Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Maher Abdelshkour
Maher Abdelshkour
Rising star
Total 15 years of experience (including 9 years in Sweden and 6 years in Dubai - currently in Kuala Lumpur) in the field of Information Technology with extensive network engineering, administration, and troubleshooting experience in Enterprise and Service Provider networks. Strong work ethic with in-depth research and planning capabilities that consistently lead to completion of successful projects. Proven ability to diagnose complex problems and quickly deliver effective solutions. Extensive hands-on experience that includes CCNP R&S, CCNP Security and CCNA certifications.
Biography from communities:
Total 17 years of experience in the field of Information Technology with extensive network engineering, administration, and troubleshooting experience in Enterprise and Service Provider networks. Strong work ethic with in-depth research and planning capabilities that consistently lead to completion of successful projects. Proven ability to diagnose complex problems and quickly deliver effective solutions. Extensive hands-on experience that includes CCNP R&S, CCNP Security and CCNA certifications.
Expertise:
Networking Hardware
Routers: Cisco (IOS, Cat OS).
Switches, Bridges, Hubs: Cisco Catalyst.
Security / Firewalls
IP Sec, VPNs, Cryptography, Key Management, AAA Model (RADIUS, TACACS), Cisco Authentication Proxy, Access Lists, IOS Firewall, 802.1x, IOS Security Features, DMZ set ups, CBAC, DoS and common threats prevention, Cisco IDS / IPS (Intrusion Detection / Prevention System), Cisco Secure ACS Server, Cisco VPN Concentrator, Cisco PIX / ASA Firewall, VPN Client, Cisco Security Manager (CSM), Cisco MARS, Cisco NAC / CANAC.
Routing
Static Routing, RIPv1, RIPv2, RIP nG, IGRP, EIGRP, OSPF, IS-IS, BGPv4, ODR, GRE, MPLS,
IPv6, Traffic Engineering, Policy Based Routing PBR, Route Filtering, Redistribution, Summarization
Switching & Bridging
Catalyst Cat OS and IOS based Switches, VTP, STP, RSTP, Trucking, VLANs,
Layer 3 Switches, Logical Ether channels, Transparent Bridging.
LAN
Media: Ethernet, Fast Ethernet, Gigabit Ethernet, FDDI, CDDI, Token Ring, ATM LAN Emulation Network
WAN
Leased lines 64k - 155Mb (PPP / HDLC), Frame Relay, ATM, ISDN, x DSL, Load Balancing, Multi Homing, Satellite links
Various Features & Services
IOS and Cat OS Features, HSRP, IRDP, NAT, SNMP, SYSLOG, NTP, DHCP, CDP, DNS, HTTP, TFTP and FTP Management, IPv6 test projects, RAS Solutions, Cisco CNR (DNS & DHCP server)
QoS (Quality of Service)
WRED, Queuing features, FRTP, CAR, RTP, MLS QoS, LLQ, Policy Based Routing, CBWFQ
Total 15 years of experience (including 9 years in Sweden and 6 years in Dubai - currently in Kuala Lumpur) in the field of Information Technology with extensive network engineering, administration, and troubleshooting experience in Enterprise and Service Provider networks. Strong work ethic with in-depth research and planning capabilities that consistently lead
Recent Badges
Stats
Member since
10-08-2013
56
Posts
367
Helpful
1
Solution
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
06:22 AM
12-12-2017
06:22 AM
Hi Bogdan,
Thanks a lot for your help!
Best Regards,
Maher
... View more
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
04:41 AM
12-12-2017
04:41 AM
I noticed this:
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
Now this means the issue is on the Bintec.
