Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Vikas Saxena
Stats
Member since
05-21-2004
163
Posts
97
Helpful
16
Solutions
Created by
Vikas Saxena
in Security Documents
in Security Documents
08-11-2011
08:10 PM
08-11-2011
08:10 PM
Introduction Automatic SCEP enrollment is a feature where a network administrator can provide Client Authentication certificates to the users with minimal Administrative assistance. This results in less calls to help desk if planned and deployed correctly. This document is based on the Configuration example http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b25dc1.shtml Requirements ASA Code Release Notes http://www.cisco.com/en/US/products/ps8411/prod_release_notes_list.html Licensing Suggested reading http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/overview_c78-527488.html Release Notes http://www.cisco.com/en/US/products/ps8411/prod_release_notes_list.html Configuration basics If you have followed the Configuration Example http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b25dc1.shtml to the letter you will not face any problem for 2.5/2.4/IPhone/IPad/Android. AnyConnect 3.0 3.0 Client behaves differently for SCEP enrollment and there are configuration changes required on the ASA to complete this task. The configuration for previous generation clients is incompatible with 3.0 (but with co-exists) and the configuration for 3.0 will not work for 2.x client. The Profile requirement is same with one exception that <CAURL PromptForChallengePW="true"> {Password challenge should be TRUE} is a mandatory field without this you will not get an "Enroll" button and client will not try to fetch the certificate from the CA server. In the tunnel-group you must have 'scep-enrollment enable' command. In the group-policy you must have 'scep-forwarding-url <url>' command. The URL in this command will be same as <CAURL> in the profile. The authentication method should be 'BOTH' Certificate and AAA. The Anyconnect 3.0 does not use 'ssl certificate-authentication <interface> <port>' command to fail the client authentication but the authentication method to kick start the SCEP enrollment.
... View more
Labels:
06-02-2011
10:07 PM
Hello, 12.3(14)T6 is a verrrrrrrry old version the support for SSL VPN client (usable SSL VPN - from alot of angles) came in from 12.4(20)T onwards. Try the new SDM it should give you all the feautres or try Cisco Configuration Pro. -Vikas
... View more
06-02-2011
10:04 PM
Hello, I suggest you should get a case opened with TAC since this is not the correct place to work on a router crash. I suspect CSCsr11109 but the router should not crash. -Vikas
... View more
06-02-2011
09:57 PM
Hello Vibi, In PIX 6.3.5 it is not possible to U turn the traffic. So the VPN client users will not be able to go to the Remote Office connected to your PIX via IPSEC tunnel.The rule PIX follows is that you cannot go out the same interface through which you come in without crossing any other interface. Since in the case of U-Turning the traffic from the VPN client will get decrypted on the outside interface and the routing (for remote office network) will point to outside again, the traffic will fail. Solutions: ======= Upgrade PIX 515 to 7.x and use same-security-traffic permit [inter/intra] interface command with nat (outside) 0 , OR (The complicated one but successfully implemented at many locations) ====================================================== On the outside interface of PIX 515 6.3.5 create sub interfaces. Say e0/1.1 and e0/1.2 (Create two interfaces out of 1) Both interfaces will have separate public ip address. E0/1.1 will have the default gateway pointed to its next hop and will be used by the VPN client. E0/1.2 will be used by the IPSEC L2L to the remote office and will have static route pointing to the peer ip and as well as to the remote network (just like IPSEC terminated on any other interface but the default interface (DG)). The E0/1.2 interface is just like a DMZ and will have lower security interface (6.x code can not have two interfaces with the same security level) Therefore regular natting rules will be followed. To implement this solution you either have another router infront of this PIX or your ISP must coordinate with you so that you can have dot1q running on the ISP router as well. BTW: The PIX codes (either 6.7 or 8) are out of engineering. -Vikas
... View more
06-02-2011
09:36 PM
Hi Mukund, The tunnel can be kept alive if there is constant traffic inside the tunnel. For this you can use different ways to send periodic continuous traffic in side the tunnel. Like an SNMP server constantly pulling data from router or sending pings periodically, in case if SNMP is an overkill you can use smartcallhome feature on the Cisco router to schedule ping to a site as well. OR, you can configure SLA monitoring just to send constant pings to keep the tunnel alive. The tunnel WILL die down if there is no traffic, the only way to keep it alive is by constant stream of traffic. -Vikas
... View more
05-27-2011
05:28 AM
How does your topology looks like? I imagine it in two ways: 1. LAN------ASA---------router---------HQ +---------internet---------HQ or 2. LAN-------router-------ASA---------internet--------HQ +--------serial----------------------------HQ the second one is simpler, in the router you will have one default gw as ASA, ASA has one default GW as internet ISP hop. In the router you will have one route for HQ pointing to serial. You can use floating static route for the HQ network and point it to ASA. When the ASA will get the traffic destined for the HQ (crypto) it will initiate the tunnel if does not exist or encrypt it if already exists, no need for RRI. With router you can also do fancy stuff using SLA monitoring, this will make route tweaking granular. -Vikas
... View more
05-27-2011
04:48 AM
Hi, You need to post your crypto config and the packet-tracer data. Crypto config with port and proto are always complicated. Juniper side is working with filters, you should too, rather than specifying ports and protos in the crypto, configure filters and let the crypto be ip to ip. -Vikas
... View more
05-27-2011
02:44 AM
if this kind of problem was resolved by restarting the FW, then the only thing which can happen is that the IPSEC SA were out of sync, One side will keep on sending the traffic and other side will keep on rejecting it because it has no SA. The other thing I could imagine is one of those bugs where ASP table goes out of synch after multiple rekeys and there is no way but to reload to FW to overcome the situation. The ASP problem is rare now in newer codes.
