Cisco Community
English
Register
Register
cancel
turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Vikas Saxena
‎09-25-2018
Vikas Saxena
Member since ‎05-21-2004
Cisco Employee
163
Posts
92
Helpful
16
Solutions
Recent Badges
15 Accepted Solution
1 Accepted Solution
5 Accepted Solution
50 Replies
20 Replies
View All
Recent Badges
Awards

SCEP Enrollment - Anyconnect 3.0/2.4/2....

Created by Vikas Saxena Cisco Employee in Security Documents
‎08-11-2011 08:10 PM
‎08-11-2011 08:10 PM
Introduction Automatic SCEP enrollment is a feature where a network administrator can provide Client Authentication certificates to the users with minimal Administrative assistance. This results in less calls to help desk if planned and deployed correctly. This document is based on the Configuration example http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b25dc1.shtml Requirements ASA Code Release Notes http://www.cisco.com/en/US/products/ps8411/prod_release_notes_list.html Licensing Suggested reading http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/overview_c78-527488.html Release Notes http://www.cisco.com/en/US/products/ps8411/prod_release_notes_list.html Configuration basics If you have followed the Configuration Example http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b25dc1.shtml to the letter you will not face any problem for 2.5/2.4/IPhone/IPad/Android. AnyConnect 3.0 3.0 Client behaves differently for SCEP enrollment and there are configuration changes required on the ASA to complete this task. The configuration for previous generation clients is incompatible with 3.0 (but with co-exists) and the configuration for 3.0 will not work for 2.x client. The Profile requirement is same with one exception that <CAURL PromptForChallengePW="true"> {Password challenge should be TRUE} is a mandatory field without this you will not get an "Enroll" button and client will not try to fetch the certificate from the CA server. In the tunnel-group you must have 'scep-enrollment enable' command. In the group-policy you must have 'scep-forwarding-url <url>' command. The URL in this command will be same as <CAURL> in the profile. The authentication method should be 'BOTH' Certificate and AAA. The Anyconnect 3.0 does not use 'ssl certificate-authentication <interface> <port>' command to fail the client authentication but the authentication method to kick start the SCEP enrollment. ... View more
Labels:

Re: SSL VPN

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎06-02-2011 10:07 PM
‎06-02-2011 10:07 PM
Hello, 12.3(14)T6 is a verrrrrrrry old version the support for SSL VPN client (usable SSL VPN - from alot of angles) came in from 12.4(20)T onwards. Try the new SDM it should give you all the feautres or try Cisco Configuration Pro. -Vikas ... View more

Re: issues with EZVPN router keeps rebo...

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎06-02-2011 10:04 PM
‎06-02-2011 10:04 PM
Hello, I suggest you should get a case opened with TAC since this is not the correct place to work on a router crash. I suspect CSCsr11109 but the router should not crash. -Vikas ... View more

Re: how to access remote site over IPSE...

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎06-02-2011 09:57 PM
‎06-02-2011 09:57 PM
Hello Vibi, In PIX 6.3.5 it is not possible to U turn the traffic. So the VPN client users will not be able to go to the Remote Office connected to your PIX via IPSEC tunnel.The rule PIX follows is that you cannot go out the same interface through which you come in without crossing any other interface. Since in the case of U-Turning the traffic from the VPN client will get decrypted on the outside interface and the routing (for remote office network) will point to outside again, the traffic will fail. Solutions: ======= Upgrade PIX 515 to 7.x and use same-security-traffic permit [inter/intra] interface command with nat (outside) 0 , OR (The complicated one but successfully implemented at many locations) ====================================================== On the outside interface of PIX 515 6.3.5 create sub interfaces. Say e0/1.1 and e0/1.2 (Create two interfaces out of 1) Both interfaces will have separate public ip address. E0/1.1 will have the default gateway pointed to its next hop and will be used by the VPN client. E0/1.2 will be used by the IPSEC L2L to the remote office and will have static route pointing to the peer ip and as well as to the remote network (just like IPSEC terminated on any other interface but the default interface (DG)). The E0/1.2 interface is just like a DMZ and will have lower security interface (6.x code can not have two interfaces with the same security level) Therefore regular natting rules will be followed. To implement this solution you either have another router infront of this PIX or your ISP must coordinate with you so that you can have dot1q running on the ISP router as well. BTW: The PIX codes (either 6.7 or 8) are out of engineering. -Vikas ... View more

Re: Dynamic VPN tunnel lifetime

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎06-02-2011 09:36 PM
‎06-02-2011 09:36 PM
Hi Mukund, The tunnel can be kept alive if there is constant traffic inside the tunnel. For this you can use different ways to send periodic continuous traffic in side the tunnel. Like an SNMP server constantly pulling data from router or sending pings periodically, in case if SNMP is an overkill you can use smartcallhome feature on the Cisco router to schedule ping to a site as well. OR, you can configure SLA monitoring just to send constant pings to keep the tunnel alive. The tunnel WILL die down if there is no traffic, the only way to keep it alive is by constant stream of traffic. -Vikas ... View more

Re: Reverse Route Injection with ASA550...

