Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jimwillsher
08-18-2017
Stats
Member since
08-02-2009
34
Posts
5
Helpful
0
Solutions
07-03-2016
01:52 PM
Same vlan but different subnets, and no DHCP broadcast. So I should be safe.
Many thanks for your help, I couldn't have achieved it without your guidance. VERY much appreciated.
Jim (in Scotland)
... View more
07-03-2016
01:14 PM
Just my understanding - or lack thereof - of DHCP :-) I assumed that a device didn't know which subnet it was on, and sent the DHCP request out (broadcast), and I was worried that the DHCP server at the "other site" might reply. Am I mistaken?
Jim
... View more
07-02-2016
11:30 PM
Brilliant! Initially I had
permit ip host remote.host.ip.address any
in acl-EXT-IN. But I've removed that and added the two rules you mention, and it seems to work :-) This is the output from the two sow crypto commands:
LaminatesFibre#show cryp isakm sa IPv4 Crypto ISAKMP SA dst src state conn-id status 82.69.1.37 82.69.10.202 QM_IDLE 2002 ACTIVE IPv6 Crypto ISAKMP SA LaminatesFibre#show cryp ipsec sa interface: Tunnel0 Crypto map tag: Tunnel0-head-0, local addr 82.69.1.37 protected vrf: (none) local ident (addr/mask/prot/port): (82.69.1.37/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (82.69.10.202/255.255.255.255/47/0) current_peer 82.69.10.202 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 228, #pkts encrypt: 228, #pkts digest: 228 #pkts decaps: 181, #pkts decrypt: 181, #pkts verify: 181 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 82.69.1.37, remote crypto endpt.: 82.69.10.202 path mtu 1500, ip mtu 1500, ip mtu idb Dialer0 current outbound spi: 0x91630BBD(2439187389) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x71F38487(1911784583) transform: esp-3des esp-md5-hmac , in use settings ={Transport, } conn id: 3, flow_id: Onboard VPN:3, sibling_flags 80000000, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4236741/54472) IV size: 8 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x91630BBD(2439187389) transform: esp-3des esp-md5-hmac , in use settings ={Transport, } conn id: 4, flow_id: Onboard VPN:4, sibling_flags 80000000, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4236742/54472) IV size: 8 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: LaminatesFibre#
You've already been very kind to me with your assistance, but could I trouble you to cast your eye one final time over my configs? I've attached both and they are entire (except passwords). The parts I'm keen to get sanity-checked are the crypto stuff and also my access lists (acl-EXT-IN). For example, I have a DHCP server at both sites, but now that I'm no longer permitting all traffic, is it necessary for me to still be blocking DHCP?
Many thanks again for your time and help.
Jim
... View more
07-02-2016
02:27 PM
ok, strange....I've re-keyed all the commands after a reload, and now it works! I've also had to add an allow all to my inbound ACL at both ends, allowing all from the "other side" public IP.
It seems to work, and looking at the output from the two sh cryp commands, it's encrpyting.
... View more
07-01-2016
11:53 PM
Many thanks for your reply.
