Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jeremyn
Stats
Member since
05-29-2013
19
Posts
0
Helpful
0
Solutions
Created by
jeremyn
in Small Business Routers
in Small Business Routers
12-17-2013
07:01 PM
12-17-2013
07:01 PM
Hello, I have an RV320. When creating an Easy VPN tunnel I am given the option of to provide an ip address and mask for the split tunnel configuration. The manual states that this is the VPN tunnel's interface. Can someone explain why this interface ends in a zero? I configure the interface for 192.168.10.1 /24 and when I save, it converts it to a network id of 192.168.10.0 /24. What do I do with this interface or range? Do I configure firewall rules to allow it to a specified vlan? It currently will not allow access to my domain, only the router's management ip address. Thanks, JN
... View more
Labels:
12-17-2013
06:56 PM
I can confirm some of these issues with my RV320. I have the easy vpn configured and can access the default vlan, but nothing on another defined vlan. I added access rules for the virtual ip range, and even the vpn interface. Neither of which worked. I was unsuccessful changing the default vlan to something else.
... View more
12-10-2013
07:31 PM
Does the other Linksys router have a static route for the VPN subnet? I believe it would need to know where to route packets back to. I have a problem with vpn access for my client through the RV320. As in, no access to anything. If you could share the relevant parts of your config, that'd help me. Thanks
... View more
Created by
jeremyn
in Small Business Routers
in Small Business Routers
12-10-2013
07:23 PM
12-10-2013
07:23 PM
Had a desktop disable it's firewall today, no joy. The gateway incremented by 1 as well, which is really odd in the virtual ip space. Here's what I get as output IPv4 Address. . . . . . . . . . . : 172.16.100.101 Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 172.16.100.102 Configuration: Virtual IP Range 172.16.100.100 - 129 Easy VPN Group No 1 Tunnle Name: Omitted Min Password Complexity Enabled Password: Omitted Interface: WAN1 Enabled: Full Tunnel Ip address 192.168.10.0 /24 Extended Auth: local db Ideas? Thanks, JN
... View more
Created by
jeremyn
in Small Business Routers
in Small Business Routers
12-08-2013
03:38 PM
12-08-2013
03:38 PM
Ok a little more progress. Testing with a Sprint Mifi, the VPN now authenticates. Either my home router or comcast is somehow blocking the vpn connection. I'm still unable to access any resources, going to have the company disable the firewall on a desktop tomorrow and test. I will report back here. Thanks, JN
... View more
Created by
jeremyn
in Small Business Routers
in Small Business Routers
12-08-2013
03:13 PM
12-08-2013
03:13 PM
Hey Tom, I finally got back on site. I now have remote access enabled, and the VPN was working temporarily, however now I can't connect at all via Cisco VPN Client. Oddly enough, I had to enable HTTPS on the outside interface to allow remote management. My understanding is that the checkbox would take care of that. Here's the relevant client logs with the destination ip removed: 144 14:59:30.000 12/08/13 Sev=Info/4 IKE/0x6300004B Discarding IKE SA negotiation (I_Cookie=CDA66B11F9AF1DF8 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING 145 14:59:30.001 12/08/13 Sev=Info/4 CM/0x63100014 Unable to establish Phase 1 SA with server "<##.##.##.##" because of "DEL_REASON_PEER_NOT_RESPONDING" Cisco RV320 Log: 2013-12-08, 15:06:56 Kernel kernel: [ACCESS_RULE]: IN=eth1 SRC= DST= DMAC= SMAC= LEN=52 TOS=0x00 PREC=0x00 TTL=122 ID=20127 DF PROTO=TCP SPT=2148 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0 I've tested the following: 1. Rebooted Router. 2. Recreated a VPN Easy Connect group with preshared key. Any other ideas, thoughts? The VPN stopped responding completely before today, and the reboot successfully allowed connections, briefly, before returning to the current state. Thanks, JN
... View more
Created by
jeremyn
in Small Business Routers
in Small Business Routers
11-08-2013
02:10 PM
11-08-2013
02:10 PM
I'll try this next chance I get. This is a site I visit about once every other month. I'll post the results back here when I know more. Thanks
... View more
Created by
jeremyn
in Small Business Routers
in Small Business Routers
11-07-2013
07:31 AM
11-07-2013
07:31 AM
No, the firewalls are not disabled. ICMP (ping) responds when attempting across vlans. It does not work when connected via vpn. Nor does anything else for that matter. The mask on my connection seems odd to me. Should it be configured as a /24 instead, or this a default for vpn connections?
