Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About bachma0507
08-18-2017
Stats
Member since
01-28-2011
13
Posts
0
Helpful
0
Solutions
04-17-2011
07:43 AM
It's a PPTP vpn tunnel. I get no response when I ping the IP of the outside interface from home or anywhere outside of the physical office location. I can ping the IP address of the outside interface of the working PIX successfully. The error message I get is: "The PPTP-VPN server did not respond. Please contact your systems administrator. Try reconnecting. If the problem continues, verify your settings and contact your Administator." Here is the config of the working PIX: Building configuration... : Saved : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password tdkuTUSh53d2MT6B encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname dslpix domain-name mycompany.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 no fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 no names name 172.26.0.238 tlc042 name 172.26.0.250 tlc001 name 172.26.0.251 tlc002 name 172.26.0.41 lkm-srv-dcs-01 name 172.26.5.20 TLCXCH01 name 172.26.0.11 TLCXCH01_Web_Mail access-list outside_access_in permit tcp any host 172.26.0.11 eq imap4 access-list outside_access_in permit tcp any host 68.xxx.xxx.10 eq ssh access-list outside_access_in permit tcp any host 172.26.0.11 eq www access-list outside_access_in permit tcp any host 172.26.0.11 eq smtp access-list outside_access_in permit udp any any eq 4500 access-list outside_access_in permit udp any any eq isakmp access-list outside_access_in permit icmp any any access-list inside_outbound_nat0_acl permit ip any 172.26.0.192 255.255.255.248 access-list splittunnel permit ip 172.26.0.0 255.255.0.0 172.26.0.0 255.255.0.0 access-list TLC_splitTunnelAcl permit ip 172.26.0.0 255.255.0.0 any pager lines 24 logging on mtu outside 1500 mtu inside 1500 ip address outside 68.xxx.xxx.14 255.255.255.248 ip address inside 172.26.0.253 255.255.0.0 ip audit info action alarm ip audit attack action alarm ip local pool pptp-client-ip 172.26.0.195-172.26.0.199 pdm location 172.26.0.238 255.255.255.255 inside pdm location 172.26.0.250 255.255.255.255 inside pdm location 172.26.0.251 255.255.255.255 inside pdm location 172.26.0.41 255.255.255.255 inside pdm location 192.168.5.0 255.255.255.0 inside pdm location 172.26.0.192 255.255.255.248 outside pdm location 172.26.5.20 255.255.255.255 inside pdm location 172.26.0.11 255.255.255.255 inside pdm location 172.26.0.54 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) 68.xxx.xxx.12 172.26.0.251 netmask 255.255.255.255 0 0 static (inside,outside) 68.xxx.xxx.10 172.26.0.250 netmask 255.255.255.255 0 0 static (inside,outside) 172.26.5.20 172.26.5.20 netmask 255.255.255.255 0 0 static (inside,outside) 172.26.0.11 172.26.0.11 netmask 255.255.255.255 0 0 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 68.xxx.xxx.9 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http 172.26.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server community my-public no snmp-server enable traps floodguard enable sysopt connection permit-pptp sysopt connection permit-l2tp crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside isakmp enable outside isakmp key ******** address 0.0.0.0 netmask 0.0.0.0 isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 vpngroup TLC address-pool pptp-client-ip vpngroup TLC dns-server 172.26.0.250 172.26.0.251 vpngroup TLC wins-server 172.26.0.250 172.26.0.251 vpngroup TLC default-domain TLCUSA.mycompany.com vpngroup TLC split-tunnel splittunnel vpngroup TLC idle-time 1800 vpngroup TLC password ******** telnet 172.26.0.0 255.255.0.0 inside telnet 0.0.0.0 0.0.0.0 inside telnet timeout 5 ssh timeout 5 management-access inside console timeout 0 vpdn group PPTP-VPDN-GROUP accept dialin pptp vpdn group PPTP-VPDN-GROUP ppp authentication chap vpdn group PPTP-VPDN-GROUP ppp authentication mschap vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto required vpdn group PPTP-VPDN-GROUP client configuration address local pptp-client-ip vpdn group PPTP-VPDN-GROUP client configuration dns 172.26.0.250 172.26.0.251 vpdn group PPTP-VPDN-GROUP pptp echo 60 vpdn group PPTP-VPDN-GROUP client authentication local vpdn username yyyyy password ********* vpdn enable outside vpdn enable inside dhcpd address 172.26.0.254-172.26.1.29 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside username xxxx password eNFScgcUsDOLFsBQ encrypted privilege 2 username zzzzz password HKVV2E67LcaGEJHY encrypted privilege 2 terminal width 80 Cryptochecksum:455e098afea58a4aa09d4c05896e7924 : end [OK]