I have uploaded four entire configs (except for passwords; IPs and ACLs are real), one for each site with the tunnel and one for each site after loading the crypto commands. Before adding crypto, the tunnel is up:
LaminatesFibre#ping 192.168.3.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.3.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 44/44/48 ms LaminatesFibre#
but after adding crypto, it's down:
LaminatesFibre#ping 192.168.3.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.3.2, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) LaminatesFibre#
Finally, here's the output from the two commands on one site, after adding the crypto:
LaminatesFibre#show cryp isakm sa IPv4 Crypto ISAKMP SA dst src state conn-id status 82.69.10.202 82.69.1.37 MM_NO_STATE 0 ACTIVE IPv6 Crypto ISAKMP SA LaminatesFibre# LaminatesFibre#show cryp ipsec sa interface: Tunnel0 Crypto map tag: Tunnel0-head-0, local addr 82.69.1.37 protected vrf: (none) local ident (addr/mask/prot/port): (82.69.1.37/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (82.69.10.202/255.255.255.255/47/0) current_peer 82.69.10.202 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 5, #recv errors 0 local crypto endpt.: 82.69.1.37, remote crypto endpt.: 82.69.10.202 path mtu 1500, ip mtu 1500, ip mtu idb Dialer0 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: LaminatesFibre#
... View more
Created by
jimwillsher
in VPN and AnyConnect
in VPN and AnyConnect
07-01-2016
02:05 PM
07-01-2016
02:05 PM
Hi
I have set up a tunnel bewteen two Cisco 887s across the internet. it works fine, but now I want to encrypt it but I'm not getting very far. These are the useful bits of the config:
R1 (LAN 192.168.7.x/24, WAN 82.69.1.37)
interface Tunnel0 ip address 172.16.1.1 255.255.255.0 ip mtu 1400 ip tcp adjust-mss 1360 tunnel source 82.69.1.37 tunnel destination 82.69.10.202
ip access-list extended acl-NAT-Ranges deny ip 192.168.7.0 0.0.0.255 192.168.3.0 0.0.0.255 permit ip 192.168.7.0 0.0.0.255 any
ip route 192.168.3.0 255.255.255.0 172.16.1.2
R2 (LAN 192.168.3.x/24, WAN 82.69.10.202)
interface Tunnel0 ip address 172.16.1.2 255.255.255.0 ip mtu 1400 ip tcp adjust-mss 1360 tunnel source 82.69.10.202 tunnel destination 82.69.1.37
ip access-list extended acl-NAT-Ranges deny ip 192.168.3.0 0.0.0.255 192.168.7.0 0.0.0.255 permit ip 192.168.3.0 0.0.0.255 any
ip route 192.168.7.0 255.255.255.0 172.16.1.1
All works fine, I can ping devices on the other system and I can map network drives to remote servers etc.
But...I want to add some security. I have tried various things to add encryption, e.g.:
crypto isakmp key PASS address 82.69.1.37 crypto ipsec transform-set TS esp-3des esp-md5-hmac mode transport crypto ipsec profile protect-gre set security-association lifetime seconds 86400 set transform-set TS crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 lifetime 86400 int Tunnel0 tunnel protection ipsec profile protect-gre
tunnel mode ipsec ipv4
(plus the opposite for the other router).
However as soon as I add the command:
int Tunnel0 tunnel protection ipsec profile protect-gre
or
int Tunnel0 tunnel mode ipsec ipv4
I can no longer ping.
I'm not after NASA-grade encryption, I just want something simple. Most of the google articles I can find are quite old and the configurations give me errors about GDOI etc.
Many thanks to anyone who can assist.
Jim
... View more
Labels:
02-07-2016
08:34 AM
Hello Sorry for the long post, but I've hopefully presented all pertinent information. I have a Cisco 800 (877) with an ADSL connection (interface Dialer0). All my LAN devices are on a single interface, Vlan1. I have recently been added to an IPv6 trial by my ISP, Zen Internet (UK-based). I'm running OIS 12.4(24).T4. I have a *reasonable* understanding of IPv4, but IPv6 is all very new to me. This is the exact wording in the email from my ISP: ==================== Thank you for your email. Your subscriber account has now been enabled for IPv6. Your IPv6 address details are: ND Prefix: 2a02:8011:d000:21::/64 PD Prefix: 2a02:8010:6036::/48 The two prefixes are described below, along with some further information on the Zen IPv6 service: /64 Neighbour Discovery (ND) Prefix. This is used to automatically address the WAN