Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Kn1ghtR1d3rOfD00m
Online
Kn1ghtR1d3rOfD0
Member since
02-25-2014
Beginner
Created by
Kn1ghtR1d3rOfD0
in VPN and AnyConnect
03-01-2019
08:58 PM
03-01-2019
08:58 PM
you were right, after correcting the right peers and crypt acl matched the correct interesting traffic, somehow when I had the script and be ready for copy and paste, that made me fail, so I did it step by step, and no errors, tunnels are up and running, thanks for the catch up
... View more
Created by
Kn1ghtR1d3rOfD0
in VPN and AnyConnect
03-01-2019
10:07 AM
03-01-2019
10:07 AM
yes, not sure and not quite familiar with the CLI, I modified so Ips are fake, the rest is what I currently have not sure how to revert it back BEFORE THE CHANGE crypto map OUTSIDE_map1 10 match address OUTSIDE_cryptomap_9 crypto map OUTSIDE_map1 10 set peer 37.120.33.66 crypto map OUTSIDE_map1 10 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES BELOW AFTER THE CHANGE crypto map OUTSIDE_map1 10 match address OUTSIDE_cryptomap_9 crypto map OUTSIDE_map1 10 set peer 37.120.33.66 38.122.33.68 crypto map OUTSIDE_map1 10 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map OUTSIDE_map1 11 match address OUTSIDE_cryptomap_10 crypto map OUTSIDE_map1 11 set peer 38.122.33.68 crypto map OUTSIDE_map1 11 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES INFO: You must configure ikev2 remote-authentication pre-shared-key and/or certificate to complete authentication. ERROR: Exceeded maximum of 9 ipsec-proposals for crypto map. CISCO_ASAFW/pri/act(config)#
... View more
Created by
Kn1ghtR1d3rOfD0
in VPN and AnyConnect
03-01-2019
06:13 AM
03-01-2019
06:13 AM
Hi, I have been trying to understand if I missed something or if if there is a limit for the crypto maps when creating a vpn, there was already up and running a vpn tunnel crypto map OUTSIDE_map1 9 match address OUTSIDE_cryptomap_9
crypto map OUTSIDE_map1 10 set peer X.X.X.X
crypto map OUTSIDE_map1 10 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES So I tried the create new vpn under the sequence of 10 crypto map OUTSIDE_map1 11 match address OUTSIDE_cryptomap_10 crypto map OUTSIDE_map1 11 set peer X.X.X.X crypto map OUTSIDE_map1 11 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES and I got the error: ERROR: Exceeded maximum of 9 ipsec-proposals for crypto map. and overwrote the crytpos that I have and merged them
... View more
Labels:
02-20-2019
01:01 PM
I see, yeah, let me get the list first, I see what you mean, Thanks, brb
... View more
02-20-2019
12:40 PM
Hi team, Just wondering if there is such documentation or reference or guide, if exist, and that's why I posted under this side of the forum, what I'm looking for if someone can tell me, some sort of order of shutdown the reason is that we will have an electrical window in the DC, so I know that there are many other factor to consider, but just want an overview of the shutdown order
... View more
Labels:
01-13-2019
08:21 AM
HI team, Im quite confused when using NAT, this might seem a chucky question, but I just want to confirm if Im getting it correct the funcionality of NAT I have the following topology, where PCs on the LAN (on the left) want to reach the WWW server (in this example) , so basically is a communication where on R1 I have to create a Dynamic NAT to translate the private hosts and a static NAT on R2 to translate the WWW server. Since I cannot advertise the public IPs on the routing protocol, is it required or valid to use static route? cause what confused me is that each lan has to reach each other but using public IPs
... View more
- Tags:
- nat
Labels:
01-12-2019
04:19 PM
Thank you so much Richard, Im truly glad with had the time to assist me, I gave a shot on PT after making the changes and it did not work, However, I remade it on Eve NG, and this time, it worked very well, I did the test and both subnets can reach each other after using the proper static routes, using the tunnel For sure, PT still it not on stable and has soo many limitations, but anyhow, I want to thank you for all your support and the other feedback I got, R3#ping 10.0.4.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.4.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms R3#ping 172.16.0.4 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.0.4, timeout is 2 seconds: !!!!! I tested shutting down one of the uplinks of R3 and the packets always arrive achieving its objective, R3(config)#int e0/0 R3(config-if)#shut R3(config-if)#end *Jan 13 00:02:49.219: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on Ethernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached R3(config-if)#end R3#traceroute 10.0.4.1 *Jan 13 00:02:51.195: %SYS-5-CONFIG_I: Configured from console by console *Jan 13 00:02:51.214: %LINK-5-CHANGED: Interface Ethernet0/0, changed state to administratively down *Jan 13 00:02:52.219: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to down R3#ping 10.0.4.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.4.1, timeout is 2 seconds: !!!!!
