Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Ross Mccullough
10-09-2017
Stats
Member since
08-09-2012
27
Posts
0
Helpful
0
Solutions
Created by
Ross Mccullough
in Voice Systems
in Voice Systems
07-05-2014
07:02 AM
07-05-2014
07:02 AM
Group, I came across some unexpected behavior yesterday I was wondering if someone could help shed some light on the problem. In my DNS I created this record: _sip._upd.platautofinance.com which when I do a query using MX Toolbox it is correctly reporting the following: On the SPA504 I have programmed the SRV records into the system using the following: So here is the issue, the phones will register correctly to the primary server but after a length of time ALL the phones will abandon ship and jump to the secondary server and stay there. I have to manually shut the secondary down, reboot the endpoints at which point they will re-register with the primary. So I think I need to understand the mechanism a bit better. Here is what I can think of: The phones are not using the primary DNS service record providers DNS servers, we are using OpenDNS instead of Network Solutions <-- Unlikely because the SPA would not be able to resolve the SIP SRV records / servers at all with a broken DNS resolution. I can tell by dropping from the primary to the secondary that resolution is taking place on the phone because they are jumping between the right ones. My understanding is the proxy fallback interval should have the phone register (and they should be checking periodically if the primary is available again and if so, re-register the to the lowest-weighted server) but that's not happening without a manual reboot. Once on the secondary they want to stay there. My firewall for both the primary and secondary servers do not answer ICMP. So the question is: why do the SPA phones think the primary is offline? What is the mechanism or criteria the SPA uses to determine a server is offline and then rolling to the secondary? Why do they want to stick around the secondary which is using only a best effort connection when we have a bonded T on the primary? Thanks as always for your help and input group! Appreciate your time.
... View more
Labels:
Created by
Ross Mccullough
in Switching
in Switching
03-03-2014
03:04 PM
03-03-2014
03:04 PM
Hello, It apprears to me that when I configured PBR on the inside interface that all traffic that should be routed to the vpn LAN address at 10.41.14.110 is actually being forced out of GigabitEthernet0/0. The PBR should have ACL 100 for the phones going to GigabitEthernet0/2 which is does, and ACL 101 should be sent down GigabitEthernet0/0 but ALL the other traffic is being sent out GigabitEthernet0/0 including the VPN traffic. I was able to resolve this today by adjusting the route-map PBR by setting a lower cost on the VPN traffic before it is forced out the WAN1 interface. The modification is below as well as the ACL. Thanks for the help everyone! pl-gw1-paf-router1#show route-map PBR route-map PBR, permit, sequence 10 Match clauses: ip address (access-lists): 100 Set clauses: ip next-hop verify-availability 206.135.77.81 1 track 20 [up] Policy routing matches: 6196088 packets, 1730149548 bytes route-map PBR, permit, sequence 20 Match clauses: ip address (access-lists): VPNTraffic Set clauses: ip next-hop 10.41.14.110 Policy routing matches: 3293 packets, 373398 bytes route-map PBR, permit, sequence 30 Match clauses: ip address (access-lists): 101 Set clauses: ip next-hop verify-availability 71.40.160.121 2 track 10 [up] Policy routing matches: 4971034 packets, 718272101 bytes pl-gw1-paf-router1# pl-gw1-paf-router1#show access-list VPNTraffic Extended IP access list VPNTraffic 10 permit ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 (3045 matches) 20 permit ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 (175 matches) pl-gw1-paf-router1#
... View more
Created by
Ross Mccullough
in Switching
in Switching
03-02-2014
01:02 PM
03-02-2014
01:02 PM
Group, Wanted to get your input on an issue where I am sure I am overlooking something. I rebuilt the router for IP SLA and PBR but I am having a VPN issue. Here is the scenario: The LAN is 10.41.14.0/255.255.255.0 On the LAN is a VPN device for the networks sits at 10.41.14.110, the VPN has the tunnels built correctly but remotely I can only ping the firewall and the VPN at 10.41.14.100 and 10.41.14.110 respectively from the remote LAN's but no others. I need to get this piece resolved. After some more investigation I can confirm the following: The remote LAN can ping 10.41.14.100 and 10.41.14.110 but nothing else. The router can ping any IP address in the remote LAN without issue. Seems like the issue is the data coming back into the router, perhaps a missing ACL allowing traffic in? The router is allowing HTTPS to itself via CCP. I have highlighted them in the config below. Thanks for your input as always!! Building configuration... Current configuration : 7935 bytes ! ! Last configuration change at 15:05:40 NewYork Sun Mar 2 2014 by cisco ! NVRAM config last updated at 15:08:13 NewYork Sun Mar 2 2014 by cisco ! NVRAM config last updated at 15:08:13 NewYork Sun Mar 2 2014 by cisco version 15.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname pl-gw1-paf-router1 ! boot-start-marker boot-end-marker ! ! security authentication failure rate 3 log security passwords min-length 6 logging buffered 51200 warnings enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX enable password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ! aaa new-model ! ! aaa authentication login default local ! ! ! ! ! aaa session-id common clock timezone NewYork -5 0 clock summer-time NewYork date Mar 9 2014 2:00 Nov 2 2014 2:00 ! no ip source-route ip cef ! ! ! ! ! ! no ip bootp server ip domain name XXXXXXXXXXXXXXXXXX ip name-server 208.67.220.220 ip name-server 208.67.222.222 ip name-server 8.8.4.4 ip name-server 8.8.8.8 no ipv6 cef ! multilink bundle-name authenticated ! ! ! crypto pki trustpoint TP-self-signed-1476751880 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1476751880 revocation-check none rsakeypair TP-self-signed-1476751880 ! ! crypto pki certificate chain TP-self-signed-1476751880 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 31343736 37353138 3830301E 170D3134 30333032 31373431 32345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34373637 35313838 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B9C5 15A9B6DA 5AADCF68 1D3552E8 BBC3E0FB 34B47C34 4C01A0F6 BD0D958B EC218CDC 158F6357 DE4EDAD6 5259873D B4FD60E9 2D886198 38E81FCD 71967384 C6BF68DF 88D01803 DF3E1D18 1E73BAFE 531C04BB 80F86321 A538CAF6 B79483D9 68E85FCE A06F98AF 9CF981AE 8712517C 607AA3A1 1862D58E FA0A8207 84EE78A3 D3670203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 14F2ECA8 2C1C0B8E 80A46975 33679CE4 F0E917B0 0B301D06 03551D0E 04160414 F2ECA82C 1C0B8E80 A4697533 679CE4F0 E917B00B 300D0609 2A864886 F70D0101 05050003 818100AE 25C715F4 B2B1E151 715C9517 45316F3A 1F53DF3A 4D444558 9C3A5B5F F940E554 055BE425 C2FAA35B 05137D7C 0059184A 6203C168 30D914F2 B65D6650 D357E457 B734F0E0 A5403927 FFE2AE9B 22885C2B F8BB2944 484C644D 7B482C22 8666BA17 139C5AE5 3D176884 443BFBBD 351DA9BB 4CD17E62 AFBEA900 73D5C3B2 D1BEEE quit license udi pid CISCO2911/K9 sn FGL172810VH license boot module c2900 technology-package securityk9 ! ! object-group service Asterisk description SIP VOIP Phones udp range 5060 5080 udp range 10001 20000 ! username cisco privilege 15 password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXX ! redundancy ! ! ! ! ! ! track 10 ip sla 1 reachability delay down 1 up 1 ! track 20 ip sla 2 reachability delay down 1 up 1 ! class-map match-any CCP-Transactional-1 match dscp af21 match dscp af22 match dscp af23 class-map match-any CCP-Voice-1 match dscp ef class-map match-any CCP-Routing-1 match dscp cs6 class-map match-any CCP-Signaling-1 match dscp cs3 match dscp af31 class-map match-any CCP-Management-1 match dscp cs2 ! policy-map sdm-qos-test-123 class class-default policy-map CCP-QoS-Policy-1 class CCP-Voice-1 priority percent 33 class CCP-Signaling-1 bandwidth percent 5 class CCP-Routing-1 bandwidth percent 5 class CCP-Management-1 bandwidth percent 5 class CCP-Transactional-1 bandwidth percent 5 class class-default fair-queue random-detect policy-map CCP-QoS-Policy-2 class class-default shape average 2560000 service-policy CCP-QoS-Policy-1 ! ! ! ! ! ! ! ! ! ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 ip address 71.XX.160.123 255.255.255.248 ip nat outside ip virtual-reassembly in duplex auto speed auto no mop enabled ! interface GigabitEthernet0/1 ip address 10.41.14.100 255.255.255.0 ip nat inside ip virtual-reassembly in ip policy route-map PBR duplex auto speed auto ! interface GigabitEthernet0/2 ip address 206.XX.77.82 255.255.255.240 ip nat outside ip virtual-reassembly in duplex auto speed auto service-policy output CCP-QoS-Policy-2 ! ip forward-protocol nd ! ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip flow-top-talkers top 25 sort-by bytes cache-timeout 3600 ! no ip nat service sip udp port 5060 ip nat inside source route-map Brighthouse interface GigabitEthernet0/0 overload ip nat inside source route-map Megapath interface GigabitEthernet0/2 overload ip nat inside source static tcp 10.41.14.103 80 71.XX.160.123 80 extendable ip nat inside source static tcp 10.41.14.103 443 71.XX.160.123 443 extendable ip route 0.0.0.0 0.0.0.0 71.XX.160.121 track 10 ip route 0.0.0.0 0.0.0.0 206.XX.77.81 track 20 ip route 10.0.2.0 255.255.255.0 10.41.14.110 2 permanent ip route 10.67.188.32 255.255.255.224 10.41.14.99 6 permanent ip route 10.67.188.96 255.255.255.224 10.41.14.99 8 permanent ip route 10.200.107.0 255.255.255.0 10.41.14.99 9 permanent ip route 10.200.110.0 255.255.254.0 10.41.14.99 7 permanent ip route 74.200.107.0 255.255.255.0 10.41.14.99 5 permanent ip route 74.200.110.0 255.255.254.0 10.41.14.99 4 permanent ip route 192.168.10.0 255.255.255.224 10.41.14.110 3 permanent ip route 208.67.188.32 255.255.255.224 10.41.14.99 2 permanent ip route 208.67.188.96 255.255.255.224 10.41.14.99 3 permanent ! ip sla auto discovery ip sla 1 icmp-echo 71.XX.160.121 source-interface GigabitEthernet0/0 threshold 1000 timeout 3000 frequency 10 ip sla schedule 1 life forever start-time now ip sla 2 icmp-echo 206.XX.77.81 source-interface GigabitEthernet0/2 threshold 1000 timeout 3000 frequency 10 ip sla schedule 2 life forever start-time now access-list 10 permit 10.41.14.0 0.0.0.255 access-list 100 permit object-group Asterisk any any access-list 101 permit ip any any ! route-map Megapath permit 10 match ip address 10 match interface GigabitEthernet0/2 ! route-map PBR permit 10 match ip address 100 set ip next-hop verify-availability 206.XX.77.81 1 track 20 ! route-map PBR permit 30 match ip address 101 set ip next-hop verify-availability 71.XX.160.121 2 track 10 ! route-map Brighthouse permit 10 match ip address 10 match interface GigabitEthernet0/0 ! ! snmp-server community public RO snmp-server community ourCommStr RW snmp-server location Clearwater North snmp-server contact MIS IT Services x1000 snmp-server enable traps entity-sensor threshold snmp-server host 97.XX.78.222 XXXXXXXXXXXXXXXXXX ! ! ! control-plane ! ! ! line con 0 line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 privilege level 15 password 7 14071D0E550D270721296766 transport input ssh ! scheduler allocate 20000 1000 ntp update-calendar ntp server 24.56.178.140 prefer source GigabitEthernet0/0 ntp server 64.239.96.53 source GigabitEthernet0/0 ntp server 96.226.123.157 source GigabitEthernet0/0 ntp server 64.113.32.5 source GigabitEthernet0/0 ntp server 129.6.15.30 prefer source GigabitEthernet0/0 ntp server 12.10.191.151 source GigabitEthernet0/0 ! end
... View more
Labels:
Created by
Ross Mccullough
in Small Business Routers
in Small Business Routers
02-13-2014
07:50 AM
02-13-2014
07:50 AM
Group, Good morning, wanted to run some config questions by you as I am a bit unclear on a few things regarding load balancing and the IP SLA and PBR routing. Let's start with the basics: GigabitEthernet0/1 --> LAN GigabitEthernet0/0 --> ISP 1 WAN GigabitEthernet0/2 --> ISP 2 WAN So here is what I am attempting to accomplish. We have added ISP 2 to specifically send our VOIP traffic down, I would like to direct our PBX traffic from the LAN down this link. I have already added the config for the IP SLA to the router but I am unsure about configuration of the PBR to over-ride the routing tables and I believe PBR statements are evaluated before routing and how they are applied. Currently my default route-map looks like this: route-map SDM-RMAP_1 permit 1 match ip address 104 My ACL 104 looks like this: access-list 104 permit ip 192.168.10.0 0.0.0.31 any My understanding is that although you can only have 1 route-map per interface you can sequence them as well, when a match occurs it takes the action and continues to evaluate till the bottom of the sequence. So my question is can I / should I configure it like this for the desired results? Create the object group: object-group Asterisk description SIP Communication Server udp source range 5060-5061 udp source range 10001-20000 NAT the traffic from the inside to the outside for SIP Signaling: ip nat inside source static udp 192.168.10.11 5060 2xx.135.77.158 5060 Create the ACL for the VOIP Traffic: access-list 109 remark ISP Traffic access-list 109 permit object-group Asterisk any host 2xx.135.77.158 Modify the existing route-map: no route-map SDM_RMAP_1 route-map SDM_RMAP_1 permit 10 match ip address 109 set interface GigabitEthernet0/2 exit route-map SDM_RMAP_1 permit 20 match ip address 104 exit exit Apply the traffic to the interface where the traffic is coming in on ISP2: interface GigabitEthernet0/2 ip policy route-map SDM_RMAP_1 I think that covers it, if the access-list 104 is the last statement to be evaluated should I put a deny any at the end of the statement? Group THANK YOU so much for taking the time to review this config with me. I appreciate it very much!