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-27-2011 05:28 AM
‎05-27-2011 05:28 AM
How does your topology looks like? I imagine it in two ways: 1. LAN------ASA---------router---------HQ                  +---------internet---------HQ or 2. LAN-------router-------ASA---------internet--------HQ                    +--------serial----------------------------HQ the second one is simpler, in the router you will have one default gw as ASA, ASA has one default GW as internet ISP hop. In the router you will have one route for HQ pointing to serial. You can use floating static route for the HQ network and point it to ASA. When the ASA will get the traffic destined for the HQ (crypto) it will initiate the tunnel if does not exist or encrypt it if already exists, no need for RRI. With router you can also do fancy stuff using SLA monitoring, this will make route tweaking granular. -Vikas ... View more

Re: site to site issue ASA5510 to Junip...

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-27-2011 04:48 AM
‎05-27-2011 04:48 AM
Hi, You need to post your crypto config and the packet-tracer data. Crypto config with port and proto are always complicated. Juniper side is working with filters, you should too, rather than specifying ports and protos in the crypto, configure filters and let the crypto be ip to ip. -Vikas ... View more

Re: ASA5505 - supernet crypto ACL

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-27-2011 04:29 AM
‎05-27-2011 04:29 AM
This should work. ... View more

Re: Site-to-Site VPN

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-27-2011 02:44 AM
‎05-27-2011 02:44 AM
if this kind of problem was resolved by restarting the FW, then the only thing which can happen is that the IPSEC SA were out of sync, One side will keep on sending the traffic and other side will keep on rejecting it because it has no SA. The other thing I could imagine is one of those bugs where ASP table goes out of synch after multiple rekeys and there is no way but to reload to FW to overcome the situation. The ASP problem is rare now in newer codes. ... View more

Re: Site-to-Site VPN

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-26-2011 11:34 PM
‎05-26-2011 11:34 PM
Please rate and mark it as resolve so that others can know what we did here, if it is alright with you. ... View more