... View more
04-15-2011
11:53 AM
I have two PIX 501 devices with virtually the same configuration (except with different outisde and inside IP addresses, VPN pool IPs, etc). I can get to the outside on both from within the inside network. I have VPN connectivity set up on both. However, I can only access the VPN through one of the devices. I compared the configuration on the working PIX to the one on the non-working one but cannot see what the issue can be. I also cannot ping the outside interface on the problem pix, which I think may the cause of the issue since when I try to connect to the VPN it gives an error indicating that the PPTP-VPN server is not responding. I have PAT set up on both for the outside interface and that works fine. The config of the problem PIX is below. Any help is greatly appreciated. Building configuration... : Saved : PIX Version 6.3(3) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password tdkuTUSh53d2MT6B encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname attdslpix2 domain-name mycompany.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list inside_outbound_nat0_acl permit ip any 172.26.0.192 255.255.255.248 access-list outside_access_in permit udp any any eq 4500 access-list outside_access_in permit udp any any eq isakmp access-list outside_access_in permit icmp any any access-list splittunnel permit ip 172.26.0.0 255.255.0.0 172.26.0.0 255.255.0.0 access-list TLC_splitTunnelAcl permit ip 172.26.0.0 255.255.0.0 any pager lines 24 logging on logging standby mtu outside 1500 mtu inside 1500 ip address outside 70.xxx.xx.158 255.255.255.248 ip address inside 172.26.0.249 255.255.0.0 ip audit info action alarm ip audit attack action alarm ip local pool pptp-client-ip 172.26.5.195-172.26.5.199 pdm location 172.26.5.192 255.255.255.248 outside pdm location 172.26.0.192 255.255.255.248 outside pdm logging alerts 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 70.xxx.xx.153 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http 172.26.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps tftp-server inside 172.26.0.54 /pix549 floodguard enable sysopt connection permit-pptp sysopt connection permit-l2tp crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside isakmp enable outside isakmp key ******** address 0.0.0.0 netmask 0.0.0.0 isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup TLC address-pool pptp-client-ip vpngroup TLC dns-server 172.26.0.250 172.26.0.251 vpngroup TLC wins-server 172.26.0.250 172.26.0.251 vpngroup TLC split-tunnel splittunnel vpngroup TLC idle-time 1800 vpngroup TLC password ******** telnet 172.26.0.0 255.255.0.0 inside telnet 0.0.0.0 0.0.0.0 inside telnet timeout 5 ssh timeout 5 management-access inside console timeout 0 vpdn group PPTP-VPDN-GROUP accept dialin pptp vpdn group PPTP-VPDN-GROUP ppp authentication chap vpdn group PPTP-VPDN-GROUP ppp authentication mschap vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto required vpdn group PPTP-VPDN-GROUP client configuration address local pptp-client-ip vpdn group PPTP-VPDN-GROUP client configuration dns 172.26.0.250 172.26.0.251 vpdn group PPTP-VPDN-GROUP pptp echo 60 vpdn group PPTP-VPDN-GROUP client authentication local vpdn username bjulien password ********* vpdn enable outside vpdn enable inside dhcpd address 172.26.5.100-172.26.5.130 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside dhcpd enable inside terminal width 80 Cryptochecksum:696e36174e523ef7b16b20cd9532d111 : end [OK]
... View more
- Tags:
- vpn_configuration
Labels:
04-13-2011
09:56 AM
I am now using an ASA 5505 and not the PIX 501 for L2TP vpn client access. The ASA 5505 works fine. Thanks.
