Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About murraymwps
08-23-2018
Stats
Member since
12-18-2014
34
Posts
0
Helpful
0
Solutions
Created by
murraymwps
in Wireless and Mobility
in Wireless and Mobility
01-22-2018
02:18 PM
01-22-2018
02:18 PM
I'm trying to track a users connection history looking at my 5520 syslogs. The client MAC is 3d61:c445:f8de and I've pulled the instances in the syslog of the MAC but I can't tell what AP it's connecting to. Is that info in these logs? If not, is there another way to find this?
2018-01-18 14:43:10 Local0.Info 172.31.1.8 HS_WLC5520: *SISF BT Process: Jan 18 19:43:11.303: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=7c:d1:c3:78:fe:90 2018-01-18 15:20:35 Local0.Info 172.31.1.8 HS_WLC5520: *sisfSwitcherTask: Jan 18 20:20:35.628: %SISF-6-ENTRY_CREATED: sisf_shim_utils.c:485 Entry created A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M= 2018-01-18 15:20:39 Local0.Info 172.31.1.8 HS_WLC5520: *SISF BT Process: Jan 18 20:20:40.028: %SISF-6-ENTRY_CHANGED: sisf_shim_utils.c:488 Entry changed A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=7c:d1:c3:78:fe:90 2018-01-18 15:40:42 Local0.Info 172.31.1.6 HS_WLC5508: *sisfSwitcherTask: Jan 18 15:40:42.989: %SISF-6-ENTRY_CREATED: sisf_shim_utils.c:485 Entry created A=fe80::cef:3d61:c445:f8de V=192 I=wired:13 P=0000 M= 2018-01-18 15:41:42 Local0.Info 172.31.1.6 HS_WLC5508: *SISF BT Process: Jan 18 15:41:43.598: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::cef:3d61:c445:f8de V=192 I=wired:13 P=0000 M=
... View more
Labels:
08-11-2017
08:27 AM
So.... dumb mistake. The interface was down. As soon as I plugged it in the route showed up. Yes - the route was in there. I didn't realize it when I cut and paste the config that it wasn't in the output. As I mentioned even after entering the route it didn't show up until the interface was up. Rookie mistake.
... View more
08-11-2017
06:20 AM
I'm getting a "gateway of last resort is not set" on a 2911 after entering "ip routing" and a route statement for 0.0.0.0 0.0.0.0. What am I missing:
br1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.0.0.0/24 is directly connected, GigabitEthernet0/0
L 10.0.0.10/32 is directly connected, GigabitEthernet0/0
br1#sr Building configuration...
Current configuration : 1757 bytes ! ! Last configuration change at 13:10:36 UTC Fri Aug 11 2017 ! version 15.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname br1 ! boot-start-marker boot-end-marker ! ! ! no aaa new-model ! ! ! ! ! ! ! ! ! ! ! ! ! ! no ip domain lookup ip cef no ipv6 cef ! multilink bundle-name authenticated ! ! cts logging verbose ! ! ! ! redundancy ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 description Uplink to Cat3850 Gi0/24 ip address 10.0.0.10 255.255.255.0 duplex auto speed auto ! interface GigabitEthernet0/1 description Internal ip address X.X.X.X 255.255.255.192 duplex auto speed auto ! interface GigabitEthernet0/2 ip address X.X.X.X 255.255.255.248 duplex auto speed auto ! interface GigabitEthernet0/0/0 ip address X.X.X.X 255.255.255.252 duplex full speed 1000 ! ip forward-protocol nd ! no ip http server no ip http secure-server ! ! ! ! ! control-plane ! ! alias exec s show ip int br alias exec srt show ip route alias exec sc show cdp nei | e SEP|AIR alias exec sri show run | i alias exec srb show run | b alias exec sr show run ! line con 0 line aux 0 line 2 no activation-character no exec transport preferred none transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 login local transport input telnet ssh ! scheduler allocate 20000 1000 ! end
... View more
Labels:
02-03-2017
06:20 AM
Rahul,
Thanks for your response. Shouldn't the packet tracer command generate the interesting traffic to bring up the tunnel? Here is the debug output:
A-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified
ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# debug crypto ikev1 127 ASA-5510# debug crypto ipsec 127 ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.90, sport=704, daddr=10.1.1.130, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510# ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.35, sport=32977, daddr=192.168.1.74, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.115, sport=1216, daddr=10.1.1.179, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.115, sport=1216, daddr=10.1.1.179, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.35, sport=32977, daddr=192.168.1.74, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.40, sport=37344, daddr=192.168.1.74, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.12, sport=13940, daddr=10.1.1.51, dport=48385 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.12, sport=14196, daddr=10.1.1.51, dport=48385 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.12, sport=14964, daddr=10.1.1.51, dport=35584 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.40, sport=37344, daddr=192.168.1.74, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.12, sport=13940, daddr=10.1.1.51, dport=48385 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.17, sport=24963, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.19, sport=919, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.20, sport=25068, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.21, sport=5819, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.25, sport=25573, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. $icmp 172.30.1.5 8 0 10.1.1.5 detailed IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.115, sport=1216, daddr=10.1.1.179, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. Packet-tracer input inside icmp 172.30.1.5 8 0 10.1.1.5 det$
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=172.30.1.5, sport=0, daddr=10.1.1.5, dport=0 Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside
Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: NAT divert to egress interface outside Untranslate 10.1.1.5/0 to 10.1.1.5/0
Phase: 3 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. <--- More --->IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.17, sport=24963, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.20, sport=25068, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. Forward Flow based lookup yields rule: in id=0xac0446e8, priority=0, domain=inspect-ip-options, deny=true hits=136153, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 4 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information: Forward Flow based lookup yields rule: in id=0xac9449f0, priority=70, domain=inspect-icmp, deny=false hits=355, user_data=0xac943a78, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0xac0442c0, priority=66, domain=inspect-icmp-error, deny=false hits=365, user_data=0xac0438d8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 6 Type: NAT Subtype: Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: Static translate 172.30.1.5/0 to 172.30.1.5/0 Forward Flow based lookup yields rule: in id=0xac9474a8, priority=6, domain=nat, deny=false hits=10365, user_data=0xabdcaa08, cs_id=0x0, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 7 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0xabfbe300, priority=70, domain=encrypt, deny=false hits=10365, user_data=0x0, cs_id=0xac838348, reverse, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=any, output_ifc=outside