... View more
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
04:39 AM
12-12-2017
04:39 AM
That's right!
sh crypto ipsec sa interface: outside Crypto map tag: outside_map, seq num: 1, local addr: 1.1.1.1
access-list outside_cryptomap extended permit ip 172.16.2.0 255.255.255.0 192.168.113.0 255.255.255.0 local ident (addr/mask/prot/port): (172.16.2.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.113.0/255.255.255.0/0/0) current_peer: 2.2.2.2 #pkts encaps: 450, #pkts encrypt: 450, #pkts digest: 450 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 450, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #TFC rcvd: 0, #TFC sent: 0 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0 #send errors: 0, #recv errors: 0
local crypto endpt.: 1.1.1.1/4500, remote crypto endpt.: 2.2.2.2/40634 path mtu 1500, ipsec overhead 58(36), media mtu 1500 PMTU time remaining (sec): 0, DF policy: copy-df ICMP error validation: disabled, TFC packets: disabled current outbound spi: 4A942B97 current inbound spi : 15A679D3 inbound esp sas: spi: 0x15A679D3 (363231699) SA State: active transform: esp-3des esp-md5-hmac no compression in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, } slot: 0, conn_id: 44, crypto-map: outside_map sa timing: remaining key lifetime (kB/sec): (4193280/24679) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001 outbound esp sas: spi: 0x4A942B97 (1251224471) SA State: active transform: esp-3des esp-md5-hmac no compression in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, } slot: 0, conn_id: 44, crypto-map: outside_map sa timing: remaining key lifetime (kB/sec): (4147177/24679) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001
but still can't access the remote network nor the remote can access our local network.
Do you think a restart is needed?
... View more
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
04:02 AM
12-12-2017
04:02 AM
Seems better now
Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,outside) source static NETWORK_OBJ_172.16.2.0_24 NETWORK_OBJ_172.16.2.0_24 destination static NETWORK_OBJ_192.168.113.0_24 NETWORK_OBJ_192.168.113.0_24 no-proxy-arp Additional Information: NAT divert to egress interface outside Untranslate 192.168.113.220/0 to 192.168.113.220/0
Phase: 2 Type: NAT Subtype: Result: ALLOW Config: nat (inside,outside) source static NETWORK_OBJ_172.16.2.0_24 NETWORK_OBJ_172.16.2.0_24 destination static NETWORK_OBJ_192.168.113.0_24 NETWORK_OBJ_192.168.113.0_24 no-proxy-arp Additional Information: Static translate 172.16.2.10/0 to 172.16.2.10/0
Phase: 3 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information:
Phase: 4 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:
Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information:
Phase: 6 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information:
Phase: 7 Type: VPN Subtype: encrypt Result: ALLOW Config: Additional Information:
Phase: 8 Type: NAT Subtype: rpf-check Result: ALLOW Config: nat (inside,outside) source static NETWORK_OBJ_172.16.2.0_24 NETWORK_OBJ_172.16.2.0_24 destination static NETWORK_OBJ_192.168.113.0_24 NETWORK_OBJ_192.168.113.0_24 no-proxy-arp Additional Information:
Phase: 9 Type: VPN Subtype: ipsec-tunnel-flow Result: ALLOW Config: Additional Information:
Phase: 10 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information:
Phase: 11 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:
Phase: 12 Type: FLOW-CREATION Subtype: Result: ALLOW Config: Additional Information: New flow created with id 11493, packet dispatched to next module Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: allow
... View more
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
03:53 AM
12-12-2017
03:53 AM
Hi again,
yes of course.
here it is:
sh run nat nat (inside,outside) source static NETWORK_OBJ_172.16.2.0_24 NETWORK_OBJ_172.16.2.0_24 destination static NETWORK_OBJ_192.168.113.0_24 NETWORK_OBJ_192.168.113.0_24 no-proxy-arp nat (inside,outside) source static EBOOTIS-INT EBOOTIS-EXT nat (inside,outside) source static FIREPOWER-INT FIREPOWER-EXT ! nat (inside,outside) after-auto source dynamic any interface
... View more
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
03:33 AM
12-12-2017
03:33 AM
Hello Bogdan,
Thanks for the prompt reply.
I have tried to move the identity NAT for VPN into the first position.
nat (inside,outside) source static NETWORK_OBJ_172.16.2.0_24 NETWORK_OBJ_172.16.2.0_24 destination static NETWORK_OBJ_192.168.113.0_24 NETWORK_OBJ_192.168.113.0_24 no-proxy-arp
But unfortunately the problem still exists.
