Hello All,   I'm looking for a bit of guidance or options to deal with a change I need to implement.  I currently have 2 x cisco 867vae routers each with a VDSL connected to a network with 2 VRRP instances running so that various vlans can have their internet traffic directed out each of the VDSL services but if one fails they failover.  All works ok however on the "corporate" vlan the client wants an ASA5506 to replace one of the 867VAE routers as the circuit is to be upgraded to a Fiber To The Premises .  So I have a failover issue to solve as well as traffic balancing.     Connecting to the ASA and 867VAE is an SG300 Switch.  I was thinking to switch on EIGRP on switch, ASA and 867VAE to deal with my VRRP no longer being an option. I could potentially use multiple EIGRP instances to direct traffic for specific vlans to specific routers. I know I could do all the failover on the ASA and direct traffic to the 867VAE router on loss of the Fiber, but this doesn't provide any protection if the ASA falls over.     Has anyone got any other ideas on how to approach?    Thanks in advance Dave ... View more

Hello All,   Just looking for some feedback on the following requirement.  We have an IPTV solution going in spread over a few floors.  The Specification says the following with my comments in Blue and red.  Red being where I'm unsure.   The specification says Certified Switches are 2960's but am I wrong I can do it with SG550x's?  Any thoughts or comments would be appreciated.   IPTV Spec requirements - VLAN support - SG550x supports -Trunked ports (Ports that allow multiple VLAN tagged traffic as well as untagged traffic using PVID) - SG550x supports Multicast traffic features: - IGMP v2 support (IGMP v3 support also desirable) - SG550x supports - IGMP snooping support per VLAN - SG550x supports - Fast Leave - SG550x supports - Immediate Leave - Multicast traffic filtering - SG550x supports - Rules to allow/block multicast traffic per port based on source port or multicast id - ??? The SG550X has ACLs that can provide source port based allow/block but I cant see where I could specify Multicast ID in ACL's or other location.  I dont think the SG550x can do this. - Switch must be able to act as querier per VLAN. - SG550x supports - QoS classification based on VLAN if multiple services are run on the switches (ability to assign a priority to multicast traffic also desirable)  -  ??? I cant see this as an option.  I can only see options to apply Qos to physical interfaces or ACL's and there is not an option to apply to a Vlan.  I think the issue here is if multiple separate instances of IPTV use the same QOS settings you would have to have a Qos mappings per vlan.   -SNMP for monitoring - SG550x supports -Support for Microsoft multicast load balancing - This is at the Core and we have a 4500 Chassis so am ok with this.   I'd appreciate any feedback and thoughts. Regards Dave   ... View more

Hello All,   I have a new project which requires a guest environment as well as SSIDs for internal service. The client wants to utilise a 3rd party onboarding cloud based platform for the guests to be able to capture facebook etc.. however wants to retain the internal authentication for the internal services.  We are proposing a Cisco Wireless Controller solution.   The cloud based onboarding platform is radius based and I know I can set the SSID AAA to point towards various Radius Servers or no Radius as the case may be. Is this the best approach? Does anyone have any pointers on a likely scenario?   We are in the design phase at the moment so looking for ideas on how to provide a Guest Wifi with minimal administration but also obtaining user basic details.   Best Regards David   ... View more

Content Removed ... View more