... View more
Created by
bachma0507
in VPN and AnyConnect
in VPN and AnyConnect
04-13-2011
08:59 AM
04-13-2011
08:59 AM
Thank you! That worked.
... View more
Created by
bachma0507
in VPN and AnyConnect
in VPN and AnyConnect
04-13-2011
06:48 AM
04-13-2011
06:48 AM
I am unable to connect to the vpn I set up on my ASA 5505 using the Cisco VPN Client on a Windows machine. The log of the vpn client and the config of the ASA 5505 are below. Any help in resolving this is appreciated. LOG CISCO VPN CLIENT Cisco Systems VPN Client Version 5.0.06.0160 Copyright (C) 1998-2009 Cisco Systems, Inc. All Rights Reserved. Client Type(s): Windows, WinNT Running on: 6.1.7600 Config file directory: C:\Program Files\Cisco Systems\VPN Client\ 1 09:34:23.030 04/13/11 Sev=Info/4 CM/0x63100002 Begin connection process 2 09:34:23.061 04/13/11 Sev=Info/4 CM/0x63100004 Establish secure connection 3 09:34:23.061 04/13/11 Sev=Info/4 CM/0x63100024 Attempt connection with server "71.xx.xx.253" 4 09:34:23.061 04/13/11 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 71.xx.xx.253. 5 09:34:23.061 04/13/11 Sev=Info/4 IKE/0x63000001 Starting IKE Phase 1 Negotiation 6 09:34:23.077 04/13/11 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 71.xx.xx.253 7 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 71.xx.xx.253 8 09:34:23.170 04/13/11 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from 71.xx.xx.253 9 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 10 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 11 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x63000001 Peer supports DPD 12 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x63000001 Peer supports NAT-T 13 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x63000001 Peer supports IKE fragmentation payloads 14 09:34:23.170 04/13/11 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 15 09:34:23.170 04/13/11 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 71.xx.xx.253 16 09:34:23.170 04/13/11 Sev=Info/6 IKE/0x63000055 Sent a keepalive on the IPSec SA 17 09:34:23.170 04/13/11 Sev=Info/4 IKE/0x63000083 IKE Port in use - Local Port = 0xEB07, Remote Port = 0x1194 18 09:34:23.170 04/13/11 Sev=Info/5 IKE/0x63000072 Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end IS behind a NAT device 19 09:34:23.170 04/13/11 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 20 09:34:23.170 04/13/11 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system 21 09:34:23.186 04/13/11 Sev=Info/5 IKE/0x6300005E Client sending a firewall request to concentrator 22 09:34:23.186 04/13/11 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 71.xx.xx.253 23 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 71.xx.xx.253 24 09:34:23.248 04/13/11 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 71.xx.xx.253 25 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 172.26.6.1 26 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.0.0 27 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 172.26.0.250 28 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 172.26.0.251 29 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000 30 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = TLCUSA 31 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000 32 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5505 Version 8.2(1) built by builders on Tue 05-May-09 22:45 33 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001 34 09:34:23.248 04/13/11 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194 35 09:34:23.248 04/13/11 Sev=Info/4 CM/0x63100019 Mode Config data received 36 09:34:23.264 04/13/11 Sev=Info/4 IKE/0x63000056 Received a key request from Driver: Local IP = 172.26.6.1, GW IP = 71.xx.xx.253, Remote IP = 0.0.0.0 37 09:34:23.264 04/13/11 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 71.xx.xx.253 38 09:34:23.326 04/13/11 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 71.xx.xx.253 39 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 71.xx.xx.253 40 09:34:23.326 04/13/11 Sev=Info/5 IKE/0x63000045 RESPONDER-LIFETIME notify has value of 86400 seconds 41 09:34:23.326 04/13/11 Sev=Info/5 IKE/0x63000047 This SA has already been