... View more
05-26-2011
11:34 PM
Please rate and mark it as resolve so that others can know what we did here, if it is alright with you.
... View more
05-26-2011
11:29 PM
Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for IPV4 address! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for IPV4 net mask! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for DNS server address! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for WINS server address! Aug 11 07:06:27 [IKEv1]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Received unsupported transaction mode attribute: 5 Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Banner! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Save PW setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Default Domain Name! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Split Tunnel List! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Split DNS! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for PFS setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Client Browser Proxy Setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for backup ip-sec peer list! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Client Smartcard Removal Disconnect Setting! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for Application Version! Aug 11 07:06:27 [IKEv1]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Client Type: WinNT Client Application Version: 5.0.05.0290 Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for FWTYPE! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test , Username = cisco, IP = 20.20.20.1, MODE_CFG: Received request for DHCP hostname for DDNS is: PD1-STATIC-WXP! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Obtained IP addr (192.168.1.4) prior to initiating Mode Cfg (XAuth enabled) Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Sending subnet mask (255.255.255.0) to remote client Aug 11 07:06:27 [IKEv1]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Assigned private IP address 192.168.1.4 to remote user Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, constructing blank hash payload Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Send Client Browser Proxy Attributes! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Browser Proxy set to No-Modify. Browser Proxy data will NOT be included in the mode-cfg reply Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, Send Cisco Smartcard Removal Disconnect enable!! Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP = 20.20.20.1, constructing qm hash payload Aug 11 07:06:27 [IKEv1]: IP = 20.20.20.1, IKE_DECODE SENDING Message (msgid=fa774da7) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 206 Check above. The Tunnel-Group and the hostname. Also make sure that you have 'Register this connection in the DNS' setting checked under VA Advanced properties. This is by default in Cisco VPN client. If StrongSwan has a VA then it has to follow the rules in Windows API, this setting should be there if it has a VA, in case it is a miniport driver (shim) kind of setup, it may not have a VA. Here is the packet: Frame 9 (590 bytes on wire, 590 bytes captured) Ethernet II, Src: Cisco_d7:74:dd (00:25:45:d7:74:dd), Dst: Vmware_ad:75:1b (00:50:56:ad:75:1b) Internet Protocol, Src: 11.12.12.5 (11.12.12.5), Dst: 11.12.12.25 (11.12.12.25) User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67) Bootstrap Protocol Message type: Boot Request (1) Hardware type: Ethernet Hardware address length: 6 Hops: 0 Transaction ID: 0x011b5678 Seconds elapsed: 7 Bootp flags: 0x0000 (Unicast) 0... .... .... .... = Broadcast flag: Unicast .000 0000 0000 0000 = Reserved flags: 0x0000 Client IP address: 0.0.0.0 (0.0.0.0) Your (client) IP address: 0.0.0.0 (0.0.0.0) Next server IP address: 0.0.0.0 (0.0.0.0) Relay agent IP address: 11.12.12.5 (11.12.12.5) Client MAC address: Cisco_d7:74:dd (00:25:45:d7:74:dd) Client hardware address padding: 00000000000000000000 Server host name not given Boot file name not given Magic cookie: (OK) Option: (t=53,l=1) DHCP Message Type = DHCP Discover Option: (53) DHCP Message Type Length: 1 Value: 01 Option: (t=57,l=2) Maximum DHCP Message Size = 1152 Option: (57) Maximum DHCP Message Size Length: 2 Value: 0480 Option: (t=61,l=45) Client identifier Option: (61) Client identifier Length: 45 Value: 00636973636F2D303032352E343564372E373464642D5044... Option: (t=12,l=15) Host Name = "PD1-STATIC-WXP" Option: (12) Host Name Length: 15 Value: 5044312D5354415449432D57585000 Option: (t=55,l=6) Parameter Request List Option: (55) Parameter Request List Length: 6 Value: 01060F2C0321 1 = Subnet Mask 6 = Domain Name Server 15 = Domain Name 44 = NetBIOS over TCP/IP Name Server 3 = Router 33 = Static Route End Option Padding The only thing left untried is the "Register this connection in the DNS" thingy which you can find in the Advanced properties of the VA.