... View more
Labels:
Created by
Ross Mccullough
in Small Business Security
in Small Business Security
02-04-2014
04:57 AM
02-04-2014
04:57 AM
Update: Well I wasn't able to fix my problem but I was able to bypass it. The Zywall has a second WAN interface, I pointed the IPSEC policy towards the second IP and the tunnel came right up. So, that being said, it would *appear* that the firewall doesn't like the specific IP address I was trying to point it to. If I can determine specifically what caused this issue I will pass it along.
... View more
Created by
Ross Mccullough
in Small Business Security
in Small Business Security
02-01-2014
05:51 AM
02-01-2014
05:51 AM
Group, Trying to build a site to site IP Sec VPN tunnel and I am getting an error I am not familiar with, I was hoping someone could enlighten me before I come unglued. This SA540 "appears" to be configured the same as the additonal 2 SA540/SA520 that built the tunnels successfully and without any issue at all. The endpoint is a Zywall USG100, from it's logs it is obvious the error is on the SA540 side I'm a bit puzzled. Any insight on this error and resolution would be greatly appreciated. I have tried the usual bits, deleted the IKE and VPN proposals out, reboot the device, reboot the Zywall, change the configuration name etc. None of it seems to stick. Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Using IPsec SA configuration: 10.0.2.0/24<->192.168.10.0/27 Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Configuration found for xx.76.78.219. Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Configuration found for xx.76.78.219. Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Initiating new phase 1 negotiation: xx.76.78.218[500]<=>xx.76.78.219[500] Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Beginning Identity Protection mode. Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:185]: XXX: NUMNATTVENDORIDS: 3 Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 4 Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 8 Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 9 Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: sendto (Permission denied) Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: sendfromto failed Fri Jan 31 20:37:47 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: Failed to begin ipsec sa negotiation with xx.76.78.219[500]. Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: accept a request to establish IKE-SA: xx.76.78.219 Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Configuration found for xx.76.78.219. Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Configuration found for xx.76.78.219. Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Initiating new phase 1 negotiation: xx.76.78.218[500]<=>xx.76.78.219[500] Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: Beginning Identity Protection mode. Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:185]: XXX: NUMNATTVENDORIDS: 3 Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 4 Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 8 Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 9 Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: sendto (Permission denied) Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: sendfromto failed Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: failed to begin ipsec sa negotiation with xx.76.78.219[500]. Fri Jan 31 20:37:51 2014 (GMT -0500): [clrctr00fw0100] [IKE] ERROR: Attempt of establishing IKE-SA: Failed: xx.76.78.219
... View more
Labels:
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
01-04-2014
09:38 AM
01-04-2014
09:38 AM
Karsten, Thanks again for your valuable input, the configuration is below. The endpoints are as follows: 71.xx.160.123 --> 2911 IOS Router 97.xx.231.22 -->SA540 SMB Firewall Please let me know if you have any further questions that I can post up. <-- 2911 Config 71.xx.160.123--> Building configuration... Current configuration : 12196 bytes ! ! Last configuration change at 12:26:53 NewYork Sat Jan 4 2014 by cisco version 15.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname pl-gw1-paf-router1 ! boot-start-marker boot-end-marker ! ! security authentication failure rate 3 log security passwords min-length 6 logging buffered 52000 enable secret 5 enable password 7 ! aaa new-model ! ! aaa authentication login default local aaa authentication login ciscocp_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network ciscocp_vpn_group_ml_1 local ! ! ! ! ! aaa session-id common clock timezone NewYork -5 0 clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00 ! no ip source-route ip cef ! ! ! ! ! ! no ip bootp server ip domain name platautofinance.com ip name-server 208.67.220.220 ip name-server 208.67.222.222 ip name-server 8.8.4.4 ip name-server 8.8.8.8 no ipv6 cef ! multilink bundle-name authenticated ! ! ! crypto pki trustpoint TP-self-signed-1476751880 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1476751880 revocation-check none rsakeypair TP-self-signed-1476751880 ! ! crypto pki certificate chain TP-self-signed-1476751880 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 31343736 37353138 3830301E 170D3133 31313235 31373234 31325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34373637 35313838 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B70E D68704F7 1DC5B4C1 6DFF6421 41224111 E3BA9B0F 91C01E8E E9B61469 8722444D C2347B5E EB063258 C4F61C0F E17E5B51 6A63D7FC B93FA1BD A58CC717 D64DA408 56325935 C0F5D80C 5A1048AA 6DA0FF36 91A140A4 F9CDE135 955BF3E5 67065FD6 947CA3BB 954FA23B 547F7C6D DE6DC530 259F2503 6E72581A 68F53F80 74D70203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 143012D1 A2989973 8A811A4E 124912E3 7CE0F9AC 41301D06 03551D0E 04160414 3012D1A2 9899738A 811A4E12 4912E37C E0F9AC41 300D0609 2A864886 F70D0101 05050003 8181005A ED92B7D5 9F05C89A FCC402E0 A71B2646 DF3558B1 ABC98AD0 10E5895F 4C31590E 413F8598 371C20FF 80015DA1 950E37B6 A33D3F94 C1680EF3 209B7F1D 4ABB3368 2028466F CB1BEE42 34F1C902 9F956F3E 1238886E D4A9C4C3 7C9EFE6F D30B06C9 FC06DFAA 089622FE 1C171FEA 5D495E9A 06053BF3 9CF06146 360285E7 1E8DAF quit license udi pid CISCO2911/K9 sn FGL172810VH license boot module c2900 technology-package securityk9 ! ! object-group network RFC1918 10.0.0.0 255.0.0.0 172.16.0.0 255.240.0.0 192.168.0.0 255.255.0.0 ! username cisco privilege 15 secret 4 username blakmoon91 secret 4 ! redundancy ! ! ! ! ! ip tcp synwait-time 10 no ip ftp passive ! class-map match-any CCP-Transactional-1 match dscp af21 match dscp af22 match dscp af23 class-map match-any CCP-Voice-1 match dscp ef class-map match-any CCP-Routing-1 match dscp cs6 class-map match-any CCP-Signaling-1 match dscp cs3 match dscp af31 class-map match-any CCP-Management-1 match dscp cs2 ! policy-map sdm-qos-test-123 class class-default policy-map CCP-QoS-Policy-1 class CCP-Voice-1 priority percent 33 class CCP-Signaling-1 bandwidth percent 5 class CCP-Routing-1 bandwidth percent 5 class CCP-Management-1 bandwidth percent 5 class CCP-Transactional-1 bandwidth percent 5 class class-default fair-queue random-detect ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp policy 2 encr aes 256 authentication pre-share group 2 lifetime 28800 crypto isakmp key address 97.xx.78.222 no-xauth crypto isakmp key address 67.xx.146.158 crypto isakmp key address 97.xx.231.22 crypto isakmp key address 98.xx.151.234 ! crypto isakmp client configuration group PlatinumVPNPool key dns 10.41.14.10 192.168.10.3 wins 10.41.14.10 192.168.10.3 domain clearwater.thrifty.com pool SDM_POOL_1 acl 108 include-local-lan split-dns clearwater.thrifty.com pfs max-users 25 max-logins 10 banner ^CYou are now connecting to a secure network. All connections are monitiored. If you have reached this in error please disconnect now. Call the Helpdesk X1000 for more information.^C crypto isakmp profile ciscocp-ike-profile-1 match identity group PlatinumVPNPool client authentication list ciscocp_vpn_xauth_ml_1 isakmp authorization list ciscocp_vpn_group_ml_1 client configuration address respond virtual-template 1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac mode tunnel crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac mode tunnel crypto ipsec transform-set PlatinumTransform esp-aes 256 esp-sha-hmac mode tunnel ! crypto ipsec profile CiscoCP_Profile1 set security-association lifetime seconds 10800 set security-association idle-time 1800 set transform-set ESP-3DES-SHA set pfs group2 set isakmp-profile ciscocp-ike-profile-1 ! ! ! crypto map SDM_CMAP_1 1 ipsec-isakmp description Tunnel to97.xx.78.222 set peer 97.xx.78.222 set transform-set ESP-3DES-SHA match address 104 crypto map SDM_CMAP_1 2 ipsec-isakmp description Tunnel to67.xx.146.158 set peer 67.xx.146.158 set transform-set PlatinumTransform match address 110 crypto map SDM_CMAP_1 3 ipsec-isakmp description Tunnel to97.xx.231.22 set peer 97.xx.231.22 set transform-set PlatinumTransform match address 109 crypto map SDM_CMAP_1 4 ipsec-isakmp description Tunnel to98.xx.151.234 set peer 98.xx.151.234 set transform-set PlatinumTransform match address 100 ! ! ! ! ! interface Null0 no ip unreachables ! interface Embedded-Service-Engine0/0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress shutdown ! interface GigabitEthernet0/0 description $ETH_WAN$$FW_OUTSIDE$$ETH-WAN$ ip address 71.xx.160.123 255.255.255.248 no ip redirects no ip proxy-arp ip verify unicast reverse-path ip nbar protocol-discovery ip flow ingress ip flow egress ip nat outside ip virtual-reassembly in duplex auto speed auto no mop enabled crypto map SDM_CMAP_1 ! interface GigabitEthernet0/1 description $FW_INSIDE$$ETH-LAN$$ETH-LAN$ ip address 10.41.14.100 255.255.255.0 no ip redirects no ip proxy-arp ip nbar protocol-discovery ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in duplex auto speed auto no mop enabled service-policy output CCP-QoS-Policy-1 ! interface GigabitEthernet0/2 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress shutdown duplex auto speed auto no mop enabled ! interface Virtual-Template1 type tunnel ip unnumbered GigabitEthernet0/0 no ip redirects no ip unreachables no ip proxy-arp ip flow ingress tunnel mode ipsec ipv4 tunnel protection ipsec profile CiscoCP_Profile1 ! ip local pool SDM_POOL_1 192.168.26.1 192.168.26.50 ip forward-protocol nd ! ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip flow-top-talkers top 25 sort-by bytes cache-timeout 3600 ! no ip nat service sip udp port 5060 ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload ip nat inside source static tcp 10.41.14.103 80 71.xx.160.123 80 extendable ip nat inside source static tcp 10.41.14.103 443 71.xx.160.123 443 extendable ip route 0.0.0.0 0.0.0.0 71.xx.160.121 ip route 10.67.188.32 255.255.255.224 10.41.14.99 6 permanent ip route 10.67.188.96 255.255.255.224 10.41.14.99 8 permanent ip route 10.200.107.0 255.255.255.0 10.41.14.99 9 permanent ip route 10.200.110.0 255.255.254.0 10.41.14.99 7 permanent ip route 74.200.107.0 255.255.255.0 10.41.14.99 5 permanent ip route 74.200.110.0 255.255.254.0 10.41.14.99 4 permanent ip route 208.67.188.32 255.255.255.224 10.41.14.99 2 permanent ip route 208.67.188.96 255.255.255.224 10.41.14.99 3 permanent ! ip access-list extended TRAFFIC-NAT-SERVER-10.41.14.103 deny ip host 10.41.14.103 object-group RFC1918 permit tcp host 10.41.14.103 eq www any permit tcp host 10.41.14.104 eq 443 any ! ip sla auto discovery logging trap errors logging host 192.168.10.29 access-list 2 remark HTTP Access-class list access-list 2 remark CCP_ACL Category=1 access-list 2 remark Platinum LAN access-list 2 permit 10.41.14.0 0.0.0.255 access-list 2 deny any access-list 100 remark CCP_ACL Category=4 access-list 100 remark IPSec Rule access-list 100 permit ip 10.41.14.0 0.0.0.255 192.168.75.0 0.0.0.255 access-list 101 remark Master Rules access-list 101 remark CCP_ACL Category=1 access-list 101 remark FaxFinder WWW Traffic access-list 101 permit tcp any host 71.xx.160.123 eq www access-list 101 remark FaxFinder HTTPS Traffic access-list 101 permit tcp any host 71.xx.160.123 eq 443 access-list 101 remark NTP Time Protocol access-list 101 permit udp any host 71.xx.160.123 eq ntp access-list 101 remark IPSEC Protocols access-list 101 permit udp any host 71.xx.160.123 eq non500-isakmp access-list 101 remark IPSEC Protocols access-list 101 permit udp any host 71.xx.160.123 eq isakmp access-list 101 remark ESP Traffic access-list 101 permit esp any host 71.xx.160.123 access-list 101 remark General Permit access-list 101 permit ip any any access-list 102 remark CCP_ACL Category=2 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.75.0 0.0.0.255 access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.76.0 0.0.0.255 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 access-list 102 remark Platinum LAN NAT Rule access-list 102 permit ip 10.41.14.0 0.0.0.255 any access-list 104 remark CCP_ACL Category=4 access-list 104 remark IPSec Rule access-list 104 permit ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 access-list 108 remark CCP_ACL Category=4 access-list 108 permit ip 10.41.14.0 0.0.0.255 any access-list 109 remark IPSec Rule access-list 109 remark CCP_ACL Category=4 access-list 109 permit ip 10.41.14.0 0.0.0.255 192.168.76.0 0.0.0.255 access-list 110 remark CCP_ACL Category=4 access-list 110 remark IPSec Rule access-list 110 permit ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 no cdp run ! route-map NAT-SERVER-10.41.14.103 permit 10 match ip address TRAFFIC-NAT-SERVER-10.41.14.103 ! route-map SDM_RMAP_1 permit 1 match ip address 102 ! ! snmp-server community RW snmp-server community public RO snmp-server location Clearwater North snmp-server contact MIS IT Services x1000 snmp-server enable traps entity-sensor threshold snmp-server host 192.168.10.29 Mccullour9320 ! ! ! control-plane ! ! banner login ^CYou have reached a security checkpoint. All connections are monitored. Follow company usage guidelines. Please contact the MIS IT Department for more information at x1000.