Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Joel Johnson
11-29-2018
Stats
Member since
02-19-2014
11
Posts
0
Helpful
1
Solution
Created by
Joel Johnson
in VPN and AnyConnect
in VPN and AnyConnect
11-22-2018
07:50 AM
11-22-2018
07:50 AM
Thanks again, This was one of the original posts i came across when searching, it lead me onto finding the video which gave me a very clear idea of how to implement it in my environment.
... View more
Created by
Joel Johnson
in VPN and AnyConnect
in VPN and AnyConnect
11-22-2018
07:35 AM
11-22-2018
07:35 AM
Thanks for the reply JP, After doing some further packet captures i could see traffic bouncing about. I managed to come across this great video that helped me fix the issue. Luckily enough it was simple to follow and matched my scenario. Just needed to add a loopback address and route traffic correctly. https://www.youtube.com/watch?v=ARg-RYM0tIs
... View more
11-20-2018
09:21 AM
Hello, I'm currently having an issue with a NAT'ed Hairpinned s2s VPN setup. The VPN itself is up and running okay but i don't seem to be able to ping or route past the remote peer. Please see image attached for a quick overview. Based on the diagram, from 192.168.100.1 i am able to ping 10.50.13.50 over the VPN tunnel and back but i am unable to ping anything else or further hops such as 10.50.13.2 or 'other subnets'. The rules in place from the 'firewall' are correct and allowing the specified traffic. We can see traffic being returned to 10.50.13.50 from 10.50.13.2 for example during a ping but not any further.
I think the problem lays with how i am trying to NAT or route the traffic in this hairpin type scenario. All the other s2s tunnels i have configured previously have used a dedicated inside and outside interface, so i'm a bit stuck on this one. Thanks for any assistance.
... View more
Labels:
Created by
Joel Johnson
in VPN and AnyConnect
in VPN and AnyConnect
02-08-2017
06:22 AM
02-08-2017
06:22 AM
Good Afternoon, I'm having some trouble with traffic on a double s2s tunnel. Please see the attached image for a overview and debug info. Setup is IPSEC VPN : Pepwave (Peer1)<---Agressive mode--->800 router (Peer2)<-----main Mode--->ASA (Peer3).
As the attached image shows i have perfect ipsec comms between each site, e.i. Peer 1 can ping Peer 2 subnets 100%, Peer 2 can ping Peer 3 subnets, But when trying to ping or communicate from Peer 1 to Peer 3, traffic goes missing and only 7-10% of the traffic is returned. I only have control of Peer devices 1 and 2, originally i assumed a routing problem with Peer 3, as the debug info in the image attached suggests traffic isn't being returned from peer 3, when peer 1 is the source.
Are there any other debugs i can do to help show whats happening to the traffic? Thanks, Joel
... View more
Labels:
04-02-2014
05:54 AM
Yes sorry, was a typo and looking at to many diagrams!
interesting traffic is:
permit ip 192.168.224.190 0.0.0.7 192.168.40.0 0.0.0.255
permit ip 192.168.40.0 0.0.0.255 10.21.0.0 0.0.255.255
permit ip 192.168.40.0 0.0.0.255 192.168.0.0 0.0.255.255
permit ip 192.168.40.0 0.0.0.255 172.16.10.0 0.0.0.255
permit ip 192.168.40.0 0.0.0.255 172.16.11.0 0.0.0.255
permit ip 192.168.40.0 0.0.0.255 172.16.12.0 0.0.0.255
permit ip 192.168.40.0 0.0.0.255 10.53.16.0 0.0.1.255
permit ip 192.168.40.0 0.0.0.255 10.53.133.0 0.0.0.255
Traffic on Router A LAN (192.168.40.X) can't reach Router C LAN (10.21.0.0, 192.168.0.0, 172.16.10.0, 172.16.11.0, etc)
... View more
04-02-2014
05:23 AM