... View more
Created by
Maher Abdelshkour
in VPN and AnyConnect
in VPN and AnyConnect
12-12-2017
02:41 AM
12-12-2017
02:41 AM
Hello,
We have a VPN connection between our HQ and one of our branches which has a Bintec router. Phase 1 and phase 2 are up, but no there is no traffic is being passed.
This is the result of debug cry ipsec:
HQ# debug crypto ipsec 255 HQ# IPSEC: Received a PFKey message from IKE IPSEC DEBUG: Received a DELETE PFKey message from IKE for an inbound SA (SPI 0x6BC9BF90) IPSEC DEBUG: Outbound SA (SPI 0x7DD2A486) destroy started, state active IPSEC: Destroy current outbound SPI: 0x7DD2A486 IPSEC DEBUG: Outbound SA (SPI 0x7DD2A486) free started, state active IPSEC DEBUG: Outbound SA (SPI 0x7DD2A486) state change from active to dead IPSEC DEBUG: Deleting the outbound encrypt rule for SPI 0x7DD2A486 IPSEC: Increment SA NP ref counter for outbound SPI 0x7DD2A486, old value: 0, new value: 1, (ctm_ipsec_delete_acl_entry:7580) IPSEC: Deleted outbound encrypt rule, SPI 0x7DD2A486 Rule ID: 0x00007f314aa98ac0 IPSEC: Decrement SA NP ref counter for outbound SPI 0x7DD2A486, old value: 1, new value: 0, (ctm_ipsec_delete_acl_cb:5843) IPSEC DEBUG: Deleting the outbound permit rule for SPI 0x7DD2A486 IPSEC: Increment SA NP ref counter for outbound SPI 0x7DD2A486, old value: 0, new value: 1, (ctm_ipsec_delete_acl_entry:7580) IPSEC: Deleted outbound permit rule, SPI 0x7DD2A486 Rule ID: 0x00007f314aa99170 IPSEC: Decrement SA NP ref counter for outbound SPI 0x7DD2A486, old value: 1, new value: 0, (ctm_ipsec_delete_acl_cb:5843) IPSEC DEBUG: Deleting the Outbound VPN context for SPI 0x7DD2A486 IPSEC: Increment SA NP ref counter for outbound SPI 0x7DD2A486, old value: 0, new value: 1, (ctm_ipsec_free_sa:10053) IPSEC: Deleted outbound VPN context, SPI 0x7DD2A486 VPN handle: 0x000000000085546c IPSEC: Decrement SA NP ref counter for outbound SPI 0x7DD2A486, old value: 1, new value: 0, (ctm_np_vpn_delete_cb:12591) IPSEC DEBUG: Outbound SA (SPI 0x7DD2A486) free completed IPSEC DEBUG: Outbound SA (SPI 0x7DD2A486) destroy completed IPSEC DEBUG: Inbound SA (SPI 0x6BC9BF90) destroy started, state active IPSEC: Destroy current inbound SPI: 0x6BC9BF90 IPSEC DEBUG: Inbound SA (SPI 0x6BC9BF90) free started, state active IPSEC DEBUG: Inbound SA (SPI 0x6BC9BF90) state change from active to dead IPSEC DEBUG: Deleting the inbound decrypt rule for SPI 0x6BC9BF90 IPSEC: Increment SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 0, new value: 1, (ctm_ipsec_delete_acl_entry:7580) IPSEC: Deleted inbound decrypt rule, SPI 0x6BC9BF90 Rule ID: 0x00007f314aa905a0 IPSEC: Decrement SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 1, new value: 0, (ctm_ipsec_delete_acl_cb:5843) IPSEC DEBUG: Deleting the inbound permit rule for SPI 0x6BC9BF90 IPSEC: Increment SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 0, new value: 1, (ctm_ipsec_delete_acl_entry:7580) IPSEC: Deleted inbound permit rule, SPI 0x6BC9BF90 Rule ID: 0x00007f314aa9a800 IPSEC: Decrement SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 1, new value: 0, (ctm_ipsec_delete_acl_cb:5843) IPSEC DEBUG: Deleting the inbound tunnel flow rule for SPI 