... View more
Created by
jeremyn
in Small Business Routers
in Small Business Routers
11-06-2013
08:20 PM
11-06-2013
08:20 PM
Hello all, I have a RV320 router with the Easy VPN configured and I am able to connect via the client. My issue is that once I connect, I cannot access any resources in any vlans. Can anyone point me in the right direction? I have the admin guide but it doesn't offer much detail. The ipconfig for the vpn connection looks like this: IPv4 Address. . . . . . . . . . . : 172.16.100.100 Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 172.16.100.101 I can ping the router's management ip address (on another vlan), but nothing else.
... View more
Labels:
Created by
jeremyn
in Network Security
in Network Security
06-12-2013
02:52 PM
06-12-2013
02:52 PM
My apologies for not sharing the full config. It looks like you are correct in that being the root issue and I will go through and reconfigure the access-list to be more specific. I'll mark your reply as the correct answer as it is helpful in finalizing the configuration. Thanks!
... View more
Created by
jeremyn
in Network Security
in Network Security
06-12-2013
11:37 AM
06-12-2013
11:37 AM
Greetings again everyone, Thanks to everyone for responding to my previous requests for help. I worked with a Cisco TAC the last couple days to resolve this issue. It turned out to be a NAT issue between the two vlans. The original access-list for natting was this: access-list NoNAT extended permit ip 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list NoNAT extended permit ip 10.0.0.0 255.0.0.0 172.16.0.0 255.240.0.0 access-list NoNAT extended permit ip 10.0.0.0 255.0.0.0 192.168.0.0 255.255.0.0 access-list NoNAT extended permit ip 172.16.0.0 255.240.0.0 10.0.0.0 255.0.0.0 access-list NoNAT extended permit ip 172.16.0.0 255.240.0.0 172.16.0.0 255.240.0.0 access-list NoNAT extended permit ip 192.168.0.0 255.255.0.0 10.0.0.0 255.0.0.0 access-list NoNAT extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0 access-list NoNAT extended permit ip 10.0.0.0 255.255.240.0 10.51.0.0 255.255.255.0 access-list NoNAT extended permit ip 10.21.0.0 255.255.240.0 10.51.0.0 255.255.255.0 nat (WTA2COB) 0 access-list NoNAT nat (WTA2COB) 1 0.0.0.0 0.0.0.0 nat (FACSURV) 0 access-list NoNAT nat (FACSURV) 1 0.0.0.0 0.0.0.0 The revised configuration was this: access-list EXEMPT permit ip 192.168.150.0 255.255.255.0 access-list EXEMPT permit ip 192.168.151.0 255.255.255.0 nat (WTA2COB) 0 access-list EXEMPT nat (WTA2COB) 1 192.168.150.0 255.255.255.0 nat (FACSURV) 0 access-list EXEMPT nat (FACSURV) 1 192.168.151.0 255.255.255.0 From what I can tell, the 192.168 statement in the NoNAT access-list didn't work because it was for 192.168.0.0 /16, wherease the Exempt access-list applied for each subnet specifically. Let me know if I'm correct in that assumption. Long term I'd like to update the NoNAT to reflect the smaller subnets and then apply the access-list to these interfaces. Thanks, J
... View more
Created by
jeremyn
in Network Security
in Network Security
06-03-2013
12:34 PM
06-03-2013
12:34 PM
Hi guys, I won't be able to share the full config. I am in training this week and will be unable to follow up on this ticket. I'd like to follow this up next week if possible. I may open up a TAC case here pretty soon, and will definitely follow up with the answer if I get it. Thanks, J
... View more
Created by
jeremyn
in Network Security
in Network Security
05-31-2013
11:55 AM
05-31-2013
11:55 AM
Thanks all, I worked on this some more today, testing with some additional rules. The ASA is acting like it doesn't see my rules: Added NAT statements: nat (FACSURV) 0 access-list NoNAT nat (FACSURV) 1 0.0.0.0 0.0.0.0 nat (WTA2COB) 0 access-list NoNAT nat (WTA2COB) 1 0.0.0.0 0.0.0.0 Access rules below: access-list aWTA2COB; 5 elements; name hash: 0xadecbc34 access-list aWTA2COB line 1 extended permit ip any 192.168.151.64 255.255.255.192 (hitcnt=0) 0xeb0a6bb8 access-list aWTA2COB line 2 extended permit ip any 192.168.151.128 255.255.255.128 (hitcnt=0) 0x3a7dfade access-list aWTA2COB line 3 extended permit ip any 192.168.151.0 255.255.255.0 (hitcnt=0) 0x93302455 access-list aWTA2COB line 4 remark test access-list aWTA2COB line 5 extended permit ip any any (hitcnt=0) 0xdbfec94c access-list aWTA2COB line 6 remark test access-list aWTA2COB line 7 extended permit icmp any