Can a Cisco 881 router create an L2TP/IPsec tunnel via NAT to Windows 2008?

Hi
Was anyone successfull in setting up an L2TP/IPsec tunnel through NAT-T against a Windows 2008/ R2 RRAS server? I am using an 881 router and the layout is someting like this:
Client -> 881 -> NAT -> internet -> Windows 2008 RRAS
The tunnel goes form the 881 to the Windows server (not from the client...).
Thanks
Roland

Hi Federico
Thanks for your help! Much appreciated.
In my case this should be transparent to the client - I would like not to initiate the connection from the client.
Does that makes sense? I am considering L2TP because Windows 2008 R2 doesn't support IPSec tunnels through NAT (2008 R2 being the responder and the Cisco router the initiator of the IPSec connection).
Regards
Roland

Similar Messages

  • Can a Cisco 2600 router do PPTP,L2TP, and IPSec?

    General question.

    2600 supports L2TP and PPTP with MPPE with an IP PLUS version, and IPsec with a firewall version.

  • Is it possible to build two different L2TP/IPSec tunnels per subnet or per user?

    Dear colleagues
    I wondered whether anyone could help with this one.
    Is it possible to build two different L2TP/IPSec tunnels per subnet or per user on a Cisco router or any other third party manufacturer?  The idea behind is to allow different access to resources to different support technicians.  Your help is much appreciated.

    Sure, the ASA can use LDAP/AD information to select what access list should be applied for that specific user or group of users logging into the VPN. You can use whats called DAP or just LDAP Attribute Maps.

  • 1921 Router Q: How many IPsec tunnels will it support?

    Sorry if this isn't the spot for hardware questions... I need to know how many IPsec VPN tunnels one Cisco1921 can support reliably. Haven't had any luck sifting through documentation on the web.
    Thanks in advance for any help!

    The SEC-K9 permanent licenses apply to the Cisco 1900, 2900, and 3900 ISR G2 platforms; these licenses limit
    all encrypted tunnel counts to 225 tunnels maximum for IP Security (IPsec), Secure Sockets Layer VPN (SSL
    VPN), a secure time-division multiplexing (TDM) gateway, and secure Cisco Unified Border Element (CUBE) and
    1000 tunnels for Transport Layer Security (TLS) sessions.
    The SEC-K9 license limits encrypted throughput to less than or equal to 85-Mbps unidirectional traffic in or out of
    the ISR G2 router, with a bidirectional total of 170 Mbps. This requirement applies for the Cisco 1900, 2900, and
    3900 ISR G2 platforms. The SEC-K9 permanent licenses apply to the Cisco 1900, 2900, and 3900 ISR G2 platforms; these licenses limit
    Thanks
    Ajay

  • Mac os x wiki server can't authenticate user password from active directory recently after we upgraded to windows 2008 server.

    after upgraded to windows 2008 server, our  mac os x wiki server can't authenticate user password anymore. How can I re-bind the wiki server to the AD again? thanks in advance.

    Solved it by deleting the user and creating a new one with the same userID.
    Maybe it occured because I marked the "user has to change password after first login" box when resetting the password but didn't yet allow him to do so in the webpages menu?!?

  • Creating instance oracle 10.2.0.4 on Windows 2008 32bit

    Hello,
    I'm trying to install oracle database (10.2.0.3 with patch 10.2.0.4) on Windows 2008 32bit.
    I first installed the Oracle software, and then started to create the instance. But the dbca gives me following error:
    ora-12560:TNS:protocol adapter
    and instance creations fails. Also trying to create the service via the oradim fails.
    Then I found this:
    Install Oracle 10.2.0.3 (Vista/2008 version) on Windows 2008 Active Directory Controller.
    When trying to create the database, around 2% completion, the error ORA-12560 will occur.
    This Problem does NOT reproduce on a Member server. Only the Active Directory Controller.
    Cause
    This is currently logged as Bug 7263061.
    Solution
    Currently, the only workaround is to Install the software on a Non-Controller machine.
    You can try demoting the Controller machine to a Member machine.
    Perform the install, create the database.
    When everything is setup correctly, you can promote the machine back to a Controller.
    However, be aware you may have to go through these steps whenever you create a new DB.
    DIM-00019: create service error
    O/S-Error: (OS 1388) A new member could not be added to a local group because
    the member has the wrong account type.
    WORKAROUND:
    None
    so workaround none? or you make that controller machine to a non-controller, but this doesn't seem to be a good solution if that server is already in production???
    Is there possible another solutions to get around this?
    This means that I can't install Oracle on a Windows 2008? Customers will be happy, maybe I can switch them all to Linux? ;)