0x6BC9BF90 IPSEC: Increment SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 0, new value: 1, (ctm_ipsec_delete_acl_entry:7580) IPSEC: Deleted inbound tunnel flow rule, SPI 0x6BC9BF90 Rule ID: 0x00007f314aa02b30 IPSEC: Decrement SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 1, new value: 0, (ctm_ipsec_delete_acl_cb:5843) IPSEC DEBUG: Deleting the Inbound VPN context for SPI 0x6BC9BF90 IPSEC: Increment SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 0, new value: 1, (ctm_ipsec_free_sa:10053) IPSEC: Deleted inbound VPN context, SPI 0x6BC9BF90 VPN handle: 0x000000000085612c IPSEC: Decrement SA NP ref counter for inbound SPI 0x6BC9BF90, old value: 1, new value: 0, (ctm_np_vpn_delete_cb:12591) IPSEC: Removed SA from last received DB, SPI: 0x6BC9BF90, user: 1.1.1.1, peer: 1.1.1.1, SessionID: 0x00027000 IPSEC DEBUG: Inbound SA (SPI 0x6BC9BF90) free completed IPSEC DEBUG: Inbound SA (SPI 0x6BC9BF90) destroy completed IPSEC: Received a PFKey message from IKE IPSEC: Parsing PFKey GETSPI message IPSEC: Creating IPsec SA IPSEC: Getting the inbound SPI IPSEC DEBUG: Inbound SA (SPI 0x00000000) state change from inactive to embryonic IPSEC: New embryonic SA created @ 0x00007f314aa48160, SCB: 0x4A851930, Direction: inbound SPI : 0xA408878F Session ID: 0x00028000 VPIF num : 0x00000002 Tunnel type: l2l Protocol : esp Lifetime : 240 seconds IPSEC: Received a PFKey message from IKE IPSEC: Parsing PFKey ADD message IPSEC: Creating IPsec SA IPSEC: Adding the outbound SA, SPI: 0x08054576 IPSEC DEBUG: Outbound SA (SPI 0x08054576) state change from inactive to embryonic IPSEC: New embryonic SA created @ 0x00007f314aa01430, SCB: 0x4AA15580, Direction: outbound SPI : 0x08054576 Session ID: 0x00028000 VPIF num : 0x00000002 Tunnel type: l2l Protocol : esp Lifetime : 240 seconds Rule Lookup for local 172.16.2.0 to remote 192.168.113.0 PROXY MATCH on crypto map outside_map seq 1 IPSEC DEBUG: Using NP outbound permit rule for SPI 0x08054576 IPSEC: Completed host OBSA update, SPI 0x08054576 IPSEC: Creating outbound VPN context, SPI 0x08054576 Flags: 0x00000025 SA : 0x00007f314aa01430 SPI : 0x08054576 MTU : 1500 bytes VCID : 0x00000000 Peer : 0x00000000 SCB : 0x426E769D Channel: 0x00007f3139ba14c0 IPSEC: Increment SA NP ref counter for outbound SPI 0x08054576, old value: 0, new value: 1, (ctm_ipsec_create_vpn_context:8216) IPSEC: Completed outbound VPN context, SPI 0x08054576 VPN handle: 0x00000000008588a4 IPSEC: New outbound encrypt rule, SPI 0x08054576 Src addr: 172.16.2.0 Src mask: 255.255.255.0 Dst addr: 192.168.113.0 Dst mask: 255.255.255.0 Src ports Upper: 0 Lower: 0 Op : ignore Dst ports Upper: 0 Lower: 0 Op : ignore Protocol: 0 Use protocol: false SPI: 0x00000000 Use SPI: false IPSEC: Increment SA NP ref counter for outbound SPI 0x08054576, old value: 1, new value: 2, (ctm_ipsec_create_acl_entry:6773) IPSEC: Completed outbound encrypt rule, SPI 0x08054576 Rule ID: 0x00007f314aa01c90 IPSEC: Decrement SA NP ref counter for outbound SPI 0x08054576, old value: 2, new value: 1, (ctm_ipsec_create_acl_cb:5723) IPSEC: New outbound permit rule, SPI 0x08054576 Src addr: 2.2.2.2 Src mask: 255.255.255.255 Dst