interface of your Router, or if you are directly connected without a router, the WAN interface of that device. /48 Delegation Prefix. This is usually provided over DHCPv6, and requires that your router acts as a requesting router for the purpose of IPv6 delegation RFC3633 - (https://tools.ietf.org/html/rfc3633). Subnets of this prefix are used by the CPE to address devices on the LAN. If prefix delegation is not supported on the router, a suggested interface ID and static route is available, which should allow routing to take place. We also have an IPv6 enabled DNS Resolver (2a02:8010:1::212:23:3:100) , the IPv6 Address of this will be automatically advertised to supporting routers RFC3646 (https://tools.ietf.org/html/rfc3646). It can also be configured manually if required. ==================== I have configured IPv6 on my router as follows: ipv6 unicast-routing ipv6 cef ipv6 dhcp pool NODE-DHCPV6 dns-server 2A02:8010:6036:0:4CCB:4CB:E7AF:4D34 < What I believe to be the correct IP for my Windows server on the LAN domain-name HOME.local interface Vlan1 ipv6 address NODE-PD ::/64 eui-64 ipv6 address autoconfig ipv6 enable ipv6 nd other-config-flag ipv6 dhcp server NODE-DHCPV6 interface Dialer0 ipv6 address FE80::1 link-local ipv6 address NODE-PD ::FF:0:0:0:1/128 ipv6 address autoconfig ipv6 enable ipv6 dhcp client pd NODE-PD rapid-commit dialer-list 1 protocol ipv6 permit ipv6 route ::/0 Dialer0 Note that the above was gleaned mostly from two googled pages, namely: http://www.internode.on.net/support/guides/internet_access/ipv6/cisco_routers/ https://supportforums.cisco.com/document/54871/ipv6-cisco-877 In other words, I've followed the above guides blindly, and I'm not necessarily doing the right thing :-) Everything *seems* to be working correctly. I can ping internal and external IPv6 addresses, I can get results back from a ping -6 www.google.co.uk (on Windows), and I get 19/20 from http://ipv6-test.com/ (the missing one being a rDNS entry, which I will contact my ISP about). Here is my doubt/concern. I have some VMs in the house, hosting some websites, antivirus server, mail server etc. I want to guarantee that the IPv6 addresses assigned to these hosts will never change, so that I can add AAAA DNS entries. To ensure that addresses don't change, for IPv4 I would normally use DHCP on my Windows server for this, but I understand that a local DHCP server for IPv6 should rarely be required. As I understand it, using the eui-64 method of address generation should assign an IPv6 address based on the MAC, but that doesn't seem to be happening. As such, I'm worried that the address might change in the future, for whatever reason. Here's an example IPCONFIG output: Ethernet adapter Ethernet: Connection-specific DNS Suffix . : HOME.local Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I219-LM Physical Address. . . . . . . . . : F8-CA-B8-32-5C-6B DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2a02:8010:6036:0:e1da:6637:a4dd:fa48(Preferred) Temporary IPv6 Address. . . . . . : 2a02:8010:6036:0:d5a5:93d7:988d:1462(Preferred) Link-local IPv6 Address . . . . . : fe80::e1da:6637:a4dd:fa48%22(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.214(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : 07 February 2016 15:29:43 Lease Expires . . . . . . . . . . : 12 February 2016 15:29:44 Default Gateway . . . . . . . . . : fe80::221:a0ff:fee9:55b8%22 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.12 DHCPv6 IAID . . . . . . . . . . . : 66636472 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-1E-E8-D5-F8-CA-B8-32-5C-6B DNS Servers . . . . . . . . . . . : 2a02:8010:6036:0:4ccb:4cb:e7af:4d34 192.168.1.11 NetBIOS over Tcpip. . . . . . . . : Enabled Connection-specific DNS Suffix Search List : HOME.local As I see it, there's no correlation between the MAC (F8-CA-B8-32-5C-6B) and the IPv6 address (2a02:8010:6036:0:e1da:6637:a4dd:fa48). Am I worrying unnecessarily? Am I doing things right, or wrong, or have I got some Frankenstein hybrid configuration that's doomed to fail? As I say, things *seem* to be working....but I want to get this right. For the avoidance of doubt, I do have an IPv4 DHCP server configured,but not IPv6. Many thanks to whomever is able to assist.