Hi, Yes the tunnel comes up but wont route the required traffic. I can only seem to route VPN traffic from router A to router B, and from router B to router C. What i cant do is route via the VPN from router A to route C (in Failover Mode). A B C pepwave Cat 5 cable <----------> Cisco 861 <------VPN------> Cisco device Normal mode Pepwave <-----3GVPN-----> Cisco 861 <------VPN------> Cisco device Failover Mode 192.168.40.X 192.168.224.193 10.71.1.0 The cisco tunnel from the 861 to the cisco device works fine and i can ping between the LANs. The first ACL for the cisco 861 to Cisco device is 192.168.40.X to 10.71.1.0 from the physical cat5 cable from the pepwave to the Cisco 861, this passed traffic to 10.71.1.0 with no issues. But the failover 3G VPN with the Second ACL also 192.168.40.X to 10.71.1.0 wont send traffic between 192.168.40.X and 10.71.1.0, it only lets traffic from pepwave Lan 192.168.40.X to Cisco 861 192.168.224.193 in the tunnel. I'm not sure if i have to add some special command or routing information. The pictures and conf should help explain. Thanks,
... View more
04-02-2014
03:45 AM
Hi All, I'm having some issues with a site to site to site VPN. i've attached a diagram to help. In the topology i have a Pepwave HD2, Cisco 861 and another cisco device. The pepwave provides both cabled LAN traffic and failover 3G traffic. I have created a VPN tunnel between the two cisco devices that is up and active and able to route incoming cabled traffic from the pepwave between the cisco devices on the VPN tunnel. My goal is to get traffic from 192.168.40.X to 10.71.1.0 via the 3G VPN for the failover scenario. I've configured a VPN for the pepwave HD2 3G traffic using a dynamic map. The tunnel comes up but is idle - and the second diagram attached shows the tunnel is active for LAN traffic 172.16.17.0 to 192.168.224.192, but wont come up for 192.168.40.X to 10.71.1.0. Someone in the cisco community suggested that only one interface can support one VPN tunnel at once from the same address range. I've attached my config of the 861 router, does anyone know how i can route this traffic via the VPN tunnels on IOS as the same-security-traffic permit inter-intraface same-security-traffic permit intra-interface commands dont work on IOS . Thanks,
... View more
- Tags:
- ios
Labels:
03-30-2014
04:10 AM
Hi Shetty, your comments about the network are correct. The Satellite passes traffic to the cisco at a ground station to be encrypted to the cisco at HQ, once the sate is down the 3G tunnel needs to pass traffic to the ground station cisco for routing down the same tunnel to HQ So both the pepwave and cisco 86X use the same ACL to access the HQ cisco via VPN. Would that cause both peers to present the same vpn network/proxy-id on same wan. Only part of the pepwave 3G tunnel comes up (the part that doesnt include the same addresses as in the satellite link in the ACL. Would you know of a way to get around this? I only have access to the cisco 86X (on IOS) and pepwave so cant run the ASA commands. ill post what i have from the IOS though ASAP. Thanks! Joel
... View more
03-20-2014
06:29 AM
Hi Shetty. I've attached a PDF with diagram to help explain. (Red traffic failover route, blue traffic normal data) Basically traffic from 192.168.40.xxx needs to be able to talk to devices at 10.21.1.71 - traveling from cisco 861 to Cisco HQ via the VPN. In normal operation the satellite network passes traffic to the 861 for encryption. BUT when the Sat is Down the pepwave can failover to the Cisco via 3G. The VPN ACL for the cisco to Cisco is already 192.168.40.xxx to 10.21.1.71. So would the VPN ACL for the 3G (dynamic) to cisco be 192.168.40.xxx to 10.21.1.71. as well as the inteded destination is 10.21.1.71 and the source is 192.168.40.xxx? Or would i need to route traffic differently? And i assume the best way to do this is to use one Crypto map with different proirities? Thanks,
... View more
Created by
Joel Johnson
in VPN and AnyConnect
in VPN and AnyConnect
03-18-2014
10:29 AM
03-18-2014
10:29 AM