alive for 0 seconds, setting expiry to 86400 seconds from now 42 09:34:23.326 04/13/11 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 71.xx.xx.253 43 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN) from 71.xx.xx.253 44 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 71.xx.xx.253 45 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000049 Discarding IPsec SA negotiation, MsgID=89EE7032 46 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=2617522400DC1763 R_Cookie=029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED 47 09:34:23.326 04/13/11 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 71.xx.xx.253 48 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000058 Received an ISAKMP message for a non-active SA, I_Cookie=2617522400DC1763 R_Cookie=029325381036CCD8 49 09:34:23.326 04/13/11 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(Dropped) from 71.xx.xx.253 50 09:34:26.696 04/13/11 Sev=Info/4 IKE/0x6300004B Discarding IKE SA negotiation (I_Cookie=2617522400DC1763 R_Cookie=029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED 51 09:34:26.696 04/13/11 Sev=Info/4 CM/0x63100012 Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_IKE_NEG_FAILED". 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 52 09:34:26.696 04/13/11 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 53 09:34:26.696 04/13/11 Sev=Info/6 CM/0x63100046 Set tunnel established flag in registry to 0. 54 09:34:26.696 04/13/11 Sev=Info/4 IKE/0x63000001 IKE received signal to terminate VPN connection ---------------------------------------------------------------------------------------- ASA 5505 CONFIG : Saved : ASA Version 8.2(1) ! hostname ciscoasa domain-name mycompany.com enable password tdkuTUSh53d2MT6B encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface Vlan1 nameif inside security-level 100 ip address 172.26.0.252 255.255.0.0 ! interface Vlan2 nameif outside security-level 0 ip address 71.xx.xx.253 255.255.255.240 ! interface Ethernet0/0 switchport access vlan 2 speed 100 duplex full ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive clock timezone EST -5 clock summer-time EDT recurring dns server-group DefaultDNS domain-name mycompany.com access-list LIMU_Split_Tunnel_List remark The corporate network behind the ASA access-list LIMU_Split_Tunnel_List standard permit 172.26.0.0 255.255.0.0 access-list outside_access_in extended permit icmp any any access-list outside_access_in extended permit udp any any eq 4500 access-list outside_access_in extended permit udp any any eq isakmp access-list outside_access_in extended permit tcp any host 71.xx.xxx.251 eq ftp access-list outside_access_in extended permit tcp any host 71.xx.xxx.244 eq 3389 access-list inside_outbound_nat0_acl extended permit ip any 172.26.5.192 255.255.255.240 access-list inside_outbound_nat0_acl extended permit ip any 172.26.6.0 255.255.255.128 pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 ip local pool VPN_POOL 172.26.6.1-172.26.6.100 mask 255.255.0.0 icmp unreachable rate-limit 1 burst-size 1 asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 static (inside,outside) 71.xx.xxx.251 172.26.5.9 netmask 255.255.255.255 static (inside,outside) 71.xx.xxx.244 172.26.0.136 netmask 255.255.255.255 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 71.xx.xxx.241 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius http server enable http 172.26.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd auto_config outside ! no threat-detection basic-threat no threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes wins-server value 172.26.0.250 172.26.0.251 dns-server value 172.26.0.250 172.26.0.251 vpn-tunnel-protocol IPSec l2tp-ipsec svc default-domain value TLCUSA group-policy LIMUVPNPOL1 internal group-policy LIMUVPNPOL1 attributes dns-server value 172.26.0.250 172.26.0.251 vpn-idle-timeout 30 vpn-tunnel-protocol IPSec l2tp-ipsec split-tunnel-policy tunnelspecified split-tunnel-network-list value LIMU_Split_Tunnel_List address-pools value VPN_POOL group-policy TLCVPNGROUP internal group-policy TLCVPNGROUP attributes dns-server value 172.26.0.250 172.26.0.251 vpn-tunnel-protocol IPSec l2tp-ipsec