^C ! line con 0 transport output telnet line aux 0 transport output telnet line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 password 7 02160B5E520F020D494F5D4A transport input telnet ssh transport output telnet ssh line vty 5 15 transport input telnet ssh transport output telnet ssh ! scheduler allocate 20000 1000 ntp update-calendar ntp server 24.56.178.140 prefer source GigabitEthernet0/0 ntp server 64.239.96.53 source GigabitEthernet0/0 ntp server 96.226.123.157 source GigabitEthernet0/0 ntp server 64.113.32.5 source GigabitEthernet0/0 ntp server 129.6.15.30 prefer source GigabitEthernet0/0 ntp server 12.10.191.151 source GigabitEthernet0/0 ! end
... View more
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
12-31-2013
08:53 AM
12-31-2013
08:53 AM
Karsten, Thanks for your valuable insight, I can browse via http on our VPN connection now. Beautiful. Looking at my post do you have any insight into why the two firewalls wouldn't be able to ping one another? My item 1, is there anything in the ACL's that you see that would prevent this? Attempting to create site to site between two offices but for some reason they cannot ping each other. It's a strange thing. 97.xx.231.22 <--> 71.xx.160.123
... View more
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
12-29-2013
01:20 PM
12-29-2013
01:20 PM
Group, Have a small issue I am sure is related back to ACL. I wanted to have some experts take a look at my config please. Here is the issue: Attempting to create site to site between two offices but for some reason they cannot ping each other. It's a strange thing. 97.xx.231.22 <--> 71.xx.160.123 I can ping both firewalls from the outside using a another computer but from the internal firewall utilities they cannot ping each other. From both I can ping their respective gateways. Secondly, I did a inside outside translation as you can see here for 80 & 443 which is preventing me from browsing http and https via the VPN for the remote LAN, can this be modified to allow access? I can get access when I dial in via VPN client but can't via the permanent VPN tunnel. Here is the config. no ip nat service sip udp port 5060 ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload ip nat inside source static tcp 10.41.14.103 80 71.xx.160.123 80 extendable ip nat inside source static tcp 10.41.14.103 443 71.xx.160.123 443 extendable ip route 0.0.0.0 0.0.0.0 71.xx.160.121 ip route 10.67.188.32 255.255.255.224 10.41.14.99 6 permanent ip route 10.67.188.96 255.255.255.224 10.41.14.99 8 permanent ip route 10.200.107.0 255.255.255.0 10.41.14.99 9 permanent ip route 10.200.110.0 255.255.254.0 10.41.14.99 7 permanent ip route 74.200.107.0 255.255.255.0 10.41.14.99 5 permanent ip route 74.200.110.0 255.255.254.0 10.41.14.99 4 permanent ip route 208.67.188.32 255.255.255.224 10.41.14.99 2 permanent ip route 208.67.188.96 255.255.255.224 10.41.14.99 3 permanent ! ip sla auto discovery logging trap errors logging host 192.168.10.29 access-list 2 remark HTTP Access-class list access-list 2 remark CCP_ACL Category=1 access-list 2 remark Platinum LAN access-list 2 permit 10.41.14.0 0.0.0.255 access-list 2 deny any access-list 101 remark Master Rules access-list 101 remark CCP_ACL Category=1 access-list 101 remark FaxFinder WWW Traffic access-list 101 permit tcp any host 71.xx.160.123 eq www access-list 101 remark FaxFinder HTTPS Traffic access-list 101 permit tcp any host 71.xx.160.123 eq 443 access-list 101 remark NTP Time Protocol access-list 101 permit udp any host 71.xx.160.123 eq ntp access-list 101 remark IPSEC Protocols access-list 101 permit udp any host 71.xx.160.123 eq non500-isakmp access-list 101 remark IPSEC Protocols access-list 101 permit udp any host 71.xx.160.123 eq isakmp access-list 101 remark ESP Traffic access-list 101 permit esp any host 71.xx.160.123 access-list 101 remark General Permit access-list 101 permit ip any any access-list 102 remark CCP_ACL Category=2 access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.76.0 0.0.0.255 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 access-list 102 remark Platinum LAN NAT Rule access-list 102 permit ip 10.41.14.0 0.0.0.255 any access-list 104 remark CCP_ACL Category=4 access-list 104 remark IPSec Rule access-list 104 permit ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 access-list 108 remark CCP_ACL Category=4 access-list 108 permit ip 10.41.14.0 0.0.0.255 any access-list 109 remark IPSec Rule access-list 109 remark CCP_ACL Category=4 access-list 109 permit ip 10.41.14.0 0.0.0.255 192.168.76.0 0.0.0.255 access-list 110 remark CCP_ACL Category=4 access-list 110 remark IPSec Rule access-list 110 permit ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 no cdp run ! route-map SDM_RMAP_1 permit 1 match ip address 102
... View more
Labels:
Created by
Ross Mccullough
in IP Telephony and Phones
in IP Telephony and Phones
12-26-2013
12:27 PM
12-26-2013
12:27 PM
Group, Have some issues to run by you to get the experts opinion. Let's start with the setup: HQ 2911 Router SF300P Switches with QOS in basic mode, Voice VLAN 1 SPA504 IP Phone(s) DC <-- Asterisk PBX located here with other SPA504 phones Whats happening: Some HQ users are complaining since I swapped the firewall from a SA540 to 2911 about phone to phone transfers in the HQ, not being able to hear, outside calls to HQ are hard to hear or one-way streams, calls from HQ to DC sometimes are one way audio streams, if you call back a couple of times you can finally establish a 2 way call, and its intermittent. What I have been able to diagnose: I have set QOS on the switch in basic mode and can verify that by running the queue 4 stats they climbing for queue 4 correctly on the unlink port from the switch to the firewall. However on the firewall when I monitor the QOS on the inside to outside interface I don't see any movement on the Signaling or Voice streams, I do see the CCP_Routing, CCP_Management, and CCP_Transactional climbing as we get phone calls. I can verify that on the firewall the QOS policy for VOIP is set to EF and to AF31 respectively and seems to be correct, on the phones I can verify the policy is set to COS 3 & 5 respectively. 5/DSCP46/0xB8 3/DSCP26/0x68. Wireshark shows data flowing into the firewall has the correct DSCP set to 0xB8. I have turned off SIP ALG on the 2911. Didn't seem to help. NAT is being handled by the phones, not Asterisk. I have verified the RTP range and it doesn't seem the calls are out of range. I have done a Wireshark trace at the DC end and can verify that when users at the DC are saying they can't hear the other party that at the PBX both RTSP stream exist. Any feedback would be greatly appreciated. I have attached some profiles from the QOS and the QOS settings and the config is below. If you need further information please let me know and I will post it back. Thanks experts!! Your insight and input are always valuable a rookie on these 2911's! Building configuration... Current configuration : 11240 bytes ! ! Last configuration change at 12:22:54 NewYork Thu Dec 26 2013 by cisco ! NVRAM config last updated at 11:10:28 NewYork Thu Dec 26 2013 by cisco ! NVRAM config last updated at 11:10:28 NewYork Thu Dec 26 2013 by cisco version 15.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname pl-gw1-paf-router1 ! boot-start-marker boot-end-marker ! ! security authentication failure rate 3 log security passwords min-length 6 logging buffered 52000 enable secret 5 <EDITED> enable password 7 <EDITED> ! aaa new-model ! ! aaa authentication login default local aaa authentication login ciscocp_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network ciscocp_vpn_group_ml_1 local ! ! ! ! ! aaa session-id common clock timezone NewYork -5 0 clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00 ! no ip source-route ip cef ! ! ! ! ! ! no ip bootp server ip domain name <EDITED> ip name-server 208.67.220.220 ip name-server 208.67.222.222 ip name-server 8.8.4.4 ip name-server 8.8.8.8 no ipv6 cef ! multilink bundle-name authenticated ! ! ! crypto pki trustpoint TP-self-signed-1476751880 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1476751880 revocation-check none rsakeypair TP-self-signed-1476751880 ! ! crypto pki certificate chain TP-self-signed-1476751880 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 31343736 37353138 3830301E 170D3133 31313235 31373234 31325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34373637 35313838 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B70E D68704F7 1DC5B4C1 6DFF6421 41224111 E3BA9B0F 91C01E8E E9B61469 8722444D C2347B5E EB063258 C4F61C0F E17E5B51 6A63D7FC B93FA1BD A58CC717 D64DA408 56325935 C0F5D80C 5A1048AA 6DA0FF36 91A140A4 F9CDE135 955BF3E5 67065FD6 947CA3BB 954FA23B 547F7C6D DE6DC530 259F2503 6E72581A 68F53F80 74D70203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 143012D1 A2989973 8A811A4E 124912E3 7CE0F9AC 41301D06 03551D0E 04160414 3012D1A2 9899738A 811A4E12 4912E37C E0F9AC41 300D0609 2A864886 F70D0101 05050003 8181005A ED92B7D5 9F05C89A FCC402E0 A71B2646 DF3558B1 ABC98AD0 10E5895F 4C31590E 413F8598 371C20FF 80015DA1 950E37B6 A33D3F94 C1680EF3 209B7F1D 4ABB3368 2028466F CB1BEE42 34F1C902 9F956F3E 1238886E D4A9C4C3 7C9EFE6F D30B06C9 FC06DFAA 089622FE 1C171FEA 5D495E9A 06053BF3 9CF06146 360285E7 1E8DAF quit license udi pid CISCO2911/K9 sn FGL172810VH license boot module c2900 technology-package securityk9 ! ! object-group service Asterisk description Asterisk VOIP udp source eq 5060 udp source range 16384 16842 ! username cisco privilege 15 secret 4 <EDITED> username blakmoon91 secret 4 <EDITED> ! redundancy ! ! ! ! ! ip tcp synwait-time 10 no ip ftp passive ! class-map match-any CCP-Transactional-1 match dscp af21 match dscp af22 match dscp af23 class-map match-any CCP-Voice-1 match dscp ef class-map match-any CCP-Routing-1 match dscp cs6 class-map match-any CCP-Signaling-1 match dscp cs3 match dscp af31 class-map match-any CCP-Management-1 match dscp cs2 ! policy-map sdm-qos-test-123 class class-default policy-map CCP-QoS-Policy-1 class CCP-Voice-1 priority percent 33 class CCP-Signaling-1 bandwidth percent 5 class CCP-Routing-1 bandwidth percent 5 class CCP-Management-1 bandwidth percent 5 class CCP-Transactional-1 bandwidth percent 5 class class-default fair-queue random-detect ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp policy 2 encr aes 256 authentication pre-share group 2 crypto isakmp key <EDITED> address 97.XXX.78.222 no-xauth crypto isakmp key <EDITED> address 67.XXX.146.158 ! crypto isakmp client configuration group PlatinumVPNPool key <EDITED> dns 10.41.14.10 192.168.10.3 wins 10.41.14.10 192.168.10.3 domain <EDITED> pool SDM_POOL_1 acl 108 include-local-lan split-dns <EDITED> pfs max-users 25 max-logins 10 banner ^CYou are now connecting to a secure network. All connections are monitiored. If you have reached this in error please disconnect now. Call the Helpdesk X1000 for more information.