Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About meet_mkhan
10-09-2017
meet_mkhan
Member since
04-24-2010
Beginner
10-09-2014
05:37 AM
Hi Harish, Please check the o/ps below and route print in attached file Latest ASA Config ASA Version 8.0(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted names ! interface Ethernet0/0 nameif outside security-level 0 ip address 192.168.10.10 255.255.255.0 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.14.12 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive access-list dubai_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0 access-list INSIDE_nat0_outbound extended permit ip any 192.168.14.0 255.255.255 .0 pager lines 24 mtu outside 1500 mtu inside 1500 ip local pool testpool 192.168.15.240-192.168.15.250 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 192.168.10.12 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.14.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set setFirstSet esp-3des esp-md5-hmac crypto dynamic-map dyn1 1 set transform-set setFirstSet crypto dynamic-map dyn1 1 set reverse-route crypto map mymap 1 ipsec-isakmp dynamic dyn1 crypto map mymap interface outside crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 43200 crypto isakmp policy 65535 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 no crypto isakmp nat-traversal telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global group-policy mphone internal group-policy mphone attributes split-tunnel-policy tunnelspecified split-tunnel-network-list value dubai_splitTunnelAcl username testuser password IqY6lTColo8VIF24 encrypted privilege 15 username testuser attributes vpn-group-policy mphone username khans password X5bLOVudYKsK1JS/ encrypted privilege 15 username khans attributes vpn-group-policy mphone tunnel-group mphone type remote-access tunnel-group mphone general-attributes address-pool testpool tunnel-group mphone ipsec-attributes pre-shared-key * prompt hostname context Cryptochecksum:12308d7ff6c6df3d71181248e8d38ba8 : end ciscoasa# Route Print after vpn connection C:\>route print =========================================================================== Interface List 0x1 ........................... MS TCP Loopback interface 0x40003 ...00 24 01 a2 e6 f1 ...... D-Link DFE-520TX PCI Fast Ethernet Adapter - Packet Scheduler Miniport 0x250004 ...00 05 9a 3c 78 00 ...... Cisco Systems VPN Adapter - Packet Schedule r Miniport =========================================================================== =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.10.1 192.168.10.211 20 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.10.0 255.255.255.0 192.168.10.211 192.168.10.211 20 192.168.10.211 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.10.255 255.255.255.255 192.168.10.211 192.168.10.211 20 192.168.14.0 255.255.255.0 192.168.15.1 192.168.15.240 1 192.168.15.0 255.255.255.0 192.168.15.240 192.168.15.240 20 192.168.15.240 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.15.255 255.255.255.255 192.168.15.240 192.168.15.240 20 213.42.233.97 255.255.255.255 192.168.10.1 192.168.10.211 1 224.0.0.0 240.0.0.0 192.168.10.211 192.168.10.211 20 224.0.0.0 240.0.0.0 192.168.15.240 192.168.15.240 20 255.255.255.255 255.255.255.255 192.168.10.211 192.168.10.211 1 255.255.255.255 255.255.255.255 192.168.15.240 192.168.15.240 1 Default Gateway: 192.168.10.1 =========================================================================== Persistent Routes: None C:\> C:\>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : asu Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Unknown IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection 7: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : D-Link DFE-520TX PCI Fast Ethernet A dapter Physical Address. . . . . . . . . : 00-24-01-A2-E6-F1 Dhcp Enabled. . . . . . . . . . . : No IP Address. . . . . . . . . . . . : 192.168.10.211 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.10.1 DNS Servers . . . . . . . . . . . : 213.42.20.20 195.229.241.222 Ethernet adapter Local Area Connection 8: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Cisco Systems VPN Adapter Physical Address. . . . . . . . . : 00-05-9A-3C-78-00 Dhcp Enabled. . . . . . . . . . . : No IP Address. . . . . . . . . . . . : 192.168.15.240 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . :
