Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About michaelchandra
10-09-2017
Stats
Member since
02-27-2013
19
Posts
0
Helpful
0
Solutions
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
05-05-2013
09:15 PM
05-05-2013
09:15 PM
Hi all, I have cisco 837 series as a ADSL modem. I'm on 192.168.1.2 and my VPN client have 192.168.2.1. We can ping each other but when we try to play LAN games, we can't see each other. I believe this is caused by UDP Broadcast not reach the VPN client. How can I forward the UDP broadcast ? Any help will be appreciated. Sorry for my bad english. Thank you. Here is my configuration : Building configuration...
Current configuration : 3704 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname michael
!
boot-start-marker
boot-end-marker
!
memory-size iomem 5
no logging console
enable secret 5 $1$pZLW$9RZ8afI8QdGRq0ssaEJVu0
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
!
aaa session-id common
!
resource policy
!
ip subnet-zero
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool michael
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 202.134.0.155
!
ip dhcp pool excluded-address
host 192.168.1.4 255.255.255.0
hardware-address 01c8.d719.957a.b9
!
!
ip cef
ip name-server 202.134.0.155
ip name-server 203.130.193.74
vpdn enable
!
!
!
!
username michael privilege 15 secret 5 $1$ZJQu$KDigCvYWKkzuzdYHBEY7f.
username danny privilege 10 secret 5 $1$BDs.$Ez0u9wY7ywiBzVd1ECX0N/
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp xauth timeout 15
!
crypto isakmp client configuration group michaelvpn
key vpnpassword
pool SDM_POOL_1
acl 199
netmask 255.255.255.0
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
set transform-set ESP-3DES-SHA
!
!
crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
!
!
interface Ethernet0
description $FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
hold-queue 100 out
!
interface Ethernet2
no ip address
shutdown
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 0/35
pppoe-client dial-pool-number 1
!
!
interface FastEthernet1
duplex auto
speed auto
!
interface FastEthernet2
duplex auto
speed auto
!
interface FastEthernet3
duplex auto
speed auto
!
interface FastEthernet4
duplex auto
speed auto
!
interface Virtual-PPP1
no ip address
!
interface Dialer1
description $FW_OUTSIDE$
mtu 1492
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp chap hostname ispusername
ppp chap password 0 isppassword
ppp pap sent-username ispusername password 0 isppassword
crypto map SDM_CMAP_1
!
ip local pool SDM_POOL_1 192.168.2.1 192.168.2.5
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
no ip http secure-server
!
ip nat inside source static udp 192.168.1.0 1723 interface Dialer1 1723
ip nat inside source static tcp 192.168.1.4 21 interface Dialer1 21
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
!
access-list 1 remark SDM_ACL Category=16
access-list 1 permit 192.0.0.0 0.255.255.255
access-list 102 remark SDM_ACL Category=2
access-list 102 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
access-list 199 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
route-map SDM_RMAP_1 permit 1
match ip address 102
!
!
control-plane
!
banner motd ^C
Authorized Access Only
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED
You must have explicit permission to access this device.
All activities performed on this device are logged.
Any violations of access policy will result in disciplinary action.
^C
!
line con 0
no modem enable
line aux 0
line vty 0 4
!
