We use that with our terminal servers... Not really thrilled with it.. but I'll give it a shot.. Thanks ... View more

Sure thing. It's lab'ed up, so no need to sanitize the config.... 3560 first, then 881 config below that.   3560C: version 15.0 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Flex_A ! boot-start-marker boot-end-marker ! ! no aaa new-model system mtu routing 1500 ip routing ! ! vtp mode transparent ! ! ! spanning-tree mode pvst spanning-tree extend system-id ! ! ! ! ! ! ! ! crypto ikev2 keyring MyKeys  peer Flex_A.cisco.com   address 44.33.22.12   pre-shared-key local k3yA   pre-shared-key remote k3yB  ! ! ! crypto ikev2 profile default  match identity remote fqdn Flex_B.cisco.com  identity local fqdn Flex_A.cisco.com  authentication remote pre-share  authentication local pre-share  keyring local MyKeys ! ! vlan internal allocation policy ascending ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0  ip address 192.168.1.1 255.255.255.255 ! interface Tunnel0  ip address 10.0.0.2 255.255.255.0  tunnel source FastEthernet0/12  tunnel destination 44.33.22.12  tunnel protection ipsec profile default ! interface FastEthernet0/1 ! interface FastEthernet0/2 ! interface FastEthernet0/3 ! interface FastEthernet0/4 ! interface FastEthernet0/5 ! interface FastEthernet0/6 ! interface FastEthernet0/7 ! interface FastEthernet0/8 ! interface FastEthernet0/9 ! interface FastEthernet0/10 ! interface FastEthernet0/11 ! interface FastEthernet0/12  no switchport  ip address 44.33.22.11 255.255.255.0 ! interface GigabitEthernet0/1 ! interface GigabitEthernet0/2 ! interface Vlan1  no ip address  shutdown ! ip http server ip http secure-server ! ip route 0.0.0.0 0.0.0.0 44.33.22.12 ip route 192.168.2.1 255.255.255.255 10.0.0.1 ! ! ! line con 0 line vty 5 15 ! end     ! 881 Router: version 15.3 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Flex_B ! boot-start-marker boot-end-marker ! ! ! no aaa new-model memory-size iomem 10 ! ! ! ! ! ! ! ! ! ! ip cef no ipv6 cef ipv6 multicast rpf use-bgp ! ! multilink bundle-name authenticated ! ! vtp mode transparent ! ! ! crypto ikev2 keyring MyKeys  peer Flex_A.cisco.com   address 44.33.22.11   pre-shared-key local k3yB   pre-shared-key remote k3yA  ! ! ! crypto ikev2 profile default  match identity remote fqdn Flex_A.cisco.com  identity local fqdn Flex_B.cisco.com  authentication remote pre-share  authentication local pre-share  keyring local MyKeys ! ! ! csdb tcp synwait-time 30 csdb tcp idle-time 3600 csdb tcp finwait-time 5 csdb tcp reassembly max-memory 1024 csdb tcp reassembly max-queue-length 16 csdb udp idle-time 30 csdb icmp idle-time 10 csdb session max-session 65535 ! ! ! ! crypto ipsec profile default  set ikev2-profile default ! ! ! ! ! ! interface Loopback0  ip address 192.168.2.1 255.255.255.255 ! interface Tunnel0  ip address 10.0.0.1 255.255.255.0  tunnel source FastEthernet4  tunnel destination 44.33.22.11  tunnel protection ipsec profile default ! interface FastEthernet0  no ip address ! interface FastEthernet1  no ip address ! interface FastEthernet2  no ip address ! interface FastEthernet3  no ip address ! interface FastEthernet4  ip address 44.33.22.12 255.255.255.0  duplex auto  speed auto ! interface Vlan1  no ip address ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip route 0.0.0.0 0.0.0.0 44.33.22.11 ip route 192.168.1.1 255.255.255.255 10.0.0.2 ! ! ! control-plane ! ! ! line con 0  logging synchronous  no modem enable line aux 0 line vty 0 4  login  transport input all ! ! end ... View more

Just for grins... I had a spare 3560C to play with... I was able to configure flex vpn on it, and I am passing traffic (IPV4)... Part of me is debating to throw the WAN into a separate VRF, and then use it as a VPN endpoint (only for testing). Would be interesting to see what the throughput would be. ... View more

Thank you for the answer! ... View more

The bug search states fixed as of yesterday. I do not see the download avaiable yet though.   https://tools.cisco.com/bugsearch/bug/CSCun10631 ... View more

Paul, I decided that it was not in the best interest of my company. Mostly because I would be adding another dependancy with having to forward the logs to another server, and then adding that server to the CDA. For now I just installed a 2012 (non R2) domain controller. I'm really torn, because I would have loved to have used the latest group policy that R2 had to offer. I was given a time frame of about a year for a fix, which is really unreasonable, but there's not a thing I can do about it. ... View more

Same issue here.. I have opened a case with TAC, and they stated that it's in development, but it's known not to work. There is a "work around", but I'm still debating if it something I want to do. You basically need to configure event log forwarding for event ID 4768 (Kerberos authentication), to another DC that is running one of the supported versions of Windows server. I'm going to test it if I can find better documentation on the web somewhere. ... View more