Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About joaoareias
Stats
Member since
09-12-2013
13
Posts
0
Helpful
0
Solutions
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-24-2013
07:00 AM
09-24-2013
07:00 AM
Hi, I managed to solve the problem. The problem was: ip route 10.0.0.0 255.0.0.0 Null0 250 I removed this route and now it works. Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-24-2013
07:00 AM
09-24-2013
07:00 AM
Hi, I managed to solve the problem. The problem was: ip route 10.0.0.0 255.0.0.0 Null0 250 I removed this route and now it works. Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-23-2013
07:45 AM
09-23-2013
07:45 AM
Full config: version 15.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname xxxxxxx ! boot-start-marker boot-end-marker ! ! logging buffered 50000 enable password 7 xxxxx ! aaa new-model ! ! aaa authentication login default local aaa authentication enable default enable aaa authentication ppp default local none ! ! ! ! ! aaa session-id common memory-size iomem 10 ! ! ! no ip source-route ! ! ! ! ! ! ! ip cef no ipv6 cef ! ! multilink bundle-name authenticated license udi pid CISCO881-SEC-K9 sn xxxxx ! ! username client password 7 xxxxxx ! ! ! ! ! ! policy-map SHAPE-20 class class-default shape average 9500000 95000 0 ! ! crypto logging session ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key PASS address IP ! ! crypto ipsec transform-set VPN-IM esp-3des esp-md5-hmac mode tunnel ! ! ! crypto map Map1 10 ipsec-isakmp set peer IP set transform-set VPN-IM match address VPN ! ! ! ! ! interface FastEthernet0 no ip address load-interval 30 ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address load-interval 30 ! interface FastEthernet4 no ip address load-interval 30 duplex auto speed auto ! interface FastEthernet4.20 encapsulation dot1Q 20 ip address IP MASK ip nat outside ip virtual-reassembly in crypto map Map1 service-policy output SHAPE-20 ! interface FastEthernet4.30 ! interface Vlan1 description == LAN: LAN Local == ip address 192.168.20.254 255.255.255.0 ip nat inside ip virtual-reassembly in ip verify unicast reverse-path ! ip forward-protocol nd ip http server ip http secure-server ! ! ip dns server ip nat inside source list ACL_NAT interface FastEthernet4.20 overload ip route 0.0.0.0 0.0.0.0 62.28.9.17 ip route 10.0.0.0 255.0.0.0 Null0 250 ip route 172.16.0.0 255.240.0.0 Null0 250 ! ip access-list extended ACL_NAT deny ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255 permit ip 192.168.20.0 0.0.0.255 any ip access-list extended VPN permit ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255 ! ! ! ! ! control-plane ! ! ! line con 0 no modem enable line aux 0 line vty 0 4 transport input all ! ! end
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-23-2013
07:29 AM
09-23-2013
07:29 AM
Hi, I removed all denies from the ACL and nothing. I removed tha ACL from the interface and nothing. Nothing in the log. Result from the show crypto isakmp sa: IPv4 Crypto ISAKMP SA dst src state conn-id status IPv6 Crypto ISAKMP SA Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-23-2013
02:54 AM
09-23-2013
02:54 AM
Hi, Still the same: ip access-list extended ACL_NAT deny ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255 permit ip 192.168.20.0 0.0.0.255 any ip access-list extended VPN permit ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255 ! access-list 113 deny ip 0.0.0.0 0.255.255.255 any access-list 113 deny ip 224.0.0.0 31.255.255.255 any access-list 113 deny ip 127.0.0.0 0.255.255.255 any access-list 113 deny ip 10.0.0.0 0.255.255.255 any access-list 113 deny ip 172.16.0.0 0.15.255.255 any access-list 113 deny ip 192.168.0.0 0.0.255.255 any access-list 113 permit ip 62.48.131.96 0.0.0.31 any access-list 113 permit ip 62.48.131.128 0.0.0.15 any access-list 113 permit tcp any any established access-list 113 permit tcp any eq ftp-data any access-list 113 permit udp any any eq domain access-list 113 permit udp any eq domain any access-list 113 permit udp any eq ntp any access-list 113 permit icmp any any echo-reply access-list 113 permit icmp any any time-exceeded access-list 113 permit icmp any any traceroute access-list 113 permit icmp any any packet-too-big access-list 113 permit icmp any any unreachable access-list 113 remark Adicionar Servers do cliente, web, mail, etc access-list 113 permit esp any any access-list 113 permit udp any any eq isakmp access-list 113 permit udp any any eq non500-isakmp I should see something in the logs, right? But nothing. Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-22-2013