Hello All,   Can anyone assist with the 1810 OEAP Access points and Mobility express?  I have 2 x 1832's setup as controllers and 2 additional 1832s connected as Lwapp's.  They work fine.  I have 4 x 1810  OEAP 's and they associate to the controller and I can see they have Ip addresses through the Controller GUI but they are not fully associated and keep re-attempting to associate.   I've tried mobility firmwares 8.4.100.0 and 8.5.103.0 but same issue although 8.5.103.0 i could see the  Below is the error messages on the 1810  OEAP 's.  I know something isnt correct as when I login to the Access Point from the console the username and pass are default and not inherited the credentials from the Mobiity platform   1810 IP addresses through the gui - See attached image.   Access Point Console log below WAP7#deb capwap client error WAP7#[*09/16/2017 16:32:03.4470] Calling wtpGetAcToJoin from timer expiry. [*09/16/2017 16:32:03.4470] DiscRep[0]: addr 192.168.1.51, apMgrCount 1 [*09/16/2017 16:32:03.4470] Selected MWAR 'FulmerME' 192.168.1.51 (index 0). [*09/16/2017 16:32:03.4470] apMgrCount 1, index 0 [*09/16/2017 16:32:03.4470] Adding Ipv4 AP manager 192.168.1.51 to least load [*09/16/2017 16:32:03.4470] WLC: FulmerME ApMgr count 1, ipTransportTried 0, prefer-mode 0, isIpv4OrIpv6Static 0 [*09/16/2017 16:32:03.4470] IPv4 Pref mode. Choosing AP Mgr with index 0, IP 192.168.1.51, load 5, AP ip: (192.168.1.111) [*09/16/2017 16:32:03.4470] capwapSetTransportAddr returning: index 0, apMgrCount 0 [*09/16/2017 16:32:03.4470] [*09/16/2017 16:32:03.4470] Synchronizing time with AC time: 1505579514 [*09/16/2017 16:31:54.0000] can't find the Ip from discoveryRequest array [*09/16/2017 16:31:54.0000] [*09/16/2017 16:31:54.0000] [*09/16/2017 16:31:54.0000] CAPWAP State: DTLS Setup [*09/16/2017 16:31:54.0000] DTLS connection created sucessfully local_ip: 192.168.1.111 local_port: 5248 peer_ip: 192.168.1.51 peer_port: 5246 [*09/16/2017 16:31:54.0699] Dtls Session Established with the AC 192.168.1.51, port 5246 [*09/16/2017 16:31:54.0699] [*09/16/2017 16:31:54.0699] CAPWAP State: Join [*09/16/2017 16:31:54.0699] Sending Join request to 192.168.1.51 through port 5248 [*09/16/2017 16:31:54.0799] Join Response from 192.168.1.51 [*09/16/2017 16:31:54.0799] AC accepted join request with result code: 0 [*09/16/2017 16:31:54.0799] [*09/16/2017 16:31:54.0799] AC IPv4 192.168.1.51, load 8, count 1 [*09/16/2017 16:31:54.1499] NSS Removing existing tunnel 0 [*09/16/2017 16:31:54.1599] cen_platform_add_capwap_hw_tunnel: done, wtp 192.168.1.51, ap 192.168.1.111 [*09/16/2017 16:31:54.1599] CAPWAP data tunnel UPDATE to forwarding SUCCEEDED [*09/16/2017 16:31:54.1899] Starting Post Join timer [*09/16/2017 16:31:54.1899] [*09/16/2017 16:31:54.1899] CAPWAP State: Image Data [*09/16/2017 16:31:54.1899] AP current image version 8.5.103.0 [*09/16/2017 16:31:54.1899] Controller current image version 8.5.103.0 [*09/16/2017 16:31:54.1899] Version is the same, do not need update. [*09/16/2017 16:31:54.2399] do NO_UPGRADE, part2 is active part [*09/16/2017 16:31:54.2399] [*09/16/2017 16:31:54.2399] CAPWAP State: Configure [*09/16/2017 16:31:54.2499] DOT11_CFG[0] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:31:54.2499] DOT11_CFG[1] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:31:54.3099] LAN update poe_enable 0 override 0 numports 3 portid 1 portenable 0 [*09/16/2017 16:31:54.3099] Configuration Status sent to 192.168.1.51 (part 0) [*09/16/2017 16:31:57.0291] Re-Tx Count=1, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:31:57.0291] [*09/16/2017 16:31:59.8882] Re-Tx Count=2, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:31:59.8882] [*09/16/2017 16:32:02.7373] Re-Tx Count=3, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:02.7373] [*09/16/2017 16:32:05.5964] Re-Tx Count=4, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:05.5964] [*09/16/2017 16:32:08.4455] Re-Tx Count=5, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:08.4455] [*09/16/2017 16:32:11.3046] Re-Tx Count=6, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:11.3046] [*09/16/2017 16:32:11.3046] Max retransmission count exceeded, going back to DISCOVER mode. [*09/16/2017 16:32:11.3046] Dropping msg CAPWAP_CONFIGURATION_STATUS, type = 4, len = 2545, eleLen = 2553, sendSeqNum = 1 [*09/16/2017 16:32:11.3046] GOING BACK TO DISCOVER MODE [*09/16/2017 16:32:11.3046] [*09/16/2017 16:32:11.3046] CAPWAP State: DTLS Teardown [*09/16/2017 16:32:11.3146] [DP] Deleting capwap datapath [*09/16/2017 16:32:11.3146] CAPWAP data tunnel delete from forwarding succeeded [*09/16/2017 16:32:11.3146] Dropping dtls packet since session is not established. Peer 192.168.1.51-5246, Local 192.168.1.111-5248, conn (nil) [*09/16/2017 16:32:16.0531] DTLS session cleanup completed. Restarting capwap state machine. [*09/16/2017 16:32:16.0531] Restarting WLC Discovery [*09/16/2017 16:32:16.0531] Starting Discovery. [*09/16/2017 