addr: 1.1.1.1 Dst mask: 255.255.255.255 Src ports Upper: 4500 Lower: 4500 Op : equal Dst ports Upper: 40634 Lower: 40634 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Increment SA NP ref counter for outbound SPI 0x08054576, old value: 1, new value: 2, (ctm_ipsec_create_acl_entry:6934) IPSEC: Completed outbound permit rule, SPI 0x08054576 Rule ID: 0x00007f314aaaf4f0 IPSEC: Decrement SA NP ref counter for outbound SPI 0x08054576, old value: 2, new value: 1, (ctm_ipsec_create_acl_cb:5723) IPSEC: Decrement SA NP ref counter for outbound SPI 0x08054576, old value: 1, new value: 0, (ctm_np_vpn_context_cb:12531) IPSEC: Increment SA HW ref counter for outbound SPI 0x08054576, old value: 0, new value: 1, (ctm_nlite_ipsec_create_hw_obsa:1230) IPSEC: Received a PFKey message from IKE IPSEC: Parsing PFKey UPDATE message IPSEC: Creating IPsec SA IPSEC: Updating the inbound SA, SPI: 0xA408878F IPSEC: New embryonic SA created @ 0x00007f314aa48160, SCB: 0x4A851930, Direction: inbound SPI : 0xA408878F Session ID: 0x00028000 VPIF num : 0x00000002 Tunnel type: l2l Protocol : esp Lifetime : 240 seconds Rule Lookup for local 172.16.2.0 to remote 192.168.113.0 PROXY MATCH on crypto map outside_map seq 1 IPSEC DEBUG: Using NP inbound permit rule for SPI 0xA408878F IPSEC: Completed host IBSA update, SPI 0xA408878F IPSEC: Creating inbound VPN context, SPI 0xA408878F Flags: 0x00000026 SA : 0x00007f314aa48160 SPI : 0xA408878F MTU : 0 bytes VCID : 0x00000000 Peer : 0x008588A4 SCB : 0x426D6F6F Channel: 0x00007f3139ba14c0 IPSEC: Increment SA NP ref counter for inbound SPI 0xA408878F, old value: 0, new value: 1, (ctm_ipsec_create_vpn_context:8149) IPSEC: Completed inbound VPN context, SPI 0xA408878F VPN handle: 0x0000000000044f0c IPSEC: Updating outbound VPN context 0x008588A4, SPI 0x08054576 Flags: 0x00000025 SA : 0x00007f314aa01430 SPI : 0x08054576 MTU : 1500 bytes VCID : 0x00000000 Peer : 0x00044F0C SCB : 0x426E769D Channel: 0x00007f3139ba14c0 IPSEC: Increment SA NP ref counter for outbound SPI 0x08054576, old value: 0, new value: 1, (ctm_ipsec_update_vpn_context:8345) IPSEC: Completed outbound VPN context, SPI 0x08054576 VPN handle: 0x00000000008588a4 IPSEC: Completed outbound inner rule, SPI 0x08054576 Rule ID: 0x00007f314aa01c90 IPSEC: Completed outbound outer SPD rule, SPI 0x08054576 Rule ID: 0x00007f314aaaf4f0 IPSEC: Decrement SA NP ref counter for outbound SPI 0x08054576, old value: 1, new value: 0, (ctm_np_vpn_context_cb:12531) IPSEC: New inbound tunnel flow rule, SPI 0xA408878F Src addr: 192.168.113.0 Src mask: 255.255.255.0 Dst addr: 172.16.2.0 Dst mask: 255.255.255.0 Src ports Upper: 0 Lower: 0 Op : ignore Dst ports Upper: 0 Lower: 0 Op : ignore Protocol: 0 Use protocol: false SPI: 0x00000000 Use SPI: false IPSEC: Increment SA NP ref counter for inbound SPI 0xA408878F, old value: 1, new value: 2, (ctm_ipsec_create_acl_entry:6339) IPSEC: Completed inbound tunnel flow rule, SPI 0xA408878F Rule ID: 0x00007f314aa90e80 IPSEC: Decrement SA NP ref counter for inbound SPI 0xA408878F, old value: 2, new value: 1, (ctm_ipsec_create_acl_cb:5723) IPSEC: New inbound decrypt rule, SPI 0xA408878F Src addr: 1.1.1.1 Src mask: 