    I care about low-budget shops, too. It's one reason you won't find me extolling the virtues of (for example) solid state hard disks, which are still not cheap enough for mass deployment.
    But come on! A shop that can ONLY afford one server and one Windows license? And yet they want to install Oracle?? Really??!
    I think instead of banging your head against an installation brick wall, you should help your clients and customers cut their cloth according to their means. If they want to run Oracle, then they should resource accordingly. For about AU$2500 or less, they could purchase an additional, quite capable server, install Linux on it (OEL for $99 per year, or Centos (say) for absolutely nothing), and have themselves a dedicated Oracle server running perfectly fine in a mostly-Windows environment. (The OS the database runs on is irrelevant to anyone making use of the database's capabilities, after all). If they can't spring for even that sort of money, encourage them to adjust their standard to be more realistic: a cheap desktop PC can be purchased for mere hundreds of dollars, have a free OS, and have Oracle installed (unsupported) on top of that. If even that is a step to far, I'd suggest using MySQL or Postgres instead of Oracle.
    So whilst I'm certain you're not the only one encountering the problems of working in low budget environments, I'd say this is going to extremes. If someone wants to run Oracle, and if they've stumped up the several thousand dollars necessary to purchase it, it seems utter madness not to come up with a few hundred dollars more to get it running on a dedicated machine. It would be like me being able to afford the Ferrari, but not the cost of the petrol to run it on!
    A suggestion I made to a lawyer friend of mine recently: purchase an Asus EEE Desktop (cost: AU$499, for 1GB RAM and 120GB HDD), replace its Windows Home Os with Ubuntu, install Oracle XE (cost: $0), attach 1TB USB drive as backup mechanism (cost: AU$210). He now runs a dedicated Oracle database server for less than US$500. I wouldn't exactly recommend that sort of thing for mission-critical environments, but it will do the job he needs it to do! The point, though, is that you just have to be realistic about it, and create an environment that matches your requirements -without picking a fight from the get-go with the installer!

  • I am unable to browse internet from my cisco 881 router and configuration is below could any one help me in this regard