16:32:16.0531] No uplink IPv6 address [*09/16/2017 16:32:16.0531] IP DNS 8.8.8.8, 0.0.0.0; Domain [*09/16/2017 16:32:16.0531] DHCPv6 conf not found or empty, restart client process. [*09/16/2017 16:32:16.0731] Did not get log server settings from DHCP. [*09/16/2017 16:32:16.0731] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0) [*09/16/2017 16:32:16.0831] Discovery Response from 192.168.1.51 [*09/16/2017 16:32:16.0831] AC IPv4 192.168.1.51, load 5, count 1 [*09/16/2017 16:32:34.4470] Calling wtpGetAcToJoin from timer expiry. [*09/16/2017 16:32:34.4470] DiscRep[0]: addr 192.168.1.51, apMgrCount 1 [*09/16/2017 16:32:34.4470] Selected MWAR 'FulmerME' 192.168.1.51 (index 0). [*09/16/2017 16:32:34.4570] apMgrCount 1, index 0 [*09/16/2017 16:32:34.4570] Adding Ipv4 AP manager 192.168.1.51 to least load [*09/16/2017 16:32:34.4570] WLC: FulmerME ApMgr count 1, ipTransportTried 0, prefer-mode 0, isIpv4OrIpv6Static 0 [*09/16/2017 16:32:34.4570] IPv4 Pref mode. Choosing AP Mgr with index 0, IP 192.168.1.51, load 5, AP ip: (192.168.1.111) [*09/16/2017 16:32:34.4570] capwapSetTransportAddr returning: index 0, apMgrCount 0 [*09/16/2017 16:32:34.4570] [*09/16/2017 16:32:34.4570] Synchronizing time with AC time: 1505579545 [*09/16/2017 16:32:25.0000] can't find the Ip from discoveryRequest array [*09/16/2017 16:32:25.0000] [*09/16/2017 16:32:25.0000] [*09/16/2017 16:32:25.0000] CAPWAP State: DTLS Setup [*09/16/2017 16:32:25.0000] DTLS connection created sucessfully local_ip: 192.168.1.111 local_port: 5248 peer_ip: 192.168.1.51 peer_port: 5246 [*09/16/2017 16:32:25.0599] Dtls Session Established with the AC 192.168.1.51, port 5246 [*09/16/2017 16:32:25.0599] [*09/16/2017 16:32:25.0599] CAPWAP State: Join [*09/16/2017 16:32:25.0699] Sending Join request to 192.168.1.51 through port 5248 [*09/16/2017 16:32:25.0699] Join Response from 192.168.1.51 [*09/16/2017 16:32:25.0699] AC accepted join request with result code: 0 [*09/16/2017 16:32:25.0699] [*09/16/2017 16:32:25.0699] AC IPv4 192.168.1.51, load 8, count 1 [*09/16/2017 16:32:25.1399] NSS Removing existing tunnel 0 [*09/16/2017 16:32:25.1699] cen_platform_add_capwap_hw_tunnel: done, wtp 192.168.1.51, ap 192.168.1.111 [*09/16/2017 16:32:25.1699] CAPWAP data tunnel UPDATE to forwarding SUCCEEDED [*09/16/2017 16:32:25.1999] Starting Post Join timer [*09/16/2017 16:32:25.1999] [*09/16/2017 16:32:25.1999] CAPWAP State: Image Data [*09/16/2017 16:32:25.1999] AP current image version 8.5.103.0 [*09/16/2017 16:32:25.1999] Controller current image version 8.5.103.0 [*09/16/2017 16:32:25.1999] Version is the same, do not need update. [*09/16/2017 16:32:25.2399] do NO_UPGRADE, part2 is active part [*09/16/2017 16:32:25.2399] [*09/16/2017 16:32:25.2399] CAPWAP State: Configure [*09/16/2017 16:32:25.2399] DOT11_CFG[0] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:32:25.2399] DOT11_CFG[1] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:32:25.3099] LAN update poe_enable 0 override 0 numports 3 portid 1 portenable 0 [*09/16/2017 16:32:25.3099] Configuration Status sent to 192.168.1.51 (part 0) [*09/16/2017 16:32:28.0390] Re-Tx Count=1, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:28.0390] [*09/16/2017 16:32:30.8882] Re-Tx Count=2, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:30.8882] [*09/16/2017 16:32:33.7473] Re-Tx Count=3, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:33.7473] [*09/16/2017 16:32:36.5964] Re-Tx Count=4, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:36.5964] [*09/16/2017 16:32:39.4455] Re-Tx Count=5, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:39.4455] [*09/16/2017 16:32:42.3046] Re-Tx Count=6, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:42.3046] [*09/16/2017 16:32:42.3046] Max retransmission count exceeded, going back to DISCOVER mode. [*09/16/2017 16:32:42.3046] Dropping msg CAPWAP_CONFIGURATION_STATUS, type = 4, len = 2545, eleLen = 2553, sendSeqNum = 1 [*09/16/2017 16:32:42.3046] GOING BACK TO DISCOVER MODE [*09/16/2017 16:32:42.3046] [*09/16/2017 16:32:42.3046] CAPWAP State: DTLS Teardown [*09/16/2017 16:32:42.3146] [DP] Deleting capwap datapath [*09/16/2017 16:32:42.3146] CAPWAP data tunnel delete from forwarding succeeded [*09/16/2017 16:32:42.3146] Dropping dtls packet since session is not established. Peer 192.168.1.51-5246, Local 192.168.1.111-5248, conn (nil) Access Point