Hi David, Please change the transform set to 3des-sha Please  do the following changes on both the routers: crypto  ipsec transform-set 3des-sha-transform esp-3des esp-sha-hmac crypto map aesmap 10 ipsec-isakmp      no set transform-set aes-sha-transform      set transform-set 3aes-sha-transform Initiate  traffic and let me know if it works for you. Regards, Anisha P.S.:  please mark this thread as answered if you feel your query is resolved.  Do rate helpful posts. ... View more

Hi, To open a TAC case you can dial the front line number based on your country. http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html#telephone Hope this helps. Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

Hi Derek, When the user is initiates a VPN Connection, the connection will fall on the Tunnel-group or the Connection profile. Each connection profile will have a group-policy assigned. By default the group-policy is DefaultGroupPolicy. You can change the same by defining the group-policy explicitly. When you use LDAP to authenticate, you have an option to bind the group-policy to a user as well. This can be done with the help of LDAP Attribute Map. This group-policy will take precendence over any setting of the group-policy. I.e. in your case the group-policy Employee_Access will take precendence over the group-policy defined in the connection profile Hope this helps. Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

Hi, Please do the following: Policy elements > Command Sets > Create Give a name Enter the grant condition , commands and arguments Click on ADD Click on Submit Click on Access-policy > Device Default Access > Authorization > Customize Customized results > Available:Select Command set > Move to selected ok. Select the rule to apply TACACS authorization on the default device admin authorization page. In the results of the shell profile Command set . Click on Select and select the command set you created. Click on Ok. Hope this helps. Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

Hi, there is no way to crack the password. Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

Hi Michael, ASA is a Firewall. hence its primary function is to protect the network. Routing might be an issue if you make an ASA do it. If i understand correctly, then the two site are on the same network and not acorss internet. i guess a router will be a better choice. Hope this helps. Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

Hi, If you do not have the DVD, then open a TAC case and the cisco engineer will publish the image and insturctions for you. Hope this helps. Regards, Anisha P.S.: please mark this thread as answered if you  feel your query is resolved. Do rate helpful posts. ... View more

Hi, Can you check if there are any other peers defined at a lower sequence number with the same intersting traffic.? If yes can you bring the concerned peer at a lower sequence. e.g. access-li vpn1 permit ip host 1.1.1.1 host 2.2.2.2 access-list vpn2 permit ip host 1.1.1.1 host 2.2.2.2 cry map clientmap 1 match address vpn1 cry map clientmap 1 set peer 4.4.4.4 cry map clientmap 2 match address vpn2 cry map clientmap 2 set peer 42.42.42.42 Hope this helps. Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. do rate helpful posts. ... View more

Hi Hasan, The Anyconnect works in a different manner than the IPsec client. The PCF files no more exist. XML profile of the users are used for the connection. You can configure the XML profiles based on the configuration guide provided by Nicolas in the above reply. Hope this helps. Regards, Anisha P.S.: Please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

hi, can you please open the radius packet header on the wireshark and check for the Auth-Type value? It should be set to Accept Regards, Anisha P.S.:Please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more

Hi, how did you figure out that it is hitting the other access service? Regards, Anisha ... View more

Hi, The configuration seems fine. What do the logs in the reoprts show? which authorization profile is it falling ? Regards, Anisha P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts. ... View more