Result: input-interface: inside input-status: up input-line-status: up output-interface: outside <--- More --->IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.21, sport=5819, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.25, sport=25573, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.12, sport=13940, daddr=10.1.1.51, dport=48385 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510# ASA-5510# ASA-5510# ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.76, sport=15220, daddr=10.1.1.51, dport=35584 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.12, sport=14964, daddr=10.1.1.51, dport=35584 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.90, sport=13771, daddr=10.1.1.179, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.34, sport=8413, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# Packet-tracer input inside icmp 172.30.1.5 8 0 10.1.1.5 det$
Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside
Phase: 2 Type: UN-NAT IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=172.30.1.5, sport=0, daddr=10.1.1.5, dport=0 Subtype: static Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: NAT divert to egress interface outside Untranslate 10.1.1.5/0 to 10.1.1.5/0
Phase: 3 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: <--- More --->IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. Forward Flow based lookup yields rule: in id=0xac0446e8, priority=0, domain=inspect-ip-options, deny=true hits=136451, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 <--- More --->IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.77, sport=52681, daddr=192.168.1.21, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. src ip/id=0.0.0.0, mask=0.0.0.0, port=0 <--- More --->IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.34, sport=8413, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 4 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information: Forward Flow based lookup yields rule: in id=0xac9449f0, priority=70, domain=inspect-icmp, deny=false hits=356, user_data=0xac943a78, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0xac0442c0, priority=66, domain=inspect-icmp-error, deny=false hits=366, user_data=0xac0438d8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 6 Type: NAT Subtype: Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: Static translate 172.30.1.5/0 to 172.30.1.5/0 Forward Flow based lookup yields rule: in id=0xac9474a8, priority=6, domain=nat, deny=false hits=10374, user_data=0xabdcaa08, cs_id=0x0, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 7 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0xabfbe300, priority=70, domain=encrypt, deny=false hits=10374, user_data=0x0, cs_id=0xac838348, reverse, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=any, output_ifc=outside
Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.115, sport=1216, daddr=10.1.1.179, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.115, sport=1216, daddr=10.1.1.179, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.90, sport=13771, daddr=10.1.1.179, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.30, sport=11180, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.33, sport=8354, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510# ASA-5510# ASA-5510# term mooIPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.12, sport=35072, daddr=10.1.1.51, dport=35072 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.76, sport=35072, daddr=10.1.1.51, dport=35072 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.33, sport=8354, daddr=192.168.1.200, dport=31488 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. n
%ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.12, sport=35072, daddr=10.1.1.51, dport=35072 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. %ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.76, sport=35072, daddr=10.1.1.51, dport=35072 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510#
%ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified %ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.77, sport=52681, daddr=192.168.1.21, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=17, saddr=172.30.1.77, sport=52681, daddr=192.168.1.3, dport=41216 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 5 per second, max configured rate is 10; Current average rate is 9 per second, max configured rate is 5; Cumulative total count is 5842 %ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.40, sport=37600, daddr=192.168.1.74, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. Packet-
ASA-5510#Packet-tracer input inside icmp 172.30.1.5 8 0 10.1.1.5 detailed
Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside
Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: NAT divert to egress interface outside Untranslate 10.1.1.5/0 to 10.1.1.5/0
Phase: 3 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0xac0446e8, priority=0, domain=inspect-ip-options, deny=true hits=136752, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 4 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information: Forward Flow based lookup yields rule: in id=0xac9449f0, priority=70, domain=inspect-icmp, deny=false hits=357, user_data=0xac943a78, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0xac0442c0, priority=66, domain=inspect-icmp-error, deny=false hits=367, user_data=0xac0438d8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 6 Type: NAT Subtype: Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: Static translate 172.30.1.5/0 to 172.30.1.5/0 Forward Flow based lookup yields rule: in id=0xac9474a8, priority=6, domain=nat, deny=false hits=10384, user_data=0xabdcaa08, cs_id=0x0, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 7 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0xabfbe300, priority=70, domain=encrypt, deny=false hits=10384, user_data=0x0, cs_id=0xac838348, reverse, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=any, output_ifc=outside
Result: input-interface: inside input-status: up input-line-status: up output-interface: outside %ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. output-status: up %ASA-4-752010: IKEv2 Doesn't have a proposal specified output-line-status: up IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.133, sport=53217, daddr=10.1.1.182, dport=20480 Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
%ASA-5-111008: User 'enable_15' executed the 'packet-tracer input inside icmp 172.30.1.5 8 0 10.1.1.5 detailed' command. %ASA-5-111010: User 'enable_15', running 'CLI' from IP 108.20.58.194, executed 'packet-tracer input inside icmp 172.30.1.5 8 0 10.1.1.5 detailed' IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
ASA-5510# ASA-5510# %ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.40, sport=37600, daddr=192.168.1.74, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. %ASA-7-752002: Tunnel Manager Removed entry. Map Tag = ASAtoMX. Map Sequence Number = 20. %ASA-4-752010: IKEv2 Doesn't have a proposal specified IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.133, sport=53217, daddr=10.1.1.182, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. no mon ASA-5510# IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.35, sport=34001, daddr=192.168.1.74, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.90, sport=14027, daddr=10.1.1.179, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.35, sport=34001, daddr=192.168.1.74, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.40, sport=37600, daddr=192.168.1.74, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.133, sport=53217, daddr=10.1.1.182, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.90, sport=14027, daddr=10.1.1.179, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.35, sport=34001, daddr=192.168.1.74, dport=20480 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched. IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=6, saddr=172.30.1.90, sport=14027, daddr=10.1.1.179, dport=35875 IPSEC(crypto_map_check)-3: Checking crypto map ASAtoMX 20: matched.