... View more
05-26-2011
10:56 PM
That's what I suspected. Check if IPSEC IKE service in the Windows has started or not. (services.msc). Try disabling the Windows FW may be the UDP/500, UDP/4500 are disabled. -Vikas
... View more
05-26-2011
12:41 AM
try turning on nat-t and flap the tunnel and see if the traffic passes. Otherwise you need to go all the way and capture the packets to see which side is at fault.
... View more
05-26-2011
12:39 AM
do a capture on both end on the outside interface like this access-li 150 permit ip host host access-li 150 permit ip host host cap capout access-li 150 interface outside run this on both the FW. please post 'sh run all sysopt', I will assume the Wizard will put sysopt connection permit-vpn by default. If you have TX increasing on other side but RX=0 on other than I believe ESP is blocked inbound on the other side.
... View more
05-25-2011
11:54 PM
Internal network(branch)---->ASA5505 <------->BT ADSL(dynamic IP, NAT)<-------Internet------->ASA5510<----Internal network(HQ) You can ping successfully from left to right but not from right to left. Had this been a route issue then PING would not have been successful any way. We need to check: 1. When you ping from right to left (HQ->BR) , - does the packet make it to the HQ FW - Does the HQ FW encrypts it (do you see increasing TX in ipsec sa (sh cry ipsec sa)) - Do you see increasing RX in the BR (sh cry ipsec SA) - Do you see increasing TX in the BR (if you see this, that means the echo request made it to the destination and echo reply came back - this probably will not be the case since you are here reading this ) - Does the echo request make it to the actual destination - Do you see echo reply coming out of the destination Check for any FW on the destination, If Windows XP and if Cisco VPN client installed, check for Stateful FW option in the VPN client. if on turn it off. Try again.
... View more
Created by
Vikas Saxena
in Security Documents
08-11-2011
08-11-2011
IntroductionAutomatic SCEP enrollment is a feature where a network
administrator can provide Client ...
06-02-2011
Hello, 12.3(14)T6 is a verrrrrrrry old version the support for SSL VPN
client (usable SSL VPN - from...
06-02-2011
Hello,I suggest you should get a case opened with TAC since this is not
the correct place to work on...
Created by
Vikas Saxena
in VPN
06-02-2011
06-02-2011
Hello Vibi,In PIX 6.3.5 it is not possible to U turn the traffic. So the
VPN client users will not b...
06-02-2011
Hi Mukund,The tunnel can be kept alive if there is constant traffic
inside the tunnel. For this you ...
05-27-2011
How does your topology looks like?I imagine it in two
ways:1.LAN------ASA---------router---------HQ
...
05-27-2011
Hi,You need to post your crypto config and the packet-tracer data.Crypto
config with port and proto ...
05-27-2011
if this kind of problem was resolved by restarting the FW, then the only
thing which can happen is t...
05-26-2011
Please rate and mark it as resolve so that others can know what we did
here, if it is alright with y...
05-26-2011
Aug 11 07:06:27 [IKEv1 DEBUG]: Group = IPSEC-Test, Username = cisco, IP
= 20.20.20.1, MODE_CFG: Rece...
05-26-2011
That's what I suspected.Check if IPSEC IKE service in the Windows has
started or not. (services.msc)...
05-26-2011
try turning on nat-t and flap the tunnel and see if the traffic passes.
Otherwise you need to go all...
05-26-2011
do a capture on both end on the outside interface like thisaccess-li 150
permit ip host host access-...
Public Statistics
| Date Registered | 05-21-2004 12:43 PM |
| Date Last Visited | 09-25-2018 07:51 PM |
| Total Messages Posted | 163 |
| Total Helpful Votes Received | 97 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
