Hello Eric, Thanks for the quick response. You can imagine that I am disappointed. In the documentation, be it datasheets or administration guides etc, I have seen no remarks about this. Am I correct? At home I ''ve got an ASA5505 and a 881 router to play with. Both without wifi. Some functions I like to have seperate, although it's less cost-effective. No options there. With regards, Jaap ... View more

Hi, The IP-addresses came from the dhcp-pool as configured in the router. No dhcp-relay configured (see attachment). The warning on the switch with dhcp-snooping enabled gave the message that an unauthorized dhcp server was signaled (on a trusted interface, the up-link). On the MS DHCP server (from the logging I got from the quys over there): DNS renew request from the 10.47.94.0, so from the netword address of the subnet !! Update failes. Several renew requests and failures. ??? Greetz Jaap ... View more

Hi Ivan, It must have been to early for me this morning :). Followed your advice and deleted: - crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_SHA Added: - TRANS_ESP_3DES_SHA (as first option) to crypto dynamic-map outside_dyn_map 40 set transform-set vpnclient ESP-DES-MD5 ESP-3DES-MD5 ESP-3DES-SHA and it works !!! :) The L2TP is also still working. It seems that my 5505 (and the other AS-models?) does/do not like two lines with 'crypto dynamic-map', i.c. 20 & 40. Is this a flaw in the handling? Anyway, thanks a lot for your help. Greetz Jaap ... View more

Hi, Thanks for your answer. I think you are referring to the group-policy DefaultRAGroup? The group-policy used for testing the Cisco VPN-client (with user Graham) is 'cisco_client_vpn' with one of the attributes being 'vpn-tunnel-protocol IPSec'. group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes vpn-tunnel-protocol l2tp-ipsec group-policy cisco_client_vpn internal group-policy cisco_client_vpn attributes dns-server value 10.16.0.20 vpn-tunnel-protocol IPSec default-domain value diode-networks.local username graham password DLaUiAX3l78qgoB5c7iVNw== nt-encrypted privilege 0 username graham attributes vpn-group-policy cisco_client_vpn username jaap password cCiE5PO1AMnFfx.p encrypted privilege 15 tunnel-group DefaultRAGroup general-attributes address-pool VPNtest default-group-policy DefaultRAGroup tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key * tunnel-group DefaultRAGroup ppp-attributes no authentication chap no authentication ms-chap-v1 authentication ms-chap-v2 tunnel-group cisco_client_vpn type ipsec-ra tunnel-group cisco_client_vpn general-attributes address-pool VPNtest default-group-policy cisco_client_vpn tunnel-group cisco_client_vpn ipsec-attributes pre-shared-key * tunnel-group cisco_client_vpn ppp-attributes no authentication chap no authentication ms-chap-v1 authentication ms-chap-v2 Could it be that my problem has to do with with: - the crypto (dynamic-)map. Numbers 20, 40? - no routes defined by the VPN-client wizard? - no reverse route injection configured? And what IPSec transformsets are offred by the VPN-clients? Thanx, Jaap ... View more

Hi Tom, You're assumptions are correct. Although I 'll have to check on point 3. The solution you propose will do the trick. Thanks for your explanation. Jaap ... View more

Hi again, I attached a diagram to explain my 'problem' maybe more clearly. It concerns a partial move of some servers because the move can't taken place in a single service window. Users workstation partially connect to an IP-address in stead of a DNS name. TIA Jaap ... View more

Hi again, I attached a diagram to explain my 'problem' maybe more clearly. It concerns a partial move of some servers because the move can't taken place in a single service window. Users workstation partially connect to an IP-address in stead of a DNS name. TIA Jaap Jaap ... View more

Hi, Yes the servers are using public routable IPs. They are not NATted. In front of the servers are one or more firewall and also in some occasions loadbalansers. Greetz, Jaap ... View more