    HOME#sho run
    Building configuration...
    Current configuration : 5657 bytes
    ! Last configuration change at 10:51:11 UTC Fri May 17 2013 by admin
    version 15.0
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname HOME
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    enable secret 5 $1$bgx9$VrtQW3Wg182VyYhKAHLbN.
    no aaa new-model
    memory-size iomem 10
    crypto pki trustpoint TP-self-signed-1190003239
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1190003239
    revocation-check none
    rsakeypair TP-self-signed-1190003239
    crypto pki certificate chain TP-self-signed-1190003239
    certificate self-signed 01
      3082024A 308201B3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31313930 30303332 3339301E 170D3133 30353137 31303333
      35315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 31393030
      30333233 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100C002 80BBF151 E095E469 AA7DBB18 2A9E3CC2 4AC223F6 ABE0AF49 876C1203
      65D0E246 786F174D E5B7897A 44C5755A 2571E58A 184A6C62 DD992A2A D8A24878
      25A8D3C3 03F5D3C2 522EC8BB 302B0CCD 2945087A 7AF01418 D0056679 6F64DB4A
      BE2D5DA1 106CD03A 83B422A2 3CCBAE88 F2413123 12269390 6949DFE0 411118E7
      8F210203 010001A3 72307030 0F060355 1D130101 FF040530 030101FF 301D0603
      551D1104 16301482 12484F4D 452E7777 772E7961 686F6F2E 636F6D30 1F060355
      1D230418 30168014 3D2D854D 1203F50D 77F4ABC5 B61CEAF6 C922F4DF 301D0603
      551D0E04 1604143D 2D854D12 03F50D77 F4ABC5B6 1CEAF6C9 22F4DF30 0D06092A
      864886F7 0D010104 05000381 8100B24C 48BACACE 87ADEA03 386F2045 CC89624A
      4EB1AD09 062EB2A4 CF4C96CA 0B2CF001 BD2C3804 8DC47FED 6A5B5F0D 3965AC6E
      4FC4682F 707E4132 8F27C083 C7FAE1BD 21D055E6 C79D5DAD 051B6321 D35DB4F2
      044E6BBD DAD08B6A 6ED87C7E 08F4F7E1 4EFDFB6F 867AF6FA 84165CFC D219D56F
      A82EABD4 AD9CFA24 A5088145 E571
            quit
    ip source-route
    ip routing protocol purge interface
    ip dhcp excluded-address 10.10.10.1
    ip dhcp pool ccp-pool
       import all
       network 10.10.10.0 255.255.255.248
       default-router 10.10.10.1
       domain-name www.google.com
       dns-server 192.168.1.1
       lease 0 2
    ip cef
    ip domain name www.yahoo.com
    ip name-server 84.235.6.55
    ip name-server 84.235.57.230
    no ipv6 cef
    multilink bundle-name authenticated
    license udi pid CISCO881-SEC-K9 sn FCZ1516933C
    username admin privilege 15 password 0 cisco
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface FastEthernet4
    ip address dhcp
    ip access-group 101 in
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
    ip address 10.10.10.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat inside
    ip nat enable
    ip virtual-reassembly
    ip tcp adjust-mss 1452
    interface Vlan2
    no ip address
    ip nat inside
    ip virtual-reassembly
    ip default-gateway 192.168.1.1
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source list 101 interface FastEthernet4 overload
    ip route 0.0.0.0 0.0.0.0 FastEthernet4
    access-list 23 permit 10.10.10.0 0.0.0.7
    access-list 101 permit ip any any
    dialer-list 1 protocol ip permit
    no cdp run
    control-plane
    banner exec ^C
    % Password expiration warning.
    Cisco Configuration Professional (Cisco CP) is installed on this device
    and it provides the default username "cisco" for  one-time use. If you have
    already used the username "cisco" to login to the router and your IOS image
    supports the "one-time" user option, then this username has already expired.
    You will not be able to login to the router with this username after you exit
    this session.
    It is strongly suggested that you create a new username with a privilege level
    of 15 using the following command.
    username <myuser> privilege 15 secret 0 <mypassword>
    Replace <myuser> and <mypassword> with the username and password you
    want to use.
    ^C
    banner login ^C
    Cisco Configuration Professional (Cisco CP) is installed on this device.
    This feature requires the one-time use of the username "cisco" with the
    password "cisco". These default credentials have a privilege level of 15.
    YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE
    PUBLICLY-KNOWN CREDENTIALS
    Here are the Cisco IOS commands.
    username <myuser>  privilege 15 secret 0 <mypassword>
    no username cisco
    Replace <myuser> and <mypassword> with the username and password you want
    to use.
    IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
    NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
    For more information about Cisco CP please follow the instructions in the
    QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
    ^C
    banner motd ^Cuthorized ^C
    line con 0
    login local
    no modem enable
    line aux 0
    line vty 0 4
    access-class 23 in
    privilege level 15
    password cisco
    logging synchronous
    login local
    transport input telnet ssh
    scheduler max-task-time 5000
    end

    HOME#ping 4.2.2.2
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    HOME#sh ip int br
    Interface                  IP-Address      OK? Method Status                Protocol
    FastEthernet0              unassigned      YES unset  down                  down
    FastEthernet1              unassigned      YES unset  down                  down
    FastEthernet2              unassigned      YES unset  down                  down
    FastEthernet3              unassigned      YES unset  down                  down
    FastEthernet4              192.168.1.120   YES DHCP   up                    up 
    NVI0                       10.10.10.1      YES unset  up                    up 
    Vlan1                      10.10.10.1      YES NVRAM  down                  down
    Vlan2                      unassigned      YES NVRAM  down                  down
    HOME#
    fast ethernet is connected to my internet connection

  • Inter-vlan routing on CIsco 881 router ?