255.255.255.255 Dst addr: 2.2.2.2 Dst mask: 255.255.255.255 Src ports Upper: 40634 Lower: 40634 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Increment SA NP ref counter for inbound SPI 0xA408878F, old value: 1, new value: 2, (ctm_ipsec_create_acl_entry:6501) IPSEC: Completed inbound decrypt rule, SPI 0xA408878F Rule ID: 0x00007f314aa90f90 IPSEC: Decrement SA NP ref counter for inbound SPI 0xA408878F, old value: 2, new value: 1, (ctm_ipsec_create_acl_cb:5723) IPSEC: New inbound permit rule, SPI 0xA408878F Src addr: 1.1.1.1 Src mask: 255.255.255.255 Dst addr: 2.2.2.2 Dst mask: 255.255.255.255 Src ports Upper: 40634 Lower: 40634 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Increment SA NP ref counter for inbound SPI 0xA408878F, old value: 1, new value: 2, (ctm_ipsec_create_acl_entry:6501) IPSEC: Completed inbound permit rule, SPI 0xA408878F Rule ID: 0x00007f314aaa1d80 IPSEC: Decrement SA NP ref counter for inbound SPI 0xA408878F, old value: 2, new value: 1, (ctm_ipsec_create_acl_cb:5723) IPSEC: Decrement SA NP ref counter for inbound SPI 0xA408878F, old value: 1, new value: 0, (ctm_np_vpn_context_cb:12531) IPSEC: Increment SA HW ref counter for inbound SPI 0xA408878F, old value: 0, new value: 1, (ctm_nlite_ipsec_create_hw_ibsa:805) IPSEC: Added SA to last received DB, SPI: 0xA408878F, user: 1.1.1.1, peer: 1.1.1.1, SessionID: 0x00028000 IPSEC DEBUG: Inbound SA (SPI 0xA408878F) state change from embryonic to active IPSEC DEBUG: Outbound SA (SPI 0x08054576) state change from embryonic to active
-------------------------
packet tracer results:
packet-tracer input inside icmp 172.16.2.10 0 0 192.168.113.220
Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 1.1.1.2 using egress ifc outside
Phase: 2 Type: NAT Subtype: Result: ALLOW Config: nat (inside,outside) source static EBOOTIS-INT EBOOTIS-EXT Additional Information: Static translate 172.16.2.10/0 to 1.1.1.30/0
Phase: 3 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information:
Phase: 4 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:
Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information:
Phase: 6 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information:
Phase: 7 Type: NAT Subtype: rpf-check Result: ALLOW Config: nat (inside,outside) source static EBOOTIS-INT EBOOTIS-EXT Additional Information:
Phase: 8 Type: FLOW-CREATION Subtype: Result: ALLOW Config: Additional Information: New flow created with id 10593, packet dispatched to next module
Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (inspect-icmp-seq-num-not-matched) ICMP Inspect seq num not matched
------------
Running Config:
sh run nat nat (inside,outside) source static EBOOTIS-INT EBOOTIS-EXT nat (inside,outside) source static FIREPOWER-INT FIREPOWER-EXT nat (inside,outside) source static NETWORK_OBJ_172.16.2.0_24 NETWORK_OBJ_172.16.2.0_24 destination static NETWORK_OBJ_192.168.113.0_24 NETWORK_OBJ_192.168.113.0_24 no-proxy-arp route-lookup
----------------
I think it's a nat problem but I can't fix it.
... View more
Labels:
01-16-2016
02:03 AM
Thank you Joel for your reply.
I've figured out the problem, it was from the Lancom router.