... View more
01-12-2019
01:44 PM
thanks for your feedback, Im still trying to set it up for the packet tracer, Im just giving my last shot before trying on GNS3 or any other platform, I did what was recommended, the tunnel comes up via the loopbacks, I made the static routes and each LAN is known, but as soon as I shut down the serial 0/0/0 on R3, I get this output like it does not know how to reach it, despite the fact that the loopback is reachable via OSPF when trying to ping the LAN of R3 from R4: R4#ping 10.0.4.129 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.4.129, timeout is 2 seconds: U.U.U Success rate is 0 percent (0/5) ========================================== this is the config of R3 so far: interface Loopback0 ip address 4.4.4.4 255.255.255.255 ip ospf 1 area 0 ! interface Tunnel0 ip address 172.16.0.4 255.255.255.0 mtu 1476 tunnel source Loopback0 tunnel destination 3.3.3.3 ! ! interface GigabitEthernet0/0 ip address 10.0.4.1 255.255.255.128 duplex auto speed auto ! interface GigabitEthernet0/1 no ip address duplex auto speed auto shutdown ! interface Serial0/0/0 ip address 200.0.0.13 255.255.255.252 clock rate 2000000 ! interface Serial0/0/1 ip address 200.0.0.6 255.255.255.252 ! interface Vlan1 no ip address shutdown ! router ospf 1 log-adjacency-changes network 200.0.0.12 0.0.0.3 area 0 network 200.0.0.4 0.0.0.3 area 0 ! ip classless ip route 10.0.4.128 255.255.255.224 3.3.3.3 ! ================================BELOW CONFIG OF R3================================== interface Loopback0 ip address 3.3.3.3 255.255.255.255 ip ospf 1 area 0 ! interface Tunnel0 ip address 172.16.0.3 255.255.255.0 mtu 1476 tunnel source Loopback0 tunnel destination 4.4.4.4 ! ! interface GigabitEthernet0/0 ip address 10.0.4.129 255.255.255.224 duplex auto speed auto ! interface GigabitEthernet0/1 no ip address duplex auto speed auto shutdown ! interface Serial0/0/0 ip address 200.0.0.14 255.255.255.252 clock rate 2000000 shutdown ! interface Serial0/0/1 ip address 200.0.0.10 255.255.255.252 clock rate 2000000 ! interface Vlan1 no ip address shutdown ! router ospf 1 log-adjacency-changes network 200.0.0.8 0.0.0.3 area 0 network 200.0.0.12 0.0.0.3 area 0 ! ip classless ip route 10.0.4.0 255.255.255.128 4.4.4.4 ============PERSPECTIVE FROM R3 WHEN SERIAL 0/0/0 IS ACTIVE============= R3#show ip route 10.0.4.0 Routing entry for 10.0.4.0/25 Known via "static", distance 1, metric 0 Routing Descriptor Blocks: * 4.4.4.4 Route metric is 0, traffic share count is 1 R3#show ip route 4.4.4.4 Routing entry for 4.4.4.4/32 Known via "ospf 1", distance 110, metric 65, type intra area Last update from 200.0.0.13 on Serial0/0/0, 00:00:20 ago Routing Descriptor Blocks: * 200.0.0.13, from 4.4.4.4, 00:00:20 ago, via Serial0/0/0 Route metric is 65, traffic share count is 1 R3# R3#show ip int brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 10.0.4.129 YES manual up up GigabitEthernet0/1 unassigned YES unset administratively down down Serial0/0/0 200.0.0.14 YES manual up up Serial0/0/1 200.0.0.10 YES manual up up Loopback0 3.3.3.3 YES manual up up Tunnel0 172.16.0.3 YES manual up up ===================PERSPECTIVE WHEN SERIAL IS SHUTDOWN FROM R3========================== R3#show ip route 4.4.4.4 Routing entry for 4.4.4.4/32 Known via "ospf 1", distance 110, metric 193, type intra area Last update from 200.0.0.9 on Serial0/0/1, 00:00:06 ago Routing Descriptor Blocks: * 200.0.0.9, from 4.4.4.4, 00:00:06 ago, via Serial0/0/1 Route metric is 193, traffic share count is 1 R3#show ip route 10.0.4.0 Routing entry for 10.0.4.0/25 Known via "static", distance 1, metric 0 Routing Descriptor Blocks: * 4.4.4.4 Route metric is 0, traffic share count is 1 R3# but still I cannot reach the other ends LAN R3#ping 10.0.4.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.4.1, timeout is 2 seconds: U.U any ideas on what I might be missing as far as the config is related to? thanks so much