... View more
10-09-2014
02:42 AM
Hello Marius Gunnerud and Hari, I really appreciate the solutions you people provided.I have done the changes in pool and tried to access my inside network but still same problem.Kindly check here under o/ps and attached file at vpn user side. ciscoasa(config)# no ip local pool testpool 192.168.14.240-192.168.14.250 ciscoasa(config)# ciscoasa(config)# ip local pool testpool 192.168.15.240-192.168.15.250 ciscoasa(config)# int e0/0 ciscoasa(config-if)# no sh ciscoasa(config-if)# ciscoasa# ciscoasa# sh cry ciscoasa# sh crypto is ciscoasa# sh crypto isakmp sa ciscoasa# sh crypto isakmp sa Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: 2.50.34.52 Type : user Role : responder Rekey : no State : AM_ACTIVE ciscoasa# sh crypto ipse ciscoasa# sh crypto ipsec sa ciscoasa# sh crypto ipsec sa interface: outside Crypto map tag: dyn1, seq num: 1, local addr: 192.168.10.10 local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (192.168.15.240/255.255.255.255/0/0) current_peer: 2.50.34.52, username: testuser dynamic allocated peer ip: 192.168.15.240 #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #send errors: 0, #recv errors: 0 local crypto endpt.: 192.168.10.10, remote crypto endpt.: 2.50.34.52 path mtu 1500, ipsec overhead 58, media mtu 1500 current outbound spi: DB10CB59 inbound esp sas: spi: 0x5E310D99 (1580273049) transform: esp-3des esp-md5-hmac none in use settings ={RA, Tunnel, } slot: 0, conn_id: 4096, crypto-map: dyn1 sa timing: remaining key lifetime (sec): 28766 IV size: 8 bytes replay detection support: Y outbound esp sas: spi: 0xDB10CB59 (3675310937) transform: esp-3des esp-md5-hmac none in use settings ={RA, Tunnel, } slot: 0, conn_id: 4096, crypto-map: dyn1 sa timing: remaining key lifetime (sec): 28766 IV size: 8 bytes replay detection support: Y ciscoasa# sh cli ciscoasa# sho ciscoasa# show cl ciscoasa# show cli ciscoasa# show vp ciscoasa# show vpn ciscoasa# show vpn- ciscoasa# show vpn-sessiondb ERROR: % Incomplete command ciscoasa# show vpn-sessiondb ? detail Show detailed output email-proxy Email-Proxy sessions full Output formatted for data management programs index Index of session l2l IPsec LAN-to-LAN sessions ratio Show VPN Session protocol or encryption ratios remote IPsec Remote Access sessions summary Show VPN Session summary svc SSL VPN Client sessions vpn-lb VPN Load Balancing Mgmt sessions webvpn WebVPN sessions ciscoasa# show vpn-sessiondb de ciscoasa# show vpn-sessiondb detail ERROR: % Incomplete command ciscoasa# show vpn-sessiondb detail ? email-proxy Email-Proxy sessions full Output formatted for data management programs index Index of session l2l IPsec LAN-to-LAN sessions remote IPsec Remote Access sessions svc SSL VPN Client sessions vpn-lb VPN Load Balancing Mgmt sessions webvpn WebVPN sessions ciscoasa# show vpn-sessiondb detail re ciscoasa# show vpn-sessiondb detail remote Session Type: IPsec Detailed Username : testuser Index : 1 Assigned IP : 192.168.15.240 Public IP : 2.50.34.52 Protocol : IKE IPsec Encryption : 3DES Hashing : MD5 SHA1 Bytes Tx : 240 Bytes Rx : 1920 Pkts Tx : 4 Pkts Rx : 38 Pkts Tx Drop : 0 Pkts Rx Drop : 0 Group Policy : mphone Tunnel Group : mphone Login Time : 00:22:21 UTC Thu Oct 9 2014 Duration : 0h:02m:38s NAC Result : Unknown VLAN Mapping : N/A VLAN : none IKE Tunnels: 1 IPsec Tunnels: 1 IKE: Tunnel ID : 1.1 UDP Src Port : 2976 UDP Dst Port : 500 IKE Neg Mode : Aggressive Auth Mode : preSharedKeys Encryption : 3DES Hashing : SHA1 Rekey Int (T): 43200 Seconds Rekey Left(T): 43048 Seconds D/H Group : 2 Filter Name : IPsec: Tunnel ID : 1.2 Local Addr : 0.0.0.0/0.0.0.0/0/0 Remote Addr : 192.168.15.240/255.255.255.255/0/0 Encryption : 3DES Hashing : MD5 Encapsulation: Tunnel Rekey Int (T): 28800 Seconds Rekey Left(T): 28646 Seconds Idle Time Out: 30 Minutes Idle TO Left : 29 Minutes Bytes Tx : 240 Bytes Rx : 1920 Pkts Tx : 4 Pkts Rx : 38 NAC: Reval Int (T): 0 Seconds Reval Left(T): 0 Seconds SQ Int (T) : 0 Seconds EoU Age(T) : 154 Seconds Hold Left (T): 0 Seconds Posture Token: Redirect URL : ciscoasa#
... View more
10-09-2014
12:37 AM