    Hello, I have configured my 881 to perform inter-VLAN routing i.e. I am using ports 0-2 as tagged switch ports (with PC's plugged in and addressed on their relevant subnets) and port 3 as a trunk feeding in to port 4 as a router on stick configuration.
    For some reason I am unable to ping between subnets. It seems the trunk is failing ?
    Could someone please take a look and help me out. It must be something basic. This is driving me crazy.
    p.s. I have entered 'switchport trunk encapsulation dot1q' on port 3 (the trunk) however it is not showing up.
    Thank you kindly for any help.
    Building configuration...
    Current configuration : 1564 bytes
    ! Last configuration change at 22:45:55 UTC Wed Apr 29 2015
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname Router
    boot-start-marker
    boot-end-marker
    no aaa new-model
    memory-size iomem 10
    ip flow-cache timeout active 1
    ip cef
    no ipv6 cef
    license udi pid CISCO881-K9 sn FGL171824DY
    interface FastEthernet0
     switchport access vlan 10
     no ip address
    interface FastEthernet1
     switchport access vlan 10
     no ip address
    interface FastEthernet2
     switchport access vlan 2
     no ip address
    interface FastEthernet3
     switchport trunk native vlan 15
     switchport mode trunk
     no ip address
     spanning-tree portfast
    interface FastEthernet4
     no ip address
     ip flow ingress
     ip flow egress
     duplex auto
     speed auto
    interface FastEthernet4.1
     encapsulation dot1Q 15 native
     ip address 192.168.15.1 255.255.255.0
    interface FastEthernet4.2
     encapsulation dot1Q 2
     ip address 192.168.2.1 255.255.255.0
    interface FastEthernet4.10
     encapsulation dot1Q 10
     ip address XXX.XXX.XXX.XXX 255.255.255.252  <== altered to block public ip address details
    interface Vlan1
     ip address 192.168.1.1 255.255.255.0
    ip default-gateway XXX.XXX.XXX.XXX <== altered to block public ip address details
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip flow-export source FastEthernet4
    ip flow-export version 5 origin-as
    ip flow-export destination 192.168.247.232 9996
    ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX <== altered to block public ip address details
    line con 0
     no modem enable
    line aux 0
    line vty 0 4
     login
     transport input all
    end

    Are you able to provide a diagram please? Having trouble understanding what you are trying to do.

  • Need a Way to Create a Local Group Push via GPO on Windows Server 2003 DC

    There is a new requirement to create a new local group on all machines and add all local and built-in administrators. To save time, I would like a GPO to create the new group, along with configuring its members. Any helpful information I found
    is for Windows Server 2008 and up.
    Does anyone know what I can do with my Windows Server 2003 DC?
    Thanks,
    Jasmin

    > Does anyone know what I can do with my Windows Server 2003 DC?
    Since DCs do not have local groups - what OS are your member servers and
    clients running? If 2003/XP: Install KB943729
    You need _one_ computer running Vista/2008 or higher to edit your GPO.
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • Windows Mobile 5.0 L2TP/IPSec native VPN to 3030

    Has anyone successfully setup a VPN using the built in VPN client in Windows Mobile 5.0 to a Cisco 3030? I am running into problems but have no idea why. I followed chapter 13 of "The Complete Cisco VPN Configuration Guide" from Cisco Press, to configure the L2TP/IPSec for Windows Client software, but still no luck. I would much rather use the native software from Windows Mobile rather than purchase a 3rd party app. Any help or reference's are greatly appreciated. Thanks in advance!

    Windows Mobile user 5.0 doesnt work with cisoc 3030. Mobile client requests a domain name on the credentials, which seems to be as "not valid" on the concentrator.