... View more
Labels:
12-07-2014
12:58 AM
I've done a confreg reload of everything and...so far....it seems to be working..... Many thanks Jim
... View more
12-05-2014
01:30 PM
Still no joy, and I've added speed settings to the ports: interface FastEthernet0 duplex full speed 100 ! interface FastEthernet1 duplex full speed 100 ! interface FastEthernet2 duplex full speed 100 ! interface FastEthernet3 duplex full speed 100 I'm now connected to a different port on the Cisco and I've had a load of continuous pings running. When the problem occurs, pings to the router fail (and my PC-based connections drop) but pings to other devices on the LAN all succeed, as do pings from a remote site to the WAN IP. So it's definitely something on the LAN side of the router; not the PC, not the WAN side; not the switch. Please help, I'm going nuts with this as it's causing a lot of embarrasment when Skype/Lync calls drop mid-call :-( I'm going to have to replace it with a Netgear at this rate. Many thanks Jim
... View more
12-05-2014
07:49 AM
Strange....I've had a second PC hooked up to the 877 directly, not going through our main switch, and it has had a ping -t running. When everything dropped earlier, pings from that PC did NOT drop. I'm pretty confident it's not the switch; it's a TP-Link 24-port gigabit that replaced a Dell PowerConnect 16-port, and we had the same problem when that was in place. I've swapped the connections on the 877 and will see what happens; it could be an issue specific to FE0. Jim
... View more
12-04-2014
12:26 PM
Here's the output after an occurrence that's just happened: Cisco877#sh log Syslog logging: enabled (0 messages dropped, 5197 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. No Inactive Message Discriminator. Console logging: disabled Monitor logging: disabled Buffer logging: level informational, 662 messages logged, xml disabled, filtering disabled Logging Exception size (4096 bytes) Count and timestamp logging messages: disabled Persistent logging: disabled No active filter modules. ESM: 0 messages dropped Trap logging: level debugging, 84260 message lines logged Logging to 192.168.1.50 (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 84260 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled Logging to 192.168.1.215 (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 84260 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled Log Buffer (4096 bytes): 4 20:19:44.162: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(51646) -> 82.69.47.116(25), 1 packet Dec 4 20:19:48.187: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(40991) -> 82.71.3.59(25), 1 packet Dec 4 20:19:52.272: %FW-6-DROP_PKT: Dropping tcp session 37.252.162.126:443 192.168.1.215:59448 due to Stray Segment with ip ident 0 tcpflags 0x5004 seq.no 477919163 ack 0 Dec 4 20:20:00.598: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 12 packets Dec 4 20:20:30.292: %FW-6-DROP_PKT: Dropping tcp session 217.163.21.35:443 192.168.1.215:59459 due to Stray Segment with ip ident 0 tcpflags 0x5004 seq.no 707160579 ack 0 Dec 4 20:20:46.420: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(51651) -> 82.69.47.116(25), 1 packet Dec 4 20:20:50.441: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(40996) -> 82.71.3.59(25), 1 packet Dec 4 20:21:00.587: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 12 packets Dec 4 20:21:02.291: %FW-6-DROP_PKT: Dropping tcp session 68.178.177.8:443 192.168.1.205:54274 due to Retransmitted Segment with Invalid Flags with ip ident 0 tcpflags 0x5004 seq.no 1488467456 ack 2480886212 Dec 4 20:21:34.306: %FW-6-DROP_PKT: Dropping tcp session 23.195.50.110:443 192.168.1.215:59507 due to SYN inside current window with ip ident 0 tcpflags 0x8012 seq.no 428093149 ack 2568338795 Dec 4 20:21:47.793: %SEC-6-IPACCESSLOGP: list acl-EXT-IN permitted tcp 138.128.146.20(47492) -> 88.97.49.242(25), 1 packet Dec 4 20:21:52.698: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(44083) -> 82.69.45.208(25), 1 packet Dec 4 20:22:00.580: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 15 packets Dec 4 20:22:29.274: %FW-6-DROP_PKT: Dropping tcp session 23.195.50.110:443 192.168.1.215:59510 due to SYN inside current window with ip ident 0 tcpflags 0x8012 seq.no 409166136 ack 2347211612 Dec 4 