... View more
02-03-2017
05:16 AM
Can't figure out why this L2L VPN is being denied. "show crypto isa sa" returns "There are no IKEv1 SAs". running ver 8.4(5). What am I missing?
ASA-5510# sh run : Saved : ASA Version 8.4(5) ! hostname ASA-5510 names ! interface Ethernet0/0 nameif outside security-level 0 ip address 2.2.2.2 255.255.255.248 ! interface Ethernet0/1 nameif inside security-level 100 ip address 172.30.1.1 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.99.1 255.255.255.0 management-only ! boot system disk0:/asa845-k8.bin boot system disk0:/asa821-k8.bin ftp mode passive clock timezone EST -5 clock summer-time EDT recurring object network obj-172.30.1.0 subnet 172.30.1.0 255.255.255.0 object network obj-10.1.1.0 subnet 10.1.1.0 255.255.255.0 object network obj-192.168.1.0 subnet 192.168.1.0 255.255.255.0 object network obj-172.30.1.5 host 172.30.1.5 access-list inbound extended permit icmp any any echo-reply access-list inbound extended permit icmp any any time-exceeded access-list inbound extended permit icmp any any unreachable access-list inbound extended permit ip 108.20.58.0 255.255.255.0 any access-list no-nat extended permit ip 172.30.1.0 255.255.255.0 10.1.1.0 255.255.255.0 access-list no-nat extended permit ip 172.30.1.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list 90 extended permit ip 172.30.1.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list 90 extended permit ip 172.30.1.0 255.255.255.0 10.1.1.0 255.255.255.0 access-list 90 extended permit ip 172.30.1.0 255.255.255.0 192.168.123.0 255.255.255.0 access-list 90 extended permit ip 172.30.1.0 255.255.255.0 10.1.4.0 255.255.255.0 access-list HRB_Beverly extended permit ip 172.30.1.0 255.255.255.0 10.1.1.0 255.255.255.0 access-list HRB_Beverly extended permit ip 172.30.1.0 255.255.255.0 192.168.1.0 255.255.255.0 pager lines 24 logging enable logging monitor debugging logging buffered debugging logging asdm informational mtu outside 1500 mtu inside 1500 mtu management 1500 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-192.168.1.0 obj-192.168.1.0 no-proxy-arp route-lookup ! object network obj-172.30.1.0 nat (inside,outside) dynamic interface object network obj-172.30.1.5 nat (inside,outside) static interface service tcp www www access-group inbound in interface outside route outside 0.0.0.0 0.0.0.0 173.9.61.94 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa authentication telnet console LOCAL http server enable http 192.168.1.0 255.255.255.0 management http 172.30.1.0 255.255.255.0 inside http 192.168.99.0 255.255.255.0 management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec ikev1 transform-set Meraki_Transform_Set esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set myset esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set 3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto dynamic-map dynmap 10 set ikev1 transform-set myset 3DES-SHA crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map ASAtoMX 20 match address HRB_Beverly crypto map ASAtoMX 20 set peer 3.3.3.3 crypto map ASAtoMX 20 set ikev1 transform-set myset crypto map ASAtoMX interface outside crypto isakmp identity address crypto ikev1 am-disable crypto ikev1 policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 28800 crypto ikev1 policy 20 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet 172.30.1.0 255.255.255.0 inside telnet timeout 15 ssh timeout 15 ssh key-exchange group dh-group1-sha1 console timeout 0 management-access inside dhcpd dns 75.75.75.75 75.75.76.76 ! dhcpd address 172.30.1.10-172.30.1.75 inside dhcpd enable inside ! dhcpd address 192.168.99.2-192.168.99.20 management dhcpd enable management ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn tunnel-group 3.3.3.3 type ipsec-l2l tunnel-group 3.3.3.3 ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect icmp inspect ip-options ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:b62f99094ec95885763bcb405438012f : end ASA-5510# ASA-5510# ASA-5510# Packet-tracer input inside icmp 172.30.1.5 8 0 10.1.1.5 det$
Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside
Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: NAT divert to egress interface outside Untranslate 10.1.1.5/0 to 10.1.1.5/0
Phase: 3 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0xac0446e8, priority=0, domain=inspect-ip-options, deny=true hits=56935, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 4 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information: Forward Flow based lookup yields rule: in id=0xac9449f0, priority=70, domain=inspect-icmp, deny=false hits=221, user_data=0xac943a78, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0xac0442c0, priority=66, domain=inspect-icmp-error, deny=false hits=221, user_data=0xac0438d8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 6 Type: NAT Subtype: Result: ALLOW Config: nat (inside,any) source static obj-172.30.1.0 obj-172.30.1.0 destination static obj-10.1.1.0 obj-10.1.1.0 no-proxy-arp route-lookup Additional Information: Static translate 172.30.1.5/0 to 172.30.1.5/0 Forward Flow based lookup yields rule: in id=0xac9474a8, priority=6, domain=nat, deny=false hits=7342, user_data=0xabdcaa08, cs_id=0x0, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=inside, output_ifc=any
Phase: 7 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0xabfbe300, priority=70, domain=encrypt, deny=false hits=7342, user_data=0x0, cs_id=0xac838348, reverse, flags=0x0, protocol=0 src ip/id=172.30.1.0, mask=255.255.255.0, port=0 dst ip/id=10.1.1.0, mask=255.255.255.0, port=0, dscp=0x0 input_ifc=any, output_ifc=outside
Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
... View more
Labels:
12-09-2016
06:36 AM
Looks like a fix has just been released but I can't find these software versions to download. From the bug search page:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb48640?emailclick=CNSemail