  • I have a Cisco wireless router.  Can I buy an Airport Express plug in booster for a distant part of my house or do I need an Airport Extreme base station instead to make the Airport Express plug in booster work?

    Can I buy an Airport Express plug-in wifi signal booster to connect to a Cisco wireless router, or do I have to buy an Airport Extreme base station to make the Airport Express plug-in work?

    You would need either an AirPort Extreme or an AirPort Express connected to the Cisco router, with a permanent Ethernet cable connection.
    Configure the Extreme or Express that is connected to the Cisco router to "create a wireless network".
    Then, you could add an AirPort Express to "extend a wireless network" to provide more wireless coverage for the network that the Extreme or Express would be creating.
    Remember that the Express can only "extend" the quality of signal that it receives, so it must be located where it can receive a strong signal from the "main" AirPort.
    If you don't need the Cisco wireless signal, you could turn it off.....or use that network for guests or something similar.
    The bottom line here......you always need two Apple routers if you want to extend the network wirelessly.

  • P2P Blocking is disabled in cisco 881 W router

    Hi
    We are facing an issue with the communication between wireless clients in same subnet .These users are not able to ping each other in cisco 881 W wireless router.
    But we can do in this router to disable this P2P blocking.  

    Well I would use a static on the AP, but if you depending on IOS dhcp to be reliable, then maybe you need to setup a Mac reservation for the AP. It would be after to just set a static on the AP. Since you know your environment will grow, it might be better that you start setting them to static. IOS dhcp isn't 100% reliable as you have already experienced.
    Sent from Cisco Technical Support iPad App

  • Cisco 1941 Router-on-a-Stick w/ 11VLANs trunked to a Cisco 2960: Can Ping a device in another VLAN, that device cannot ping back