20:22:50.939: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(51663) -> 82.69.47.116(25), 1 packet Dec 4 20:22:54.964: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(44088) -> 82.69.45.208(25), 1 packet Dec 4 20:23:00.581: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 7 packets Dec 4 20:23:10.823: %FW-6-DROP_PKT: Dropping tcp session 88.97.49.242:59351 216.58.208.34:443 due to RST inside current window with ip ident 29949 tcpflags 0x5014 seq.no 1226830570 ack 3453581517 Dec 4 20:23:51.940: %FW-6-DROP_PKT: Dropping tcp session 23.195.63.139:80 192.168.1.215:59514 due to Invalid Seq# with ip ident 59880 tcpflags 0x5011 seq.no 1084492278 ack 1444424189 Dec 4 20:24:00.582: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(40986) -> 82.71.3.59(25), 3 packets Dec 4 20:24:00.582: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(44067) -> 82.69.45.208(25), 4 packets Dec 4 20:24:00.582: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(51641) -> 82.69.47.116(25), 4 packets Dec 4 20:24:22.023: %FW-6-DROP_PKT: Dropping tcp session 88.97.49.242:54347 179.60.192.49:443 due to RST inside current window with ip ident 13779 tcpflags 0x5014 seq.no 1328697609 ack 1209108995 Dec 4 20:25:00.580: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(40991) -> 82.71.3.59(25), 3 packets Dec 4 20:25:00.580: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(51646) -> 82.69.47.116(25), 4 packets Dec 4 20:25:00.580: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(44072) -> 82.69.45.208(25), 3 packets Dec 4 20:25:02.348: %FW-6-DROP_PKT: Dropping tcp session 88.97.49.242:59551 216.58.208.35:443 due to RST inside current window with ip ident 2134 tcpflags 0x5014 seq.no 94686862 ack 3140316892 Dec 4 20:25:03.652: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(51673) -> 82.69.47.116(25), 1 packet Dec 4 20:25:07.693: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(41018) -> 82.71.3.59(25), 1 packet Nothing obvious that I can see :-( Should I increase logging somehow? Jim
... View more
12-04-2014
10:20 AM
It's really only used as an internet gateway, since Cisco cripple it with a 100Mb switch. So there's only one RJ45 connected, and that goes to a gigabit switch. Very good suggestions though, thanks for that. What I'll do is capture the logging next time it happens, with no changes, and then set the interface settings that you've suggested and see what happens. Thanks again Jim
... View more
12-04-2014
09:25 AM
Thanks Neil. Could you clarify please, so that I run the right commands? My config has these commands: logging buffered 16386 logging rate-limit 100 except warnings no logging console no logging monitor if I issue a show log I only see commands related to packets dropped by the firewall: Cisco877#sh log Syslog logging: enabled (0 messages dropped, 5197 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. No Inactive Message Discriminator. Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 83556 messages logged, xml disabled, filtering disabled Logging Exception size (4096 bytes) Count and timestamp logging messages: disabled Persistent logging: disabled No active filter modules. ESM: 0 messages dropped Trap logging: level debugging, 83560 message lines logged Logging to 192.168.1.50 (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 83560 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled Logging to 192.168.1.215 (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 83560 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled Log Buffer (16386 bytes): 6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(39836) -> 82.71.3.59(25), 1 packet Dec 4 16:53:00.673: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 11 packets Dec 4 16:53:16.852: %FW-6-DROP_PKT: Dropping tcp session 88.97.49.242:52042 134.170.185.125:80 due to RST inside current window with ip ident 28603 tcpflags 0x5014 seq.no 334908965 ack 2998717454 Dec 4 16:54:00.582: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(42918) -> 82.69.45.208(25), 1 packet Dec 4 16:54:00.674: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 8 packets Dec 4 16:54:13.409: %FW-6-DROP_PKT: Dropping tcp session 88.97.49.242:51990 216.58.208.32:443 due to RST inside current window with ip ident 22062 tcpflags 0x5014 seq.no 888286696 ack 3966538452 Dec 4 