svc re-xauth disable ipsec-udp enable default-domain value TLCUSA username barry.julien password YCkQv7rLwCSNRqra06+QXg== nt-encrypted privilege 0 username barry.julien attributes vpn-group-policy TLCVPNGROUP vpn-tunnel-protocol IPSec l2tp-ipsec username bjulien password bhKBinDUWhYqGbP4 encrypted username bjulien attributes vpn-group-policy TLCVPNGROUP tunnel-group DefaultRAGroup general-attributes address-pool VPN_POOL default-group-policy DefaultRAGroup tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key * tunnel-group DefaultRAGroup ppp-attributes no authentication ms-chap-v1 authentication ms-chap-v2 tunnel-group TLCVPNGROUP type remote-access tunnel-group TLCVPNGROUP general-attributes address-pool VPN_POOL default-group-policy TLCVPNGROUP tunnel-group TLCVPNGROUP ipsec-attributes pre-shared-key * isakmp ikev1-user-authentication none tunnel-group TLCVPNGROUP ppp-attributes authentication pap authentication ms-chap-v2 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp ! service-policy global_policy global prompt hostname context Cryptochecksum:b94898c163c59cee6c143943ba87e8a4 : end asdm history enable
... View more
Labels:
04-08-2011
12:35 PM
I'm trying to setup a L2TP over IPSEC vpn connection on a PIX 501 that will use key sharing. In addition, I have a PPTP connection setup which allows connectivity. Two things, the L2TP vpn client I am using does not connect and times out. The second is that the PPTP client I use does connect, but cannot ping any resources on the network. The config on the PIX is below: Building configuration... : Saved : PIX Version 6.3(3) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password tdkuTUSh53d2MT6B encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname attdslpix2 domain-name mycompany.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list inside_outbound_nat0_acl permit ip any 172.26.5.192 255.255.255.248 access-list outside_access_in permit udp any any eq 4500 access-list outside_access_in permit udp any any eq isakmp access-list outside_access_in permit icmp any any access-list splittunnel permit ip 172.26.0.0 255.255.0.0 172.26.0.0 255.255.0.0 access-list TLC_splitTunnelAcl permit ip 172.26.0.0 255.255.0.0 any pager lines 24 logging on logging standby mtu outside 1500 mtu inside 1500 ip address outside 70.x.x.x 255.255.255.248 ip address inside 172.26.0.249 255.255.0.0 ip verify reverse-path interface outside ip audit info action alarm ip audit attack action alarm ip local pool pptp-client-ip 172.26.5.195-172.26.5.199 ip local pool l2tp-client-ip 172.26.7.100-172.26.7.199 pdm location 172.26.5.192 255.255.255.248 outside pdm logging alerts 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 route outside 0.0.0.0 0.0.0.0 70.x.x.y 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http 172.26.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec sysopt connection permit-pptp sysopt connection permit-l2tp crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport crypto dynamic-map l2tp 30 set transform-set TRANS_ESP_3DES_SHA crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map map1 30 ipsec-isakmp dynamic l2tp crypto map map1 interface outside isakmp enable outside isakmp key ******** address 0.0.0.0 netmask 0.0.0.0 isakmp nat-traversal 20 isakmp policy 5 authentication pre-share isakmp policy 5 encryption 3des isakmp policy 5 hash sha isakmp policy 5 group 2 isakmp policy 5 lifetime 86400 isakmp policy 10 authentication rsa-sig isakmp policy 10 encryption des isakmp policy 10 hash sha isakmp policy 10 group 1 isakmp policy 10 lifetime 86400 vpngroup TLC address-pool pptp-client-ip vpngroup TLC dns-server 172.26.0.250 172.26.0.251 vpngroup TLC split-tunnel splittunnel vpngroup TLC idle-time 1800 vpngroup TLC password ******** telnet 172.26.0.0 255.255.0.0 inside telnet 0.0.0.0 0.0.0.0 inside telnet timeout 5 ssh timeout 5 management-access inside console timeout 0 vpdn group PPTP-VPDN-GROUP accept dialin pptp vpdn group PPTP-VPDN-GROUP ppp authentication chap vpdn group PPTP-VPDN-GROUP ppp authentication mschap vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto required vpdn group PPTP-VPDN-GROUP client configuration address