... View more
01-12-2019
10:18 AM
Understood Sir, You are absolutely right, let me use the loopbacks instead and give it a shot, if it does not work because PT limitations, I will give it a try like Julio states,
... View more
01-12-2019
09:57 AM
I see, intersting, let me give it a shot, using loopbacks, I did not see the fact that serial0/0/0 if I shutdown, like no failover will occur, but the requirement confused when it said, use only static routes for GRE LAN :/ super thanks for your feedback,
... View more
01-12-2019
07:54 AM
Hi team, Im having a hard time to make this topology work, the requirement is the following: 1- use ospf for the entire topology 2- make static routes for the GRE tunnel for LAN31 and LAN41 only 3- LAN31 and LAN41 should NOT be appearing in the R1 and R2 routing table 4- GRE tunnel should be active for LAN31 and LAN41 regardless of which of the two interfaces are active in R3 and R4, for instance, if I shutdown serial 0/0/0 on R3, the tunnel should be active Can someone help me with the packet tracer file, I have tried using static routes and each of the tunnel is up but cant reach each other, not sure if Im doing something wrong, any feedback since most of the topologies I have seen just involved 3 routers, but in this case, based on the requirement, I have 4 routers I have attached the files of R3 and R4 and the topology I will highly appreciate it your assistance, Regards,
... View more
- Tags:
- gre
Labels:
Created by
Kn1ghtR1d3rOfD0
in VPN and AnyConnect
11-30-2018
01:59 PM
11-30-2018
01:59 PM
thank you thank you thank you :) it worked
... View more
11-30-2018
11:49 AM
Hi, Im trying to set up a VPN site to site from a source subnet /24 to be translated (PAT) using a single public IP so the local subnet can reach the destination subnet site B is not using PAT, instead, they are using static nat the tunnel is up when I generate traffic from the source LAN, but I cannot ping to the other site could you please help me to identify what could be the culprit cause surely Im missing something in my access list or NAT statement from the other end Im going to put the config of the objects and access list cause the tunnel is up, so its irrelevant I think SITE A config from ASA object-group network PRIVATE-NETWORK Description Local Networks network-object 192.168.10.0 255.255.255.0 exit ! object network VPN-PAT host 203.0.113.30 exit ! object-group network DESTINATION-NETWORK Description Destination NETWORKS network-object 192.168.20.0 255.255.255.0 exit ! -======= nat (INSIDE,OUTSIDE) source dynamic PRIVATE-NETWORK VPN-PAT destination static DESTINATION-NETWORK DESTINATION-NETWORK CRYPTO ACL ON ASA1: access-list crypto-acl-lan1 extended permit ip object VPN-PAT object-group DESTINATION-NETWORK ACCESS-LIST ON ASA1 access-list INSIDE_access_in_1 line 1 extended permit ip object-group PRIVATE-NETWORK object-group DESTINATION-NETWORK ============================================ SITE B: object-group network LOCAL-DATA Description DATA Networks network-object 192.168.20.0 255.255.255.0 exit ! object network REMOTE-PUBLIC-PAT-IP host 203.0.113.30 exit ! object-group network DESTINATION_NETWORK Description Destination NETWORKS network-object 192.168.10.0 255.255.255.0 exit ! -======= nat (INSIDE,OUTSIDE) source static LOCAL-DATA LOCAL-DATA destination static DESTINATION_NETWORK