...the following are known fixed releases:
9.1(7.12)
97.1(0.95)
97.1(0.96)
97.1(12.8)
97.1(6.43)
98.1(1.15)
98.1(1.16)
98.1(10.16)
98.1(11.3)
98.1(2.26)
98.1(2.27)
I can't see where to download 97.x or 98.x. I see 9.6 as the highest version. Are these typos?
... View more
12-02-2016
12:52 PM
Does anyone have any ideas on a workaround for failing CVE-2016-2183. Cisco published the vulnerability back in September but hasn't come up with a workaround or fix.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl
I'm running an ASA 5512 ver 9.3(2). We've failed PCI compliance twice now.
thanks,
-mike
... View more
Labels:
Created by
murraymwps
in VPN and AnyConnect
in VPN and AnyConnect
10-26-2015
04:22 PM
10-26-2015
04:22 PM
I'm failing when connecting via AnyConnect (error attached). This started happening after a code upgrade from 7.x to 8.2(5)55 on the ASA 5505. The output on the ASA is below: Oct 26 2015 19:14:01: %ASA-6-725001: Starting SSL handshake with client comcast:1.1.1.156/58629 for TLSv1 session. Oct 26 2015 19:14:01: %ASA-7-725010: Device supports the following 4 cipher(s). Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[1] : RC4-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[2] : AES128-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[3] : AES256-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[4] : DES-CBC3-SHA Oct 26 2015 19:14:01: %ASA-7-725008: SSL client comcast:1.1.1.156/58629 proposes the following 6 cipher(s). Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[1] : AES256-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[2] : AES128-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[3] : DHE-DSS-AES256-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[4] : DHE-DSS-AES128-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[5] : DES-CBC3-SHA Oct 26 2015 19:14:01: %ASA-7-725011: Cipher[6] : EDH-DSS-DES-CBC3-SHA Oct 26 2015 19:14:01: %ASA-7-725012: Device chooses cipher : AES128-SHA for the SSL session with client comcast:1.1.1.156/58629 Oct 26 2015 19:14:01: %ASA-6-725002: Device completed SSL handshake with client comcast:1.1.1.156/58629 Oct 26 2015 19:14:01: %ASA-6-725007: SSL session with client comcast:1.1.1.156/58629 terminated. Do I need to do something with the cert?
... View more
Labels:
10-26-2015
10:02 AM
I have a question on whether the following config limits broadcast traffic to 10%. I believe it sends a trap notification when the threshold is reached but does it also limit the broadcast traffic to 10%? Or do I need the "storm-control action shutdown" to accomplish that? interface GigabitEthernet3/0/2 switchport access vlan 128 switchport mode access switchport voice vlan 560 storm-control broadcast level 10.00 storm-control action trap spanning-tree portfast Thanks -mike
... View more
Labels:
10-01-2015
09:43 AM
ASA 5505 running 8.2(5) We have the wireless network on the dmz of the firewall. I need to allow the wifi users to be able to connect to the inside subnet. dmz subnet: 192.168.3.0/24 inside subnet: 192.168.1.0/24 My packet tracer is failing asa# packet-tracer input dmz tcp 192.168.3.10 25 192.168.1.9 25 Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 match ip inside 192.168.1.0 255.255.255.0 dmz any static translation to 192.168.1.0 translate_hits = 0, untranslate_hits = 15 Additional Information: NAT divert to egress interface inside Untranslate 192.168.1.0/0 to 192.168.1.0/0 using netmask 255.255.255.0 Phase: 2 Type: ACCESS-LIST Subtype: no-forward-rule Result: DROP Config: Additional Information: Result: input-interface: dmz input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule Here is the pertinent config: asa# sh run : Saved : ASA Version 8.2(5) ! hostname asa names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 switchport access vlan 3 ! interface Ethernet0/7 description Wireless switchport access vlan 3 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 123.123.123.201 255.255.255.248 ! interface Vlan3 no forward interface Vlan1 nameif dmz security-level 50 ip address 192.168.3.1 255.255.255.0 ! same-security-traffic permit intra-interface access-list inbound extended permit icmp any any unreachable access-list inbound extended permit icmp any any echo-reply access-list inbound extended permit icmp any any time-exceeded access-list inbound extended permit tcp any host 123.123.123.202 eq https access-list inbound extended permit tcp 123.65.144.0 255.255.248.0 host 123.123.123.202 eq smtp access-list inbound extended permit tcp 123.81.64.0 255.255.248.0 host 123.123.123.202 eq smtp access-list 121 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 121 extended permit ip 192.168.1.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list 121 extended permit ip 192.168.0.0 255.255.252.0 192.168.42.0 255.255.255.0 access-list 122 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 122 extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 122 extended permit ip 172.20.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 123 extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list datto extended permit ip host 192.168.1.12 any access-list datto extended permit tcp any any eq ssh access-list gsm extended permit ip 192.168.1.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list gsm extended permit ip 192.168.2.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list vpn standard permit 192.168.1.0 255.255.255.0 access-list vpn standard permit 172.20.1.0 255.255.255.0 access-list vpn standard permit 192.168.42.0 255.255.255.0 access-list nat0out extended permit ip 192.168.2.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list nat0out extended permit ip 172.20.