local pptp-client-ip vpdn group PPTP-VPDN-GROUP client configuration dns 172.26.0.250 172.26.0.251 vpdn group PPTP-VPDN-GROUP pptp echo 60 vpdn group PPTP-VPDN-GROUP client authentication local vpdn group L2TP-VPDN-GROUP accept dialin l2tp vpdn group L2TP-VPDN-GROUP ppp authentication pap vpdn group L2TP-VPDN-GROUP client configuration address local l2tp-client-ip vpdn group L2TP-VPDN-GROUP client configuration dns 172.26.0.250 172.26.0.251 vpdn group L2TP-VPDN-GROUP client configuration wins 172.26.0.250 172.26.0.251 vpdn group L2TP-VPDN-GROUP client authentication local vpdn group L2TP-VPDN-GROUP l2tp tunnel hello 60 vpdn username user1 password ********* vpdn username user2 password ********* vpdn enable outside vpdn enable inside dhcpd address 172.26.5.100-172.26.5.130 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside terminal width 80 Cryptochecksum:007a9f1d72e4f1d3bb75c4e68525eb30 : end [OK]
... View more
- Tags:
- l2tp_vpn
Labels:
02-17-2011
01:27 PM
I connected back the PIX and everything is working again with no timeout delays. The speed is fine so it was perhaps my imagination about its slower speed compared to the ASA 5505. In any case, I want to continue to troubleshoot the ASA to figure out what's causing the delays.
... View more
02-17-2011
12:33 PM
The show interface output is below. I disabled threat detection and the the connection was working well for the past few hours until about 5 minutes ago, when the timing out delays started once again. I would gladly go back to the PIX, however, it only has a 10 user license and internet connectivity through the PIX seems to be a little slower than the ASA 5505 which has an unlimited user license. I bought a 50 user upgrade for the PIX but when I tried to activate it online, it says it cannot find the PIX serial number. I called Cisco Support, and they were able to find the serial in their records but the activation still said cannot find the serial number. Cisco Licensing Support is now handling the support case. Even when I am able to finally upgrade the user licenses on the PIX, I am hesitant to use it because of the slowness. I really need the ASA to work. Thanks for all your help. SHOW INTERFACE OUTPUT Interface Vlan1 "inside", is up, line protocol is up Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec MAC address 000000000, MTU 1500 IP address 172.26.0.252, subnet mask 255.255.0.0 Traffic Statistics for "inside": 32874148 packets input, 42566284217 bytes 17716087 packets output, 2130191314 bytes 717349 packets dropped 1 minute input rate 13 pkts/sec, 1251 bytes/sec 1 minute output rate 14 pkts/sec, 3006 bytes/sec 1 minute drop rate, 2 pkts/sec 5 minute input rate 342 pkts/sec, 473414 bytes/sec 5 minute output rate 188 pkts/sec, 8879 bytes/sec 5 minute drop rate, 2 pkts/sec Interface Vlan2 "outside", is up, line protocol is up Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec MAC address 00000000, MTU 1500 IP address zz.xx.yyy.aaa, subnet mask 255.255.255.240 Traffic Statistics for "outside": 17631945 packets input, 2088968709 bytes 30773743 packets output, 42375079649 bytes 2331 packets dropped 1 minute input rate 0 pkts/sec, 0 bytes/sec 1 minute output rate 0 pkts/sec, 63 bytes/sec 1 minute drop rate, 0 pkts/sec 5 minute input rate 188 pkts/sec, 8879 bytes/sec 5 minute output rate 337 pkts/sec, 472819 bytes/sec 5 minute drop rate, 0 pkts/sec Interface Ethernet0/0 "", is up, line protocol is up Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex(Half-duplex), Auto-Speed(100 Mbps) Available but not configured via nameif MAC address 0000000, MTU not set IP address unassigned 17635405 packets input, 2490698444 bytes, 0 no buffer Received 4495 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 2518 switch ingress policy drops 30754836 packets output, 42922459626 bytes, 0 underruns 403173 output errors, 317098 collisions, 0 interface resets 0 late collisions, 16506 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/1 "", is down, line protocol is down Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex, Auto-Speed Available but not configured via nameif MAC address 0000000, MTU not set IP address unassigned 