^C crypto isakmp profile ciscocp-ike-profile-1 match identity group PlatinumVPNPool client authentication list ciscocp_vpn_xauth_ml_1 isakmp authorization list ciscocp_vpn_group_ml_1 client configuration address respond virtual-template 1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac mode tunnel crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac mode tunnel crypto ipsec transform-set PlatinumTransform esp-aes 256 esp-sha-hmac mode tunnel ! crypto ipsec profile CiscoCP_Profile1 set security-association lifetime seconds 10800 set security-association idle-time 1800 set transform-set ESP-3DES-SHA set pfs group2 set isakmp-profile ciscocp-ike-profile-1 ! ! ! crypto map SDM_CMAP_1 1 ipsec-isakmp description Tunnel to 97.xxx.78.222 set peer 97.XXX.78.222 set transform-set ESP-3DES-SHA match address 104 crypto map SDM_CMAP_1 2 ipsec-isakmp description Tunnel to 67.xxx.146.158 set peer 67.XXX.146.158 set transform-set PlatinumTransform match address 110 ! ! ! ! ! interface Null0 no ip unreachables ! interface Embedded-Service-Engine0/0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress shutdown ! interface GigabitEthernet0/0 description $ETH_WAN$$ETH-WAN$$FW_OUTSIDE$ ip address 71.XXX.160.123 255.255.255.248 no ip redirects no ip unreachables no ip proxy-arp ip verify unicast reverse-path ip nbar protocol-discovery ip flow ingress ip flow egress ip nat outside ip virtual-reassembly in duplex auto speed auto no mop enabled crypto map SDM_CMAP_1 ! interface GigabitEthernet0/1 description $ETH-LAN$$ETH-LAN$$FW_INSIDE$ ip address 10.41.14.100 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ip nat inside ip virtual-reassembly in duplex auto speed auto no mop enabled service-policy output CCP-QoS-Policy-1 ! interface GigabitEthernet0/2 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress shutdown duplex auto speed auto no mop enabled ! interface Virtual-Template1 type tunnel ip unnumbered GigabitEthernet0/0 no ip redirects no ip unreachables no ip proxy-arp ip flow ingress tunnel mode ipsec ipv4 tunnel protection ipsec profile CiscoCP_Profile1 ! ip local pool SDM_POOL_1 192.168.26.1 192.168.26.50 ip forward-protocol nd ! ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip flow-top-talkers top 25 sort-by bytes cache-timeout 3600 ! no ip nat service sip udp port 5060 ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload ip nat inside source static tcp 10.41.14.103 80 71.XXX.160.123 80 extendable ip nat inside source static tcp 10.41.14.103 443 71.XXX.160.123 443 extendable ip route 0.0.0.0 0.0.0.0 71.XXX.160.121 ip route 10.67.188.32 255.255.255.224 10.41.14.99 6 permanent ip route 10.67.188.96 255.255.255.224 10.41.14.99 8 permanent ip route 10.200.107.0 255.255.255.0 10.41.14.99 9 permanent ip route 10.200.110.0 255.255.254.0 10.41.14.99 7 permanent ip route 74.200.107.0 255.255.255.0 10.41.14.99 5 permanent ip route 74.200.110.0 255.255.254.0 10.41.14.99 4 permanent ip route 208.67.188.32 255.255.255.224 10.41.14.99 2 permanent ip route 208.67.188.96 255.255.255.224 10.41.14.99 3 permanent ! ip sla auto discovery logging trap errors logging host 192.168.10.29 access-list 2 remark HTTP Access-class list access-list 2 remark CCP_ACL Category=1 access-list 2 remark Platinum LAN access-list 2 permit 10.41.14.0 0.0.0.255 access-list 2 deny any access-list 101 remark Master Rules access-list 101 remark CCP_ACL Category=1 access-list 101 remark Asterisk VOIP access-list 101 permit object-group Asterisk any any access-list 101 remark FaxFinder WWW Traffic access-list 101 permit tcp any host 71.XXX.160.123 eq www access-list 101 remark FaxFinder HTTPS Traffic access-list 101 permit tcp any host 71.XXX.160.123 eq 443 access-list 101 remark NTP Time Protocol access-list 101 permit udp any host 71.XXX.160.123 eq ntp access-list 101 remark IPSEC Protocols access-list 101 permit udp any host 71.XXX.160.123 eq non500-isakmp access-list 101 remark IPSEC Protocols access-list 101 permit udp any host 71.XXX.160.123 eq isakmp access-list 101 remark ESP Traffic access-list 101 permit esp any host 71.XXX.160.123 access-list 101 remark General Permit access-list 101 permit ip any any access-list 102 remark CCP_ACL Category=2 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 access-list 102 remark IPSec Rule access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 access-list 102 remark Platinum LAN NAT Rule access-list 102 permit ip 10.41.14.0 0.0.0.255 any access-list 104 remark CCP_ACL Category=4 access-list 104 remark IPSec Rule access-list 104 permit ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31 access-list 108 remark CCP_ACL Category=4 access-list 108 permit ip 10.41.14.0 0.0.0.255 any access-list 110 remark CCP_ACL Category=4 access-list 110 remark IPSec Rule access-list 110 permit ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255 no cdp run ! route-map SDM_RMAP_1 permit 1 match ip address 102 ! ! snmp-server community <EDITED> RW snmp-server community public RO snmp-server location Clearwater North snmp-server contact MIS IT Services x1000 snmp-server enable traps entity-sensor threshold snmp-server host 192.168.10.29 Mccullour9320 ! ! ! control-plane ! ! banner login ^CYou have reached a security checkpoint. All connections are monitored. Follow company usage guidelines. Please contact the MIS IT Department for more information at x1000.^C ! line con 0 transport output telnet line aux 0 transport output telnet line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 password 7 <EDITED> transport input telnet ssh transport output telnet ssh line vty 5 15 transport input telnet ssh transport output telnet ssh ! scheduler allocate 20000 1000 ntp update-calendar ntp server 24.56.178.140 prefer source GigabitEthernet0/0 ntp server 64.239.96.53 source GigabitEthernet0/0 ntp server 96.226.123.157 source GigabitEthernet0/0 ntp server 64.113.32.5 source GigabitEthernet0/0 ntp server 129.6.15.30 prefer source GigabitEthernet0/0 ntp server 12.10.191.151 source GigabitEthernet0/0 ! end
... View more
Labels:
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
07-10-2013
09:42 AM
07-10-2013
09:42 AM
Rudy, Thanks for the follow up, appreciate the help. I took a look at the remote endpoint (an SA540) and it seems that all the settings as far as I can tell are the same on both devices. On the SA540 it just keeps showing timeout oh Phase 2 waiting for Phase 1 to respond. IKE Direction: Both Exchange Mode: Main Local Address: Local WAN IP Remote: Remote WAN IP IKE SA: AES256 / SHA1 Pre Shared Key: Y Group 2 SA Lifetime 28800 XAuth: None VPN Policy Policy: Auto Local Gateway: Dedicated WAN Remote Endpoint: 97.76.78.218 Enable NetBIOS: Y Local Traffic: 10.0.2.0 / 255.255.255.0 Remote: 192.168.10.0 / 255.255.255.224 Auto Policy Parameters: SA Lifetime: 3600 Encryption: AES-256 / SHA1 PFS: Yes Group 2 I can confirm the the other end the 2911 does have UPD 500 / 4500/ ESP in an ACL but a remote port scan shows the ports closed. Perhaps a conflict in an ACL? The 2911 config posted below. Input is GREATLY appreciated! Building configuration... Current configuration : 38030 bytes ! ! Last configuration change at 11:35:36 EDT Wed Jul 10 2013 by cisco version 15.1 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname pl-gw1-tpa ! boot-start-marker boot-end-marker ! ! logging buffered 52000 enable secret 5 $1$PY04$lr7M7hXShNpHY2OFzi8Yj1 enable password 7 153F080F1126272B3D216C71415757 ! aaa new-model ! ! aaa authentication login default local aaa authentication login ciscocp_vpn_xauth_ml_1 local aaa authentication enable default enable aaa authorization network ciscocp_vpn_group_ml_1 local ! ! ! ! ! aaa session-id common ! clock timezone EST -5 0 clock summer-time EDT recurring ! no ipv6 cef no ip source-route ip cef ! ! ! ip dhcp excluded-address 10.0.15.1 10.0.15.9 ip dhcp excluded-address 10.0.15.21 10.0.15.30 ! ip dhcp pool ccp-pool1 network 10.0.15.0 255.255.255.224 domain-name platautofinance.com dns-server 208.67.220.220 208.67.222.222 default-router 10.0.15.1 ! ! no ip bootp server ip domain name platautofinance.com ip host pl-gw1-tpa.platautofinance.com 192.168.10.1 ip name-server 208.67.220.220 ip name-server 208.67.222.222 ip name-server 8.8.4.4 ! multilink bundle-name authenticated ! ! crypto pki token default removal timeout 0 ! crypto pki trustpoint TP-self-signed-3265635853 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-3265635853 revocation-check none rsakeypair TP-self-signed-3265635853 ! ! crypto pki certificate chain TP-self-signed-3265635853 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 33323635 36333538 3533301E 170D3133 30363137 31363035 33385A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 32363536 33353835 3330819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100920C 1E8282C0 73A070FD D38CE7FA 9BFB28A9 2DBB650A E2BDBE39 DE6973B6 E7D3B5B0 1CB17B0C BD1EDF5A 71110AF8 A284BD91 E53F8759 4983DBBD E30F21AA FEA356E8 0ECA20AC FA3A7182 8124C4F5 338EA780 24B05B3E EFF044E4 2D32805F 10E34A2A 92D88F7F BEC18A26 C81F719B 4F40B442 3AA29410 362C2831 579DC2FF 784B0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 1482EF2E AA9A36F0 5E63266D 42493D85 2DC1474A 38301D06 03551D0E 04160414 82EF2EAA 9A36F05E 63266D42 493D852D C1474A38 300D0609 2A864886 F70D0101 05050003 81810000 03FA4A1B 645F0399 C5BA4EBD 2CE916F7 9CE5066E D95E0666 EB3AC88D FDEFEBBC 38207B55 B2803706 2DAA39F4 0635DAF9 860C3D5F 8CB68A8C D07F9669 260ECCCE 1C6A94B7 6CC6D15F 6B2E35C4 78AF2469 A138ECA9 72C6BC5E 8C6ADEFF 5896B228 32B19F52 7A938A05 A59B4421 13ADFAE9 413DC2DF FF0A9CB3 5B9D3E3E B383B5 quit license udi pid CISCO2911/K9 sn FGL162410ZE license boot module c2900 technology-package securityk9 ! ! object-group service Asterisk description SIP Communication Settings udp range 16384 16482 udp range 5060 5061 ! object-group service MSExchange description Exchange Server Services tcp eq pop3 tcp eq 143 tcp eq 443 tcp eq smtp tcp eq www ! object-group service OpenFire description Openfire IM Services tcp eq 7777 tcp range 5222 5223 ! object-group service ReadyDesk description ReadyDesk Helpdesk Applications tcp range 7575 7576 tcp eq 8081 ! username cisco privilege 15 password 7 0722224F5B05150A0200525F567A username blakmoon91 privilege 15 password 7 132814111E0008253E3671606772 ! redundancy ! ! ! ! ! ! crypto isakmp policy 1 encr aes 256 authentication pre-share group 2 lifetime 28800 crypto isakmp key xxxxxxxxx address 71.40.160.123 crypto isakmp key xxxxxxxxx address 98.101.151.234 crypto isakmp key xxxxxxxxx address 67.78.146.158 255.255.255.252 no-xauth crypto isakmp invalid-spi-recovery crypto isakmp nat keepalive 30 ! crypto isakmp client configuration group PlatinumVPN key xxxxxxxxxxxxx dns 192.168.10.3 10.0.2.2 domain platautofinance.com pool SDM_POOL_1 acl 121 save-password include-local-lan split-dns clearwater.thrifty.com split-dns platautofinance.com pfs max-users 25 netmask 255.255.255.224 banner ^CYou have reached a security checkpoint. All connections are monitored. Follow company usage guidelines. Please contact the MIS IT Department for more information at 727-249-0844. ^C crypto isakmp profile ciscocp-ike-profile-1 match identity group PlatinumVPN client authentication list ciscocp_vpn_xauth_ml_1 isakmp authorization list ciscocp_vpn_group_ml_1 client configuration address respond virtual-template 1 ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set PlatinumTransform esp-aes 256 esp-sha-hmac ! crypto ipsec profile CiscoCP_Profile1 description Used by the VPN Pool. set security-association lifetime seconds 10800 set transform-set ESP-3DES-SHA set pfs group2 set isakmp-profile ciscocp-ike-profile-1 ! ! crypto map Platinum 1 ipsec-isakmp description Platinum Crypto Set set peer 67.78.146.158 set security-association lifetime seconds 3600 set transform-set PlatinumTransform set pfs group2 match address 106 ! ! ! ! ! interface Embedded-Service-Engine0/0 no ip address no ip redirects ip flow ingress shutdown ! interface GigabitEthernet0/0 description