16:55:03.072: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(50500) -> 82.69.47.116(25), 1 packet Dec 4 16:55:26.285: %FW-6-DROP_PKT: Dropping tcp session 172.228.99.152:443 192.168.1.216:55816 due to Stray Segment with ip ident 44301 tcpflags 0x5004 seq.no 3227290753 ack 0 Dec 4 16:55:56.947: %SEC-6-IPACCESSLOGP: list acl-EXT-IN denied tcp 103.41.124.60(9090) -> 88.97.49.242(22), 1 packet Dec 4 16:56:00.672: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 35 packets Dec 4 16:56:00.672: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(42904) -> 82.69.45.208(25), 4 packets Dec 4 16:56:00.672: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(50479) -> 82.69.47.116(25), 4 packets Dec 4 16:56:00.672: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(39826) -> 82.71.3.59(25), 4 packets Dec 4 16:56:04.553: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(50506) -> 82.69.47.116(25), 1 packet Dec 4 16:56:05.561: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(39853) -> 82.71.3.59(25), 1 packet Dec 4 16:56:47.659: %FW-6-DROP_PKT: Dropping tcp session 23.63.99.218:80 192.168.1.205:52105 due to SYN inside current window with ip ident 0 tcpflags 0x8012 seq.no 702035596 ack 4117363060 Dec 4 16:57:00.673: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(42909) -> 82.69.45.208(25), 5 packets Dec 4 16:57:00.673: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(39831) -> 82.71.3.59(25), 4 packets Dec 4 16:57:00.673: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(50484) -> 82.69.47.116(25), 2 packets Dec 4 16:57:07.055: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(50512) -> 82.69.47.116(25), 1 packet Dec 4 16:57:08.059: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(39859) -> 82.71.3.59(25), 1 packet Dec 4 16:57:18.637: %FW-6-DROP_PKT: Dropping tcp session 173.194.67.95:443 192.168.1.205:52080 due to Retransmitted Segment with Invalid Flags with ip ident 1251 tcpflags 0x5004 seq.no 1539574469 ack 0 Dec 4 16:57:40.310: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(48911) -> 50.63.202.104(25), 1 packet Dec 4 16:57:49.176: %FW-6-DROP_PKT: Dropping tcp session 88.97.49.242:51778 82.69.10.202:3389 due to RST inside current window with ip ident 6231 tcpflags 0x5014 seq.no 4097025617 ack 3869095260 Dec 4 16:58:00.671: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 3 packets Dec 4 16:58:00.671: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(42914) -> 82.69.45.208(25), 4 packets Dec 4 16:58:00.671: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(39836) -> 82.71.3.59(25), 4 packets Dec 4 16:58:08.540: %SEC-6-IPACCESSLOGP: list acl-INT-IN permitted tcp 192.168.1.50(50522) -> 82.69.47.116(25), 1 packet Jim
... View more
07-03-2016
Same vlan but different subnets, and no DHCP broadcast. So I should be
safe. Many thanks for your he...
07-03-2016
Just my understanding - or lack thereof - of DHCP :-) I assumed that a
device didn't know which subn...
07-02-2016
Brilliant! Initially I had permit ip host remote.host.ip.address any in
acl-EXT-IN. But I've removed...
07-02-2016
ok, strange....I've re-keyed all the commands after a reload, and now it
works! I've also had to add...
07-01-2016
Many thanks for your reply. I have uploaded four entire configs (except
for passwords; IPs and ACLs ...
Created by
jimwillsher
in VPN and AnyConnect
07-01-2016
07-01-2016
Hi I have set up a tunnel bewteen two Cisco 887s across the internet. it
works fine, but now I want ...
02-07-2016
HelloSorry for the long post, but I've hopefully presented all pertinent
information.I have a Cisco ...
12-07-2014
I've done a confreg reload of everything and...so far....it seems to be
working.....Many thanksJim
12-05-2014
Still no joy, and I've added speed settings to the ports: interface
FastEthernet0 duplex full speed ...
12-05-2014
Strange....I've had a second PC hooked up to the 877 directly, not going
through our main switch, an...
12-04-2014
Here's the output after an occurrence that's just happened: Cisco877#sh
logSyslog logging: enabled (...
12-04-2014
It's really only used as an internet gateway, since Cisco cripple it
with a 100Mb switch. So there's...
Public Statistics
| Date Registered | 08-02-2009 10:58 PM |
| Date Last Visited | 08-18-2017 03:51 AM |
| Total Messages Posted | 34 |
| Total Helpful Votes Received | 5 |