... View more
01-15-2016
04:34 AM
Hello,
I have installed Cisco Router that is connected to dual German ISPs and ASA 5508-X. The network is as follows:
-----------------------------------------------------------
ISP1 ISP2
192.168.1.1 192.168.2.1
|
Cisco Router (172.16.1.1)
|
Cisco ASA
|
Lancom DSL Router (172.16.2.2)
|
Exchange server (DHCP) 192.168.0.0/24 <-- Exchange IP is 192.168.0.10
|
Internal Network
-----------------------------------------------------------
The problem
1-Users can connect to exchange from internal network only, but they can't use Outlook Anyconnect from outside.
2-Users can't open OWA from outside.
Any solution?
Thank you in advance
... View more
- Tags:
- ASA 5508
Labels:
09-03-2014
12:33 AM
It's OK neocec, Please try to "clear user vty X" then check again. If still the same then you have to reload.
... View more
Created by
Maher Abdelshkour
in Networking Documents
in Networking Documents
05-19-2014
04:09 AM
05-19-2014
04:09 AM
Hi Nick, in my post I said: " roubleshooting Note: Both, the host and the switch port must have the same duplex configuration. Otherwise, the switch will have the port set to 100 Mbits / Full duplex and the server will get the card network set to 100 Mbits / Half duplex. When a device set to autonegotiation is connected to a device that is not using autonegotiation, the autonegotiation process fails. The autonegotiating end of the connection is still able to correctly detect the speed of the other end, but cannot correct the duplex mode." Cisco said: " Always hard code the speed and duplex settings for these ports. Manually configure these 10/100-Mbps link configurations for speed and duplex, which are usually 100-Mbps full duplex: But in some cases, Cisco Recommends: " Cisco recommends that auto-negotiation be used when the devices involved are compliant with the 802.3u standard. Refer to Troubleshooting Cisco Catalyst Switches to NIC Compatibility Issues for more information on specific products. Auto-negotiation is very useful for ports where devices with different capabilities are connected and disconnected on a regular basis. A good example is offices that are used by visiting employees who bring their own laptops." So we're on the same page, Nick :) Have a good day, Maher Switch-to-switch Switch-to-server Switch-to-router "
... View more
Created by
Maher Abdelshkour
in Networking Documents
in Networking Documents
05-19-2014
02:15 AM
05-19-2014
02:15 AM
Thank you n.oneill for your comment, but please refer to http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/24330-185.html to know why I recommended hard coding the speed and duplex. Thank you!
... View more
Created by
Maher Abdelshkour
in Networking Documents
in Networking Documents
05-01-2014
11:15 PM
05-01-2014
11:15 PM
Introduction Network issues can be incredibly easy to sort out (replacing a network cable, for example) to ridiculously complicated and expensive (replacing a server, maybe.) In this article, I'm hopefully trying to provide a few pointers to solving the most common issues you'll come up against. Configure Duplex and speed Troubleshooting Note: Both, the host and the switch port must have the same duplex configuration. Otherwise, the switch will have the port set to 100 Mbits / Full duplex and the server will get the card network set to 100 Mbits / Half duplex. When a device set to autonegotiation is connected to a device that is not using autonegotiation, the autonegotiation process fails. The autonegotiating end of the connection is still able to correctly detect the speed of the other end, but cannot correct the duplex mode. Symptoms: Increasing collision rate in the switch port, is not accepted in full duplex environments. Spanning tree Root Root Bridge Election Process Each switch has a bridge ID (BID) of priority value followed by MAC address. Switches exchange Bridge Protocol Data Unit (BDPU) to compare bridge IDs. The switch with the lowest bridge ID becomes the root bridge. Eventually, all switches agree that the switch with the lowest BID is the root bridge. Troubleshooting Note: It is strongly recommended that the designated root bridge is the switch with high MTBF. If the root bridge becomes unavailable, there will be a deadlock in the network during the new election process and convergence topology. Configuring Spanning Tree PortFast During the execution of the Spanning-Tree Algorithm, Spanning-Tree will force the ports to go into five different states: Blocked Listen Learn Forward Disabled Troubleshooting Note: It is strongly recommended that the NICs of the servers have a shorter transition between the up and down status. However, be aware of possible loops that are