any (hitcnt=0) 0x2cece62d access-list FACSURV_access_in; 5 elements; name hash: 0x6dc9adc7 access-list FACSURV_access_in line 1 extended permit ip 192.168.151.64 255.255.255.192 192.168.150.0 255.255.255.240 (hitcnt=0) 0x054508b7 access-list FACSURV_access_in line 2 extended permit ip 192.168.151.128 255.255.255.128 192.168.150.0 255.255.255.240 (hitcnt=0) 0xc125c41e access-list FACSURV_access_in line 3 extended permit ip host 192.168.151.3 192.168.150.0 255.255.255.240 (hitcnt=0) 0x4adc114c access-list FACSURV_access_in line 4 extended permit ip any any (hitcnt=9) 0x9fedc480 access-list FACSURV_access_in line 5 remark test access-list FACSURV_access_in line 6 extended permit icmp any any (hitcnt=0) 0xd74c33b6 Packet Tracer result: packet-tracer input wta2COB icmp 192.168.150.1 8 0 192.168.151.3 Phase: 1 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 2 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found no matching flow, creating a new flow Phase: 3 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 192.168.151.0 255.255.255.0 FACSURV Phase: 4 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: WTA2COB input-status: up input-line-status: up output-interface: FACSURV output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule I will open a TAC case today. If you have any further input, I'm willing to test. Thanks, J
... View more
Created by
jeremyn
in Network Security
in Network Security
05-30-2013
04:12 PM
05-30-2013
04:12 PM
Sorry, no luck: packet-tracer input wta2COB icmp 192.168.150.1 0 0 192.168.151.3 Phase: 1 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 2 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found no matching flow, creating a new flow Phase: 3 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 192.168.151.0 255.255.255.0 FACSURV Phase: 4 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Result: input-interface: WTA2COB input-status: up input-line-status: up output-interface: FACSURV output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule access-group aWTA2COB in interface WTA2COB access-group FACSURV_access_in in interface FACSURV Thanks for the continued responses.
... View more
Created by
jeremyn
in Network Security
in Network Security
05-30-2013
12:17 PM
05-30-2013
12:17 PM
Hi I changed the security level of the first interface higher and tested an ip packet from that subnet to the other (40/30). It failed, citing the same default rule. It appears to be blocked at that interface and never reaches the other interface. Any other ideas? Thanks, J
... View more
Created by
jeremyn
in Small Business Routers
12-17-2013
12-17-2013
Hello,I have an RV320. When creating an Easy VPN tunnel I am given the
option of to provide an ip ad...
12-17-2013
I can confirm some of these issues with my RV320. I have the easy vpn
configured and can access the ...
12-10-2013
Does the other Linksys router have a static route for the VPN subnet? I
believe it would need to kno...
12-10-2013
Had a desktop disable it's firewall today, no joy. The gateway
incremented by 1 as well, which is re...
12-08-2013
Ok a little more progress. Testing with a Sprint Mifi, the VPN now
authenticates. Either my home rou...
12-08-2013
Hey Tom,I finally got back on site. I now have remote access enabled,
and the VPN was working tempor...
11-08-2013
I'll try this next chance I get. This is a site I visit about once every
other month. I'll post the ...
11-07-2013
No, the firewalls are not disabled. ICMP (ping) responds when attempting
across vlans. It does not w...
11-06-2013
Hello all,I have a RV320 router with the Easy VPN configured and I am
able to connect via the client...
06-12-2013
My apologies for not sharing the full config. It looks like you are
correct in that being the root i...
06-12-2013
Greetings again everyone,Thanks to everyone for responding to my
previous requests for help. I worke...
06-03-2013
Hi guys,I won't be able to share the full config. I am in training this
week and will be unable to f...
05-31-2013
Thanks all,I worked on this some more today, testing with some
additional rules. The ASA is acting l...
05-30-2013
Sorry, no luck:packet-tracer input wta2COB icmp 192.168.150.1 0 0
192.168.151.3 Phase: 1Type: ACCESS...
Public Statistics
| Date Registered | 05-29-2013 04:11 PM |
| Date Last Visited | 08-18-2017 04:01 AM |
| Total Messages Posted | 19 |