Re: DHCP with VPN

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-26-2011 11:29 PM
‎05-26-2011 11:29 PM
Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for IPV4 address! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for IPV4 net mask! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for DNS server address! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for WINS server address! Aug 11 07:06:27 [IKEv1]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Received unsupported transaction mode attribute: 5 Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Banner! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Save PW setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Default Domain Name! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Split Tunnel List! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Split DNS! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for PFS setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Client Browser Proxy Setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for backup ip-sec peer list! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Client Smartcard Removal Disconnect Setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Application Version! Aug 11 07:06:27 [IKEv1]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Client Type: WinNT  Client Application Version: 5.0.05.0290 Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for FWTYPE! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test , Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for DHCP hostname for DDNS is: PD1-STATIC-WXP! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Obtained IP addr (192.168.1.4) prior to initiating Mode Cfg (XAuth enabled) Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Sending subnet mask (255.255.255.0) to remote client Aug 11 07:06:27 [IKEv1]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Assigned private IP address 192.168.1.4 to remote user Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, constructing blank hash payload Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Send Client Browser Proxy Attributes! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Browser Proxy set to No-Modify. Browser Proxy data will NOT be included in the mode-cfg reply Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Send Cisco Smartcard Removal Disconnect enable!! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, constructing qm hash payload Aug 11 07:06:27 [IKEv1]: IP = 20.20.20.1, IKE_DECODE SENDING Message (msgid=fa774da7) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 206 Check above. The Tunnel-Group and the hostname. Also make sure that you have 'Register this connection in the DNS' setting checked under VA Advanced properties. This is by default in Cisco VPN client. If StrongSwan has a VA then it has to follow the rules in Windows API, this setting should be there if it has a VA, in case it is a miniport driver (shim) kind of setup, it may not have a VA. Here is the packet: Frame 9 (590 bytes on wire, 590 bytes captured) Ethernet II, Src: Cisco_d7:74:dd (00:25:45:d7:74:dd), Dst: Vmware_ad:75:1b (00:50:56:ad:75:1b) Internet Protocol, Src: 11.12.12.5 (11.12.12.5), Dst: 11.12.12.25 (11.12.12.25) User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67) Bootstrap Protocol     Message type: Boot Request (1)     Hardware type: Ethernet     Hardware address length: 6     Hops: 0     Transaction ID: 0x011b5678     Seconds elapsed: 7     Bootp flags: 0x0000 (Unicast)         0... .... .... .... = Broadcast flag: Unicast         .000 0000 0000 0000 = Reserved flags: 0x0000     Client IP address: 0.0.0.0 (0.0.0.0)     Your (client) IP address: 0.0.0.0 (0.0.0.0)     Next server IP address: 0.0.0.0 (0.0.0.0)     Relay agent IP address: 11.12.12.5 (11.12.12.5)     Client MAC address: Cisco_d7:74:dd (00:25:45:d7:74:dd)     Client hardware address padding: 00000000000000000000     Server host name not given     Boot file name not given     Magic cookie: (OK)     Option: (t=53,l=1) DHCP Message Type = DHCP Discover         Option: (53) DHCP Message Type         Length: 1         Value: 01     Option: (t=57,l=2) Maximum DHCP Message Size = 1152         Option: (57) Maximum DHCP Message Size         Length: 2         Value: 0480     Option: (t=61,l=45) Client identifier         Option: (61) Client identifier         Length: 45         Value: 00636973636F2D303032352E343564372E373464642D5044...     Option: (t=12,l=15) Host Name = "PD1-STATIC-WXP"         Option: (12) Host Name         Length: 15         Value: 5044312D5354415449432D57585000     Option: (t=55,l=6) Parameter Request List         Option: (55) Parameter Request List         Length: 6         Value: 01060F2C0321         1 = Subnet Mask         6 = Domain Name Server         15 = Domain Name         44 = NetBIOS over TCP/IP Name Server         3 = Router         33 = Static Route     End Option     Padding The only thing left untried is the "Register this connection in the DNS" thingy which you can find in the Advanced properties of the VA. ... View more

Re: ASA 5505 + L2TP over IPSEC + Window...

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-26-2011 10:56 PM
‎05-26-2011 10:56 PM
That's what I suspected. Check if IPSEC IKE service in the Windows has started or not. (services.msc). Try disabling the Windows FW may be the UDP/500, UDP/4500 are disabled. -Vikas ... View more

Re: Site-to-Site VPN

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-26-2011 12:41 AM
‎05-26-2011 12:41 AM
try turning on nat-t and flap the tunnel and see if the traffic passes. Otherwise you need to go all the way and capture the packets to see which side is at fault. ... View more

Re: Site-to-Site VPN

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-26-2011 12:39 AM
‎05-26-2011 12:39 AM
do a capture on both end on the outside interface like this access-li 150 permit ip host host access-li 150 permit ip host host cap capout access-li 150 interface outside run this on both the FW. please post 'sh run all sysopt', I will assume the Wizard will put sysopt connection permit-vpn by default. If you have TX increasing on other side but RX=0 on other than I believe ESP is blocked inbound on the other side. ... View more

Re: EasyVPN - ASA5505 to ASA 5510

Created by Vikas Saxena Cisco Employee in VPN and AnyConnect
‎05-25-2011 11:54 PM
‎05-25-2011 11:54 PM
Internal network(branch)---->ASA5505 <------->BT ADSL(dynamic  IP, NAT)<-------Internet------->ASA5510<----Internal  network(HQ) You can ping successfully from left to right but not from right to left. Had this been a route issue then PING would not have been successful any way. We need to check: 1. When you ping from right to left (HQ->BR) , - does the packet make it to the HQ FW - Does the HQ FW encrypts it (do you see increasing TX in ipsec sa (sh cry ipsec sa)) - Do you see increasing RX in the BR (sh cry ipsec SA) - Do you see increasing TX in the BR (if you see this, that means the echo request made it to the destination and echo reply came back - this probably will not be the case since you are here reading this ) - Does the echo request make it to the actual destination - Do you see echo reply coming out of the destination Check for any FW on the destination, If Windows XP and if Cisco VPN client installed, check for Stateful FW option in the VPN client. if on turn it off. Try again. ... View more
Public Statistics
Date Registered ‎05-21-2004 12:43 PM
Date Last Visited ‎09-25-2018 07:51 PM
Total Messages Posted 163
Total Helpful Votes Received 92
Helpful Votes Given To
Helpful Votes From