Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About martinbuffleo
04-09-2019
Stats
Member since
02-22-2007
211
Posts
0
Helpful
4
Solutions
02-19-2019
06:50 AM
When trying to follow http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logon/
If we remove the list profiles option we get the error no IP address assign, and connection fails
If we leave select a profile then each of the profiles connects ok.
But my contractors could select employees and visa versa.
As a first point can someone clarify if its Name=Class and Value should return 'ou=Contractors;' or 'Contractors'
... View more
Labels:
10-10-2018
10:50 AM
Clock is good.
Did i need to delete the key pair?
For the client i have
... View more
10-10-2018
10:44 AM
I did have that but that didnt work.
Im using the following on my client:
<?xml version="1.0" encoding="UTF-8"?> <AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">; <ClientInitialization> <UseStartBeforeLogon UserControllable="true">false</UseStartBeforeLogon> <AutomaticCertSelection UserControllable="true">false</AutomaticCertSelection> <CertificateStore>All</CertificateStore> <CertificateStoreOverride>true</CertificateStoreOverride> </ClientInitialization> <ServerList> <HostEntry> <HostName>SpectraIKE</HostName> <HostAddress>vpn.spectra-group.co.uk</HostAddress> <PrimaryProtocol>IPsec <StandardAuthenticationOnly>false <AuthMethodDuringIKENegotiation> IKE-RSA </AuthMethodDuringIKENegotiation> </StandardAuthenticationOnly> </PrimaryProtocol> </HostEntry> </ServerList> </AnyConnectProfile>
... View more
10-10-2018
10:43 AM
How has that happened??
crypto pki server ca-server database level names no database archive hash sha512 lifetime certificate 3650 lifetime ca-certificate 7305 23 59 eku server-auth client-auth auto-rollover 365 database url flash:ca exit
Is 7305 too large?
... View more
10-10-2018
10:27 AM
Certificate Status: Available Certificate Serial Number (hex): 06 Certificate Usage: General Purpose Issuer: cn=ca-server Subject: Name: igsurface cn=igsurface Validity Date: start date: 17:22:39 BST Oct 10 2018 end date: 17:22:39 BST Oct 7 2028 Associated Trustpoints: igsurface Certificate Status: Available Certificate Serial Number (hex): 02 Certificate Usage: General Purpose Issuer: cn=ca-server Subject: Name: vpn.spectra-group.co.uk IP Address: 10.0.1.1 ipaddress=10.0.1.1+hostname=vpn.spectra-group.co.uk cn=BCB ou=user-vpn o=SpectraGroup Validity Date: start date: 14:42:30 BST Oct 10 2018 end date: 14:42:30 BST Oct 7 2028 Associated Trustpoints: routerCA CA Certificate Status: Available Certificate Serial Number (hex): 01 Certificate Usage: Signature Issuer: cn=ca-server Subject: cn=ca-server Validity Date: start date: 14:34:07 BST Oct 10 2018 end date: 08:04:51 BST Sep 5 1902 Associated Trustpoints: igsurface routerCA ca-server
... View more
10-10-2018
10:25 AM
ip local pool vpnusers 10.168.255.1 10.168.255.254 crypto ikev2 authorization policy ap-staff pool vpnusers route set interface crypto ikev2 proposal default encryption aes-cbc-256 aes-cbc-192 aes-cbc-128 integrity sha512 sha384 sha256 group 21 20 14 crypto ikev2 policy default match fvrf any proposal default crypto pki certificate map staff-certificate-map 10 issuer-name co cn = ca-server crypto ikev2 profile staff match identity remote key-id *$AnyConnectClient$* match certificate staff-certificate-map no identity local dn identity local fqdn 3709635.spectra-group.co.uk authentication remote rsa-sig authentication local rsa-sig pki trustpoint routerCA dpd 60 2 on-demand aaa authorization group cert list grouplist ap-staff virtual-template 3 no crypto ikev2 http-url cert crypto ipsec transform-set tr-gsm256 esp-gcm 256 mode tunnel crypto ipsec profile staff set transform-set tr-gsm256 set pfs group21 set ikev2-profile staff interface Virtual-Template3 type tunnel description Cisco AnyConnect IKEv2 ip unnumbered GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile staff
... View more
10-10-2018
10:19 AM
Im trying to configure IKEv2 on a 2921.