INTERNET_UPLINK$ETH-WAN$$FW_OUTSIDE$ ip address 97.76.78.218 255.255.255.248 no ip redirects ip flow ingress ip nat outside ip virtual-reassembly in load-interval 30 duplex auto speed auto no cdp enable no mop enabled crypto map Platinum ! interface GigabitEthernet0/1 description LAN$ETH_LAN$$ETH-LAN$$FW_INSIDE$ ip address 192.168.10.1 255.255.255.224 no ip redirects ip nbar protocol-discovery ip flow ingress ip nat inside ip virtual-reassembly in ip verify unicast reverse-path load-interval 30 duplex auto speed auto no mop enabled ! interface GigabitEthernet0/2 description $ETH-LAN$$FW_INSIDE$ ip address 10.0.15.1 255.255.255.224 no ip redirects ip flow ingress ip nat inside ip virtual-reassembly in duplex auto speed auto no mop enabled ! interface Virtual-Template1 type tunnel ip unnumbered GigabitEthernet0/0 no ip redirects ip flow ingress tunnel mode ipsec ipv4 tunnel protection ipsec profile CiscoCP_Profile1 ! ip local pool SDM_POOL_1 192.168.0.1 192.168.0.25 ip forward-protocol nd ! ip http server ip http authentication local ip http secure-server ! ip dns server ip nat inside source route-map SDM_RMAP interface GigabitEthernet0/0 overload ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload ip nat inside source static tcp 192.168.10.13 21 97.76.78.218 21 route-map SDM_RMAP_10 extendable ip nat inside source static tcp 192.168.10.3 25 97.76.78.218 25 route-map SDM_RMAP_6 extendable ip nat inside source static udp 192.168.10.29 69 97.76.78.218 69 route-map SDM_RMAP_4 extendable ip nat inside source static tcp 192.168.10.3 80 97.76.78.218 80 route-map SDM_RMAP_12 extendable ip nat inside source static tcp 192.168.10.3 110 97.76.78.218 110 route-map SDM_RMAP_15 extendable ip nat inside source static udp 192.168.10.28 161 97.76.78.218 161 route-map SDM_RMAP_8 extendable ip nat inside source static tcp 192.168.10.3 443 97.76.78.218 443 route-map SDM_RMAP_9 extendable ip nat inside source static udp 192.168.10.29 514 97.76.78.218 514 route-map SDM_RMAP_5 extendable ip nat inside source static tcp 192.168.10.6 3389 97.76.78.218 3389 route-map SDM_RMAP_3 extendable ip nat inside source static udp 192.168.10.12 5060 97.76.78.218 5060 route-map SDM_RMAP_11 extendable ip nat inside source static tcp 192.168.10.3 5222 97.76.78.218 5222 route-map SDM_RMAP_14 extendable ip nat inside source static tcp 192.168.10.3 5223 97.76.78.218 5223 route-map SDM_RMAP_13 extendable ip nat inside source static tcp 192.168.10.3 7777 97.76.78.218 7777 extendable ip nat inside source static tcp 192.168.10.28 8081 97.76.78.218 8081 route-map SDM_RMAP_7 extendable ip route 0.0.0.0 0.0.0.0 97.76.78.217 name DEFAULT_ROUTE ! ip access-list extended NAT_ACL remark Master NAT_ACL permit ip any any ! access-list 100 remark CCP_ACL Category=18 access-list 100 remark IPSec Rule access-list 100 deny ip 192.168.10.0 0.0.0.31 10.0.2.0 0.0.0.255 access-list 100 deny tcp host 192.168.10.13 eq ftp any access-list 100 deny tcp host 192.168.10.2 eq smtp any access-list 100 deny udp host 192.168.10.29 eq tftp any access-list 100 deny tcp host 192.168.10.2 eq www any access-list 100 deny tcp host 192.168.10.2 eq pop3 any access-list 100 deny udp host 192.168.10.28 eq snmp any access-list 100 deny tcp host 192.168.10.2 eq 443 any access-list 100 deny udp host 192.168.10.29 eq syslog any access-list 100 deny tcp host 192.168.10.29 eq 3389 any access-list 100 deny udp host 192.168.10.12 eq 5060 any access-list 100 deny tcp host 192.168.10.28 eq 5222 any access-list 100 deny tcp host 192.168.10.28 eq 5223 any access-list 100 deny tcp host 192.168.10.28 eq 8081 any access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.1 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.2 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.3 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.4 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.5 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.6 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.7 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.8 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.9 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.10 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.11 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.12 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.13 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.14 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.15 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.16 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.17 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.18 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.19 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.20 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.21 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.22 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.23 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.24 access-list 100 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.25 access-list 100 permit ip 192.168.10.0 0.0.0.31 any access-list 101 remark CCP_ACL Category=16 access-list 101 permit udp any host 97.76.78.218 eq tftp access-list 101 permit tcp any host 97.76.78.218 eq ftp access-list 101 permit tcp any host 97.76.78.218 eq 22 access-list 101 permit udp any host 97.76.78.218 eq snmp access-list 101 permit udp any host 97.76.78.218 eq syslog access-list 101 permit object-group OpenFire any host 97.76.78.218 access-list 101 permit object-group Asterisk any host 97.76.78.218 access-list 101 permit object-group MSExchange any host 97.76.78.218 access-list 101 permit object-group ReadyDesk any host 97.76.78.218 access-list 101 permit tcp any host 97.76.78.218 eq 3389 access-list 101 permit udp any host 97.76.78.218 eq isakmp access-list 101 permit udp any host 97.76.78.218 eq non500-isakmp access-list 101 permit esp any host 97.76.78.218 access-list 102 remark CCP_ACL Category=2 access-list 102 remark IPSec Rule access-list 102 deny ip 192.168.10.0 0.0.0.31 10.0.2.0 0.0.0.255 access-list 102 deny tcp host 192.168.10.13 eq ftp any access-list 102 deny tcp host 192.168.10.2 eq smtp any access-list 102 deny udp host 192.168.10.29 eq tftp any access-list 102 deny tcp host 192.168.10.2 eq www any access-list 102 deny tcp host 192.168.10.2 eq pop3 any access-list 102 deny udp host 192.168.10.28 eq snmp any access-list 102 deny tcp host 192.168.10.2 eq 443 any access-list 102 deny udp host 192.168.10.29 eq syslog any access-list 102 deny tcp host 192.168.10.29 eq 3389 any access-list 102 deny udp host 192.168.10.12 eq 5060 any access-list 102 deny tcp host 192.168.10.28 eq 5222 any access-list 102 deny tcp host 192.168.10.28 eq 5223 any access-list 102 deny tcp host 192.168.10.28 eq 8081 any access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.1 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.2 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.3 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.4 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.5 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.6 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.7 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.8 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.9 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.10 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.11 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.12 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.13 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.14 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.15 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.16 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.17 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.18 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.19 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.20 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.21 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.22 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.23 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.24 access-list 102 deny ip 192.168.10.0 0.0.0.31 host 192.168.0.25 access-list 102 permit ip 192.168.10.0 0.0.0.31 any access-list 106 remark CCP_ACL Category=4 access-list 106 remark IPSec Rule access-list 106 permit ip 192.168.10.0 0.0.0.31 10.0.2.0 0.0.0.255 access-list 108 remark CCP_ACL Category=2 access-list 108 deny ip host 192.168.10.29 host 192.168.0.25 access-list 108 deny ip host 192.168.10.29 host 192.168.0.24 access-list 108 deny ip host 192.168.10.29 host 192.168.0.23 access-list 108 deny ip host 192.168.10.29 host 192.168.0.22 access-list 108 deny ip host 192.168.10.29 host 192.168.0.21 access-list 108 deny ip host 192.168.10.29 host 192.168.0.20 access-list 108 deny ip host 192.168.10.29 host 192.168.0.19 access-list 108 deny ip host 192.168.10.29 host 192.168.0.18 access-list 108 deny ip host 192.168.10.29 host 192.168.0.17 access-list 108 deny ip host 192.168.10.29 host 192.168.0.16 access-list 108 deny ip host 192.168.10.29 host 192.168.0.15 access-list 108 deny ip host 192.168.10.29 host 192.168.0.14 access-list 108 deny ip host 192.168.10.29 host 192.168.0.13 access-list 108 deny ip host 192.168.10.29 host 192.168.0.12 access-list 108 deny ip host 192.168.10.29 host 192.168.0.11 access-list 108 deny ip host 192.168.10.29 host 192.168.0.10 access-list 108 deny ip host 192.168.10.29 host 192.168.0.9 access-list 108 deny ip host 192.168.10.29 host 192.168.0.8 access-list 108 deny ip host 192.168.10.29 host 192.168.0.7 access-list 108 deny ip host 192.168.10.29 host 192.168.0.6 access-list 108 deny ip host 192.168.10.29 host 192.168.0.5 access-list 108 deny ip host 192.168.10.29 host 192.168.0.4 access-list 108 deny ip host 192.168.10.29 host 192.168.0.3 access-list 108 deny ip host 192.168.10.29 host 192.168.0.2 access-list 108 deny ip host 192.168.10.29 host 192.168.0.1 access-list 108 permit tcp host 192.168.10.29 eq 3389 any access-list 109 remark CCP_ACL Category=2 access-list 109 deny ip host 192.168.10.29 host 192.168.0.25 access-list 109 deny ip host 192.168.10.29 host 192.168.0.24 access-list 109 deny ip host 192.168.10.29 host 192.168.0.23 access-list 109 deny ip host 192.168.10.29 host 192.168.0.22 access-list 109 deny ip host 192.168.10.29 host 192.168.0.21 access-list 109 deny ip host 192.168.10.29 host 192.168.0.20 access-list 109 deny ip host 192.168.10.29 host 192.168.0.19 access-list 109 deny ip host 192.168.10.29 host 192.168.0.18 access-list 109 deny ip host 192.168.10.29 host 192.168.0.17 access-list 109 deny ip host 192.168.10.29 host 192.168.0.16 access-list 109 deny ip host 192.168.10.29 host 192.168.0.15 access-list 109 deny ip host 192.168.10.29 host 192.168.0.14 access-list 109 deny ip host 192.168.10.29 host 192.168.0.13 access-list 109 deny ip host 192.168.10.29 host 192.168.0.12 access-list 109 deny ip host 192.168.10.29 host 192.168.0.11 access-list 109 deny ip host 192.168.10.29 host 192.168.0.10 access-list 109 deny ip host 192.168.10.29 host 192.168.0.9 access-list 109 deny ip host 192.168.10.29 host 192.168.0.8 access-list 109 deny ip host 192.168.10.29 host 192.168.0.7 access-list 109 deny ip host 192.168.10.29 host 192.168.0.6 access-list 109 deny ip host 192.168.10.29 host 192.168.0.5 access-list 109 deny ip host 192.168.10.29 host 192.168.0.4 access-list 109 deny ip host 192.168.10.29 host 192.168.0.3 access-list 109 deny ip host 192.168.10.29 host 192.168.0.2 access-list 109 deny ip host 192.168.10.29 host 192.168.0.1 access-list 109 permit udp host 192.168.10.29 eq tftp any access-list 110 remark CCP_ACL Category=2 access-list 110 deny ip host 192.168.10.29 host 192.168.0.25 access-list 110 deny ip host 192.168.10.29 host 192.168.0.24 access-list 110 deny ip host 192.168.10.29 host 192.168.0.23 access-list 110 deny ip host 192.168.10.29 host 192.168.0.22 access-list 110 deny ip host 192.168.10.29 host 192.168.0.21 access-list 110 deny ip host 192.168.10.29 host 192.168.0.20 access-list 110 deny ip host 192.168.10.29 host 192.168.0.19 access-list 110 deny ip host 192.168.10.29 host 192.168.0.18 access-list 110 deny ip host 192.168.10.29 host 192.168.0.17 access-list 110 deny ip host 192.168.10.29 host 192.168.0.16 access-list 110 deny ip host 192.168.10.29 host 192.168.0.15 access-list 110 