scheduler max-task-time 5000
end
... View more
Labels:
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
05-04-2013
11:04 PM
05-04-2013
11:04 PM
Thank you for the reply. I managed it solved by upgrading the ios to 12.4(25d). Thank you.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
05-01-2013
08:27 AM
05-01-2013
08:27 AM
Thank you for your response, here is the debug : Log Buffer (4096 bytes):
1 15:19:47.011: ISAKMP: set new node 856647599 to QM_IDLE
May 1 15:19:47.015: ISAKMP:(0:8:SW:1):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1
spi 2182802952, message ID = 856647599
May 1 15:19:47.015: ISAKMP:(0:8:SW:1): seq. no 0xA3285B8A
May 1 15:19:47.015: ISAKMP:(0:8:SW:1): sending packet to 120.168.1.24 my_port 4500 peer_port 52667 (R) QM_IDLE
May 1 15:19:47.019: ISAKMP:(0:8:SW:1):purging node 856647599
May 1 15:19:47.019: ISAKMP:(0:8:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE
May 1 15:19:47.019: ISAKMP:(0:8:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
May 1 15:19:49.979: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B4F274, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:19:49.983: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B4F274, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:19:55.127: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B51C44, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:19:55.127: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B51C44, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:19:58.383: ISAKMP (0:134217736): received packet from 120.168.1.24 dport 4500 sport 52667 Global (R) QM_IDLE
May 1 15:19:58.383: ISAKMP: set new node -1340288848 to QM_IDLE
May 1 15:19:58.387: ISAKMP:(0:8:SW:1): processing HASH payload. message ID = -1340288848
May 1 15:19:58.387: ISAKMP:(0:8:SW:1): processing NOTIFY DPD/R_U_THERE protocol 1
spi 0, message ID = -1340288848, sa = 81A7DCEC
May 1 15:19:58.387: ISAKMP:(0:8:SW:1):deleting node -1340288848 error FALSE reason "Informational (in) state 1"
May 1 15:19:58.387: ISAKMP:(0:8:SW:1):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
May 1 15:19:58.387: ISAKMP:(0:8:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
May 1 15:19:58.391: ISAKMP:(0:8:SW:1):DPD/R_U_THERE received from peer 120.168.1.24, sequence 0xA3285B8B
May 1 15:19:58.391: ISAKMP: set new node -752454119 to QM_IDLE
May 1 15:19:58.395: ISAKMP:(0:8:SW:1):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1
spi 2182802952, message ID = -752454119
May 1 15:19:58.395: ISAKMP:(0:8:SW:1): seq. no 0xA3285B8B
May 1 15:19:58.395: ISAKMP:(0:8:SW:1): sending packet to 120.168.1.24 my_port 4500 peer_port 52667 (R) QM_IDLE
May 1 15:19:58.399: ISAKMP:(0:8:SW:1):purging node -752454119
May 1 15:19:58.399: ISAKMP:(0:8:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE
May 1 15:19:58.399: ISAKMP:(0:8:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
May 1 15:19:59.887: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B51C44, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:19:59.887: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B51C44, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:20:05.667: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81F84148, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
May 1 15:20:05.667: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81F84148, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 After searching thru the internet, I've found : CSCsb46264 Symptoms: When a dialer interface is configured as an endpoint for a IPSec+GRE tunnel, tracebacks with bad refcount may be generated. Conditions: This symptom is observed on a Cisco 837 when router-generated packets such as routing updates are being switched. Is that possible that the root of the problem was that ? Thank you.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
05-01-2013
06:07 AM
05-01-2013
06:07 AM
Thank you for the fast response. Here is my logs : Syslog logging: enabled (1 messages dropped, 1 messages rate-limited,
0 flushes, 0 overruns, xml disabled, filtering disabled)
Console logging: disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 965 messages logged, xml disabled,
filtering disabled
Logging Exception size (4096 bytes)
Count and timestamp logging messages: disabled
No active filter modules.
Trap logging: level informational, 579 message lines logged
Log Buffer (4096 bytes):
23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:19:52.803: ISAKMP (0:134217729): received packet from 120.168.1.24 dport 4500 sport 37662 Global (R) QM_IDLE
*Feb 17 15:19:52.803: ISAKMP: set new node -423687995 to QM_IDLE
*Feb 17 15:19:52.807: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = -423687995
*Feb 17 15:19:52.807: ISAKMP:(0:1:SW:1): processing NOTIFY DPD/R_U_THERE protocol 1
spi 0, message ID = -423687995, sa = 81A5AE2C
*Feb 17 15:19:52.807: ISAKMP:(0:1:SW:1):deleting node -423687995 error FALSE reason "Informational (in) state 1"
*Feb 17 15:19:52.807: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Feb 17 15:19:52.811: ISAKMP:(0:1:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Feb 17 15:19:52.811: ISAKMP:(0:1:SW:1):DPD/R_U_THERE received from peer 120.168.1.24, sequence 0xCF41275D