I followed this guide: http://www.ifm.net.nz/cookbooks/Cisco-IOS-router-IKEv2-AnyConnect-Suite-B-Crypto.html
I can see my Windows Client selects a certificate:
Function: ConnectMgr::nextClientCert File: ConnectMgr.cpp Line: 5276 Subject Name: CN=mbsurface Issuer Name : CN=ca-server Store : Microsoft Machine
But the I see not Trust points retrieved.
2723466: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Stopping timer to wait for auth message 2723467: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Checking NAT discovery 2723468: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):NAT OUTSIDE found 2723469: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):NAT detected float to init port 62595, resp port 4500 2723470: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Searching policy based on peer's identity '*$AnyConnectClient$*' of type 'key ID' 2723471: Oct 10 17:56:29.922 BST: IKEv2:found matching IKEv2 profile 'staff' 2723472: Oct 10 17:56:29.922 BST: IKEv2:Searching Policy with fvrf 0, local address 37.0.96.35 2723473: Oct 10 17:56:29.922 BST: IKEv2:Using the Default Policy for Proposal 2723474: Oct 10 17:56:29.922 BST: IKEv2:Found Policy 'default' 2723475: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Verify peer's policy 2723476: Oct 10 17:56:29.922 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Peer's policy verified 2723477: Oct 10 17:56:29.922 BST: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieving trustpoint(s) from received certificate hash(es) 2723478: Oct 10 17:56:29.922 BST: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): NONE 2723479: Oct 10 17:56:29.922 BST: IKEv2:% Received cert hash is invalid, using configured trustpoints from profile for signing 2723480: Oct 10 17:56:29.922 BST: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Getting cert chain for the trustpoint routerCA 2723481: Oct 10 17:56:29.926 BST: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of cert chain for the trustpoint PASSED 2723482: Oct 10 17:56:29.926 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Check for EAP exchange 2723483: Oct 10 17:56:29.926 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Check for EAP exchange 2723484: Oct 10 17:56:29.926 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Verification of peer's authentication data FAILED 2723485: Oct 10 17:56:29.926 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Sending authentication failure notify 2723486: Oct 10 17:56:29.926 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Building packet for encryption. Payload contents: NOTIFY(AUTHENTICATION_FAILED) 2723487: Oct 10 17:56:29.926 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Sending Packet [To 86.163.103.98:62595/From 37.0.96.35:4500/VRF i0:f0] Initiator SPI : D40DA6AA4153E3AC - Responder SPI : 9470A3FD78E6DCE5 Message id: 1 IKEv2 IKE_AUTH Exchange RESPONSE Payload contents: ENCR 2723488: Oct 10 17:56:29.930 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Auth exchange failed 2723489: Oct 10 17:56:29.930 BST: IKEv2-ERROR:(SESSION ID = 1149,SA ID = 1):: Auth exchange failed 2723490: Oct 10 17:56:29.930 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Abort exchange 2723491: Oct 10 17:56:29.930 BST: IKEv2:(SESSION ID = 1149,SA ID = 1):Deleting SA 2723492: Oct 10 17:56:29.930 BST: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Close PKI Session 2723493: Oct 10 17:56:29.930 BST: IKEv2:(SA ID = 1):[PKI -> IKEv2] Closing of PKI Session PASSED
Is this a known issue?
... View more
Labels:
Created by
martinbuffleo
in Wireless and Mobility
in Wireless and Mobility
05-12-2017
02:52 AM
05-12-2017
02:52 AM
When connecting to the Portal users receive a trust error.
This is expected as the certificate is self signed.
Is it possible to upload my corp wildcard. *.corp.co.uk and have the APs use that certificate? Then when they need to Authenticate, have them redirect to wifi-auth.corp.co.uk?
