node -425808973
... View more
Labels:
09-15-2010
01:02 PM
oh wow, that worked. i just changed and re-tested and it works like a charm. if you are ever in the NYC area i will be getting you a few beers
... View more
09-15-2010
12:50 PM
From the router I am successfully pinging internet hosts, i am able to also telnet to google.com on port 80 and it is resolving correctly.
... View more
09-15-2010
12:47 PM
that is correct - DHCP on the Fa0 (outside) interface is supplying a default route. The nat translations does nto show any output when i ping from the laptop. when i ping from the router NAT table shows as below. I changed the Pro Inside global Inside local Outside local Outside global icmp RTR_F0:23 10.50.50.1:23 4.2.2.2:23 4.2.2.2:23 icmp RTR_F0:24 10.50.50.1:24 8.8.8.8:24 8.8.8.8:24 udp RTR_F0:68 RTR_F0:68 10.0.0.1:67 10.0.0.1:67 show ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is DEF-RTR to network 0.0.0.0 x.x.x.x/24 is subnetted, 1 subnets C x.x.x.x is directly connected, FastEthernet0 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.50.50.0/24 is directly connected, Vlan1 S 10.0.0.1/32 [254/0] via DEF-RTR, FastEthernet0 [254/0] via DEF-RTR S* 0.0.0.0/0 [254/0] via DEF-RTR
... View more
09-15-2010
11:48 AM
I have a Cisco 1711 which I am tyring to configure as a small-office router. It will assign DHCP addresses to computers on the LAN and provide them internet access. Router receives an IP from the ISP modem and router can ping hosts on the internet. PC sitting on the LAN behind the router are receiving DHCP from the router but are not able to access internet. Any help is appreciated. ! no aaa new-model ip cef ! ! no ip dhcp use vrf connected ! ip dhcp pool SPODIGIBBUSERS network 10.50.50.0 255.255.255.0 dns-server 8.8.8.8 default-router 10.50.50.1 lease 7 ! interface FastEthernet0 ip address dhcp ip nat outside ip virtual-reassembly duplex auto speed auto ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 ! interface Vlan1 ip address 10.50.50.1 255.255.255.0 ip nat inside ip virtual-reassembly ! interface Async1 no ip address encapsulation slip ! ip forward-protocol nd ! ! ip nat inside source list 1 interface FastEthernet0 overload ! access-list 1 permit any log ! ! ! ! line con 0 line 1 stopbits 1 speed 115200 flowcontrol hardware line aux 0 line vty 0 4 login !
... View more
- Tags:
- cisco_1711
- lan_internet_access
- lan_issue
- nat
- nat_issue
- network_address_translation
- pat
- router_internet_access
Labels:
Created by
shamimakhtar
in VPN and AnyConnect
09-16-2010
09-16-2010
i just took out AH as you mentioned, unfortunately it still does not
work.
Created by
shamimakhtar
in VPN and AnyConnect
09-16-2010
09-16-2010
I am trying to set up an IPsec VPN tunnel between a Cisco 1711 and
Netgear FVS318 router/firewall. P...
09-15-2010
oh wow, that worked. i just changed and re-tested and it works like a
charm.if you are ever in the N...
09-15-2010
From the router I am successfully pinging internet hosts, i am able to
also telnet to google.com on ...
09-15-2010
that is correct - DHCP on the Fa0 (outside) interface is supplying a
default route.The nat translati...
Public Statistics
| Date Registered | 09-08-2006 05:02 PM |
| Date Last Visited | 08-17-2018 12:04 AM |
| Total Messages Posted | 6 |