*Feb 17 15:19:52.811: ISAKMP: set new node -910486326 to QM_IDLE
*Feb 17 15:19:52.815: ISAKMP:(0:1:SW:1):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1
spi 2182802952, message ID = -910486326
*Feb 17 15:19:52.815: ISAKMP:(0:1:SW:1): seq. no 0xCF41275D
*Feb 17 15:19:52.815: ISAKMP:(0:1:SW:1): sending packet to 120.168.1.24 my_port 4500 peer_port 37662 (R) QM_IDLE
*Feb 17 15:19:52.819: ISAKMP:(0:1:SW:1):purging node -910486326
*Feb 17 15:19:52.819: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE
*Feb 17 15:19:52.819: ISAKMP:(0:1:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Feb 17 15:19:54.047: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B50AD8, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:19:54.047: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B50AD8, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:19:59.327: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B50AD8, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:19:59.327: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B50AD8, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:20:04.307: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81F84148, count=0
-Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:20:04.307: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81F84148, count=0
-Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0
*Feb 17 15:20:04.363: ISAKMP (0:134217729): received packet from 120.168.1.24 dport 4500 sport 37662 Global (R) QM_IDLE
*Feb 17 15:20:04.363: ISAKMP: set new node -874301582 to QM_IDLE
*Feb 17 15:20:04.367: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = -874301582
*Feb 17 15:20:04.367: ISAKMP:(0:1:SW:1): processing NOTIFY DPD/R_U_THERE protocol 1
spi 0, message ID = -874301582, sa = 81A5AE2C
*Feb 17 15:20:04.367: ISAKMP:(0:1:SW:1):deleting node -874301582 error FALSE reason "Informational (in) state 1"
*Feb 17 15:20:04.367: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Feb 17 15:20:04.379: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE
*Feb 17 15:20:04.379: ISAKMP:(0:1:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Feb 17 15:20:29.659: ISAKMP:(0:1:SW:1):purging node 377453653
*Feb 17 15:20:33.367: ISAKMP:(0:1:SW:1):purging node -2142077949
*Feb 17 15:20:42.807: ISAKMP:(0:1:SW:1):purging node -423687995
*Feb 17 15:20:54.367: ISAKMP:(0:1:SW:1):purging node -874301582
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
05-01-2013
04:39 AM
05-01-2013
04:39 AM
Hi, I'm using the cisco 837 router as my VPN server. I get connected using Cisco VPN Client Version 5. But when I ping the router ip, i get request timed out. Here is my configuration : Building configuration...
Current configuration : 3704 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname michael
!
boot-start-marker
boot-end-marker
!
memory-size iomem 5
no logging console
enable secret 5 $1$pZLW$9RZ8afI8QdGRq0ssaEJVu0
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
!
aaa session-id common
!
resource policy
!
ip subnet-zero
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool michael
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 202.134.0.155
!
ip dhcp pool excluded-address
host 192.168.1.4 255.255.255.0
hardware-address 01c8.d719.957a.b9
!
!
ip cef
ip name-server 202.134.0.155
ip name-server 203.130.193.74
vpdn enable
!
!
!
!
username michael privilege 15 secret 5 $1$ZJQu$KDigCvYWKkzuzdYHBEY7f.
username danny privilege 10 secret 5 $1$BDs.$Ez0u9wY7ywiBzVd1ECX0N/
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp xauth timeout 15
!
crypto isakmp client configuration group michaelvpn
key vpnpassword
pool SDM_POOL_1
acl 199
netmask 255.255.255.0
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
set transform-set ESP-3DES-SHA
!
!
crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
!
!
interface Ethernet0
description $FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
hold-queue 100 out
!
interface Ethernet2
no ip address
shutdown
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 0/35
pppoe-client dial-pool-number 1
!
!
interface FastEthernet1
duplex auto
speed auto
!
interface FastEthernet2
duplex auto
speed auto
!
interface FastEthernet3
duplex auto
speed auto
!
interface FastEthernet4
duplex auto
speed auto
!
interface Virtual-PPP1
no ip address
!
interface Dialer1
description $FW_OUTSIDE$
mtu 1492
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp chap hostname ispusername
ppp chap password 0 isppassword
ppp pap sent-username ispusername password 0 isppassword
crypto map SDM_CMAP_1
!
ip local pool SDM_POOL_1 192.168.2.1 192.168.2.5
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
no ip http secure-server
!
ip nat inside source static udp 192.168.1.0 1723 interface Dialer1 1723
ip nat inside source static tcp 192.168.1.4 21 interface Dialer1 21
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
!
access-list 1 remark SDM_ACL Category=16
access-list 1 permit 192.0.0.0 0.255.255.255
access-list 102 remark SDM_ACL Category=2
access-list 102 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
access-list 199 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
route-map SDM_RMAP_1 permit 1
match ip address 102
!