Sh Ver WAP7 uptime is 0 days, 1 hours, 15 minutes Last reload time : Sat Sep 16 14:16:24 UTC 2017 Last reload reason : unknown cisco AIR-OEAP1810-E-K9 ARMv7 Processor rev 0 (v7l) with 477476/214348K bytes of memory. Processor board ID KWC21200CQC AP Running Image : 8.5.103.0 Primary Boot Image : 8.5.103.0 Backup Boot Image : 8.2.151.0 AP Image type : MOBILITY EXPRESS IMAGE AP Configuration : NOT MOBILITY EXPRESS CAPABLE 4 Gigabit Ethernet interfaces 2 802.11 Radios Radio FW version : aa3dba348b0b87165b91a322796b8fd4 NSS FW version : wstephen, Base ethernet MAC Address : 00:42:5A:B8:2A:B0 Part Number : 0-0000-00 PCA Assembly Number : 074-104133-01 PCA Revision Number : 01 PCB Serial Number : KWC21200CQC Top Assembly Part Number : 000-00000-00 Top Assembly Serial Number : KWC24398CAC Top Revision Number : A0 Product/Model Number : AIR-OEAP1810-E-K9   I've run out of ideas as I've upgraded, check the time and defaulted various bits of kit.  The Release notes say they 1810's are compatible so cant explain why they arent assosciating.    Any ideas appreciated.   Regards David ... View more

Content Removed ... View more

Hello all and thanks for reading,  Got a Cisco 867 IOS router with IPSEC VPN config i'm trying to get running.  I get VPN connected but cannot access any internal devices (ive specified the internal IP ranges in the ACL.  I have exactly the same config on another site (different IOS) and it works fine so a bit stumped.  Can anyone see anything I've missed?  VPN config elements in red. Notes: - VPN establishes ok  - IOS firmware c860vae-advsecurityk9-mz.156-2.T1.bin - I can ping the router interfaces over the VPN - I have checked the devices onsite Def Gw's - The site does not have the IPSLA active so no traffic path issues. - From devices onsite I cannot ping the VPN connected device. Traceroute shows traffic gets to the router but no further. - Devices connecting to IPSEC VPN are Apple devices and can be from any public IP. - Getting the following error on debug but then I get connection.  Not getting at other site but it is running earlier firmware "CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at "My-Test IP"" Any pointers appreciated. Dave hostname ROUTER ! boot-start-marker boot-end-marker ! ! logging buffered 100000 informational enable secret XXXXXXXXXXXXXXXXXXXX ! aaa new-model ! ! aaa authentication login default local aaa authentication login vpn_xauth_ml_1 local aaa authentication login sslvpn local aaa authentication login http none aaa authorization network vpn_group_ml_1 local ! ! ! ! ! aaa session-id common wan mode ethernet ! ! ! ip dhcp excluded-address 192.168.99.1 192.168.99.99 ip dhcp excluded-address 192.168.99.240 192.168.99.254 ip dhcp excluded-address 192.168.101.1 192.168.101.99 ip dhcp excluded-address 192.168.101.240 192.168.101.254 ip dhcp excluded-address 192.168.102.1 192.168.102.99 ip dhcp excluded-address 192.168.102.120 192.168.102.254 ip dhcp excluded-address 192.168.40.1 192.168.40.99 ip dhcp excluded-address 192.168.40.120 192.168.40.254 ip dhcp excluded-address 192.168.100.1 192.168.100.5 ip dhcp excluded-address 192.168.100.30 192.168.100.35 ip dhcp excluded-address 192.168.100.250 192.168.100.254 ! ip dhcp pool Mgmt network 192.168.99.0 255.255.255.0 default-router 192.168.99.1 dns-server 8.8.8.8 ! ip dhcp pool Site network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 dns-server 8.8.8.8 lease 0 4 ! ip dhcp pool AV network 192.168.101.0 255.255.255.0 default-router 192.168.101.1 dns-server 8.8.8.8 ! ip dhcp pool Voice network 192.168.102.0 255.255.255.0 dns-server 8.8.8.8 default-router 192.168.102.1 ! ip dhcp pool TI network 192.168.40.0 255.255.255.0 default-router 192.168.40.1 dns-server 8.8.8.8 ! ! ! ip inspect name CCP_LOW dns ip inspect name CCP_LOW ftp ip inspect name CCP_LOW h323 ip inspect name CCP_LOW sip ip inspect name CCP_LOW https ip inspect name CCP_LOW icmp ip inspect name CCP_LOW imap ip inspect name CCP_LOW pop3 ip inspect name CCP_LOW rcmd ip inspect name CCP_LOW realaudio ip inspect name CCP_LOW rtsp ip inspect name CCP_LOW esmtp ip inspect name CCP_LOW sqlnet ip inspect name CCP_LOW streamworks ip inspect name CCP_LOW tftp ip inspect name CCP_LOW tcp router-traffic ip inspect name CCP_LOW udp router-traffic ip inspect name CCP_LOW vdolive ip domain name XXXXXXXXXXXXX ip ddns update method dyndns ! ip cef no ipv6 cef ! ! vpdn enable ! vpdn-group 1 ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 ! ! ! ! ! ! ! ! ! crypto pki trustpoint TP-self-signed- XXXXXXXXXXXXXXXXXXXX enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate- XXXXXXXXXXXXXXXXXXXX revocation-check none rsakeypair TP-self-signed-2943135384 ! ! crypto pki certificate chain TP-self-signed- XXXXXXXXXXXXXXXXXXXX certificate self-signed 01 XXXXXXXXXXXXXXXXXXXX quit ! ! username XXXXXXXXXXXXXXXXXXXX privilege 15 password  XXXXXXXXXXXXXXXXXXX X ! ! controller VDSL 0 shutdown ! track 1 ip sla 1 reachability delay down 180 ! ! ! ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group VPNGroup key XXXXXXXXXXXXXXXXXXXX dns 8.8.8.8 pool vpnpool acl 101 max-users 5 netmask 255.255.255.0 crypto isakmp profile vpn-ike-profile-1 match identity group VPNGroup client authentication list vpn_xauth_ml_1 isakmp authorization list vpn_group_ml_1 client configuration address respond virtual-template 2 ! ! crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac mode tunnel ! crypto ipsec profile VPN-Profile-1 set transform-set encrypt-method-1 ! ! ! ! ! ! ! interface Loopback1 no ip address ! interface Loopback100 ip ddns update hostname XXXXXXXXXXXXXXXXXXXX ip ddns update dyndns host XXXXXXXXXXXXXXXXXXXX ip address 10.10.10.1 255.255.255.0 ip nat inside ip virtual-reassembly in ! interface ATM0 no ip address shutdown no atm ilmi-keepalive ! interface ATM0.1 point-to-point pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface Ethernet0 no ip address shutdown ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address spanning-tree portfast ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface GigabitEthernet0 switchport mode trunk no ip address ! interface GigabitEthernet1 ip address XXXXXXXXXXXXXXXXXXXX 255.255.255.248 ip access-group INTERNET1 in ip flow ingress ip flow egress ip inspect CCP_LOW out ip nat outside ip virtual-reassembly in duplex auto speed auto ! interface Virtual-Template1 ip unnumbered GigabitEthernet1 ip nat inside ip virtual-reassembly in peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto passive ppp authentication pap chap ms-chap ms-chap-v2 ! interface Virtual-Template2 type tunnel ip unnumbered GigabitEthernet1 tunnel mode ipsec ipv4 tunnel protection ipsec profile VPN-Profile-1 ! interface Vlan1 ip address 192.168.99.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan40 description TI Vlan ip address 192.168.40.1 255.255.255.0 ip flow egress ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan100 ip address 192.168.100.1 255.255.255.0 ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan101 ip address 192.168.101.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan102 ip address 192.168.102.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Dialer0 ip address XXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXX ip access-group INTERNET in no ip redirects no ip unreachables no ip proxy-arp ip inspect CCP_LOW out ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname XXXXXXXXXXXXXXXXXXXX ppp chap password XXXXXXXXXXXXXXXXXXXX no cdp enable ! ip local pool vpnpool 192.168.255.10 192.168.255.20 ip local pool VPN-Pool 192.168.254.20 192.168.254.25 ip forward-protocol nd ip http server ip http authentication local ip http secure-server ! ip flow-export version 9 ip flow-export interface-names ip flow-export destination XXXXXXXXXXXXXXXXXXXX 9010 ip flow-top-talkers top 15 sort-by packets cache-timeout 360000 ! ip nat inside source static tcp 192.168.99.1 1723 interface GigabitEthernet1 1723 ip nat inside source static tcp 192.168.99.1 22 interface GigabitEthernet1 22 ip nat inside source list 1 interface GigabitEthernet1 overload ip route 0.0.0.0 0.0.0.0 XXXXXXXXXXXXXXXXXXXX track 1 ip route 0.0.0.0 0.0.0.0 192.168.99.254 100 ! ip access-list extended INTERNET1 permit icmp any any echo-reply permit icmp any any unreachable permit icmp any any time-exceeded permit udp host 8.8.8.8 eq domain any permit udp host 8.8.4.4 eq domain any permit gre any any permit tcp any any eq 1723 permit tcp any any eq 22 permit esp any any permit icmp any any permit tcp any any eq 50 permit tcp any any eq 51 permit tcp any any eq 500 permit tcp any any eq 4500 permit udp any any eq 50 permit udp any any eq 51 permit udp any any eq isakmp permit udp any any eq non500-isakmp permit udp any any eq bootps permit udp any any eq bootpc permit udp host XXXXXXXXXXXXXXXXXXXX any permit tcp host XXXXXXXXXXXXXXXXXXXX  any deny ip 192.168.0.0 0.0.0.255 any deny ip 10.0.0.0 0.255.