deny ip host 192.168.10.29 host 192.168.0.14 access-list 110 deny ip host 192.168.10.29 host 192.168.0.13 access-list 110 deny ip host 192.168.10.29 host 192.168.0.12 access-list 110 deny ip host 192.168.10.29 host 192.168.0.11 access-list 110 deny ip host 192.168.10.29 host 192.168.0.10 access-list 110 deny ip host 192.168.10.29 host 192.168.0.9 access-list 110 deny ip host 192.168.10.29 host 192.168.0.8 access-list 110 deny ip host 192.168.10.29 host 192.168.0.7 access-list 110 deny ip host 192.168.10.29 host 192.168.0.6 access-list 110 deny ip host 192.168.10.29 host 192.168.0.5 access-list 110 deny ip host 192.168.10.29 host 192.168.0.4 access-list 110 deny ip host 192.168.10.29 host 192.168.0.3 access-list 110 deny ip host 192.168.10.29 host 192.168.0.2 access-list 110 deny ip host 192.168.10.29 host 192.168.0.1 access-list 110 permit udp host 192.168.10.29 eq syslog any access-list 111 remark CCP_ACL Category=2 access-list 111 deny ip host 192.168.10.2 host 192.168.0.25 access-list 111 deny ip host 192.168.10.2 host 192.168.0.24 access-list 111 deny ip host 192.168.10.2 host 192.168.0.23 access-list 111 deny ip host 192.168.10.2 host 192.168.0.22 access-list 111 deny ip host 192.168.10.2 host 192.168.0.21 access-list 111 deny ip host 192.168.10.2 host 192.168.0.20 access-list 111 deny ip host 192.168.10.2 host 192.168.0.19 access-list 111 deny ip host 192.168.10.2 host 192.168.0.18 access-list 111 deny ip host 192.168.10.2 host 192.168.0.17 access-list 111 deny ip host 192.168.10.2 host 192.168.0.16 access-list 111 deny ip host 192.168.10.2 host 192.168.0.15 access-list 111 deny ip host 192.168.10.2 host 192.168.0.14 access-list 111 deny ip host 192.168.10.2 host 192.168.0.13 access-list 111 deny ip host 192.168.10.2 host 192.168.0.12 access-list 111 deny ip host 192.168.10.2 host 192.168.0.11 access-list 111 deny ip host 192.168.10.2 host 192.168.0.10 access-list 111 deny ip host 192.168.10.2 host 192.168.0.9 access-list 111 deny ip host 192.168.10.2 host 192.168.0.8 access-list 111 deny ip host 192.168.10.2 host 192.168.0.7 access-list 111 deny ip host 192.168.10.2 host 192.168.0.6 access-list 111 deny ip host 192.168.10.2 host 192.168.0.5 access-list 111 deny ip host 192.168.10.2 host 192.168.0.4 access-list 111 deny ip host 192.168.10.2 host 192.168.0.3 access-list 111 deny ip host 192.168.10.2 host 192.168.0.2 access-list 111 deny ip host 192.168.10.2 host 192.168.0.1 access-list 111 permit tcp host 192.168.10.2 eq smtp any access-list 112 remark CCP_ACL Category=2 access-list 112 deny ip host 192.168.10.28 host 192.168.0.25 access-list 112 deny ip host 192.168.10.28 host 192.168.0.24 access-list 112 deny ip host 192.168.10.28 host 192.168.0.23 access-list 112 deny ip host 192.168.10.28 host 192.168.0.22 access-list 112 deny ip host 192.168.10.28 host 192.168.0.21 access-list 112 deny ip host 192.168.10.28 host 192.168.0.20 access-list 112 deny ip host 192.168.10.28 host 192.168.0.19 access-list 112 deny ip host 192.168.10.28 host 192.168.0.18 access-list 112 deny ip host 192.168.10.28 host 192.168.0.17 access-list 112 deny ip host 192.168.10.28 host 192.168.0.16 access-list 112 deny ip host 192.168.10.28 host 192.168.0.15 access-list 112 deny ip host 192.168.10.28 host 192.168.0.14 access-list 112 deny ip host 192.168.10.28 host 192.168.0.13 access-list 112 deny ip host 192.168.10.28 host 192.168.0.12 access-list 112 deny ip host 192.168.10.28 host 192.168.0.11 access-list 112 deny ip host 192.168.10.28 host 192.168.0.10 access-list 112 deny ip host 192.168.10.28 host 192.168.0.9 access-list 112 deny ip host 192.168.10.28 host 192.168.0.8 access-list 112 deny ip host 192.168.10.28 host 192.168.0.7 access-list 112 deny ip host 192.168.10.28 host 192.168.0.6 access-list 112 deny ip host 192.168.10.28 host 192.168.0.5 access-list 112 deny ip host 192.168.10.28 host 192.168.0.4 access-list 112 deny ip host 192.168.10.28 host 192.168.0.3 access-list 112 deny ip host 192.168.10.28 host 192.168.0.2 access-list 112 deny ip host 192.168.10.28 host 192.168.0.1 access-list 112 permit tcp host 192.168.10.28 eq 8081 any access-list 113 remark CCP_ACL Category=2 access-list 113 deny ip host 192.168.10.28 host 192.168.0.25 access-list 113 deny ip host 192.168.10.28 host 192.168.0.24 access-list 113 deny ip host 192.168.10.28 host 192.168.0.23 access-list 113 deny ip host 192.168.10.28 host 192.168.0.22 access-list 113 deny ip host 192.168.10.28 host 192.168.0.21 access-list 113 deny ip host 192.168.10.28 host 192.168.0.20 access-list 113 deny ip host 192.168.10.28 host 192.168.0.19 access-list 113 deny ip host 192.168.10.28 host 192.168.0.18 access-list 113 deny ip host 192.168.10.28 host 192.168.0.17 access-list 113 deny ip host 192.168.10.28 host 192.168.0.16 access-list 113 deny ip host 192.168.10.28 host 192.168.0.15 access-list 113 deny ip host 192.168.10.28 host 192.168.0.14 access-list 113 deny ip host 192.168.10.28 host 192.168.0.13 access-list 113 deny ip host 192.168.10.28 host 192.168.0.12 access-list 113 deny ip host 192.168.10.28 host 192.168.0.11 access-list 113 deny ip host 192.168.10.28 host 192.168.0.10 access-list 113 deny ip host 192.168.10.28 host 192.168.0.9 access-list 113 deny ip host 192.168.10.28 host 192.168.0.8 access-list 113 deny ip host 192.168.10.28 host 192.168.0.7 access-list 113 deny ip host 192.168.10.28 host 192.168.0.6 access-list 113 deny ip host 192.168.10.28 host 192.168.0.5 access-list 113 deny ip host 192.168.10.28 host 192.168.0.4 access-list 113 deny ip host 192.168.10.28 host 192.168.0.3 access-list 113 deny ip host 192.168.10.28 host 192.168.0.2 access-list 113 deny ip host 192.168.10.28 host 192.168.0.1 access-list 113 permit udp host 192.168.10.28 eq snmp any access-list 114 remark CCP_ACL Category=2 access-list 114 deny ip host 192.168.10.2 host 192.168.0.25 access-list 114 deny ip host 192.168.10.2 host 192.168.0.24 access-list 114 deny ip host 192.168.10.2 host 192.168.0.23 access-list 114 deny ip host 192.168.10.2 host 192.168.0.22 access-list 114 deny ip host 192.168.10.2 host 192.168.0.21 access-list 114 deny ip host 192.168.10.2 host 192.168.0.20 access-list 114 deny ip host 192.168.10.2 host 192.168.0.19 access-list 114 deny ip host 192.168.10.2 host 192.168.0.18 access-list 114 deny ip host 192.168.10.2 host 192.168.0.17 access-list 114 deny ip host 192.168.10.2 host 192.168.0.16 access-list 114 deny ip host 192.168.10.2 host 192.168.0.15 access-list 114 deny ip host 192.168.10.2 host 192.168.0.14 access-list 114 deny ip host 192.168.10.2 host 192.168.0.13 access-list 114 deny ip host 192.168.10.2 host 192.168.0.12 access-list 114 deny ip host 192.168.10.2 host 192.168.0.11 access-list 114 deny ip host 192.168.10.2 host 192.168.0.10 access-list 114 deny ip host 192.168.10.2 host 192.168.0.9 access-list 114 deny ip host 192.168.10.2 host 192.168.0.8 access-list 114 deny ip host 192.168.10.2 host 192.168.0.7 access-list 114 deny ip host 192.168.10.2 host 192.168.0.6 access-list 114 deny ip host 192.168.10.2 host 192.168.0.5 access-list 114 deny ip host 192.168.10.2 host 192.168.0.4 access-list 114 deny ip host 192.168.10.2 host 192.168.0.3 access-list 114 deny ip host 192.168.10.2 host 192.168.0.2 access-list 114 deny ip host 192.168.10.2 host 192.168.0.1 access-list 114 permit tcp host 192.168.10.2 eq 443 any access-list 115 remark CCP_ACL Category=2 access-list 115 deny ip host 192.168.10.13 host 192.168.0.25 access-list 115 deny ip host 192.168.10.13 host 192.168.0.24 access-list 115 deny ip host 192.168.10.13 host 192.168.0.23 access-list 115 deny ip host 192.168.10.13 host 192.168.0.22 access-list 115 deny ip host 192.168.10.13 host 192.168.0.21 access-list 115 deny ip host 192.168.10.13 host 192.168.0.20 access-list 115 deny ip host 192.168.10.13 host 192.168.0.19 access-list 115 deny ip host 192.168.10.13 host 192.168.0.18 access-list 115 deny ip host 192.168.10.13 host 192.168.0.17 access-list 115 deny ip host 192.168.10.13 host 192.168.0.16 access-list 115 deny ip host 192.168.10.13 host 192.168.0.15 access-list 115 deny ip host 192.168.10.13 host 192.168.0.14 access-list 115 deny ip host 192.168.10.13 host 192.168.0.13 access-list 115 deny ip host 192.168.10.13 host 192.168.0.12 access-list 115 deny ip host 192.168.10.13 host 192.168.0.11 access-list 115 deny ip host 192.168.10.13 host 192.168.0.10 access-list 115 deny ip host 192.168.10.13 host 192.168.0.9 access-list 115 deny ip host 192.168.10.13 host 192.168.0.8 access-list 115 deny ip host 192.168.10.13 host 192.168.0.7 access-list 115 deny ip host 192.168.10.13 host 192.168.0.6 access-list 115 deny ip host 192.168.10.13 host 192.168.0.5 access-list 115 deny ip host 192.168.10.13 host 192.168.0.4 access-list 115 deny ip host 192.168.10.13 host 192.168.0.3 access-list 115 deny ip host 192.168.10.13 host 192.168.0.2 access-list 115 deny ip host 192.168.10.13 host 192.168.0.1 access-list 115 permit tcp host 192.168.10.13 eq ftp any access-list 116 remark CCP_ACL Category=2 access-list 116 deny ip host 192.168.10.12 host 192.168.0.25 access-list 116 deny ip host 192.168.10.12 host 192.168.0.24 access-list 116 deny ip host 192.168.10.12 host 192.168.0.23 access-list 116 deny ip host 192.168.10.12 host 192.168.0.22 access-list 116 deny ip host 192.168.10.12 host 192.168.0.21 access-list 116 deny ip host 192.168.10.12 host 192.168.0.20 access-list 116 deny ip host 192.168.10.12 host 192.168.0.19 access-list 116 deny ip host 192.168.10.12 host 192.168.0.18 access-list 116 deny ip host 192.168.10.12 host 192.168.0.17 access-list 116 deny ip host 192.168.10.12 host 192.168.0.16 access-list 116 deny ip host 192.168.10.12 host 192.168.0.15 access-list 116 deny ip host 192.168.10.12 host 192.168.0.14 access-list 116 deny ip host 192.168.10.12 host 192.168.0.13 access-list 116 deny ip host 192.168.10.12 host 192.168.0.12 access-list 116 deny ip host 192.168.10.12 host 192.168.0.11 access-list 116 deny ip host 192.168.10.12 host 192.168.0.10 access-list 116 deny ip host 192.168.10.12 host 192.168.0.9 access-list 116 deny ip host 192.168.10.12 host 192.168.0.8 access-list 116 deny ip host 192.168.10.12 host 192.168.0.7 access-list 116 deny ip host 192.168.10.12 host 192.168.0.6 access-list 116 deny ip host 192.168.10.12 host 192.168.0.5 access-list 116 deny ip host 192.168.10.12 host 192.168.0.4 access-list 116 deny ip host 192.168.10.12 host 192.168.0.3 access-list 116 deny ip host 192.168.10.12 host 192.168.0.2 access-list 116 deny ip host 192.168.10.12 host 192.168.0.1 access-list 116 permit udp host 192.168.10.12 eq 5060 any access-list 117 remark CCP_ACL Category=2 access-list 117 deny ip host 192.168.10.2 host 192.168.0.25 access-list 117 deny ip host 192.168.10.2 host 192.168.0.24 access-list 117 deny ip host 192.168.10.2 host 192.168.0.23 access-list 117 deny ip host 192.168.10.2 host 192.168.0.22 access-list 117 deny ip host 192.168.10.2 host 192.168.0.21 access-list 117 deny ip host 192.168.10.2 host 192.168.0.20 access-list 117 deny ip host 192.168.10.2 host 192.168.0.19 access-list 117 deny ip host 192.168.10.2 host 192.168.0.18 access-list 117 deny ip host 192.168.10.2 host 192.168.0.17 access-list 117 deny ip host 192.168.10.2 host 192.168.0.16 access-list 117 deny ip host 192.168.10.2 host 192.168.0.15 access-list 117 deny ip host 192.168.10.2 host 192.168.0.14 access-list 117 deny ip host 192.168.10.2 host 192.168.0.13 access-list 117 deny ip host 192.168.10.2 host 192.168.0.12 access-list 117 deny ip host 192.168.10.2 host 192.168.0.11 access-list 117 deny ip host 192.168.10.2 host 192.168.0.10 access-list 117 deny ip host 192.168.10.2 host 192.168.0.9 access-list 117 deny ip host 192.168.10.2 host 192.168.0.8 access-list 117 deny ip host 192.168.10.2 host 192.168.0.7 access-list 117 deny ip host 192.168.10.2 host 192.168.0.6 access-list 117 deny ip host 192.168.10.2 host 192.168.0.5 access-list 117 deny ip host 192.168.10.2 host 192.168.0.4 access-list 117 deny ip host 192.168.10.2 host 192.168.0.3 access-list 117 deny ip host 192.168.10.2 host 192.168.0.2 access-list 117 deny ip host 192.168.10.2 host 192.168.0.1 access-list 117 permit tcp host 192.168.10.2 eq www any access-list 118 remark CCP_ACL Category=2 access-list 118 deny ip host 192.168.10.28 host 192.168.0.25 access-list 118 deny ip host 192.168.10.28 host 192.168.0.24 access-list 118 deny ip host 192.168.10.28 host 