    Cisco 1941 Router-on-a-Stick w/ 11VLANs trunked to a Cisco 2960: From the Switch I can Ping a device in another VLAN, that device cannot ping back. Some devices can ping devices in other VLANs and the device in the other VLAN can successfully return the Ping. Have a look at the attached diagram.
    Router Config:
    show run
    Building configuration...
    Current configuration : 7224 bytes
    ! Last configuration change at 09:05:48 EDT Wed Aug 6 2014
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname ROUTER
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone EDT -8 0
    ip cef
    ip name-server 8.8.8.8
    no ipv6 cef
    multilink bundle-name authenticated
    license udi pid CISCO1941/K9
    object-group network Net_Obj_Group1 
     description This network group allows all 10.0.0.0 and Email Forwarder server through to the Plt PCs
     205.191.0.0 255.255.0.0
     10.0.0.0 255.0.0.0
    object-group network Net_Obj_Group2 
     description This Network Group includes the Host IPs allowed through the Plant Router
     host 10.194.28.23
     host 10.194.28.25
     host 10.194.28.26
     host 10.194.28.27
     host 10.194.28.28
     host 10.194.28.29
     host 10.194.28.37
     host 10.194.28.39
     host 10.194.28.40
     host 10.194.28.70
     host 10.194.28.130
     host 10.194.28.131
     host 10.194.28.132
     host 10.194.28.133
     host 10.194.28.134
     host 10.194.28.135
     host 10.194.28.136
     host 10.194.28.137
     host 10.194.28.138
     host 10.194.28.139
     host 10.194.28.140
     host 10.194.28.141
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0
     description Port Ge0/0 to IT Enterprise network Switch GE1/0/38
     ip address 10.194.28.111 255.255.255.0
     ip access-group 105 in
     ip access-group 106 out
     ip nat outside
     ip virtual-reassembly in
     shutdown
     duplex full
     speed auto
     no mop enabled
    interface GigabitEthernet0/1
     description Port to Plant PCN-K/L24 Sw1 Port 0/24
     no ip address
     duplex auto
     speed auto
     no mop enabled
    interface GigabitEthernet0/1.102
     description Port to VLAN 102
     encapsulation dot1Q 102
     ip address 192.168.102.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.104
     description Port to VLAN 104
     encapsulation dot1Q 104
     ip address 192.168.104.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.105
     description Port to VLAN 105
     encapsulation dot1Q 105
     ip address 192.168.105.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.106
     description Port to VLAN 106
     encapsulation dot1Q 106
     ip address 192.168.106.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.107
     description Port to VLAN 107
     encapsulation dot1Q 107
     ip address 192.168.107.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.111
     description Port to VLAN 111
     encapsulation dot1Q 111
     ip address 192.168.111.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.117
     description Port to VLAN 117
     encapsulation dot1Q 117
     ip address 192.168.117.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.121
     description Port to VLAN 121
     encapsulation dot1Q 121
     ip address 192.168.121.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.125
     description Port to VLAN 125
     encapsulation dot1Q 125
     ip address 192.168.125.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.150
     description Port to to VLAN 150
     encapsulation dot1Q 150
     ip address 192.168.150.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.999
     description Port to VLAN 999
     encapsulation dot1Q 999
     ip address 192.168.0.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip nat inside source static 192.168.102.201 10.194.28.23
    ip nat inside source static 192.168.121.201 10.194.28.25
    ip nat inside source static 192.168.106.251 10.194.28.26
    ip nat inside source static 192.168.107.245 10.194.28.27
    ip nat inside source static 192.168.102.251 10.194.28.28
    ip nat inside source static 192.168.150.201 10.194.28.29
    ip nat inside source static 192.168.107.179 10.194.28.37
    ip nat inside source static 192.168.111.201 10.194.28.39
    ip nat inside source static 192.168.105.201 10.194.28.40
    ip nat inside source static 192.168.106.21 10.194.28.70
    ip nat inside source static 192.168.107.146 10.194.28.130
    ip nat inside source static 192.168.107.156 10.194.28.131
    ip nat inside source static 192.168.107.161 10.194.28.132
    ip nat inside source static 192.168.107.181 10.194.28.133
    ip nat inside source static 192.168.107.191 10.194.28.134
    ip nat inside source static 192.168.106.202 10.194.28.135
    ip nat inside source static 192.168.106.212 10.194.28.136
    ip nat inside source static 192.168.117.190 10.194.28.137
    ip nat inside source static 192.168.117.100 10.194.28.138
    ip nat inside source static 192.168.106.242 10.194.28.139
    ip nat inside source static 192.168.125.100 10.194.28.140
    ip nat inside source static 192.168.125.99 10.194.28.141
    ip nat outside source static 10.194.28.23 10.194.28.23
    ip nat outside source static 10.194.28.25 10.194.28.25
    ip nat outside source static 10.194.28.26 10.194.28.26
    ip nat outside source static 10.194.28.27 10.194.28.27
    ip nat outside source static 10.194.28.28 10.194.28.28
    ip nat outside source static 10.194.28.29 10.194.28.29
    ip nat outside source static 10.194.28.37 10.194.28.37
    ip nat outside source static 10.194.28.39 10.194.28.39
    ip nat outside source static 10.194.28.40 10.194.28.40
    ip nat outside source static 10.194.28.70 10.194.28.70
    ip nat outside source static 10.194.28.130 10.194.28.130
    ip nat outside source static 10.194.28.131 10.194.28.131
    ip nat outside source static 10.194.28.132 10.194.28.132
    ip nat outside source static 10.194.28.133 10.194.28.133
    ip nat outside source static 10.194.28.134 10.194.28.134
    ip nat outside source static 10.194.28.135 10.194.28.135
    ip nat outside source static 10.194.28.136 10.194.28.136
    ip nat outside source static 10.194.28.137 10.194.28.137