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/2 "", is down, line protocol is down Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex, Auto-Speed Available but not configured via nameif MAC address 0000000, MTU not set IP address unassigned 1391268 packets input, 171193162 bytes, 0 no buffer Received 1140677 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 47420 packets output, 40507712 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/3 "", is down, line protocol is down Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex, Auto-Speed Available but not configured via nameif MAC address 00000000, MTU not set IP address unassigned 31294332 packets input, 42661930417 bytes, 0 no buffer Received 755120 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 17359091 packets output, 2338880870 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/4 "", is up, line protocol is up Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) Available but not configured via nameif MAC address 000000000, MTU not set IP address unassigned 551810 packets input, 396891089 bytes, 0 no buffer Received 148561 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 296211 packets output, 147710772 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/5 "", is down, line protocol is down Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex, Auto-Speed Available but not configured via nameif MAC address 000000000, MTU not set IP address unassigned 16173 packets input, 1782898 bytes, 0 no buffer Received 3944 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 17263 packets output, 7730039 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/6 "", is down, line protocol is down Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex, Auto-Speed Available but not configured via nameif MAC address 000000000, MTU not set IP address unassigned 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops Interface Ethernet0/7 "", is down, line protocol is down Hardware is 88E6095, BW 100 Mbps, DLY 100 usec Auto-Duplex, Auto-Speed Available but not configured via nameif MAC address 00000000, MTU not set IP address unassigned 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 0 switch ingress policy drops 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops 0 switch egress policy drops
... View more
02-17-2011
07:29 AM
All interfaces are set to auto. I disabled the threat detection. Let me see if that helps. Thanks!
... View more
02-16-2011
03:08 PM
We recently got a 10 meg dedicated internet fiber connection installed. I connected it to a PIX 501 firewall and everything worked fine (I tested it for a couple of weeks). A couple of days ago I got a new ASA 5505 and replaced the PIX with this device. It works, but every so often there seems to be a timeout when surfing the web whereby I click on a link and there is up to a 45 second wait and then the page loads quickly. I was not getting this before on the PIX so I'm assuming it's not a latency issue with the connection. I am the only one using this connection on the network so it's not to say that it's being bogged down. It's driving me crazy! I want to roll this out to the other users on the network but not when this is happening. Can someone point me in the right direction? The configuration is below: : Saved : ASA Version 8.2(1) ! hostname ciscoasa domain-name mycompany.com enable password tdkuTUSh53d2MT6B encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface Vlan1 nameif inside security-level 100 ip address 172.26.0.252 255.255.0.0 ! interface Vlan2 nameif outside security-level 0 ip address zz.xx.yyy.253 255.255.255.240 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive clock timezone EST -5 clock summer-time EDT recurring dns server-group DefaultDNS domain-name mycompany.com access-list MC_Split_Tunnel_List remark The corporate network behind the ASA access-list MC_Split_Tunnel_List standard permit 172.26.0.0 255.255.0.0 access-list outside_access_in extended permit icmp any any access-list outside_access_in extended permit udp any any eq 4500 access-list outside_access_in extended permit udp any any eq isakmp access-list outside_access_in extended permit tcp any