12:39 AM
09-22-2013
12:39 AM
Hi, sorry i didn't copy all. access-list 113 deny ip 0.0.0.0 0.255.255.255 any access-list 113 deny ip 224.0.0.0 31.255.255.255 any access-list 113 deny ip 127.0.0.0 0.255.255.255 any access-list 113 deny ip 10.0.0.0 0.255.255.255 any access-list 113 deny ip 172.16.0.0 0.15.255.255 any access-list 113 deny ip 192.168.0.0 0.0.255.255 any access-list 113 permit ip xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx any access-list 113 permit ip xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx any access-list 113 permit tcp any any established access-list 113 permit tcp any eq ftp-data any access-list 113 permit udp any any eq domain access-list 113 permit udp any eq domain any access-list 113 permit udp any eq ntp any access-list 113 permit icmp any any echo-reply access-list 113 permit icmp any any time-exceeded access-list 113 permit icmp any any traceroute access-list 113 permit icmp any any packet-too-big access-list 113 permit icmp any any unreachable If i tourn on debug on isakmp, ipsec and crypto engine e dont see anything in the logs. debug crypto isakmp debug crypto ipsec debug crypto engine Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-21-2013
01:23 PM
09-21-2013
01:23 PM
Hi, That is just a copy and paste error. The applyed map is Map1. Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-21-2013
08:10 AM
09-21-2013
08:10 AM
Hi, I have a cisco 881 router in a remote site and a ASA in our central office. I want to establish a lan-to-lan ipsec vpn between this two sites. I configured the two equipments but in the cisco 881 router when execute the command: show crypto isakmp sa It does not show any sa. Can you please help me. Here goes the cisco 881 conf: Building configuration... Current configuration : 5914 bytes ! version 15.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! multilink bundle-name authenticated license udi pid CISCO881-SEC-K9 sn "serial number" ! ! ! policy-map SHAPE-20 class class-default shape average 9500000 95000 0 ! ! crypto logging session ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key "Password" address "Asa external IP" crypto isakmp keepalive 10 ! ! crypto ipsec transform-set IM esp-3des esp-md5-hmac mode tunnel ! ! ! crypto map Map1 local-address FastEthernet4.20 crypto map Map1 10 ipsec-isakmp set peer "asa external IP" set transform-set IM match address VPN ! ! ! ! ! interface FastEthernet0 no ip address load-interval 30 ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address load-interval 30 ! interface FastEthernet4 no ip address load-interval 30 duplex auto speed auto ! interface FastEthernet4.20 encapsulation dot1Q 20 ip address xxxxxx ip access-group 113 in ip nat outside ip virtual-reassembly in crypto map Map1 service-policy output SHAPE-20 ! interface Vlan1 ip address 192.168.20.254 255.255.255.0 ip nat inside ip virtual-reassembly in ip verify unicast reverse-path ! ip forward-protocol nd ip http server ip http secure-server ! ! ip dns server ip nat inside source list ACL_NAT interface FastEthernet4.20 overload ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx ip route 10.0.0.0 255.0.0.0 Null0 250 ip route 172.16.0.0 255.240.0.0 Null0 250 ip route 192.168.0.0 255.255.0.0 Null0 250 ! ip access-list extended ACL_NAT deny ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255 permit ip 192.168.20.0 0.0.0.255 any ip access-list extended VPN permit ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255 ! ! ! ! ! control-plane ! ! ! line con 0 no modem enable line aux 0 line vty 0 4 transport input all ! ! end Thanks.