    ip nat outside source static 10.194.28.138 10.194.28.138
    ip nat outside source static 10.194.28.139 10.194.28.139
    ip nat outside source static 10.194.28.140 10.194.28.140
    ip nat outside source static 10.194.28.141 10.194.28.141
    ip route 0.0.0.0 0.0.0.0 10.194.28.1
    access-list 105 permit ip object-group Net_Obj_Group1 object-group Net_Obj_Group2
    access-list 106 permit ip object-group Net_Obj_Group2 object-group Net_Obj_Group1
    dialer-list 1 protocol ip permit
    control-plane
    banner login ^CC
    Login banner for Plant Router #01^C
    banner motd ^CC
    MOTD Banner for Plant Router^C
    line con 0
     password XXXXXXXXX
     logging synchronous
     login
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
     stopbits 1
    line vty 0 4
     password XXXXXXXXX
     logging synchronous
     login
     transport input all
    scheduler allocate 20000 1000
    ntp server 10.199.100.92
    end
    Switch Config:
    sh ru
    Building configuration...
    Current configuration : 6513 bytes
    version 12.2
    no service pad
    service timestamps debug uptime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname K24Sw01
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone EDT -5
    clock summer-time EDT recurring
    udld aggressive
    crypto pki trustpoint TP-self-signed-593746944
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-593746944
     revocation-check none
     rsakeypair TP-self-signed-593746944
      4B58BCE9 44
      quit
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface FastEthernet0
     no ip address
    interface GigabitEthernet0/1
     description Trunk port for vlans 105, 111, 125 and 999 from K24Sw01 port Ge0/1 to P22Sw01 port Ge0/24
     switchport trunk allowed vlan 105,111,125,999
     switchport mode trunk
    interface GigabitEthernet0/2
     description Trunk port for vlans 150 and 999 from K24Sw01 port Ge0/2 to N25Sw01 port Ge0/26
     switchport trunk allowed vlan 150,999
     switchport mode trunk
    interface GigabitEthernet0/3
     description Trunk port for vlans 102, 104, 106, 107, 117 and 999 from K24Sw01 port Ge0/3 to K28Sw01 port Ge0/26
     switchport trunk allowed vlan 102,104,106,107,117,999
     switchport mode trunk
    interface GigabitEthernet0/4
     description Trunk port for vlans 102, 106, 107 and 999 from K24Sw01 port Ge0/4 to H23Sw01 port Ge0/26
     switchport trunk allowed vlan 102,106,107,999
     switchport mode trunk
    interface GigabitEthernet0/5
     description Trunk port for vlans 121, 125 and 999 from K24Sw01 port Ge0/5 to M21Sw01 port Ge0/24
     switchport trunk allowed vlan 121,125,999
     switchport mode trunk
    interface GigabitEthernet0/6
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/7
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/8
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/9
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/10
     description VLan 102 access port
     switchport access vlan 102
     spanning-tree portfast
    interface GigabitEthernet0/11
     description - VLan 104 access port
     switchport access vlan 104
     spanning-tree portfast
    interface GigabitEthernet0/12
     description - VLan 105 access port
     switchport access vlan 105
     spanning-tree portfast
    interface GigabitEthernet0/13
     description - VLan 106 access port
     switchport access vlan 106
     spanning-tree portfast
    interface GigabitEthernet0/14
     description - VLan 107 access port
     switchport access vlan 107
     spanning-tree portfast
    interface GigabitEthernet0/15
     description - VLan 111 access port
     switchport access vlan 111
     spanning-tree portfast
    interface GigabitEthernet0/16
     description - VLan 117 access port
     switchport access vlan 117
     spanning-tree portfast
    interface GigabitEthernet0/17
     description - VLan 121 access port
     switchport access vlan 121
     spanning-tree portfast
    interface GigabitEthernet0/18
     description - VLan 125 access port
     switchport access vlan 125
     spanning-tree portfast
    interface GigabitEthernet0/19
     description - VLan 150 access port
     switchport access vlan 150
     spanning-tree portfast
    interface GigabitEthernet0/20
     description - VLan 999 access port
     switchport access vlan 999
     spanning-tree portfast
    interface GigabitEthernet0/21
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/22
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/23
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/24
     description From ROUTER Gw ge0/1
     switchport trunk allowed vlan 102,104-107,111,117,121,125,150,999
     switchport mode trunk
    interface GigabitEthernet0/25
    interface GigabitEthernet0/26
    interface Vlan1
     no ip address
     no ip route-cache
     shutdown
    interface Vlan102
     ip address 192.168.102.253 255.255.255.0
    interface Vlan104
     no ip address
     no ip route-cache
    interface Vlan105
     no ip address
     no ip route-cache
    interface Vlan106
     no ip address
     no ip route-cache
    interface Vlan107
     no ip address
     no ip route-cache
    interface Vlan111
     no ip address
     no ip route-cache
    interface Vlan117
     no ip address
     no ip route-cache
    interface Vlan121
     no ip address
     no ip route-cache
    interface Vlan125
     no ip address
     no ip route-cache
    interface Vlan150
     no ip address
     no ip route-cache
    interface Vlan999
     no ip address
     no ip route-cache
    ip default-gateway 192.168.102.1
    ip http server
    ip http secure-server
    snmp-server engineID local 00000009020000019634C2C0
    snmp-server community public RO
    snmp-server location 
    snmp-server contact 
    banner motd ^CCC ADMIN USE ONLY! ^C
    line con 0
     session-timeout 10 
     password xxxxxx
     logging synchronous
     login
     stopbits 1
    line vty 0 4
     session-timeout 10 
     password xxxxxxx
     login
    line vty 5 15
     session-timeout 10 
     password xxxxxxxx
     login
    ntp server 10.199.100.92
    end
    K24Sw01#