Hi Harish, Thankx for reply i can connect to internet after vpn establish but local lan access is disabled i cant able to access my local lan users. even i cant able to ping my gateway i,e 192.168.14.12(ASA E0/1 IP ADDRESS). when i connect vpn the user gets ip add 192.168.14.240.I want to connect or access a user which has ip add 192.168.14.229 my local network . computer vpn connected user (192.16814.240) go to start-->run--->\\192.168.14.229 it is not accessable gives error network path was not found.
... View more
10-08-2014
06:07 AM
Hi Marius Gunnerud, Thankx for the Reply.Check the below config i added the missing commands but the issue is not resolved ------------ ASA Version 8.0(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted names ! interface Ethernet0/0 nameif outside security-level 0 ip address 192.168.10.10 255.255.255.0 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.14.12 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive access-list dubai_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0 access-list INSIDE_nat0_outbound extended permit ip any 192.168.14.240 255.255.2 55.240 pager lines 24 mtu outside 1500 mtu inside 1500 ip local pool testpool 192.168.14.240-192.168.14.250 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list INSIDE_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 192.168.10.12 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.14.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set setFirstSet esp-3des esp-md5-hmac crypto dynamic-map dyn1 1 set transform-set setFirstSet crypto dynamic-map dyn1 1 set reverse-route crypto map mymap 1 ipsec-isakmp dynamic dyn1 crypto map mymap interface outside crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 43200 crypto isakmp policy 65535 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 no crypto isakmp nat-traversal telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global group-policy mphone internal group-policy mphone attributes split-tunnel-policy tunnelspecified split-tunnel-network-list value dubai_splitTunnelAcl username testuser password IqY6lTColo8VIF24 encrypted username khans password X5bLOVudYKsK1JS/ encrypted privilege 15 tunnel-group mphone type remote-access tunnel-group mphone general-attributes address-pool testpool tunnel-group mphone ipsec-attributes pre-shared-key * prompt hostname context Cryptochecksum:80f894dae302ca3e62d710b5a7fdb5c2 : end ciscoasa#
... View more
Created by
meet_mkhan
in VPN and AnyConnect
in VPN and AnyConnect
10-07-2014
10:13 AM
10-07-2014
10:13 AM
Hi Experts, Kindly check below config.the problem is vpn is connected but no internet access on computer after connecting vpn ASA Version 8.0(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted names ! interface Ethernet0/0 nameif outside security-level 0 ip address 192.168.10.10 255.255.255.0 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.14.12 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive access-list dubai_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0 access-list INSIDE_nat0_outbound extended permit ip any 192.168.14.240 255.255.2 55.240 pager lines 24 mtu inside 1500 mtu outside 1500 ip local pool testpool 192.168.14.240-192.168.14.250 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list INSIDE_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 192.168.10.12 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.14.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set setFirstSet esp-3des esp-md5-hmac crypto dynamic-map dyn1 1 set transform-set setFirstSet crypto dynamic-map dyn1 1 set reverse-route crypto map mymap 1 ipsec-isakmp dynamic dyn1 crypto map mymap interface outside crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 43200 crypto isakmp policy 65535 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global username testuser password IqY6lTColo8VIF24 encrypted username khans password X5bLOVudYKsK1JS/ encrypted privilege 15 tunnel-group mphone type remote-access tunnel-group mphone general-attributes address-pool testpool tunnel-group mphone ipsec-attributes pre-shared-key * prompt hostname context Cryptochecksum:059363cdf78583da4e3324e8dfcefbf0 : end ciscoasa#
... View more
- Tags:
- #5505 #asa #VPN
Labels:
09-24-2014
06:23 AM
Hi, Thankx for your support .the Problem is %ASA-4-106023: Deny udp src OUTSIDE:49.206.238.201/50875 dst INSIDE:213.42.x.x/500 by access-group "104" [0x0, 0x0] MAINFIREWALL(ASA 5510) blocking udp 500 when i allowed udp 500 vpn client connected without any issue..