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list nat0out extended permit ip 192.168.2.0 255.255.255.0 192.168.42.0 255.255.255.0 access-list nat0out extended permit ip 192.168.42.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list oceanport extended permit ip 192.168.0.0 255.255.252.0 192.168.42.0 255.255.255.0 access-list dmz_outbound extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0 ip local pool vpnpool 192.168.2.1-192.168.2.100 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-641.bin no asdm history enable arp timeout 14400 global (outside) 1 interface global (dmz) 1 interface nat (inside) 0 access-list 121 nat (inside) 1 192.168.1.0 255.255.255.0 nat (outside) 0 access-list nat0out nat (dmz) 0 access-list 123 nat (dmz) 1 192.168.3.0 255.255.255.0 static (inside,outside) 123.123.123.202 192.168.1.9 netmask 255.255.255.255 dns static (dmz,inside) 123.123.123.202 192.168.1.9 netmask 255.255.255.255 dns static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 static (inside,dmz) 192.168.3.0 192.168.3.0 netmask 255.255.255.0 access-group inbound in interface outside access-group dmz_outbound in interface dmz route outside 0.0.0.0 0.0.0.0 123.123.123.206 1 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic class-map datto-rate-limite match access-list datto ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 4096 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect pptp policy-map datto-limit class datto-rate-limite police output 1500000 100000 !
... View more
- Tags:
- #asa #security
Labels:
10-01-2015
09:43 AM
We have the wireless network on the dmz of the firewall. I need to allow the wifi users to be able to connect to the inside subnet. dmz subnet: 192.168.3.0/24 inside subnet: 192.168.1.0/24 My packet tracer is failing asa# packet-tracer input dmz tcp 192.168.3.10 25 192.168.1.9 25 Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 match ip inside 192.168.1.0 255.255.255.0 dmz any static translation to 192.168.1.0 translate_hits = 0, untranslate_hits = 15 Additional Information: NAT divert to egress interface inside Untranslate 192.168.1.0/0 to 192.168.1.0/0 using netmask 255.255.255.0 Phase: 2 Type: ACCESS-LIST Subtype: no-forward-rule Result: DROP Config: Additional Information: Result: input-interface: dmz input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule Here is the pertinent config: asa# sh run : Saved : ASA Version 8.2(5) ! hostname asa names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 switchport access vlan 3 ! interface Ethernet0/7 description Wireless switchport access vlan 3 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 123.123.123.201 255.255.255.248 ! interface Vlan3 no forward interface Vlan1 nameif dmz security-level 50 ip address 192.168.3.1 255.255.255.0 ! same-security-traffic permit intra-interface access-list inbound extended permit icmp any any unreachable access-list inbound extended permit icmp any any echo-reply access-list inbound extended permit icmp any any time-exceeded access-list inbound extended permit tcp any host 123.123.123.202 eq https access-list inbound extended permit tcp 123.65.144.0 255.255.248.0 host 123.123.123.202 eq smtp access-list inbound extended permit tcp 123.81.64.0 255.255.248.0 host 123.123.123.202 eq smtp access-list 121 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 121 extended permit ip 192.168.1.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list 121 extended permit ip 192.168.0.0 255.255.252.0 192.168.42.0 255.255.255.0 access-list 122 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 122 extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 122 extended permit ip 172.20.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 123 extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list datto extended permit ip host 192.168.1.12 any access-list datto extended permit tcp any any eq ssh access-list gsm extended permit ip 192.168.1.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list gsm extended permit ip 192.168.2.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list vpn standard permit 192.168.1.0 255.255.255.0 access-list vpn standard permit 172.20.1.0 255.255.255.0 access-list vpn standard permit 192.168.42.0 255.255.255.0 access-list nat0out extended permit ip 192.168.2.0 255.255.255.0 172.20.1.0 255.255.255.0 access-list nat0out extended permit ip 172.20.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list nat0out extended permit ip 192.168.2.0 255.255.255.0 192.168.42.0 255.255.255.0 access-list nat0out extended permit ip 192.168.42.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list oceanport extended permit ip 192.168.0.0 255.255.252.0 192.168.42.0 255.255.255.0 access-list dmz_outbound extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0 ip local pool vpnpool 192.168.2.1-192.168.2.100 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-641.bin no asdm history enable arp timeout 14400 global (outside) 1 interface global (dmz) 1 interface nat (inside) 0 access-list 121 nat (inside) 1 192.168.1.0 255.255.255.0 nat (outside) 0 access-list nat0out nat (dmz) 0 access-list 123 nat (dmz) 1 192.168.3.0 255.255.255.0 static (inside,outside) 123.123.123.202 192.168.1.9 netmask 255.255.255.255 dns static (dmz,inside) 123.123.123.202 192.168.1.9 netmask 255.255.255.255 dns static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 static (inside,dmz) 192.168.3.0 192.168.3.0 netmask 255.255.255.0 access-group inbound in interface outside access-group dmz_outbound in interface dmz route outside 0.0.0.0 0.0.0.0 123.123.123.206 1 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic class-map datto-rate-limite match access-list datto ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 4096 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect pptp policy-map datto-limit class datto-rate-limite police output 1500000 100000 !