... View more
Labels:
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-16-2013
06:20 AM
09-16-2013
06:20 AM
Hi, In this case i could work but i also have situations where i have one subnet class A and 2 hosts that have public ips but have to pass in the vpn tunnel. Thanks.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-13-2013
06:22 AM
09-13-2013
06:22 AM
Hi, Sorry the answer is not correct, i pressed accidently in the button and now i do not know how to remove that flag. JA
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-12-2013
04:20 PM
09-12-2013
04:20 PM
That is the problem i cannot define multiple subnets in the connection profile. I can add routes to the vpn but it didn't work. Thanks, João Areias
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-12-2013
04:18 PM
09-12-2013
04:18 PM
From the cisco side i have tested wth only one connection and added the other networks to the access list. From the draytek side i have 3 diferent connections. If the first connection is not the connection with the 192.168.1.0 network, if for some reason the other connections are droped, then we don't have traffic and from the draytek side the vpn is up, but from the cisco that connection is not up. Sorry for the description.
... View more
Created by
joaoareias
in VPN and AnyConnect
in VPN and AnyConnect
09-12-2013
08:20 AM
09-12-2013
08:20 AM
Hi, I have a Cisco ASA 5510 in my central site. I created a VPN to connect a remote site that has a draytek 2830. Because some particularities we need to include in this vpn other networks. So from the remote site we need to comunticate with more than one network. For example: Network: 192.168.1.0/24, 192.168.2.15/32 and 192.168.3.15/32 The only solution i have found was to create a vpn connection on the draytek for each network. On the Cisco side i created also a connectio for each network. The vpns function if they initiate in a determined order. If the vpn for the 192.168.1.0 network starts first them there is no traffic... Can you please help me. Best regards.
... View more
Labels:
09-24-2013
Hi,I managed to solve the problem.The problem was:ip route 10.0.0.0
255.0.0.0 Null0 250I removed thi...
09-24-2013
Hi,I managed to solve the problem.The problem was:ip route 10.0.0.0
255.0.0.0 Null0 250I removed thi...
09-23-2013
Full config:version 15.2no service padservice tcp-keepalives-inservice
tcp-keepalives-outservice tim...
09-23-2013
Hi,I removed all denies from the ACL and nothing.I removed tha ACL from
the interface and nothing.No...
09-23-2013
Hi, Still the same:ip access-list extended ACL_NAT deny ip 192.168.20.0
0.0.0.255 10.0.0.0 0.255.255...
09-22-2013
Hi, sorry i didn't copy all. access-list 113 deny ip 0.0.0.0
0.255.255.255 anyaccess-list 113 deny i...
09-21-2013
Hi,I have a cisco 881 router in a remote site and a ASA in our central
office.I want to establish a ...
Created by
joaoareias
in VPN and AnyConnect
09-16-2013
09-16-2013
Hi,In this case i could work but i also have situations where i have one
subnet class A and 2 hosts ...
Created by
joaoareias
in VPN and AnyConnect
09-13-2013
09-13-2013
Hi, Sorry the answer is not correct, i pressed accidently in the button
and now i do not know how to...
Created by
joaoareias
in VPN and AnyConnect
09-12-2013
09-12-2013
That is the problem i cannot define multiple subnets in the connection
profile.I can add routes to t...
Created by
joaoareias
in VPN and AnyConnect
09-12-2013
09-12-2013
From the cisco side i have tested wth only one connection and added the
other networks to the access...
Created by
joaoareias
in VPN and AnyConnect
09-12-2013
09-12-2013
Hi,I have a Cisco ASA 5510 in my central site. I created a VPN to
connect a remote site that has a d...
Public Statistics
| Date Registered | 09-12-2013 07:57 AM |
| Date Last Visited | 08-18-2017 04:27 AM |
| Total Messages Posted | 13 |