... View more
09-23-2014
06:57 AM
Hi, I can see only udp req discard on ip add 192.168.14.238 which is conn to userend asa.but client ip from where i am connecting vpn is not here in this config ciscoasa# sh logging Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 1010 messages logged Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 3126 messages logged 55/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.6/137 to outside:192.168.10 .255/137 %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 10 per se cond, max configured rate is 10; Current average rate is 10 per second, max conf igured rate is 5; Cumulative total count is 6001 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.9/137 to outside:192.168.10 .255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 % 192.168.10.51/137 to outside:192.168.10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 .10.221/445 (192.168.10.221/445) to inside:192.168.14.238/1901 (192.168.10.10/15 05) %ASA-6-305011: Built dynamic TCP translation from inside:192.168.14.238/1902 to outside:192.168.10.10/1506 %ASA-6-302013: Built outbound TCP connection 778 for outside:192.168.10.221/139 (192.168.10.221/139) to inside:192.168.14.238/1902 (192.168.10.10/1506) %ASA-6-302014: Teardown TCP connection 778 for outside:192.168.10.221/139 to ins ide:192.168.14.238/1902 duration 0:00:00 bytes 0 TCP Reset-I %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.14.238/138 to inside:192.168.1 4.255/138 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 % to outside:192.168.10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 ciscoasa# UDP request discarded from 192.168.10.51/137 to o ciscoasa# ciscoasa# ciscoasa# ciscoasa# cle ciscoasa# clear logg ciscoasa# clear logging ERROR: % Incomplete command ciscoasa# clear logging bu ciscoasa# clear logging buffer ciscoasa# clear logging as ciscoasa# clear logging asdm ciscoasa# ciscoasa# ciscoasa# clear logging ERROR: % Incomplete command ciscoasa# clear logging buffer ciscoasa# sh logging Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 4864 messages logged Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 3921 messages logged %ASA-5-111008: User 'enable_15' executed the 'clear logging buffer' command. %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 ciscoasa# ciscoasa# ciscoasa# ciscoasa# ciscoasa# sh logging Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 4986 messages logged Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 3934 messages logged ded from 192.168.10.100/137 to outside:192.168.10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.57/137 to outside:192.168.1 0.255/137 %ASA-6-305011: Built dynamic TCP translation from inside:192.168.14.238/2044 to outside:192.168.10.10/1638 %ASA-6-302013: Built outbound TCP connection 994 for outside:192.168.10.221/80 ( 192.168.10.221/80) to inside:192.168.14.238/2044 (192.168.10.10/1638) %ASA-6-302014: Teardown TCP connection 992 for outside:192.168.10.221/445 to ins ide:192.168.14.238/2041 duration 0:00:10 bytes 1807 TCP FINs %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 10 per se cond, max configured rate is 10; Current average rate is 9 per second, max confi gured rate is 5; Cumulative total count is 5889 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.57/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.57/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.6/137 to outside:192.168.10 .255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.6/137 to outside:192.168.10 .255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.6/137 to outside:192.168.10 .255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.88/137 to outside:192.168.1 0.255/137 ciscoasa# ciscoasa# ciscoasa# ciscoasa# sh logging Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 5124 messages logged Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 3951 messages logged 37 to