... View more
- Tags:
- #asa #security
Labels:
07-13-2015
11:04 AM
I just read the following in the Cisco doc: Router(config-ephone-dn)# paging ip 239.1.1.10 port 2000 "Specifies that this ephone-dn is to be used to broadcast paging messages to the idle IP phones that are associated with the paging dn-tag. If the optional keywords and arguments are not used, IP phones are paged individually using IP unicast transmission (to a maximum of ten IP phones)." Does that mean that my config uses unicast and therefore I can only page 10 IP phones?
... View more
Created by
murraymwps
in IP Telephony and Phones
in IP Telephony and Phones
07-13-2015
10:57 AM
07-13-2015
10:57 AM
I have a CME that is configured for paging. But only some of the phones "pick up" when the paging extension is dialed. In the below config, ephone 13 picks up but ephone 79 does not. Config: ephone-dn 54 number 340 paging ephone-dn 12 number 1152 call-forward busy 2100 call-forward noan 2100 timeout 10 mwi sip ephone-dn 87 number 0902 secondary 0902 call-forward busy 2100 call-forward noan 2100 timeout 20 mwi sip hold-alert 30 originator ephone 13 mac-address 001D.4596.3EEF paging-dn 54 type 7940 button 1:12 ! ephone 79 mac-address 000B.46E9.B133 paging-dn 54 button 1:87
... View more
- Tags:
- paging cme
Labels:
06-01-2015
09:41 AM
Found it: no global (dmz) 1 1.10.136.113 nat (dmz) 1 172.16.2.0 255.255.255.0
... View more
06-01-2015
08:30 AM
I added a new dmz subnet 172.16.2.0/24. The server I have there that is being statically nat'd is working fine but not the regular hosts. They can't get Internet access and I'm seeing the following error: %ASA-3-305005: No translation group found for udp src dmz:172.16.2.5/34491 dst outside:8.8.8.8/53 I'm sure it has something to do with global nat but I'm missing it. sh run : Saved : ASA Version 8.2(5) ! hostname gw names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 switchport access vlan 3 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.0.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 1.10.136.113 255.255.255.240 ! interface Vlan3 nameif dmz security-level 50 ip address 172.16.2.1 255.255.255.0 ! ftp mode passive clock timezone EST -5 clock summer-time EDT recurring object-group network mxlogic network-object 28.65.144.0 255.255.248.0 network-object 28.81.64.0 255.255.248.0 object-group service Datto tcp port-object range 2200 2250 object-group network net-local network-object 192.168.0.0 255.255.255.0 object-group network host-12-remote network-object host 10.128.12.11 object-group network host-30-remote network-object host 10.128.30.51 object-group network net-mgmt-remote network-object 10.128.6.0 255.255.255.0 network-object 10.128.11.0 255.255.255.0 network-object 10.128.12.0 255.255.255.0 access-list inbound2 extended permit icmp any any access-list inbound2 extended permit icmp any host 1.10.136.115 access-list inbound2 extended deny ip 200.161.124.0 255.255.255.0 any access-list inbound2 extended permit tcp any host 1.10.136.115 eq 82 access-list inbound2 extended permit tcp any host 1.10.136.116 eq https access-list inbound2 extended permit tcp any host 1.10.136.117 eq www access-list inbound2 extended permit tcp any host 1.10.136.117 eq https access-list inbound2 extended permit tcp any host 1.10.136.118 eq https access-list inbound2 extended permit icmp any any unreachable access-list inbound2 extended permit tcp any host 1.10.136.116 eq smtp access-list inbound2 extended permit tcp any host 1.10.136.114 eq 3389 access-list inbound2 extended permit tcp any host 1.10.136.114 eq www access-list inbound2 extended permit tcp any host 1.10.136.114 eq https access-list inbound2 extended permit tcp 28.65.144.0 255.255.248.0 host 1.10.136.114 eq smtp access-list inbound2 extended permit tcp 28.81.64.0 255.255.248.0 host 1.10.136.114 eq smtp access-list 8 extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 8 extended permit ip object-group net-local object-group host-12-remote access-list 8 extended permit ip object-group net-local object-group host-30-remote access-list 8 extended permit ip object-group net-local object-group net-mgmt-remote access-list mar-split standard permit host 192.168.0.150 access-list mar-split standard permit host 192.168.0.161 access-list mar-split standard permit host 192.168.0.200 access-list mar-split standard permit host 192.168.0.162 access-list dynmap standard permit 192.168.0.0 255.255.255.0 access-list outbound extended permit tcp any any eq 4443 access-list outbound extended permit ip host 192.168.0.249 any access-list outbound extended permit tcp any any eq 3389 access-list outbound extended permit tcp any any eq 4899 access-list outbound extended permit ip host 192.168.0.7 any access-list outbound extended permit ip host 192.168.0.9 any access-list outbound extended permit ip host 192.168.0.31 any access-list outbound extended permit ip host 192.168.0.6 any access-list outbound extended permit ip host 192.168.0.209 any access-list outbound extended permit ip host 192.168.0.3 any access-list outbound extended permit ip host 192.168.0.4 any access-list outbound extended permit ip host 192.168.0.2 