!
control-plane
!
banner motd ^C
Authorized Access Only
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED
You must have explicit permission to access this device.
All activities performed on this device are logged.
Any violations of access policy will result in disciplinary action.
^C
!
line con 0
no modem enable
line aux 0
line vty 0 4
!
scheduler max-task-time 5000
end
Thank you, anny help will be appreciated.
... View more
Labels:
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
03-07-2013
09:39 PM
03-07-2013
09:39 PM
Ok, what should I do now ? Because I don't have account to access the bug toolkit. Should I upgrade the IOS version ? Thank you.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
03-06-2013
05:00 AM
03-06-2013
05:00 AM
Here is the diagnostic log : Syslog logging: enabled (1 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) Console logging: level notifications, 1 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level debugging, 73 messages logged, xml disabled, filtering disabled Logging Exception size (4096 bytes) Count and timestamp logging messages: disabled No active filter modules. Trap logging: level informational, 53 message lines logged Log Buffer (4096 bytes): l-Access1, changed state to up *Feb 17 12:37:44.823: %LINEPROTO-5-UPDOWN: Line protocol on Interface ATM0, changed state to up *Feb 17 12:37:48.923: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up *Feb 17 12:39:07.935: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 192.168.1.4 --------------------Here is the part when I get request time out--------------------- *Feb 17 12:44:35.783: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:44:35.783: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:44:35.787: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B55490, count=0 -Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:35.787: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B55490, count=0 -Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:40.867: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:44:40.867: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:44:40.871: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B5580C, count=0 -Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:40.875: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B5580C, count=0 -Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:45.431: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:44:45.431: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:44:45.435: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81F8BBD4, count=0 -Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:45.439: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81F8BBD4, count=0 -Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:50.911: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:44:50.911: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:44:50.919: %SYS-2-BADSHARE: Bad refcount in pak_enqueue, ptr=81B573EC, count=0 -Traceback= 0x80137488 0x801DC350 0x801DDDA8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:44:50.919: %SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=81B573EC, count=0 -Traceback= 0x80137488 0x801D8830 0x801DDFD8 0x801E6860 0x807103F4 0x807F99F8 0x801E698C 0x8043FB10 0x8043FDC8 0x80D23CD0 0x80D24304 0x80D24400 0x8027B3C4 0x8027E9E0 *Feb 17 12:49:50.347: %SYS-5-CONFIG_I: Configured from console by michael on console *Feb 17 12:51:24.855: %SYS-5-CONFIG_I: Configured from console by michael on console --------------------Here is the part when I get the reply from the router--------------------- *Feb 17 12:57:22.339: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:57:22.339: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:57:23.395: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:57:23.395: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:57:25.415: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:57:25.419: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending *Feb 17 12:57:27.219: IP: tableid=0, s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), routed via RIB *Feb 17 12:57:27.219: IP: s=192.168.1.1 (local), d=192.168.2.1 (Dialer1), len 60, sending Is there any problem with my IOS version ? I'm using C837 Software (C837-K9O3Y6-M), Version 12.4(3), RELEASE SOFTWARE (fc2) and my system is ROM: System Bootstrap, Version 12.2(11r)YV1, RELEASE SOFTWARE (fc1)
Thank you for your advice
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
03-05-2013
07:03 AM
03-05-2013
07:03 AM
Sorry for the late response, I've tried the debug IP traffic but I get debug ip traffic
^
% Invalid input detected at '^' marker.
Do you mean debug ip packet ? If so, can I use the debug ip packet 199 or debug IP UDP to limit the output ? Thank you for your answer
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
03-01-2013
10:53 PM
03-01-2013
10:53 PM
You are right. How to enable debug on my 837 ? Can i use debug crypto isakmp ?