Hi, I have a cisco 861 that needs to run two L2L tunnels, one to a peplink 3G device and another to a cisco ASA: Peplink HD2 <----3G VPN Tunnel----> Cisco 861 <---VPN Tunnel----> Cisco ASA http://www.cloud-distribution.com/_CDL/files/ipsec_guide.pdf using crypto keyring dynkey (aggressive mode). I can establish the Cisco 861 and ASA VPN tunnel without a problem. But as soon as i add the 3G dynamic policy to the config for the peplink HD2. The policies seem to clash. crypto keyring dynkey pre-shared-key hostname vpn@peplink key *************** ! crypto isakmp policy 1 encr aes 256 authentication pre-share group 5 ! crypto isakmp policy 20 encr 3des authentication pre-share group 2 crypto isakmp key 2kSc89723Lkndv90K address 46.183.191.1 crypto isakmp profile dynprofile keyring dynkey self-identity user-fqdn vpn@cisco match identity user-fqdn vpn@peplink initiate mode aggressive ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac crypto ipsec transform-set 3desset esp-3des esp-sha-hmac ! set security-association lifetime seconds 3600 ! ! ! crypto dynamic-map dynmap 20 set transform-set 3desset set pfs group2 set isakmp-profile dynprofile match address VPN-TRAFFIC ! ! crypto map CMAP_CF 1 ipsec-isakmp description Tunnel to46.183.191.1 set peer 46.183.191.1 set transform-set TS set pfs group5 match address VPN-TRAFFIC crypto map CMAP_CF 20 ipsec-isakmp dynamic dynmap Is there a way to put these into seperate policies/profiles or am i doing something completely wrong? Both tunnels work okay independantly. Thanks, Joel
... View more
- Tags:
- peplink pepwave
Labels:
Created by
Joel Johnson
in VPN and AnyConnect
in VPN and AnyConnect
03-11-2014
08:36 AM
03-11-2014
08:36 AM
Hi All, I cant seem to find where i'm going wrong. I have a site to site VPN tunnel that works and passes traffic, as soon as a add another access list to allow internet bound traffic out nothing then passes through the tunnel. What am i missing? ip nat pool _Int 217.10.175.100 217.10.175.100 prefix-length 24 ip nat inside source list 101 pool _Int overload ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 217.10.176.xxx permanent ! ip access-list extended VPN-TRAFFIC permit ip 10.82.175.0 0.0.0.255 10.82.128.0 0.0.31.255 permit ip 10.82.175.0 0.0.0.255 10.82.160.0 0.0.7.255 permit ip 10.82.175.0 0.0.0.255 10.82.168.0 0.0.3.255 permit ip 10.82.175.0 0.0.0.255 10.82.172.0 0.0.1.255 permit ip 10.82.175.0 0.0.0.255 10.82.174.0 0.0.0.255 permit ip 192.168.224.200 0.0.0.7 any permit ip 192.168.224.200 0.0.0.7 10.82.128.0 0.0.31.255 permit ip 192.168.224.200 0.0.0.7 10.82.160.0 0.0.7.255 permit ip 192.168.224.200 0.0.0.7 10.82.168.0 0.0.3.255 permit ip 192.168.224.200 0.0.0.7 10.82.172.0 0.0.1.255 permit ip 192.168.224.200 0.0.0.7 10.82.174.0 0.0.0.255 ! access-list 101 permit tcp 10.82.175.0 0.0.0.255 any eq 443 access-list 101 permit tcp 10.82.175.0 0.0.0.255 any eq www access-list 101 permit udp 10.82.175.0 0.0.0.255 any eq domain access-list 101 permit icmp 10.82.175.0 0.0.0.255 any Any help is appriecated, Thanks, Joel
... View more
Labels:
11-22-2018
Thanks again, This was one of the original posts i came across when
searching, it lead me onto findi...
11-22-2018
Thanks for the reply JP,After doing some further packet captures i could
see traffic bouncing about....
11-20-2018
Hello,I'm currently having an issue with a NAT'ed Hairpinned s2s VPN
setup. The VPN itself is up and...
02-08-2017
Good Afternoon,I'm having some trouble with traffic on a double s2s
tunnel. Please see the attached ...
04-02-2014
Yes sorry, was a typo and looking at to many diagrams! interesting
traffic is: permit ip 192.168.224...
04-02-2014
Hi,Yes the tunnel comes up but wont route the required traffic.I can
only seem to route VPN traffic ...
04-02-2014
Hi All,I'm having some issues with a site to site to site VPN. i've
attached a diagram to help. In t...
03-30-2014
Hi Shetty,your comments about the network are correct. The Satellite
passes traffic to the cisco at ...
03-20-2014
Hi Shetty.I've attached a PDF with diagram to help explain. (Red traffic
failover route, blue traffi...
Created by
Joel Johnson
in VPN and AnyConnect
03-18-2014
03-18-2014
Hi,I have a cisco 861 that needs to run two L2L tunnels, one to a
peplink 3G device and another to a...
Created by
Joel Johnson
in VPN and AnyConnect
03-11-2014
03-11-2014
Hi All,I cant seem to find where i'm going wrong. I have a site to site
VPN tunnel that works and pa...
Public Statistics
| Date Registered | 02-19-2014 06:05 AM |
| Date Last Visited | 11-29-2018 07:51 AM |
| Total Messages Posted | 11 |