any access-list outbound extended permit ip host 192.168.0.25 any access-list outbound extended permit ip host 192.168.0.18 any access-list outbound extended permit ip 10.0.0.0 255.0.0.0 any access-list outbound extended permit tcp any any eq www access-list outbound extended permit tcp any any eq https access-list outbound extended permit tcp any any eq ftp access-list outbound extended permit tcp any any eq ssh access-list outbound extended permit tcp any any eq 10000 access-list outbound extended permit udp any any eq 10000 access-list outbound extended permit udp any any eq isakmp access-list outbound extended permit udp any any eq 4500 access-list outbound extended permit esp any any access-list outbound extended permit udp any any eq ntp access-list outbound extended permit ip host 192.168.0.240 any access-list outbound extended permit tcp any any eq pptp access-list outbound extended permit gre any any access-list outbound extended permit tcp any any eq 444 access-list outbound extended permit tcp any any eq 4430 access-list outbound extended permit tcp any any eq 9000 access-list outbound extended permit udp any any eq domain access-list outbound extended permit tcp any any eq domain access-list outbound extended permit icmp any any access-list outbound extended permit tcp any any eq 5999 access-list outbound extended permit ip host 192.168.0.12 any access-list outbound extended permit tcp any any eq 3101 access-list outbound extended permit tcp any any eq 65535 access-list outbound extended permit tcp any any eq 8080 access-list outbound extended permit ip host 192.168.0.13 any access-list outbound extended permit tcp any any eq 8005 access-list outbound extended permit tcp any any eq 9090 access-list outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list outbound extended permit ip host 192.168.0.165 any access-list outbound extended permit tcp 192.168.0.0 255.255.255.0 object-group Datto any object-group Datto access-list outbound extended permit tcp any any eq 5222 access-list outbound extended permit ip host 172.16.2.10 any access-list mar-filter extended permit ip 192.168.2.0 255.255.255.0 host 192.168.0.161 access-list mar-filter extended permit ip 192.168.2.0 255.255.255.0 host 192.168.0.162 access-list mar-filter extended permit udp 192.168.2.0 255.255.255.0 host 192.168.0.150 eq domain access-list mar-filter extended permit udp 192.168.2.0 255.255.255.0 host 192.168.0.200 eq domain access-list mar-filter extended deny ip 192.168.2.0 255.255.255.0 any access-list cap_outside extended permit ip any host 1.10.136.117 access-list remote_10_cryptomap extended permit ip object-group net-local object-group host-12-remote access-list remote_10_cryptomap extended permit ip object-group net-local object-group host-30-remote access-list remote_10_cryptomap extended permit ip object-group net-local object-group net-mgmt-remote access-list capin extended deny ip host 8.20.58.194 host 1.10.136.113 access-list capin extended permit ip any host 1.10.136.119 access-list capin extended permit ip host 8.20.58.194 host 1.10.136.118 access-list capin extended permit ip host 8.20.58.194 any access-list capdmz extended permit ip any host 172.16.2.1 access-list swvpnclient standard permit 172.16.2.0 255.255.255.0 access-list dmz-no-nat extended permit ip 172.16.2.0 255.255.255.0 172.16.3.0 255.255.255.0 pager lines 24 logging enable logging monitor notifications logging buffered warnings logging asdm informational no logging message 402127 mtu inside 1500 mtu outside 1500 mtu dmz 1500 ip local pool remote 192.168.2.1-192.168.2.254 ip local pool swvpnpool 172.16.3.1-172.16.3.254 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 nat-control global (outside) 1 interface global (dmz) 1 1.10.136.113 nat (inside) 0 access-list 8 nat (inside) 1 192.168.0.0 255.255.255.0 nat (dmz) 0 access-list dmz-no-nat static (inside,outside) 1.10.136.118 192.168.0.12 netmask 255.255.255.255 static (inside,outside) 1.10.136.117 192.168.0.20 netmask 255.255.255.255 static (inside,outside) 1.10.136.116 192.168.0.165 netmask 255.255.255.255 static (dmz,outside) 1.10.136.114 172.16.2.10 netmask 255.255.255.255 access-group outbound in interface inside access-group inbound2 in interface outside route outside 0.0.0.0 0.0.0.0 1.10.136.126 1 timeout xlate 3:00:00 timeout conn 8:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:03 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy aaa-server RADIUS protocol radius aaa-server RADIUS (inside) host 192.168.0.150 key ***** aaa-server swVPNClient protocol radius aaa-server swVPNClient (inside) host 172.16.2.10 key ***** aaa-server swRADIUS protocol radius aaa-server swRADIUS (inside) host 172.16.2.10 key ***** filter java 80 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 http server enable http 192.168.0.0 255.255.255.0 inside http 192.168.2.