outside:192.168.10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.163/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.85/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.163/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.85/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.163/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.85/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-6-302014: Teardown TCP connection 995 for outside:192.168.10.221/445 to ins ide:192.168.14.238/2045 duration 0:00:10 bytes 1807 TCP FINs %ASA-7-609002: Teardown local-host outside:192.168.10.221 duration 0:00:46 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.65/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.65/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 0.0.0.0/68 to inside:255.255.255.255/6 7 %ASA-7-710005: UDP request discarded from 0.0.0.0/68 to outside:255.255.255.255/ 67 %ASA-7-710005: UDP request discarded from 192.168.11.1/67 to inside:255.255.255. 255/68 %ASA-7-710005: UDP request discarded from 192.168.11.1/67 to outside:255.255.255 .255/68 %ASA-7-710005: UDP request discarded from 192.168.1.1/67 to inside:255.255.255.2 55/68 %ASA-7-710005: UDP request discarded from 192.168.1.1/67 to outside:255.255.255. 255/68 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.65/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %02015: Built outbound UDP connection 1007 for outside:157.55.130.146/40002 (157 .55.130.146/40002) to inside:192.168.14.238/13942 (192.168.10.10/1174) %ASA-7-609001: Built local-host outside:65.55.223.24 %ASA-6-302015: Built outbound UDP connection 1008 for outside:65.55.223.24/40009 (65.55.223.24/40009) to inside:192.168.14.238/13942 (192.168.10.10/1174) %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-609001: Built local-host outside:157.55.235.157 %ASA-6-302015: Built outbound UDP connection 1009 for outside:157.55.235.157/400 21 (157.55.235.157/40021) to inside:192.168.14.238/13942 (192.168.10.10/1174) %ASA-7-609001: Built local-host outside:111.221.74.41 %ASA-6-302015: Built outbound UDP connection 1010 for outside:111.221.74.41/4001 0 (111.221.74.41/40010) to inside:192.168.14.238/13942 (192.168.10.10/1174)
... View more
09-23-2014
06:25 AM
Hi, check below debugging of userendasa ciscoasa# sh logging Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 1010 messages logged Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 3126 messages logged 55/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.6/137 to outside:192.168.10 .255/137 %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 10 per se cond, max configured rate is 10; Current average rate is 10 per second, max conf igured rate is 5; Cumulative total count is 6001 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.9/137 to outside:192.168.10 .255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 % 192.168.10.51/137 to outside:192.168.10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.221/137 to outside:192.168. 10.255/137 .10.221/445 (192.168.10.221/445) to inside:192.168.14.238/1901 (192.168.10.10/15 05) %ASA-6-305011: Built dynamic TCP translation from inside:192.168.14.238/1902 to outside:192.168.10.10/1506 %ASA-6-302013: Built outbound TCP connection 778 for outside:192.168.10.221/139 (192.168.10.221/139) to inside:192.168.14.238/1902 (192.168.10.10/1506) %ASA-6-302014: Teardown TCP connection 778 for outside:192.168.10.221/139 to ins ide:192.168.14.238/1902 duration 0:00:00 bytes 0 TCP Reset-I %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.14.238/138 to inside:192.168.1 4.255/138 %ASA-7-710005: UDP request discarded from 192.168.10.51/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 % to outside:192.168.10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.11/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.66/137 to outside:192.168.1 0.255/137 %ASA-7-710005: UDP request discarded from 192.168.10.100/137 to outside:192.168. 10.255/137 ciscoasa# UDP request discarded from 192.168.10.51/137 to o
... View more
09-23-2014
06:01 AM