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
03-01-2013
08:46 PM
03-01-2013
08:46 PM
Thank you for the response. I have a question, usually when I connected to my VPN network, I can't access the internet, but right now I can browse the internet while connecting to my VPN. Still I can't ping the router. Is that okay ? Here is my configuration : Current configuration : 3632 bytes ! version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname michael ! boot-start-marker boot-end-marker ! memory-size iomem 5 no logging console enable secret 5 $1$pZLW$9RZ8afI8QdGRq0ssaEJVu0 ! aaa new-model ! ! aaa authentication login default local aaa authentication login sdm_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network sdm_vpn_group_ml_1 local ! aaa session-id common ! resource policy ! ip subnet-zero no ip dhcp use vrf connected ip dhcp excluded-address 192.168.1.1 ! ip dhcp pool michael network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 202.134.0.155 ! ip dhcp pool excluded-address host 192.168.1.4 255.255.255.0 hardware-address 01c8.d719.957a.b9 ! ! ip cef ip name-server 202.134.0.155 ip name-server 203.130.193.74 vpdn enable ! ! ! ! username michael privilege 15 secret 5 $1$ZJQu$KDigCvYWKkzuzdYHBEY7f. username danny privilege 10 secret 5 $1$BDs.$Ez0u9wY7ywiBzVd1ECX0N/ ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp xauth timeout 15 ! crypto isakmp client configuration group michaelvpn key vpnpassword pool SDM_POOL_1 acl 199 netmask 255.255.255.0 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto dynamic-map SDM_DYNMAP_1 1 set transform-set ESP-3DES-SHA ! ! crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1 crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto map SDM_CMAP_1 client configuration address respond crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1 ! ! ! interface Ethernet0 description $FW_INSIDE$ ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 hold-queue 100 out ! interface Ethernet2 no ip address shutdown hold-queue 100 out ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto pvc 0/35 pppoe-client dial-pool-number 1 ! ! interface FastEthernet1 duplex auto speed auto ! interface FastEthernet2 duplex auto speed auto ! interface FastEthernet3 duplex auto speed auto ! interface FastEthernet4 duplex auto speed auto ! interface Virtual-PPP1 no ip address ! interface Dialer1 description $FW_OUTSIDE$ mtu 1492 ip address negotiated ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 ppp chap hostname ispusername ppp chap password 0 isppassword ppp pap sent-username ispusername password 0 isppasswords crypto map SDM_CMAP_1 ! ip local pool SDM_POOL_1 192.168.2.1 192.168.2.5 ip classless ip route 0.0.0.0 0.0.0.0 Dialer1 ip http server no ip http secure-server ! ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload ip nat inside source static tcp 192.168.1.4 21 interface Dialer1 21 ! access-list 1 remark SDM_ACL Category=16 access-list 1 permit 192.0.0.0 0.255.255.255 access-list 102 remark SDM_ACL Category=2 access-list 102 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 access-list 102 permit ip 192.168.1.0 0.0.0.255 any access-list 199 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 route-map SDM_RMAP_1 permit 1 match ip address 102 ! ! control-plane ! banner motd ^C Authorized Access Only UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED You must have explicit permission to access this device. All activities performed on this device are logged. Any violations of access policy will result in disciplinary action. ^C ! line con 0 no modem enable line aux 0 line vty 0 4 ! scheduler max-task-time 5000 end Thank you
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
03-01-2013
03:13 AM
03-01-2013
03:13 AM