mitigated when not using the spanning tree on that port. Preventing Loops with Spanning Tree Solution: Enabling BPDU guard Bridge Protocol Data Unit = BPDU Configuring Errdisable Port State Recovery --> Optional Default recovery interval is 300 Troubleshooting Note: It is strongly recommended to use the bpduguard when portfast is configured. The bpduguard put the port in errdisable state when "listening" on port BPDU frames that had been set to portfast. Configuring VTP Troubleshooting Note: It is strongly recommended that new switches that are used in the production network are initially configured in "transparent" mode. Before you create VLANs, you must decide whether to use VTP in your network. Using VTP, you can make configuration changes centrally on one or more switches and have those changes automatically communicated to all the other switches in the network. Without VTP, you cannot send information about VLANs to other switches. Configuring Switchport mode Troubleshooting Note: It is strongly recommended not to leave any port configured as dynamic, this will prevent future unwanted occurrence of Trunks. Always configure all ports as "access" and then change to "trunk" ports that need to be configured as trunk. For the trunk to run smoothly, necessarily, both devices must be configured in the same VTP domain. Configuring Trunk NOTE: When setting the mode of the port, the DTP protocol is disabled. Troubleshooting Note: There are switches that do not have "switchport trunk encapsulation" command, these switches utilize dot1q protocol by default and do not support ISL protocol. Using PAgP Protocol to configure EtherChannel Modes: auto - passive negotiation of the channel desirable - active negotiation of the channel on - no protocols are used: it assumes the other side has also enabled link aggregation Troubleshooting Note: Before configuring EtherChannel between switches, you must first put the ports in "administrative down" by using the "shutdown" command. Otherwise, the other Switch (which has not been configured) will detect loop, since the first device configured in etherchannel disclose the MAC ADDRESS of the first port on all ports that comprise the channel group. All ports that belong to a channel group must have the same settings regarding the speed and transmission mode. Documenting Troubleshooting It cannot be stressed too highly that you need to document your troubleshooting. Write down what you do all the way along – it will help you in the future with similar problems, and can also help other people help you. References: https://communities.cisco.com/docs/DOC-52278
... View more
Labels:
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
Hi Bogdan, Thanks a lot for your help! Best Regards, Maher
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
I noticed this: #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 Now
this means the issue is on th...
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
That's right! sh crypto ipsec sainterface: outside Crypto map tag:
outside_map, seq num: 1, local ad...
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
Seems better now Phase: 1Type: UN-NATSubtype: staticResult:
ALLOWConfig:nat (inside,outside) source ...
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
Hi again, yes of course. here it is: sh run nat nat (inside,outside)
source static NETWORK_OBJ_172.1...
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
Hello Bogdan, Thanks for the prompt reply. I have tried to move the
identity NAT for VPN into the fi...
Created by
Maher Abdelshkour
in VPN and AnyConnect
12-12-2017
12-12-2017
Hello, We have a VPN connection between our HQ and one of our branches
which has a Bintec router. Ph...
01-16-2016
Thank you Joel for your reply. I've figured out the problem, it was from
the Lancom router.
01-15-2016
Hello, I have installed Cisco Router that is connected to dual German
ISPs and ASA 5508-X. The netwo...
09-03-2014
It's OK neocec, Please try to "clear user vty X" then check again. If
still the same then you have t...
05-19-2014
Hi Nick,in my post I said:"roubleshooting Note: Both, the host and the
switch port must have the sam...
05-19-2014
Thank you n.oneill for your comment, but please refer to
http://www.cisco.com/c/en/us/support/docs/s...
Created by
Maher Abdelshkour
in Networking Documents
05-01-2014
05-01-2014
Introduction Network issues can be incredibly easy to sort out
(replacing a network cable, for examp...
Public Statistics
| Date Registered | 10-08-2013 02:05 AM |
| Date Last Visited | 08-29-2018 12:01 AM |
| Total Messages Posted | 56 |
| Total Helpful Votes Received | 367 |
Helpful Votes Given To
Helpful Votes From