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 127.0.0.0 0.255.255.255 any deny ip host 255.255.255.255 any deny ip host 0.0.0.0 any log ip access-list extended SLAPROBE_ACL permit icmp any host XXXXXXXXXXXX ! ip sla auto discovery ip sla 1 icmp-echo XXXXXXXXXXXXXXXXXXXX source-interface GigabitEthernet1 ip sla schedule 1 life forever start-time now dialer-list 1 protocol ip permit mac-address-table aging-time 20 ! route-map SLAPROBE permit 10 match ip address SLAPROBE_ACL set ip next-hop XXXXXXXXXXXXXXXXXXXX ! route-map Fiber permit 10 match ip address 1 match interface GigabitEthernet1 ! snmp-server community public RO access-list 1 permit any access-list 101 permit ip 192.168.99.0 0.0.0.255 any access-list 101 permit ip 192.168.100.0 0.0.0.255 any access-list 101 permit ip 192.168.40.0 0.0.0.255 any access-list 101 permit ip 192.168.102.0 0.0.0.255 any access-list 101 permit ip 192.168.101.0 0.0.0.255 any ! ! ! ! line con 0 no modem enable line aux 0 line vty 0 4 transport input ssh ! scheduler allocate 20000 1000 ntp server XXXXXXXXXXXXXXXXXXXX event manager applet dyndns event track 1 state up action 1 cli command "en" action 2 cli command "user admin" action 3 cli command "conf t" action 4 cli command "interface loopback 100" action 5 cli command "shut" action 6 cli command "no shut" event manager applet Pri_back event track 1 state any action 2.0 cli command "clear ip nat trans forced" ! ... View more

Hello all, Can anyone give me an assist?  I have a site where I cannot get the a Windows IPSEC VPN working with the equipment onsite. I can connect and ca ping devices but I cannot browse to the interface or communicate on any ports.   I can however connect with IPSEC VPN same credentials via Iphone/ipad ok and access all interfaces of internal kit.  Just Windows.  I have another site with an ASA and same config from what I can make out and I can connect ok via Windows.  So I knwo my test machine is ok.  I must be missing something in the config. : ASA Version 9.6(2)2 ! hostname ASA enable password XXXXXXXXXX encrypted names ip local pool VPNDHCP 192.168.255.20-192.168.255.30 mask 255.255.255.0 ! interface GigabitEthernet1/1 nameif outside security-level 0 ip address dhcp setroute ! interface GigabitEthernet1/2 nameif inside security-level 100 ip address 192.168.254.1 255.255.255.0 ! interface GigabitEthernet1/3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/6 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/7 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/8 shutdown no nameif no security-level no ip address ! interface Management1/1 management-only no nameif no security-level no ip address ! boot system disk0:/asa962-2-lfbff-k8.SPA ftp mode passive clock timezone GMT/BST 0 clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00 same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any subnet 0.0.0.0 0.0.0.0 object network NETWORK_OBJ_192.168.120.248_29 subnet 192.168.120.248 255.255.255.248 object network NETWORK_OBJ_192.168.255.x_Addresses range 192.168.255.10 192.168.255.40 object network VVRHost host 192.168.124.2 object network VNAT_9780 host 192.168.124.2 object network V_9786TCP host 192.168.124.2 object network V_9786udp host 192.168.124.2 object network V_NAT554 host 192.168.124.2 object network NETWORK_OBJ_192.168.255.16_28 subnet 192.168.255.16 255.255.255.240 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service VNVR tcp-udp port-object eq 554 port-object eq 9780 port-object eq 9786 access-list outside_access_in extended permit ip any object aaaNetwork access-list outside_access_in extended permit object-group TCPUDP any object VHost object-group VVR access-list inside_access_in extended permit ip any any pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-762.