I try to trace route the router but what I get is only * * *. Is there something to do with the DNS server ? Because my VPN adapter seems to have strange DNS. Here is my adapter configuration : Windows IP Configuration Host Name . . . . . . . . . . . . : Michael-Desktop Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Mixed IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Wireless LAN adapter Wireless Network Connection 4: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter # 3 Physical Address. . . . . . . . . : D8-5D-4C-8F-54-EF DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Local Area Connection 3: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Cisco Systems VPN Adapter Physical Address. . . . . . . . . : 00-05-9A-3C-78-00 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::dd76:cfba:967:3822%43(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.2.3(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : DHCPv6 IAID . . . . . . . . . . . : 1006634394 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-B5-99-1B-1C-6F-65-89-41-28 DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1 NetBIOS over Tcpip. . . . . . . . : Enabled Wireless LAN adapter Wireless Network Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : 802.11 USB Wireless LAN Card Physical Address. . . . . . . . . : D8-5D-4C-8F-54-EE DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::2038:b3eb:414d:b2cf%34(Preferred) IPv4 Address. . . . . . . . . . . : 172.20.10.3(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.240 Lease Obtained. . . . . . . . . . : 01 Maret 2013 17:00:17 Lease Expires . . . . . . . . . . : 02 Maret 2013 16:45:52 Default Gateway . . . . . . . . . : 172.20.10.1 DHCP Server . . . . . . . . . . . : 172.20.10.1 DHCPv6 IAID . . . . . . . . . . . : 366501196 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-B5-99-1B-1C-6F-65-89-41-28 DNS Servers . . . . . . . . . . . : 202.152.165.39 202.155.0.10 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Tunngle: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : TAP-Win32 Adapter V9 (Tunngle) Physical Address. . . . . . . . . : 00-FF-C7-D9-93-69 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Bluetooth Network Connection 3: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) #3 Physical Address. . . . . . . . . : 00-11-B1-07-A3-D3 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : 1C-6F-65-89-41-28 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Tunnel adapter isatap.{680E748D-EEC7-40FE-A882-09F0240F8824}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Teredo Tunneling Pseudo-Interface: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:38ef:3278:8757:fe6d(Pref erred) Link-local IPv6 Address . . . . . : fe80::38ef:3278:8757:fe6d%33(Preferred) Default Gateway . . . . . . . . . : :: NetBIOS over Tcpip. . . . . . . . : Disabled Tunnel adapter isatap.{FB13218B-34DF-459E-8BCE-A992E4D479EA}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #7 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Thank you.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
02-28-2013
07:34 AM
02-28-2013
07:34 AM
Thank you for the response. I'm sure that my interface is up because I can ping the router interface inside the network. I've try to remove ip inspect and access list but it still showing request time out. But at some point I can ping my router. This made me confuse because some time I can ping the router and some time I can't. My 837 router is connected to linksys router which act as wifi router. I really appreciate your help. Thank you.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
02-28-2013
05:03 AM
02-28-2013
05:03 AM
No more error log on my VPN client. But still no luck connecting to the router. I still got request timed out. Here is my routing table, maybe it'll help : IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 172.20.10.1 172.20.10.3 25 36.81.98.170 255.255.255.255 172.20.10.1 172.20.10.3 100 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 172.20.10.0 255.255.255.240 On-link 172.20.10.3 281 172.20.10.1 255.255.255.255 On-link 172.20.10.3 100 172.20.10.3 255.255.255.255 On-link 172.20.10.3 281 172.20.10.15 255.255.255.255 On-link 172.20.10.3 281 192.168.1.0 255.255.255.0 192.168.2.1 192.168.2.4 100 192.168.2.0 255.255.255.0 On-link 192.168.2.4 281 192.168.2.4 255.255.255.255 On-link 192.168.2.4 281 192.168.2.255 255.255.255.255 On-link 192.168.2.4 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 172.20.10.3 281 224.0.0.0 240.0.0.0 On-link 192.168.2.4 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 172.20.10.3 281 255.255.255.255 255.255.255.255 On-link 192.168.2.4 281 =========================================================================== Persistent Routes: None No persistence route, is that okay? Here is my router configuration : Building configuration... Current configuration : 4332 bytes ! version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname michael ! boot-start-marker boot-end-marker ! memory-size iomem 5 no logging console enable secret 5 ! aaa new-model ! ! aaa authentication login default local aaa authentication login sdm_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network sdm_vpn_group_ml_1 local ! aaa session-id common ! resource policy ! ip subnet-zero no ip dhcp use vrf connected ip dhcp excluded-address 192.168.1.1 ! ip dhcp pool michael network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 202.134.0.155 ! ip dhcp pool excluded-address host 192.168.1.4 255.255.255.0 hardware-address 01c8.d719.957a.b9 ! ! ip cef ip name-server 202.134.0.155 ip name-server 203.130.193.74 ip inspect name SDM_LOW cuseeme ip inspect name SDM_LOW dns ip inspect name SDM_LOW ftp ip inspect name SDM_LOW h323 ip inspect name SDM_LOW https ip inspect name SDM_LOW icmp ip inspect name SDM_LOW imap ip inspect name SDM_LOW pop3 ip inspect name SDM_LOW netshow ip inspect name SDM_LOW rcmd ip inspect name SDM_LOW realaudio ip inspect name SDM_LOW rtsp ip inspect name SDM_LOW esmtp ip inspect name SDM_LOW sqlnet ip inspect name SDM_LOW streamworks ip inspect name SDM_LOW tftp ip inspect name SDM_LOW tcp ip inspect name SDM_LOW udp ip inspect name SDM_LOW vdolive vpdn enable ! ! ! ! username michael privilege 15 secret 5 username danny privilege 10 secret 5 ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp xauth timeout 15 ! crypto isakmp client configuration group michaelvpn key myvpnpassword pool SDM_POOL_1 acl 199 netmask 255.255.255.0 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto dynamic-map SDM_DYNMAP_1 1 set transform-set ESP-3DES-SHA ! ! crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1 crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto map SDM_CMAP_1 client configuration address respond crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1 ! ! ! interface Ethernet0 description $FW_INSIDE$ ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 hold-queue 100 out ! interface Ethernet2 no ip address shutdown hold-queue 100 out ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto pvc 0/35 pppoe-client dial-pool-number 1 ! ! interface FastEthernet1 duplex auto speed auto ! interface FastEthernet2 duplex auto speed auto ! interface FastEthernet3 duplex auto speed auto ! interface FastEthernet4 duplex auto speed auto ! interface Virtual-PPP1 no ip address ! interface Dialer1 description $FW_OUTSIDE$ mtu 1492 ip address negotiated ip nat outside ip inspect SDM_LOW out ip virtual-reassembly encapsulation ppp dialer pool 1 ppp chap hostname ispusername ppp chap password 0 isppassword ppp pap sent-username ispusername password 0 isppassword crypto map SDM_CMAP_1 ! ip local pool SDM_POOL_1 192.168.2.1 192.168.2.5 ip classless ip route 0.0.0.0 0.0.0.0 Dialer1 ip http server no ip http secure-server ! ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload ip nat inside source static tcp 192.168.1.4 21 interface Dialer1 21 ! access-list 1 remark SDM_ACL Category=16 access-list 1 permit 192.0.0.0 0.255.255.255 access-list 102 remark SDM_ACL Category=2 access-list 102 deny ip any host 192.168.2.1 access-list 102 deny ip any host 192.168.2.2 access-list 102 deny ip any host 192.168.2.3 access-list 102 deny ip any host 192.168.2.4 access-list 102 deny ip any host 192.168.2.5 access-list 102 permit ip 192.0.0.0 0.255.255.255 any access-list 199 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 route-map SDM_RMAP_1 permit 1 match ip address 102 ! ! control-plane ! banner motd ^C Authorized Access Only UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED You must have explicit permission to access this device. All activities performed on this device are logged. Any violations of access policy will result in disciplinary action. ^C ! line con 0 no modem enable line aux 0 line vty 0 4 ! scheduler max-task-time 5000 end I haven't tried the jawad advice to add access list. Btw, in my vpn client secured routes statistics i get 192.168.1.0 for network now, before i got 0.0.0.0 I really appreciate your help. Thank you.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
02-28-2013
01:08 AM
02-28-2013
01:08 AM
I try to connect using my phone acting as a modem, to my home network. So I'm not connecting from inside network.