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set strong2 esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map rtg 1 set transform-set strong2 crypto map remote 10 match address remote_10_cryptomap crypto map remote 10 set peer 1.130.39.52 crypto map remote 10 set transform-set strong2 crypto map remote 65000 ipsec-isakmp dynamic rtg crypto map remote interface outside crypto isakmp enable outside crypto isakmp policy 5 authentication pre-share encryption 3des hash sha group 2 lifetime 28800 crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 lifetime 28800 crypto isakmp policy 15 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet 192.168.0.0 255.255.255.0 inside telnet 192.168.2.0 255.255.255.0 inside telnet timeout 30 ssh 192.168.0.0 255.255.255.0 inside ssh 192.168.2.0 255.255.255.0 inside ssh timeout 5 console timeout 0 management-access inside threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept ntp server 1.102.46.78 webvpn group-policy remote internal group-policy remote attributes dns-server value 192.168.0.201 192.168.0.200 vpn-idle-timeout 30 ipsec-udp enable split-tunnel-policy tunnelspecified split-tunnel-network-list value dynmap default-domain value rockporttech.com split-dns value rockporttech.com split-tunnel-all-dns disable group-policy mar internal group-policy mar attributes dns-server value 192.168.0.150 192.168.0.200 vpn-idle-timeout 30 vpn-filter value mar-filter ipsec-udp enable split-tunnel-policy tunnelspecified split-tunnel-network-list value mar-split default-domain value rockporttech.com split-dns value rockporttech.com group-policy remote internal group-policy remote attributes dns-server value 172.16.2.10 split-tunnel-policy tunnelspecified split-tunnel-network-list value swvpnclient default-domain value srinvestments.com split-dns value srinvestments.com username swvpn password b23yCAArcUUDsLqY encrypted username admin password PulsCK2HzfuLpAyL encrypted privilege 15 username marquis password /z5v8kWQs6.soQFt encrypted username marquis attributes service-type remote-access tunnel-group remote type remote-access tunnel-group remote general-attributes address-pool remote authentication-server-group (outside) RADIUS LOCAL default-group-policy remote tunnel-group remote ipsec-attributes pre-shared-key ***** tunnel-group mar type remote-access tunnel-group mar general-attributes address-pool remote default-group-policy mar tunnel-group mar ipsec-attributes pre-shared-key ***** tunnel-group 2.130.39.52 type ipsec-l2l tunnel-group 2.130.39.52 ipsec-attributes pre-shared-key ***** tunnel-group remote type remote-access tunnel-group remote general-attributes address-pool swvpnpool default-group-policy remote tunnel-group remote ipsec-attributes pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns dns_map parameters message-length maximum 4000 policy-map global_policy class inspection_default inspect dns dns_map inspect ftp inspect http inspect netbios inspect pptp inspect rsh inspect sqlnet inspect sunrpc inspect tftp inspect xdmcp inspect ipsec-pass-thru inspect h323 h225 inspect h323 ras inspect sip ! service-policy global_policy global prompt hostname context no call-home reporting anonymous Cryptochecksum:4dccecdd051690aa4f9b3ea0d19d7d27 : end
... View more
- Tags:
- nat asa
Labels:
01-22-2018
I'm trying to track a users connection history looking at my 5520
syslogs. The client MAC is 3d61:c4...
Created by
murraymwps
in Unified Communications Infrastructure
12-18-2017
12-18-2017
Can anyone tell me what the difference is between CUC system call
handlers and user mailboxes from a...
08-11-2017
So.... dumb mistake. The interface was down. As soon as I plugged it in
the route showed up. Yes - t...
Created by
murraymwps
in Switching
08-11-2017
08-11-2017
I'm getting a "gateway of last resort is not set" on a 2911 after
entering "ip routing" and a route ...
02-03-2017
Rahul, Thanks for your response. Shouldn't the packet tracer command
generate the interesting traffi...
02-03-2017
Can't figure out why this L2L VPN is being denied. "show crypto isa sa"
returns "There are no IKEv1 ...
12-09-2016
Looks like a fix has just been released but I can't find these software
versions to download. From t...
12-02-2016
Does anyone have any ideas on a workaround for failing CVE-2016-2183.
Cisco published the vulnerabil...
12-02-2016
Jaime - thanks for your response. You wrote "permanently". Are there
different types of deleted? May...
Created by
murraymwps
in Unified Communications Infrastructure
12-02-2016
12-02-2016
Is there a way to undelete a voicemail message in Unity Connection 11.x?
Created by
murraymwps
in TelePresence and Video Infrastructure
11-15-2016
11-15-2016
I just set up a DX80 on prem and am connecting to a MX300 G2, also on
prem. When I connect to the MX...
Created by
murraymwps
in Unified Communications Infrastructure
03-01-2016
03-01-2016
I seem to remember a client application that ran on Windows that allowed
users to upload and customi...
10-26-2015
I'm failing when connecting via AnyConnect (error attached). This
started happening after a code upg...
Created by
murraymwps
in Switching
10-26-2015
10-26-2015
I have a question on whether the following config limits broadcast
traffic to 10%. I believe it send...
Public Statistics
| Date Registered | 12-18-2014 05:19 AM |
| Date Last Visited | 08-23-2018 07:57 AM |
| Total Messages Posted | 34 |
.jpg "VIP Advisor"){kind=icon}