    HI Mark,
    Here is the my config:
    Create sub-interfaces, set 802.1Q trunking protocol and ip address on each sub-interface
    Router(config)#interface f0/0
    Router(config-if)#no shutdown
    (Note: The main interface f0/0 doesn’t need an IP address but it must be turned on)
    Router(config)#interface f0/0.10
    Router(config-subif)#encapsulation dot1q 10
    Router(config-subif)#ip address 192.168.10.1 255.255.255.0
    Router(config-subif)#interface f0/0.20
    Router(config-subif)#encapsulation dot11 20
    Router(config-subif)#ip address 192.168.20.1 255.255.255.0
    (Note: In the “encapsulation dot1q 10″ command, 10 is the VLAN ID this interface operates in)
    Configure VLAN
    Switch(config)#vlan 10
    Switch(config-vlan)#name SALES
    Switch(config-vlan)#vlan 20
    Switch(config-vlan)#name TECH
    Set ports to access mode & assign ports to VLAN
    Switch(config)#interface range fa0/1
    Switch(config-if)#no shutdown
    Switch(config-if)# switchport mode access
    Switch(config-if)# switchport access vlan 15
    Switch(config-if)#interface range fa0/3
    Switch(config-if)#no shutdown
    Switch(config-if)#switchport mode access
    Switch(config-if)# switchport access vlan 20
    Switch(config-if)#interface range fa0/5
    Switch(config-if)#no shutdown
    Switch(config-if)#switchport mode trunk
    1. Please check all your port are up.
    2. Check the config once again.
    3. Make sure the swicth and router connection port configured as trunk and it should be up.
    This config is working for me,
    Regards
    Dont forget to rate helpful posts.

  • From where can i download cisco "CCT Routing & Switching" free ebook

    plz tell me that from where can i download cisco "CCT Routing & Switching" free ebook.thanks

    If you mean this book:
    http://www.amazon.com/Routing-Switching-Secrets-Successful-Certified/dp/148615980X
    If it not free.  Looks like it may have been freely distributed at one time, but is not anymore.
    Based on the Amazon reviews, the book is not very valuable.
    You are better off using resources from http://learningnetwork.cisco.com.

  • Can I format the CF in a cisco 1800 router and then use it on the ASA 5520?

    Can I format Compact Flash in a cisco 1800 router and then use it on the ASA 5520?

    You don't have to format the card in the router. You can do that on your PC. Just format the CF-card as FAT32 and plug it into the ASA.
    BUT: If you just want to "upgrade" the old card with a different one, then first attach the original card from the ASA to your PC and copy all files (including the hidden ones) to your PC and then copy them back to the new card. That way you also move your licenses to the new card which are stored in hidden files and your private data like keys.

Maybe you are looking for