... View more
Created by
michaelchandra
in VPN and AnyConnect
in VPN and AnyConnect
02-28-2013
01:02 AM
02-28-2013
01:02 AM
Trying your advice, here's what i get : When I try to ping my router : Pinging 192.168.1.1 with 32 bytes of data: Reply from 172.20.10.2: Destination host unreachable. Request timed out. Request timed out. Request timed out. My IP route table before connect : IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 172.20.10.1 172.20.10.2 25 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 172.20.10.0 255.255.255.0 On-link 172.20.10.2 281 172.20.10.2 255.255.255.255 On-link 172.20.10.2 281 172.20.10.255 255.255.255.255 On-link 172.20.10.2 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 172.20.10.2 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 172.20.10.2 281 =========================================================================== Persistent Routes: None My IP route table when connected : IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 172.20.10.1 172.20.10.2 25 0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.5 26 36.73.230.207 255.255.255.255 172.20.10.1 172.20.10.2 100 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 172.20.10.0 255.255.255.0 On-link 172.20.10.2 281 172.20.10.0 255.255.255.0 192.168.2.1 192.168.2.5 281 172.20.10.1 255.255.255.255 On-link 172.20.10.2 100 172.20.10.2 255.255.255.255 On-link 172.20.10.2 281 172.20.10.2 255.255.255.255 192.168.2.1 192.168.2.5 281 172.20.10.255 255.255.255.255 On-link 172.20.10.2 281 192.168.1.0 255.255.255.0 36.73.230.207 172.20.10.2 26 192.168.2.0 255.255.255.0 On-link 192.168.2.5 281 192.168.2.5 255.255.255.255 On-link 192.168.2.5 281 192.168.2.255 255.255.255.255 On-link 192.168.2.5 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 172.20.10.2 281 224.0.0.0 240.0.0.0 On-link 192.168.2.5 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 172.20.10.2 281 255.255.255.255 255.255.255.255 On-link 192.168.2.5 281 =========================================================================== Persistent Routes: Network Address Netmask Gateway Address Metric 0.0.0.0 0.0.0.0 192.168.2.1 1 Client log : 1 15:52:45.441 02/28/13 Sev=Warning/2 CVPND/0xE3400013 AddRoute failed to add a route with metric of 0: code 160 Destination 172.20.10.255 Netmask 255.255.255.255 Gateway 192.168.2.1 Interface 192.168.2.5 But I haven't tried to add the access list bcoz my sister took the console cable . I really appreciate your help. Thank you
... View more
05-05-2013
Hi all, I have cisco 837 series as a ADSL modem. I'm on 192.168.1.2 and
my VPN client have 192.168.2...
Created by
michaelchandra
in VPN and AnyConnect
05-04-2013
05-04-2013
Thank you for the reply. I managed it solved by upgrading the ios to
12.4(25d). Thank you.
Created by
michaelchandra
in VPN and AnyConnect
05-01-2013
05-01-2013
Thank you for your response, here is the debug :Log Buffer (4096 bytes):
1 15:19:47.011: ISAKMP: set...
Created by
michaelchandra
in VPN and AnyConnect
05-01-2013
05-01-2013
Thank you for the fast response. Here is my logs :Syslog logging:
enabled (1 messages dropped, 1 mes...
Created by
michaelchandra
in VPN and AnyConnect
05-01-2013
05-01-2013
Hi, I'm using the cisco 837 router as my VPN server. I get connected
using Cisco VPN Client Version ...
Created by
michaelchandra
in VPN and AnyConnect
03-07-2013
03-07-2013
Ok, what should I do now ? Because I don't have account to access the
bug toolkit. Should I upgrade ...
Created by
michaelchandra
in VPN and AnyConnect
03-06-2013
03-06-2013
Here is the diagnostic log :Syslog logging: enabled (1 messages dropped,
1 messages rate-limited, 0 ...
Created by
michaelchandra
in VPN and AnyConnect
03-05-2013
03-05-2013
Sorry for the late response, I've tried the debug IP traffic but I get
debug ip traffic ^ % Invalid ...
Created by
michaelchandra
in VPN and AnyConnect
03-01-2013
03-01-2013
You are right. How to enable debug on my 837 ? Can i use debug crypto
isakmp ?
Created by
michaelchandra
in VPN and AnyConnect
03-01-2013
03-01-2013
Thank you for the response. I have a question, usually when I connected
to my VPN network, I can't a...
Created by
michaelchandra
in VPN and AnyConnect
03-01-2013
03-01-2013
I try to trace route the router but what I get is only * * *. Is there
something to do with the DNS ...
Created by
michaelchandra
in VPN and AnyConnect
02-28-2013
02-28-2013
Thank you for the response. I'm sure that my interface is up because I
can ping the router interface...
Created by
michaelchandra
in VPN and AnyConnect
02-28-2013
02-28-2013
No more error log on my VPN client. But still no luck connecting to the
router. I still got request ...
Created by
michaelchandra
in VPN and AnyConnect
02-28-2013
02-28-2013
I try to connect using my phone acting as a modem, to my home network.
So I'm not connecting from in...
Created by
michaelchandra
in VPN and AnyConnect
02-28-2013
02-28-2013
Trying your advice, here's what i get :When I try to ping my router
:Pinging 192.168.1.1 with 32 byt...
Public Statistics
| Date Registered | 02-27-2013 03:32 AM |
| Date Last Visited | 10-09-2017 11:53 AM |
| Total Messages Posted | 19 |
