I am attempting to get a solid setup for a remote office we have going up and I am running into little issues that I cant seem to get around. Basically, we have a remote office that will have dual ISPs, one hard wired circuit from a local carrier and the other will be a Verizon 4G router that plugs in via Ethernet and hands out DHCP to my Cisco router. The Cisco router is a 2911 with IP SLA configured.  I have it setup to ping my DC out one interface and if that fails, it removes the default route and injects a new default route from the other ISP, this works ok, except one issue, which I will explain below. The problem I am having is with the VPN.  I figured using EZVPN would be the only solution because the Verizon 4G only supports DHCP so I have to be able to connect from a dynamic remote host.  The other caveat is that failover needs to be seamless as we have no person onsite that can troubleshoot.  Its fine if it takes a few minutes, but the VPN just needs to come back up on its own without any intervention. I attempted to setup two different EZVPN crypto maps on the router but realized you can only have one inside cryptomap per interface, which would cause a problem with the internal network.  I thought I could just create subinterfaces off the router to have two inside interfaces to work with but that wouldnt have helped because they would now be on different subnets. I decided that adding an ASA5505 behind the router may be the simplest solution.  Use the router only for the purpose of handling routing between the two ISPs and performing NAT out the interfaces.  Then use the ASA to do EZVPN from.  This works well but there are some issues I am trying to work through. First, when the ISP fails over to the backup, the NAT translations have to timeout before things start working again.  For a constant ping, this is fine, I have the timers set down to 15 seconds for NAT timeouts and after 15 seconds the ping picks right back up again.  However, this breaks the EZVPN.  The ASA keeps trying to bring up the ISAKMP nearly every second, which keeps resetting the countdown on the NAT timeout for the remote EZVPN server.  Because of this, the VPN will never come up until I manually clear the NAT translations on the router.  So my first question is this; is there a way to adjust the timer that the VPN uses to try to bring the tunnel up?  I tried the crypto isakmp keepalive command but that didnt help, it looks like it doesnt work with EZVPN. The second issue is really with the IP SLA and is only an issue because of the first issue I mentioned.  When the router first comes up after a reboot, both the primary and secondary interfaces come up.  However, since the primary default route is only injected into the routing table once IP SLA is up and can reach its destination, the secondary route gets injected initially and the VPN comes up over the secondary ISP.  In a few seconds, the primary default route is injected, changes the path and because of the NAT translation, breaks the tunnel and never comes up again because of the first issue with the VPN tunnel renewing the NAT translation continuously.  If I am missing something here, please let me know, or if there is a better way, please let me know that too.  This seems like easy stuff to adjust, I just dont see where to do it so maybe its not possible.  I could easily go out and purchase a $100 Linksys router that will do the failover and clear its NATs and everything, but I need better reliability out of the hardware than that.  There has got to be a way to do this on a Cisco device since consumer level equipment can. Thanks for the help! ... View more

I am having issues with IP SLA and tracking to inject a different default route.  I am running 15.0(1)M4 so the commands are a little different than what I have used on 12.4 but I followed the 15.0 guide with no luck. Here is what I have. track 123 ip sla 456 reachability delay down 10 up 10 interface GigabitEthernet0/0 ip address x.x.x.x x.x.x.x duplex auto speed auto interface GigabitEthernet0/1 ip address dhcp duplex auto speed auto ip route 0.0.0.0 0.0.0.0 x.x.x.x track 123 ip route 0.0.0.0 0.0.0.0 dhcp 254 ip sla 456 icmp-echo x.x.x.x source-ip x.x.x.x timeout 1000 threshold 2 frequency 5 ip sla schedule 456 life forever start-time now If I put in this config just as it, everything starts working.  The track goes up, the ip sla is running, my default route is the route that is bring tracked.  However, if i unplug my cable from Gi 0/0 and take down what the ip sla is monitoring, my default route goes away, the track goes down and the ip sla is timing out. When I plug my cable back in, the ip sla doesnt come back up, which doesnt bring the track back up, which doesnt insert my default route back in, which is not good.  For whatever reason I cannot get things to come back alive.  I have tried a lot of different metrics, I have tried all default settings, no luck at all.  What am I missing?? ... View more

Has anyone been able to use webvpn and a client compatible with VNC enterprise server?  My company just moved to the VNC enterprise server to support encryption and single sign on but the cisco provided VNC client for WebVPN doesnt support encryption or anything but the VNC password. TightVNC has released a beta java applet that supports encryption and other authentication methods but the ASA errors when I try to load it. With all the security that Cisco employs I find it hard to believe the only client that is supported is an unsecure connection method.  Anyone do this before? ... View more

I have a 7206VXR-G1 router with SA-VAM2+ being used for VPN termination and internet access.  The routers CPu is starting to run pretty high, reaching over 80% during peak load and I am thinking about enabling turbo ACL's as an option to help decrease CPU load.  I have a total of about 800 ACL's defined with a total of nearly 8000 ACL entries.  Some ACL's have over a hundred lines, others may only have 10 or 20. I have read here on the forums that turbo ACL's have helped out in certain situations, but I am wondering what kind of impact this will have on my VPN environment. I read that every time an ACL change is made the router has to recompile the ACL.  How long does this take on an ACL with 20 lines?  How about 100 lines?  How much memory is typicaly used with this many ACL entries? Do turbo ACL's help performance with ACL's defined for crypto maps the same as they would for interface ACL's? ... View more

I am setting up a few different WebVPN profiles I am wondering if there is any way to disable the default page. I am going to give all users specific URLs (https://mywebvpn.mydomain.com/myprofile) but I would like to completely disable the page if they try browsing to https://mywebvpn.mydomain.com. I havent been able to find a setting yet that will disable the main page but still allow access to all group-urls. I have tried adding in the https://mywebvpn.mydomain.com to the default WebVPN group and checking disable, but it still loads the webpage when going to that URL. ... View more