Thanks.
... View more
Labels:
Created by
martinbuffleo
in Other Collaboration Subjects
in Other Collaboration Subjects
03-20-2017
03:49 AM
03-20-2017
03:49 AM
Have a Cisco 8831 that is registered with our CME 11.6.
Can place calls to it, but when trying to dial we get the off hook tone and no indication that it is actually dialling.
voice register pool 2 busy-trigger-per-button 2 id mac xxxx.xxxx.xxxx type 8831 number 1 dn 46 dtmf-relay rtp-nte username auto2 password password description ConfRm codec g711ulaw paging-dn 90
Phone has the latest Firmware installed.
... View more
Labels:
03-08-2017
05:39 AM
Have fully function Cisco Call Manager Express, running 20 phones SCCP 7961 mainly.
Have purchased some new 8800 series phones 8861, 8821, and 8831.
Trying to get the 8861 registered with my CME.
My config is as follows:
voice service voip ip address trusted list ipv4 x.x.x.x ipv4 y.y.y.y cti csta mode basic no cti shutdown allow-connections sip to sip no supplementary-service sip moved-temporarily no supplementary-service sip handle-replaces fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none sip registrar server voice register pool-type 8821 phoneload-support reference-pooltype 9971 voice register global mode cme source-address internalIPAddr port 5060 max-dn 96 max-pool 24 load 8861 sip88xx.11-7-1-17.loads load 8821 sip8821.11-0-3SR1-1.loads create profile sync 0445144314544414 auto-register password XXX auto-assign 1001 to 1010 ! voice register dn 48 number 3333 voice register dn 49 number 3333 voice register pool 23 busy-trigger-per-button 2 id mac 0059.DCDE.036C type 8861 number 1 dn 48 voice register pool 24 id mac 00A2.89FB.A3EA type 8821 number 1 dn 49
IOS - Version
System image file is "flash:c2900-universalk9-mz.SPA.156-3.M1.bin"
Phone just sits saying Phone is Registering.
Status messages:
TFTP AppDialrules.xml
Error updating Network Locale
Error updating User Locale
VPN not configured
SEPXXXXX.cnf.xml
Phone version 8861:
Active Load sip88xx.11-7-1-17
What am I missing?
... View more
Labels:
12-02-2015
03:15 PM
Thanks for the reply.
turns out we needed the interwork ethernet command under the pseudowire
pseudowire-class NETWORKPW encapsulation l2tpv3 protocol l2tpv3 networkstV3class
interworking ethernet ip local interface GigabitEthernet8
Now we just have an issue with, when one end is rebooted we have to clear xconnect all for it to come back up.
... View more
12-02-2015
12:56 PM
Thanks for the reply at shall give that a go shortly and get back to you.
Thanks again.
... View more
12-02-2015
12:53 PM
I have the following config:
l2tp-class networkstV3class authentication password L2TPv3
pseudowire-class NETWORKPW encapsulation l2tpv3 protocol l2tpv3 networkstV3class ip local interface GigabitEthernet8
interface fa 0 description LAN Facing no ip address duplex auto speed auto xconnect 172.16.192.91 1 encapsulation l2tpv3 pw-class NETWORKPW
It works fine when both devices are on the same subnet.
As soon as I move to different subnets 'sh xconnect all' shows the S2 as DN. I can ping to and from both ands and no firewall is in the way.
Help please.
... View more
Labels:
11-27-2015
06:26 AM
I'm looking to configure a NAT router
server-------NAT Rt-------client
I need the client to think it talking to the NATRt cleint side.
And I need the server to to think the access requests are coming from the NATRt.
Effectivily each are unaware of the other subnet?
Any ideas? Any help appricaiated.
... View more
Labels:
You Have No Messages
Public Statistics
| Date Registered | 02-22-2007 01:56 AM |
| Date Last Visited | 04-09-2019 07:28 AM |
| Total Messages Posted | 211 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 4 | |
| 4 | |
| 10 | |
| 4 |
.jpg "VIP Expert"){kind=icon}