:Hi, Pls check here under runn config of userend asa i am getting same error at uesrend when connecting to server same wireshark output after allowing esp and 4500,500 ports ======================== ciscoasa# sh running-config : Saved : ASA Version 8.0(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted names ! interface Ethernet0/0 nameif outside security-level 0 ip address 192.168.10.10 255.255.255.0 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.14.12 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive dns domain-lookup outside dns domain-lookup inside dns server-group DefaultDNS name-server 213.42.20.20 name-server 195.241.229.222 access-list mphone_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 1 92.168.14.4 255.255.255.252 access-list inside_nat0_outbound extended permit tcp any any eq 500 access-list inside_nat0_outbound extended permit tcp any any eq 4500 access-list inside_nat0_outbound extended permit esp any any pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 ip local pool mypool 192.168.14.4-192.168.14.7 mask 255.255.255.0 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-602.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 192.168.10.12 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.14.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128 -SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256 -MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 no crypto isakmp nat-traversal telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global group-policy mphone internal group-policy mphone attributes vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value mphone_splitTunnelAcl username khans password X5bLOVudYKsK1JS/ encrypted privilege 15 username khan password Af47yOOFe80n.V9z encrypted privilege 0 username khan attributes vpn-group-policy mphone tunnel-group mphone type remote-access tunnel-group mphone general-attributes address-pool mypool default-group-policy mphone tunnel-group mphone ipsec-attributes pre-shared-key * prompt hostname context Cryptochecksum:96bbf7ab1981c6a540c7c6f51f3e5ff0 : end ciscoasa#
... View more
09-23-2014
03:18 AM
Hi, My scenario is like ISP-------MAINFIREWALL(ASA 5510)--------------SWITCH----------USEREND FIREWALL(CISCO ASA5510 WITH REMOTE ACCESS VPN CONFIGIRED) so ike traffic is permitted on main firewall do i have to permit in Userend firewall also.
... View more
09-22-2014
01:22 PM
Hi, Pls check here under details and also check attached screen shot of client pc. ciscoasa# debug crypto ipsec ciscoasa# sh lo ciscoasa# sh log ciscoasa# sh logging Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: level debugging, 260 messages logged Buffer logging: disabled Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 788 messages logged ciscoasa# sh log Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: level debugging, 442 messages logged Buffer logging: disabled Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 805 messages logged ciscoasa# ter ciscoasa# terminal moni ciscoasa# terminal monitor Monitor option not supported for the console. ciscoasa# ciscoasa# sh log Syslog logging: enabled Facility: 20 Timestamp logging: disabled Standby logging: disabled Deny Conn when Queue Full: disabled Console logging: disabled Monitor logging: level debugging, 575 messages logged Buffer logging: disabled Trap logging: disabled History logging: disabled Device ID: disabled Mail logging: disabled ASDM logging: level informational, 823 messages logged ciscoasa# ciscoasa# sh cr ciscoasa# sh cry ciscoasa# sh crypto is ciscoasa# sh crypto isakmp sa ciscoasa# sh crypto isakmp sa There are no isakmp sas
... View more
09-21-2014
10:58 AM
Hi, Thanks for the reply.I am really sorry for the delay response i enabled debugging but nothing is displayed ciscoasa# debug crypto ipsec ciscoasa# debug crypto isa ciscoasa# debug crypto isakmp ciscoasa# debug crypto eas ciscoasa# debug crypto easy ciscoasa# debug crypto ? ca Set PKI debug levels condition Set IPSec/ISAKMP debug filters engine Set crypto engine debug levels ipsec Set IPSec debug levels isakmp Set ISAKMP debug levels vpnclient Set EasyVPN client debug levels ciscoasa# debug crypto von ciscoasa# debug crypto vpncli ciscoasa# debug crypto vpnclient ciscoasa# ciscoasa# ciscoasa# ciscoasa#