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 16384 nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.255.x_Addresses NETWORK_OBJ_192.168.255.x_Addresses no-proxy-arp route-lookup nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.255.16_28 NETWORK_OBJ_192.168.255.16_28 no-proxy-arp route-lookup ! object network obj_any nat (any,outside) dynamic interface object network VNAT_9780 nat (inside,outside) static interface net-to-net no-proxy-arp service tcp 9780 9780 object network VVR_9786TCP nat (inside,outside) static interface net-to-net no-proxy-arp service tcp 9786 9786 object network V_9786udp nat (inside,outside) static interface net-to-net no-proxy-arp service udp 9786 9786 object network V_NAT554 nat (inside,outside) static interface net-to-net no-proxy-arp service tcp rtsp rtsp ! nat (inside,outside) after-auto source dynamic any interface access-group outside_access_in in interface outside access-group inside_access_in in interface inside route outside 0.0.0.0 0.0.0.0 X.X.X.X 1 route inside 192.168.0.0 255.255.255.255 192.168.254.2 1 route inside 192.168.120.0 255.255.255.0 192.168.254.2 1 route inside 192.168.121.0 255.255.255.0 192.168.254.2 1 route inside 192.168.122.0 255.255.255.0 192.168.254.2 1 route inside 192.168.124.0 255.255.255.0 192.168.254.2 1 route inside 192.168.125.0 255.255.255.0 192.168.254.2 1 route inside 192.168.126.0 255.255.255.0 192.168.254.2 1 route inside 192.168.130.0 255.255.255.0 192.168.254.2 1 route inside 192.168.144.0 255.255.255.0 192.168.254.2 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 user-identity default-domain LOCAL aaa authentication http console LOCAL aaa authentication serial console LOCAL aaa authentication ssh console LOCAL aaa authentication telnet console LOCAL http server enable http 0.0.0.0 0.0.0.0 outside http 192.168.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact service sw-reset-button crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto ca trustpool policy crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 enable outside client-services port 443 crypto ikev1 enable outside crypto ikev1 policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 60 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 90 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 140 authentication rsa-sig encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 150 authentication pre-share encryption des hash sha group 2 lifetime 86400 telnet 192.168.0.0 255.255.0.0 inside telnet timeout 5 ssh stricthostkeycheck ssh 0.0.0.0 0.0.0.0 outside ssh 192.168.0.0 255.255.0.0 inside ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 10 dhcpd auto_config outside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept ntp server 141.40.103.101 source outside prefer webvpn cache disable error-recovery disable group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes dns-server value 8.8.8.8 vpn-tunnel-protocol ikev1 l2tp-ipsec password-storage disable default-domain value aaaaaaa.local dynamic-access-policy-record DfltAccessPolicy username admin password XXXXXXXXXXXXXX encrypted privilege 15 username Administrator password XXXXXXXXXXXX encrypted privilege 15 username aaaaccess password XXXXXXXXXXXXXX nt-encrypted privilege 0 username aaavpn password XXXXXXXXXXXXXXXX nt-encrypted privilege 0 username aaavpn attributes service-type remote-access tunnel-group DefaultRAGroup general-attributes address-pool VPNDHCP default-group-policy DefaultRAGroup tunnel-group DefaultRAGroup ipsec-attributes ikev1 pre-shared-key ***** tunnel-group DefaultRAGroup ppp-attributes authentication ms-chap-v2 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp inspect icmp error inspect ipsec-pass-thru inspect pptp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous : end ... View more

Hi All, Probably something simple I'm missing and some guidance would be appreciated.. To summarise the issue: I have a site with a communal network and an existing heating system we need to integrate with.  The apartment we are working on is being re-done and all the old kit removed. Our apartment IP is 192.168.2.0/24 and the Communal network is 172.16.11.0/24.   Now the problem We are installing new and do not have access to the Heating config nor the communal area network.  We cant alter the communal equipment routing to point the heating traffic etc to our router so I have to use NAT.  I have setup the Nat where a communal address equals our device on our network.  This works and we have comms but the anomaly is that the device now no longer has access to the internet. The router doing the Nat is also the router providing the Def Gateway so I suspect the Nat is what is causing the problem.  