Hi Folks, We have a vpn tunnel from our Amazon AWS footprint to our ASA 5500 which currently sends traffic from our AWS servers in 10.200.12.0/24 to our on premise network, there's also a 172.27.1.0/24 in the ACLs and crypto maps which works but is no longer used. I am trying to add a new range, 172.31.1.0/24 which is a partner network out a different tunnel (terminating at another CI) and is distributed through the network via OSPF.  This works fine on-premise, our production on-premise LAN can see this great, but the ASA is dropping traffic bound for 172.31.1.0/24 at this end (v the AWS end) of the tunnel, the behaviour looks similar to when crypto ACLs don't match between VPN devices. DevFW01# packet-tracer input outside tcp 10.200.12.50 1024 172.31.1.2 443 deta$ Phase: 1 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information:  Forward Flow based lookup yields rule:  in  id=0x7380fb88, priority=1, domain=permit, deny=false         hits=17899775449, user_data=0x0, cs_id=0x0, l3_type=0x8         src mac=0000.0000.0000, mask=0000.0000.0000         dst mac=0000.0000.0000, mask=0100.0000.0000         input_ifc=outside, output_ifc=any Phase: 2 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in   172.31.1.0      255.255.255.0   inside Phase: 3 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group outside_access_in in interface outside access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_10 any any log debugging object-group protocol DM_INLINE_PROTOCOL_10  protocol-object ip  protocol-object icmp  protocol-object udp  protocol-object tcp Additional Information:  Forward Flow based lookup yields rule:  in  id=0x73a72398, priority=13, domain=permit, deny=false         hits=4530380, user_data=0x6f640280, cs_id=0x0, use_real_addr, flags=0x0, protocol=0         src ip/id=0.0.0.0, mask=0.0.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=outside, output_ifc=any Phase: 4 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:  Forward Flow based lookup yields rule:  in  id=0x73813890, priority=0, domain=inspect-ip-options, deny=true         hits=2031225907, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0         src ip/id=0.0.0.0, mask=0.0.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=outside, output_ifc=any Phase: 5 Type: VPN Subtype: ipsec-tunnel-flow Result: ALLOW Config: Additional Information:  Forward Flow based lookup yields rule:  in  id=0x743beb60, priority=13, domain=ipsec-tunnel-flow, deny=true         hits=14438926, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0         src ip/id=0.0.0.0, mask=0.0.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=outside, output_ifc=any Phase: 6 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:  Reverse Flow based lookup yields rule:  in  id=0x7384af18, priority=0, domain=inspect-ip-options, deny=true         hits=305412231, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0         src ip/id=0.0.0.0, mask=0.0.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=inside, output_ifc=any Phase: 7 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information:  Reverse Flow based lookup yields rule:  out id=0x74fd3f68, priority=70, domain=encrypt, deny=false         hits=3, user_data=0x0, cs_id=0x74405548, reverse, flags=0x0, protocol=0         src ip/id=172.31.1.0, mask=255.255.255.0, port=0         dst ip/id=10.200.0.0, mask=255.255.0.0, port=0, dscp=0x0         input_ifc=any, output_ifc=outside Result: input-interface: outside input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule I'd normally expect to see this if ACLs don't match, but the crypto map shows the new range correctly.  Also the AWS side has correct ACL rules that allow this and correct routes (otherwise the traffic wouldn't enter the tunnel right?)   Any thoughts?   ... View more

Hi Folks, We're in the process of establishing a VPN tunnel to a business partner who wants us to NAT down the created tunnel translating both source and destination addresses.  We use OSPF in a single large area to manage our routing and do static routes as little as possible if at all.  I think I have a weird problem with what they are asking me to do (they're flat and statically route) but I could be wrong/confused. Topology goes; [Our ASA 5500] -------- [ Our 3845 Router] -------------------( CAT PICTURES (INTERNET) ) ------------  [  Their ASA they only use as a VPN endpoint ]----[SRX] I have IPSEC configured on the 3845 router to create a tunnel to them.  I also have a static route for the 172.31.1.0/24 address that they are exposing as NATted destination IPs for us.  I have a NAT rule on the ASA which translates packets sent to the destination 172.31.1.0/24 and gives them the source 172.16.89.0/24 which is the only source they'll accept from.   The tunnel interface has been raised with no shutdown, but line protocol is down because no interesting traffic has attempted to traverse it yet.  The reason no interesting traffic has attempted to traverse it, is because there is no route to it, because distributing the static route into OSPF can only happen once the tunnel interface is up and the route is active, which doesn't happen until traffic gets to it....  you get the idea. Have I misunderstood something or can a route to a tunnel not be distributed into OSPF because until traffic is routed to the tunnel it won't raise? ... View more

Hi Folks, I've set up compliance (IM logging from Jabber) to a Postgres server as per the instructions, and also per the threads that reveal the secret step of creating a windows user that matches the DB user.  Everything seems OK in that the database is contactable, verified by the interface, the message archiver service starts great on both nodes, but looking at the database in pgadmin I can only see the default catalog.  If this is logging messages, where are they going? How can I confirm for sure that this is working (i.e. how can I retrieve a message one Jabber user sent another from the DB?) ... View more

Hi Folks, I must be blind but where is the implementation guide for web chat?  The overall CCX implementation guide only mentions it in passing and while socialminer is detailed as a requirement I can't see why, socialminer seems to be what the name suggests - negative sentiment capture and action for social media, not for backending web chat for contact center. Where's TFM so I can RTFM? ... View more

Hi folks, I'm getting conflicting information.  Can I use third party SIP video clients with CUCM? If I can, do I need a particular license? - Geordie ... View more