... View more
09-20-2014
12:47 AM
Hi Experts, Kindly help in solving the problem in remote access vpn. I configured Remote access VPN on cosco asa 5510 evrything is working fine i can able to connect internet on that machine but user cannot able to connect using easy vpn client 5.0 to its server. Kindly check below config Note e0/0 ip add 192.168.10.10 is natted with public ip 213.42.204.135 on main(core ) firewall scenario : ISP-------MAINFIREWALL(ASA 5510)--------------SWITCH----------USEREND FIREWALL(CISCO ASA5510 WITH REMOTE ACCESS VPN CONFIGIRED) ASA Version 8.0(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted names ! interface Ethernet0/0 nameif OUTSIDE security-level 0 ip address 192.168.10.10 255.255.255.0 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.14.12 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive pager lines 24 mtu inside 1500 mtu OUTSIDE 1500 ip local pool mpool 192.168.14.2-192.168.14.10 mask 255.255.255.0 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-602.bin no asdm history enable arp timeout 14400 global (OUTSIDE) 101 interface nat (inside) 101 0.0.0.0 0.0.0.0 route OUTSIDE 0.0.0.0 0.0.0.0 192.168.10.12 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.14.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128 -SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256 -MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map OUTSIDE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map OUTSIDE_map interface OUTSIDE crypto isakmp enable OUTSIDE crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 65535 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global group-policy mediaphone internal group-policy mediaphone attributes dns-server value 213.42.20.20 195.241.229.222 vpn-tunnel-protocol IPSec username khans password X5bLOVudYKsK1JS/ encrypted privilege 15 username khan password Af47yOOFe80n.V9z encrypted privilege 0 username khan attributes vpn-group-policy mediaphone tunnel-group mediaphone type remote-access tunnel-group mediaphone general-attributes address-pool mpool default-group-policy mediaphone tunnel-group mediaphone ipsec-attributes pre-shared-key * prompt hostname context Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e : end ciscoasa#
... View more
- Tags:
- CCNP SECURITY
Labels:
Created by
meet_mkhan
in Network Management
in Network Management
01-07-2014
10:59 PM
01-07-2014
10:59 PM
Hi Experts, I am in process of configuring HSRP on cisco 3640 switches every thing is seems to be fine but i cannot able to ping the vitual ip from SW5 which is configured on SW1 and SW2 but i can ping the real ips.One more thing is when i make shutdown all interface of SW1 then i can ping to virtual ip and real ip of SW2. Kindly check the attached network diagram. Any kind of help is appreciated. SW1#sh run SW1#sh running-config Building configuration... Current configuration : 1186 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SW1 ! interface FastEthernet1/0 ! interface FastEthernet1/1 switchport mode trunk ! interface FastEthernet1/2 ! interface FastEthernet1/3 ! interface FastEthernet1/4 switchport mode trunk ! interface FastEthernet1/5 ! interface FastEthernet1/6 ! interface FastEthernet1/7 ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface Vlan1 no ip address ! interface Vlan70 ip address 192.168.70.4 255.255.255.0 standby 1 ip 192.168.70.1 standby 1 priority 150 ! SW1# =================================== Building configuration... *Mar 1 09:32:10.353: %HSRP-6-STATECHANGE: Vlan70 Grp 1 state Standby -> Active *Mar 1 09:32:17.217: %HSRP-6-STATECHANGE: Vlan70 Grp 1 state Active -> Speak *Mar 1 09:32:27.317: %HSRP-6-STATECHANGE: Vlan70 Grp 1 state Speak -> Standby Current configuration : 1104 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SW2 ! boot-start-marker boot-end-marker ! ! interface FastEthernet1/1 switchport mode trunk ! interface FastEthernet1/2 ! interface FastEthernet1/3 switchport mode trunk ! interface FastEthernet1/4 ! interface FastEthernet1/5 ! interface FastEthernet1/6 ! interface FastEthernet1/7 ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface Vlan1 no ip address no ip route-cache ! interface Vlan70 ip address 192.168.70.7 255.255.255.0 standby 1 ip 192.168.70.1 ! SW2# *Mar 1 09:32:57.097: %HSRP-6-STATECHANGE: Vlan70 Grp 1 state Standby -> Active *Mar 1 09:32:57.681: %HSRP-6-STATECHANGE: Vlan70 Grp 1 state Active -> Speak *Mar 1 09:33:07.681: %HSRP-6-STATECHANGE: Vlan70 Grp 1 state Speak -> Standby ==================================== SW3#sh run SW3#sh running-config Building configuration... Current configuration : 1046 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SW3 ! interface FastEthernet1/1 ! interface FastEthernet1/2 ! interface FastEthernet1/3 switchport mode trunk ! interface FastEthernet1/4 switchport mode trunk ! interface FastEthernet1/5 switchport access vlan 70 ! interface FastEthernet1/6 ! interface FastEthernet1/7 ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface Vlan1 no ip address ! interface Vlan70 ip address 192.168.70.14 255.255.255.0 ! SW3# ============================= SW5#ping 192.168.70.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.70.1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) SW5#sh run SW5#sh running-config Building configuration... Current configuration : 1030 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SW5 ! boot-start-marker boot-end-marker ! ! interface FastEthernet1/1 ! interface FastEthernet1/2 ! interface FastEthernet1/3 ! interface FastEthernet1/4 ! interface FastEthernet1/5 switchport access vlan 70 ! interface FastEthernet1/6 ! interface FastEthernet1/7 ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface Vlan1 no ip address ! interface Vlan70 ip address 192.168.70.17 255.255.255.0 ! line con 0 line aux 0 line vty 0 4 login ! ! end SW5#
... View more
Labels:
10-09-2014 05:37 AM
Hi Harish,Please check the o/ps below and route print in attached
fileLatest ASA Config ASA Version ...
10-09-2014 02:42 AM
Hello Marius Gunnerud and Hari,I really appreciate the solutions you
people provided.I have done the...
10-09-2014 12:37 AM
Hi Harish, Thankx for reply i can connect to internet after vpn
establish but local lan access is di...
10-08-2014 06:07 AM
Hi Marius Gunnerud,Thankx for the Reply.Check the below config i added
the missing commands but the ...
Created by
meet_mkhan
in VPN and AnyConnect
10-07-2014 10:13 AM
10-07-2014 10:13 AM
Hi Experts,Kindly check below config.the problem is vpn is connected but
no internet accesson comput...
09-24-2014 06:23 AM
Hi,Thankx for your support .the Problem is %ASA-4-106023: Deny udp src
OUTSIDE:49.206.238.201/50875 ...
09-23-2014 06:57 AM
Hi,I can see only udp req discard on ip add 192.168.14.238 which is conn
to userend asa.but client i...
09-23-2014 06:25 AM
Hi,check below debugging of userendasa ciscoasa# sh loggingSyslog
logging: enabled Facility: 20 Time...
09-23-2014 06:01 AM
:Hi,Pls check here under runn config of userend asa i am getting same
error at uesrend when connecti...
09-23-2014 03:18 AM
Hi,My scenario is likeISP-------MAINFIREWALL(ASA
5510)--------------SWITCH----------USEREND FIREWALL...
09-22-2014 01:22 PM
Hi,Pls check here under details and also check attached screen shot of
client pc. ciscoasa# debug cr...
09-21-2014 10:58 AM
Hi,Thanks for the reply.I am really sorry for the delay responsei
enabled debugging but nothing is d...
09-20-2014 12:47 AM
Hi Experts,Kindly help in solving the problem in remote access vpn.I
configured Remote access VPN on...
Created by
meet_mkhan
in Network Management
01-07-2014 10:59 PM
01-07-2014 10:59 PM
Hi Experts,I am in process of configuring HSRP on cisco 3640 switches
every thing is seems to be fin...
Public Statistics
| Date Registered | 04-24-2010 07:01 PM |
| Date Last Visited | 10-09-2017 12:24 PM |
| Total Messages Posted | 65 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 11 | |
| 6 | |
| 2 | |
| 2 |
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Advocate"){kind=icon}