I need to achieve the Nat as well as internet access? Not sure how to tie the Nat to just the WAN2 (vlan172) interface so it does not affect the outbound internet traffic. Can you anyone point me in the right direction? Thanks in advance  David Network diagram attached Cisco Router 867 Config : logging buffered 51200 warnings ! no aaa new-model wan mode dsl ! ! ! ip dhcp excluded-address 192.168.2.1 192.168.2.99 ip dhcp excluded-address 192.168.2.200 192.168.2.254 ! ip dhcp pool Home network 192.168.2.0 255.255.255.0 dns-server 8.8.8.8 default-router 192.168.2.1 lease 2 ! ! ! ip inspect name CCP_LOW dns ip inspect name CCP_LOW ftp ip inspect name CCP_LOW h323 ip inspect name CCP_LOW sip ip inspect name CCP_LOW https ip inspect name CCP_LOW icmp ip inspect name CCP_LOW imap ip inspect name CCP_LOW pop3 ip inspect name CCP_LOW rcmd ip inspect name CCP_LOW realaudio ip inspect name CCP_LOW rtsp ip inspect name CCP_LOW esmtp ip inspect name CCP_LOW sqlnet ip inspect name CCP_LOW streamworks ip inspect name CCP_LOW tftp ip inspect name CCP_LOW tcp ip inspect name CCP_LOW udp router-traffic ip inspect name CCP_LOW vdolive no ip domain lookup ip domain name yourdomain.com ip cef no ipv6 cef ! ! vpdn enable ! vpdn-group 1 ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 ! ! ! ! username admin privilege 15 password 0 XXXX ! ! controller VDSL 0 no cdp run ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface ATM0 no ip address no atm ilmi-keepalive ! interface ATM0.1 point-to-point pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface Ethernet0 no ip address shutdown ! interface Ethernet0.101 encapsulation dot1Q 101 pppoe-client dial-pool-number 1 no cdp enable ! interface FastEthernet0 no ip address spanning-tree portfast ! interface FastEthernet1 no ip address spanning-tree portfast ! interface FastEthernet2 no ip address spanning-tree portfast ! interface FastEthernet3 Description Communal_Network switchport access vlan 172 no ip address spanning-tree portfast ! interface GigabitEthernet0 no ip address ! interface Virtual-Template1 ip unnumbered Dialer0 ip nat inside ip virtual-reassembly in peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto passive ppp authentication pap chap ms-chap ms-chap-v2 ! interface Vlan1 description Internal_Network ip address 192.168.2.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan172 ip address 172.16.11.254 255.255.255.0 ip nat outside ip virtual-reassembly in ! interface Dialer0 ip address negotiated ip access-group INTERNET in no ip redirects no ip unreachables no ip proxy-arp ip inspect CCP_LOW out ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname 02037846405@focusbroadband.co.uk ppp chap password 0 C5S5E5P2S6 no cdp enable ! ip local pool vpnpool 192.168.2.251 192.168.2.253 ip forward-protocol nd ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ! ip nat inside source list 1 interface Dialer0 overload ip nat inside source static tcp 192.168.2.1 23 interface Dialer0 23 ip nat inside source static tcp 192.168.2.1 1723 interface Dialer0 1723 ip nat inside source static tcp 192.168.2.250 80 interface Dialer0 80 ip nat inside source static tcp 192.168.2.250 554 interface Dialer0 554 ip nat inside source static 192.168.2.210 172.16.11.210 extendable ip nat inside source static 192.168.2.212 172.16.11.243 extendable ip nat inside source static 192.168.2.214 172.16.11.244 extendable ip route 0.0.0.0 0.0.0.0 Dialer0 ip route 172.16.13.0 255.255.255.0 172.16.11.1 ! ip access-list extended INTERNET permit icmp any any echo-reply permit icmp any any unreachable permit icmp any any time-exceeded permit udp host 8.8.8.8 eq domain any permit udp host 8.8.4.4 eq domain any permit tcp any any eq 554 permit tcp any any eq www permit gre any any permit tcp any any eq 1723 permit tcp any any eq telnet permit tcp any any eq 68 permit tcp any any eq 67 permit udp any any eq bootpc permit udp any any eq bootps deny ip 192.168.0.0 0.0.0.255 any deny ip 10.0.0.0 0.255.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 127.0.0.0 0.255.255.255 any deny ip host 255.255.255.255 any deny ip host 0.0.0.0 any deny ip any any log ! dialer-list 1 protocol ip permit ! access-list 1 permit any ! ! line con 0 login local no modem enable line aux 0 line vty 0 4 privilege level 15 login local transport input telnet ssh ! scheduler allocate 60000 1000 ! end ... View more