REMOTE-PUBLIC-PAT-IP CRYPTO ACL ON SITE B: access-list crypto-acl-lan extended permit ip object-group LOCAL-DATA object REMOTE-PUBLIC-PAT-IP ACCESS-LIST ON SITE B: access-list INSIDE_access_in_1 line 1 extended permit ip object-group LOCAL-DATA object-group DESTINATION_NETWORK =============================================================== TUNNEL IS UP AS YOU CAN SEE on site A, same is true on site B ASA1# show crypto isakmp sa IKEv1 SAs: Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 Type : L2L Role : initiator Rekey : no State : MM_ACTIVE There are no IKEv2 SAs ASA1# show crypto ipsec sa on site A as well as site B #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 SITE B: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3 DEBUG ICMP ON ASA1 ICMP echo request translating INSIDE:192.168.20 to OUTSIDE:203.0.113.30 ICMP echo request from INSIDE:192.168.10.20 to OUTSIDE:10.238.45.160 ID=1 seq=6 len=32 ICMP echo request translating INSIDE:192.168.10.20 to OUTSIDE:203.0.113.30 ICMP echo request from INSIDE:192.168.10.20 to OUTSIDE:10.238.45.160 ID=1 seq=7 len=32 ICMP echo request translating INSIDE:192.168.10.20 to OUTSIDE:203.0.113.30 ICMP echo request from INSIDE:192.168.10.20 to OUTSIDE:10.238.45.160 ID=1 seq=8 len=32 ICMP echo request translating INSIDE:192.168.10.20 to OUTSIDE:203.0.113.30 PACKET TRACERT INPUT ON ASA 1 SITE A: Result: input-interface: INSIDE input-status: up input-line-status: up output-interface: OUTSIDE output-status: up output-line-status: up Action: allow PACKET TRACERT INPUT ON SITE B: Result: output-interface: OUTSIDE output-status: up output-line-status: up Action: allow ASA2# could you please help me to tell me what is happening and if Im missing something on the access list or NAT on site B? what would be the correct statement command Regards,
... View more
Labels:
yesterday
Thank you Arne and Bern81,that is good info at hands,Im late with this
reply because 2 days after po...
Tuesday
Hi team, Before posting here, I was searching and tried to find a post
either from here or other pla...
Created by
Kn1ghtR1d3rOfD00m
in VPN and AnyConnect
3 weeks ago
3 weeks ago
you were right, after correcting the right peers and crypt acl matched
the correct interesting traff...
Created by
Kn1ghtR1d3rOfD00m
in VPN and AnyConnect
3 weeks ago
3 weeks ago
yes, not sure and not quite familiar with the CLI, I modified so Ips are
fake, the rest is what I cu...
3 weeks ago
Hi, I have been trying to understand if I missed something or if if
there is a limit for the crypto ...
02-20-2019 12:40 PM
Hi team,Just wondering if there is such documentation or reference or
guide, if exist, and that's wh...
Created by
Kn1ghtR1d3rOfD00m
in Identity Services Engine (ISE)
02-19-2019 04:55 AM
02-19-2019 04:55 AM
thanks for your notes, I will for sure evaluate the pros and cons,
Created by
Kn1ghtR1d3rOfD00m
in Identity Services Engine (ISE)
02-19-2019 04:54 AM
02-19-2019 04:54 AM
thank you! very interesting,
Created by
Kn1ghtR1d3rOfD00m
in Identity Services Engine (ISE)
02-12-2019 08:49 PM
02-12-2019 08:49 PM
Hi team, Im totally new with the process of the upgrade, We currently
have a set up 2 PANs and 5 PSN...
01-13-2019 08:21 AM
HI team, Im quite confused when using NAT, this might seem a chucky
question, but I just want to con...
01-12-2019 04:19 PM
Thank you so much Richard, Im truly glad with had the time to assist me,
I gave a shot on PT after m...
Public Statistics
| Date Registered | 02-25-2014 08:38 AM |
| Date Last Visited | 03-23-2019 07:12 PM |
| Total Messages Posted | 116 |
| Total Helpful Votes Received | 5 |
.jpg "VIP Collaborator"){kind=icon}