192.168.0.23 access-list 118 deny ip host 192.168.10.28 host 192.168.0.22 access-list 118 deny ip host 192.168.10.28 host 192.168.0.21 access-list 118 deny ip host 192.168.10.28 host 192.168.0.20 access-list 118 deny ip host 192.168.10.28 host 192.168.0.19 access-list 118 deny ip host 192.168.10.28 host 192.168.0.18 access-list 118 deny ip host 192.168.10.28 host 192.168.0.17 access-list 118 deny ip host 192.168.10.28 host 192.168.0.16 access-list 118 deny ip host 192.168.10.28 host 192.168.0.15 access-list 118 deny ip host 192.168.10.28 host 192.168.0.14 access-list 118 deny ip host 192.168.10.28 host 192.168.0.13 access-list 118 deny ip host 192.168.10.28 host 192.168.0.12 access-list 118 deny ip host 192.168.10.28 host 192.168.0.11 access-list 118 deny ip host 192.168.10.28 host 192.168.0.10 access-list 118 deny ip host 192.168.10.28 host 192.168.0.9 access-list 118 deny ip host 192.168.10.28 host 192.168.0.8 access-list 118 deny ip host 192.168.10.28 host 192.168.0.7 access-list 118 deny ip host 192.168.10.28 host 192.168.0.6 access-list 118 deny ip host 192.168.10.28 host 192.168.0.5 access-list 118 deny ip host 192.168.10.28 host 192.168.0.4 access-list 118 deny ip host 192.168.10.28 host 192.168.0.3 access-list 118 deny ip host 192.168.10.28 host 192.168.0.2 access-list 118 deny ip host 192.168.10.28 host 192.168.0.1 access-list 118 permit tcp host 192.168.10.28 eq 5223 any access-list 119 remark CCP_ACL Category=2 access-list 119 deny ip host 192.168.10.28 host 192.168.0.25 access-list 119 deny ip host 192.168.10.28 host 192.168.0.24 access-list 119 deny ip host 192.168.10.28 host 192.168.0.23 access-list 119 deny ip host 192.168.10.28 host 192.168.0.22 access-list 119 deny ip host 192.168.10.28 host 192.168.0.21 access-list 119 deny ip host 192.168.10.28 host 192.168.0.20 access-list 119 deny ip host 192.168.10.28 host 192.168.0.19 access-list 119 deny ip host 192.168.10.28 host 192.168.0.18 access-list 119 deny ip host 192.168.10.28 host 192.168.0.17 access-list 119 deny ip host 192.168.10.28 host 192.168.0.16 access-list 119 deny ip host 192.168.10.28 host 192.168.0.15 access-list 119 deny ip host 192.168.10.28 host 192.168.0.14 access-list 119 deny ip host 192.168.10.28 host 192.168.0.13 access-list 119 deny ip host 192.168.10.28 host 192.168.0.12 access-list 119 deny ip host 192.168.10.28 host 192.168.0.11 access-list 119 deny ip host 192.168.10.28 host 192.168.0.10 access-list 119 deny ip host 192.168.10.28 host 192.168.0.9 access-list 119 deny ip host 192.168.10.28 host 192.168.0.8 access-list 119 deny ip host 192.168.10.28 host 192.168.0.7 access-list 119 deny ip host 192.168.10.28 host 192.168.0.6 access-list 119 deny ip host 192.168.10.28 host 192.168.0.5 access-list 119 deny ip host 192.168.10.28 host 192.168.0.4 access-list 119 deny ip host 192.168.10.28 host 192.168.0.3 access-list 119 deny ip host 192.168.10.28 host 192.168.0.2 access-list 119 deny ip host 192.168.10.28 host 192.168.0.1 access-list 119 permit tcp host 192.168.10.28 eq 5222 any access-list 120 remark CCP_ACL Category=2 access-list 120 deny ip host 192.168.10.2 host 192.168.0.25 access-list 120 deny ip host 192.168.10.2 host 192.168.0.24 access-list 120 deny ip host 192.168.10.2 host 192.168.0.23 access-list 120 deny ip host 192.168.10.2 host 192.168.0.22 access-list 120 deny ip host 192.168.10.2 host 192.168.0.21 access-list 120 deny ip host 192.168.10.2 host 192.168.0.20 access-list 120 deny ip host 192.168.10.2 host 192.168.0.19 access-list 120 deny ip host 192.168.10.2 host 192.168.0.18 access-list 120 deny ip host 192.168.10.2 host 192.168.0.17 access-list 120 deny ip host 192.168.10.2 host 192.168.0.16 access-list 120 deny ip host 192.168.10.2 host 192.168.0.15 access-list 120 deny ip host 192.168.10.2 host 192.168.0.14 access-list 120 deny ip host 192.168.10.2 host 192.168.0.13 access-list 120 deny ip host 192.168.10.2 host 192.168.0.12 access-list 120 deny ip host 192.168.10.2 host 192.168.0.11 access-list 120 deny ip host 192.168.10.2 host 192.168.0.10 access-list 120 deny ip host 192.168.10.2 host 192.168.0.9 access-list 120 deny ip host 192.168.10.2 host 192.168.0.8 access-list 120 deny ip host 192.168.10.2 host 192.168.0.7 access-list 120 deny ip host 192.168.10.2 host 192.168.0.6 access-list 120 deny ip host 192.168.10.2 host 192.168.0.5 access-list 120 deny ip host 192.168.10.2 host 192.168.0.4 access-list 120 deny ip host 192.168.10.2 host 192.168.0.3 access-list 120 deny ip host 192.168.10.2 host 192.168.0.2 access-list 120 deny ip host 192.168.10.2 host 192.168.0.1 access-list 120 permit tcp host 192.168.10.2 eq pop3 any access-list 121 remark CCP_ACL Category=4 access-list 121 permit ip 192.168.10.0 0.0.0.31 any ! no cdp run ! ! ! route-map SDM_RMAP permit 1 match ip address 100 ! route-map SDM_RMAP_15 permit 1 match ip address 120 ! route-map SDM_RMAP_14 permit 1 match ip address 119 ! route-map SDM_RMAP_11 permit 1 match ip address 116 ! route-map SDM_RMAP_10 permit 1 match ip address 115 ! route-map SDM_RMAP_13 permit 1 match ip address 118 ! route-map SDM_RMAP_12 permit 1 match ip address 117 ! route-map SDM_RMAP_4 permit 1 match ip address 109 ! route-map SDM_RMAP_5 permit 1 match ip address 110 ! route-map SDM_RMAP_6 permit 1 match ip address 111 ! route-map SDM_RMAP_7 permit 1 match ip address 112 ! route-map SDM_RMAP_1 permit 1 match ip address 102 ! route-map SDM_RMAP_3 permit 1 match ip address 108 ! route-map SDM_RMAP_8 permit 1 match ip address 113 ! route-map SDM_RMAP_9 permit 1 match ip address 114 ! route-map RMAP-NAT permit 10 match ip address NAT_ACL ! ! snmp-server community public RO snmp-server community ourCommStr RW snmp-server location Tampa, Florida, USA snmp-server contact MIS IT Services x1000 snmp-server enable traps snmp linkdown linkup coldstart snmp-server host 192.168.10.28 version 2c ourCommStr ! ! ! control-plane ! ! ! line con 0 line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 privilege level 15 password 7 02160B5E520F020D494F5D4A transport input telnet ssh ! scheduler allocate 20000 1000 ntp logging ntp master ntp update-calendar ntp server 64.113.32.5 source GigabitEthernet0/0 ntp server 24.56.178.140 source GigabitEthernet0/0 ntp server 12.10.191.151 source GigabitEthernet0/0 ntp server 96.226.123.157 source GigabitEthernet0/0 ntp server 129.6.15.30 prefer source GigabitEthernet0/0 ntp server 64.239.96.53 source GigabitEthernet0/0 end
... View more
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
07-08-2013
10:45 AM
07-08-2013
10:45 AM
Group, Been struggling with an error between VPN appliances and could really use some expert input with this issue. This is the output from the router. I have been getting slaughtered over keeping these tunnels lit and they keep disconnecting. Tried redoing the configuration this morning and the tunnels have dropped after the expiration of the first key. Your thoughts are GREATLY appreciated. Seems weird to have a lifeduration of both 3600 and 4608000. On the SA540 it seems I can only set one or the other. 006023: Jul 8 13:23:03.623 EDT: IPSEC(key_engine): got a queue event with 1 KMI message(s) 006024: Jul 8 13:23:23.468 EDT: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= 97.76.78.218:500, remote= 67.78.146.158:500, local_proxy= 192.168.10.0/255.255.255.224/0/0 (type=4), remote_proxy= 10.0.2.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-aes 256 esp-sha-hmac (Tunnel), lifedur= 3600s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0 006025: Jul 8 13:23:23.468 EDT: ISAKMP:(0): SA request profile is (NULL) 006026: Jul 8 13:23:23.468 EDT: ISAKMP: Created a peer struct for 67.78.146.158, peer port 500 006027: Jul 8 13:23:23.468 EDT: ISAKMP: New peer created peer = 0x2B674C90 peer_handle = 0x80000091 006028: Jul 8 13:23:23.468 EDT: ISAKMP: Locking peer struct 0x2B674C90, refcount 1 for isakmp_initiator 006029: Jul 8 13:23:23.468 EDT: ISAKMP: local port 500, remote port 500 006030: Jul 8 13:23:23.468 EDT: ISAKMP: set n 006031: Jul 8 13:23:23.468 EDT: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 315581E8 006032: Jul 8 13:23:23.468 EDT: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. 006033: Jul 8 13:23:23.468 EDT: ISAKMP:(0):found peer pre-shared key matching 67.78.146.158 006034: Jul 8 13:23:23.468 EDT: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID 006035: Jul 8 13:23:23.468 EDT: ISAKMP:(0): constructed NAT-T vendor-07 ID 006036: Jul 8 13:23:23.468 EDT: ISAKMP:(0): constructed NAT-T vendor-03 ID 006037: Jul 8 13:23:23.472 EDT: ISAKMP:(0): constructed NAT-T vendor-02 ID 006038: Jul 8 13:23:23.472 EDT: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM 006039: Jul 8 13:23:23.472 EDT: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1 006040: Jul 8 13:23:23.472 EDT: ISAKMP:(0): beginning Main Mode exchange 006041: Jul 8 13:23:23.472 EDT: ISAKMP:(0): sending packet to 67.78.146.158 my_port 500 peer_port 500 (I) MM_NO_STATE 006042: Jul 8 13:23:23.472 EDT: ISAKMP:(0):Sending an IKE IPv4 Packet. 006043: Jul 8 13:23:33.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... 006044: Jul 8 13:23:33.472 EDT: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1 006045: Jul 8 13:23:33.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 006046: Jul 8 13:23:33.472 EDT: ISAKMP:(0): sending packet to 67.78.146.158 my_port 500 peer_port 500 (I) MM_NO_STATE 006047: Jul 8 13:23:33.472 EDT: ISAKMP:(0):Sending an IKE IPv4 Packet 006048: Jul 8 13:23:43.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... 006049: Jul 8 13:23:43.472 EDT: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1 006050: Jul 8 13:23:43.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 006051: Jul 8 13:23:43.472 EDT: ISAKMP:(0): sending packet to 67.78.146.158 my_port 500 peer_port 500 (I) MM_NO_STATE 006052: Jul 8 13:23:43.472 EDT: ISAKMP:(0):Sending an IKE IPv4 Packet. 006053: Jul 8 13:23:53.468 EDT: IPSEC(key_engine): request timer fired: count = 1, (identity) local= 97.76.78.218:0, remote= 67.78.146.158:0, local_proxy= 192.168.10.0/255.255.255.224/0/0 (type=4), remote_proxy= 10.0.2.0/255.255.255.0/0/0 (type=4) 006054: Jul 8 13:23:53.468 EDT: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= 97.76.78.218:500, remote= 67.78.146.158:500, local_proxy= 192.168.10.0/255.255.255.224/0/0 (type=4), remote_proxy= 10.0.2.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-aes 256 esp-sha-hmac (Tunnel), lifedur= 3600s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0 006055: Jul 8 13:23:53.468 EDT: ISAKMP: set new node 0 to QM_IDLE 006056: Jul 8 13:23:53.468 EDT: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 97.76.78.218, remote 67.78.146.158) 006057: Jul 8 13:23:53.468 EDT: ISAKMP: Error while processing SA request: Failed to initialize SA 006058: Jul 8 13:23:53.468 EDT: ISAKMP: Error while processing KMI message 0, error 2. 006059: Jul 8 13:23:53.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... 006060: Jul 8 13:23:53.472 EDT: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 006061: Jul 8 13:23:53.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 006062: Jul 8 13:23:53.472 EDT: ISAKMP:(0): sending packet to 67.78.146.158 my_port 500 peer_port 500 (I) MM_NO_STATE 006063: Jul 8 13:23:53.472 EDT: ISAKMP:(0):Sending an IKE IPv4 Packet. 006064: Jul 8 13:23:53.624 EDT: ISAKMP:(0):purging node -206295591 006065: Jul 8 13:23:53.624 EDT: ISAKMP:(0):purging node 625489527 006066: Jul 8 13:24:03.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... 006067: Jul 8 13:24:03.472 EDT: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1 006068: Jul 8 13:24:03.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 006069: Jul 8 13:24:03.472 EDT: ISAKMP:(0): sending packet to 67.78.146.158 my_port 500 peer_port 500 (I) MM_NO_STATE 006070: Jul 8 13:24:03.472 EDT: ISAKMP:(0):Sending an IKE IPv4 Packet. 006071: Jul 8 13:24:03.624 EDT: ISAKMP:(0):purging SA., sa=2BBA9280, delme=2BBA9280 006072: Jul 8 13:24:13.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... 006073: Jul 8 13:24:13.472 EDT: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1 006074: Jul 8 13:24:13.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 006075: Jul 8 13:24:13.472 EDT: ISAKMP:(0): sending packet to 67.78.146.158 my_port 500 peer_port 500 (I) MM_NO_STATE 006076: Jul 8 13:24:13.472 EDT: ISAKMP:(0):Sending an IKE IPv4 Packet. 006077: Jul 8 13:24:23.468 EDT: IPSEC(key_engine): request timer fired: count = 2, (identity) local= 97.76.78.218:0, remote= 67.78.146.158:0, local_proxy= 192.168.10.0/255.255.255.224/0/0 (type=4), remote_proxy= 10.0.2.0/255.255.255.0/0/0 (type=4) 006078: Jul 8 13:24:23.472 EDT: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... 006079: Jul 8 13:24:23.472 EDT: ISAKMP:(0):peer does not do paranoid keepalives. 006080: Jul 8 13:24:23.472 EDT: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 67.78.146.158) 006081: Jul 8 13:24:23.472 EDT: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 67.78.146.158) 006082: Jul 8 13:24:23.472 EDT: ISAKMP: Unlocking peer struct 0x2B674C90 for isadb_mark_sa_deleted(), count 0 006083: Jul 8 13:24:23.472 EDT: ISAKMP: Deleting peer node by peer_reap for 67.78.146.158: 2B674C90 006084: Jul 8 13:24:23.472 EDT: ISAKMP:(0):deleting node 766956796 error FALSE reason "IKE deleted" 006085: Jul 8 13:24:23.472 EDT: ISAKMP:(0):deleting node -1685128159 error FALSE reason "IKE deleted" 006086: Jul 8 13:24:23.472 EDT: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL 006087: Jul 8 13:24:23.472 EDT: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA
... View more
Labels:
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
06-28-2013
02:03 PM
06-28-2013
02:03 PM
Abhishek, Good morning. After a week of hunting around I can report that the tunnels are still very buggy. I have found several things I would like to pass along for your input. I had an issue on the 2911 router with the clock source being off an hour, I have switched to NTP and that issue is resolved now, clock is accurate. Phase 1 negotiation between all SA routers and the 2911 router keeps failing. If I reboot the SA540 it will not reconnect upon startup. If I reboot the 2911 the tunnels will re-establish on startup until the next time they collapse. On the 2911 yesterday for instance I got the EasyVPN server working where I could connect at least to the 2911. Today the 2911 isn't responding to peers again. This is very frustrating as you can well understand, the inter-operability between standards based cisco products should be a given. This is identical to the issue posted here https://supportforums.cisco.com/thread/2018746 except we are obviously running much newer firmware than when this article was listed. I would love some input on how to iron this issue out. These VPN tunnels are connecting DC's together and the resulling loss of sync between them is starting to be a real headache. SA540 Log1 Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Using IPsec SA configuration: 192.168.75.0/24<->192.168.10.0/27 Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Initiating new phase 1 negotiation: 98.101.151.234[500]<=>97.76.78.218[500] Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Beginning Identity Protection mode. Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:185]: XXX: NUMNATTVENDORIDS: 3 Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 4 Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 8 Mon Jul 08 06:03:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 9 Mon Jul 08 06:04:15 2013 (GMT -0400): [pafrd00fw0100] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP 97.76.78.218->98.101.151.234 Mon Jul 08 06:05:34 2013 (GMT -0400): [pafrd00fw0100] [IKE] ERROR: Phase 1 negotiation failed due to time up for 97.76.78.218[500]. 77d5a6ba6ca43d88:0000000000000000 Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Using IPsec SA configuration: 192.168.75.0/24<->192.168.10.0/27 Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Initiating new phase 1 negotiation: 98.101.151.234[500]<=>97.76.78.218[500] Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Beginning Identity Protection mode. Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:185]: XXX: NUMNATTVENDORIDS: 3 Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 4 Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 8 Mon Jul 08 06:15:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 9 Mon Jul 08 06:16:15 2013 (GMT -0400): [pafrd00fw0100] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP 97.76.78.218->98.101.151.234 Mon Jul 08 06:17:34 2013 (GMT -0400): [pafrd00fw0100] [IKE] ERROR: Phase 1 negotiation failed due to time up for 97.76.78.218[500]. 782eb7c9cc39c70d:0000000000000000 Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Using IPsec SA configuration: 192.168.75.0/24<->192.168.10.0/27 Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Initiating new phase 1 negotiation: 98.101.151.234[500]<=>97.76.78.218[500] Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Beginning Identity Protection mode. Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:185]: XXX: NUMNATTVENDORIDS: 3 Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 4 Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 8 Mon Jul 08 06:27:44 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 9 Mon Jul 08 06:28:15 2013 (GMT -0400): [pafrd00fw0100] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP 97.76.78.218->98.101.151.234 Mon Jul 08 06:29:34 2013 (GMT -0400): [pafrd00fw0100] [IKE] ERROR: Phase 1 negotiation failed due to time up for 97.76.78.218[500]. 4b9e1c67273e8214:0000000000000000 Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: accept a request to establish IKE-SA: 97.76.78.218 Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Configuration found for 97.76.78.218. Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Initiating new phase 1 negotiation: 98.101.151.234[500]<=>97.76.78.218[500] Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: Beginning Identity Protection mode. Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:185]: XXX: NUMNATTVENDORIDS: 3 Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 4 Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 8 Mon Jul 08 06:36:48 2013 (GMT -0400): [pafrd00fw0100] [IKE] INFO: [isakmp_ident.c:189]: XXX: setting vendorid: 9
... View more
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
06-27-2013
09:04 AM
06-27-2013
09:04 AM
Abhishek, Thank you again for your continued responses. Yesterday after our discussion I went back and noticed that although I was adding the PFS Group 2 to the interfaces there weren't "taking" to the interface in CCP. After adding them again, telling CCP to write to startup config and rebooting the 2911 all 3 tunnels came up without changing the policies on the 540/520 from auto to manual. So far the tunnels have been lit and stable for almost 24 hours so I will see what happens when the SA lifetime expires if they renew properly. Im hoping based on the current results this problem has been solved and will report back shortly. Ill adjust the ACL for the config you posted to resolve the SSH problem. After than I have to sort out the VPN issues and call it a day! I'll report my findings shortly. Thank you again for your expert help.
... View more
Created by
Ross Mccullough
in VPN and AnyConnect
in VPN and AnyConnect
06-26-2013
09:54 AM
06-26-2013
09:54 AM
Hello Abhishek, Thanks very much for the reply. I have done the following to try and help this along: Yes, the connection in question is 67.78.146.158 but all three routes will be in operation. Once we figure out one I will duplicate to the others, all are 540/520 routers. I have added the PFS Group 2 to all the connections in the 2911. I don't know how to add ESP-3DES-SHA to a 540 router, I have it on AutoPolicy but I assume this would be manual policy in VPN connections however I am unsure of the values to put in there as outlined in your #1 above. I have added the debug commands however nothing in being outputted to the console windows. Perhaps I missed a step to generate the traffic? I can confirm that both SSH outside access and IPSec VPN clients are not working (they were once before) SSH is working on the inside. It almost seems as if traffic is being blocked to the outside interface or NAT rules are in the way? I used to have only 2-3 ACL before CCP generated a huge amount of rules when I tried to add a DMZ for another outside block I own. Eth2 10.0.15.1 --> 97.76.78.219 for example created huge amount of ACL i didn't have before. I wish to put a couple of webservers there for example. Thank you so much for your support and help! protected vrf: (none) local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.224/0/0) remote ident (addr/mask/prot/port): (10.0.2.0/255.255.255.0/0/0) current_peer 67.78.146.158 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 86, #pkts encrypt: 86, #pkts digest: 86 #pkts decaps: 89, #pkts decrypt: 89, #pkts verify: 89 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 97.76.78.218, remote crypto endpt.: 67.78.146.158 path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 current outbound spi: 0x171678B(24209291) PFS (Y/N): Y, DH group: group2 inbound esp sas: spi: 0x1CE5CD9D(484822429) transform: esp-3des esp-sha-hmac , in use settings ={Tunnel, } conn id: 2001, flow_id: Onboard VPN:1, sibling_flags 80000046, crypto ma p: SDM_CMAP_1 sa timing: remaining key lifetime (k/sec): (4504367/86213) IV size: 8 bytes replay detection support: Y Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x171678B(24209291) transform: esp-3des esp-sha-hmac , in use settings ={Tunnel, } conn id: 2002, flow_id: Onboard VPN:2, sibling_flags 80000046, crypto ma p: SDM_CMAP_1 sa timing: remaining key lifetime (k/sec): (4504383/86213) IV size: 8 bytes replay detection support: Y Status: ACTIVE outbound ah sas: outbound pcp sas:
... View more
Created by
Ross Mccullough
in Voice Systems
07-05-2014
07-05-2014
Group,I came across some unexpected behavior yesterday I was wondering
if someone could help shed so...
Created by
Ross Mccullough
in Switching
03-03-2014
03-03-2014
Hello,It apprears to me that when I configured PBR on the inside
interface that all traffic that sho...
Created by
Ross Mccullough
in Switching
03-02-2014
03-02-2014
Group,Wanted to get your input on an issue where I am sure I am
overlooking something. I rebuilt the...
Created by
Ross Mccullough
in Small Business Routers
02-13-2014
02-13-2014
Group,Good morning, wanted to run some config questions by you as I am a
bit unclear on a few things...
Created by
Ross Mccullough
in Small Business Security
02-04-2014
02-04-2014
Update: Well I wasn't able to fix my problem but I was able to bypass
it. The Zywall has a second WA...
Created by
Ross Mccullough
in Small Business Security
02-01-2014
02-01-2014
Group,Trying to build a site to site IP Sec VPN tunnel and I am getting
an error I am not familiar w...
Created by
Ross Mccullough
in VPN and AnyConnect
01-04-2014
01-04-2014
Karsten,Thanks again for your valuable input, the configuration is
below. The endpoints are as follo...
Created by
Ross Mccullough
in VPN and AnyConnect
12-31-2013
12-31-2013
Karsten,Thanks for your valuable insight, I can browse via http on our
VPN connection now. Beautiful...
Created by
Ross Mccullough
in VPN and AnyConnect
12-29-2013
12-29-2013
Group,Have a small issue I am sure is related back to ACL. I wanted to
have some experts take a look...
Created by
Ross Mccullough
in IP Telephony and Phones
12-26-2013
12-26-2013
Group,Have some issues to run by you to get the experts opinion. Let's
start with the setup:HQ2911 R...
Created by
Ross Mccullough
in VPN and AnyConnect
07-10-2013
07-10-2013
Rudy,Thanks for the follow up, appreciate the help. I took a look at the
remote endpoint (an SA540) ...
Created by
Ross Mccullough
in VPN and AnyConnect
07-08-2013
07-08-2013
Group,Been struggling with an error between VPN appliances and could
really use some expert input wi...
Created by
Ross Mccullough
in VPN and AnyConnect
06-28-2013
06-28-2013
Abhishek,Good morning. After a week of hunting around I can report that
the tunnels are still very b...
Created by
Ross Mccullough
in VPN and AnyConnect
06-27-2013
06-27-2013
Abhishek,Thank you again for your continued responses. Yesterday after
our discussion I went back an...
Created by
Ross Mccullough
in VPN and AnyConnect
06-26-2013
06-26-2013
Hello Abhishek,Thanks very much for the reply. I have done the following
to try and help this along:...
Public Statistics
| Date Registered | 08-09-2012 01:46 PM |
| Date Last Visited | 10-09-2017 02:14 PM |
| Total Messages Posted | 27 |