host zz.xx.yyy.251 eq ftp access-list inside_outbound_nat0_acl extended permit ip any 172.26.5.192 255.255.255.240 pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 ip local pool VPN_POOL 172.26.6.1-172.26.6.100 mask 255.255.0.0 icmp unreachable rate-limit 1 burst-size 1 asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 static (inside,outside) zz.xx.yyy.251 172.26.5.9 netmask 255.255.255.255 static (inside,outside) zz.xx.yyy.244 172.26.0.136 netmask 255.255.255.255 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 zz.xx.yyy.241 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius http server enable http 172.26.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd auto_config outside ! threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 webvpn group-policy VPNPOL1 internal group-policy VPNPOL1 attributes dns-server value 172.26.0.250 172.26.0.251 vpn-idle-timeout 30 vpn-tunnel-protocol IPSec l2tp-ipsec split-tunnel-policy tunnelspecified split-tunnel-network-list value MC_Split_Tunnel_List address-pools value VPN_POOL username bjulien password bhKBinDUWhYqGbP4 encrypted username bjulien attributes vpn-group-policy VPNPOL1 tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key * ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp ! service-policy global_policy global prompt hostname context Cryptochecksum:ed6fd7d8535120634dfb59217a295c26 : end
... View more
- Tags:
- asa_5505
Labels:
01-28-2011
10:52 AM
I just received a Cisco SG 300-10 switch, and I am a relative novice working with smart switches, so bear with me. I added a VLAN (VLAN 2) and assigned port 7 to it. So now there is the default VLAN 1 and VLAN 2. The IPv4 Interface Table is: VLAN 1 Interface: VLAN 1 IP Address Type: Static IP Address: 172.26.0.192 Mask: 255.255.0.0 Status: Valid VLAN 2 Interface: VLAN 2 IP Address Type: Static IP Address: 172.27.0.1 Mask: 255.255.0.0 Status: Valid The default gateway is 172.26.0.252. The IPv4 Static Routes now look like this: I changed the system mode to Layer 3 from Layer 2 since I assume I need to do this in order for one VLAN to see devices on another. I have a dumb switch attached to port 7 (VLAN 2) and a laptop connected to the dumb switch with IP address 172.27.0.117. On the SG 300-10 switch, port 1 is connected to the default gateway (172.26.0.252) and port 2 is connected to a desktop PC with IP address 172.26.0.136. From the desktop I can access the internet through the default gateway. As expected, from the laptop (IP 172.27.0.117) I cannot access the internet neither can I see the desktop because they are on separate VLANs. I want to be able to access the internet and also to be able to see my desktop (172.26.0.136) from the laptop so I need the VLANs to be able to access each other's devices. How would I go about doing this? By the way, all this is being done in a test environment since I need to make sure I get this right before deploying it. Thanks for your help on this.
... View more
Labels:
04-17-2011
It's a PPTP vpn tunnel.I get no response when I ping the IP of the
outside interface from home or an...
04-15-2011
I have two PIX 501 devices with virtually the same configuration (except
with different outisde and ...
04-13-2011
I am now using an ASA 5505 and not the PIX 501 for L2TP vpn client
access. The ASA 5505 works fine. ...
Created by
bachma0507
in VPN and AnyConnect
04-13-2011
04-13-2011
I am unable to connect to the vpn I set up on my ASA 5505 using the
Cisco VPN Client on a Windows ma...
04-08-2011
I'm trying to setup a L2TP over IPSEC vpn connection on a PIX 501 that
will use key sharing. In addi...
02-17-2011
I connected back the PIX and everything is working again with no timeout
delays. The speed is fine s...
02-17-2011
The show interface output is below. I disabled threat detection and the
the connection was working w...
02-17-2011
All interfaces are set to auto.I disabled the threat detection. Let me
see if that helps. Thanks!
02-16-2011
We recently got a 10 meg dedicated internet fiber connection installed.
I connected it to a PIX 501 ...
Public Statistics
| Date Registered | 01-28-2011 10:16 AM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 13 |
