AAA accounting of Lan-to-Lan VPN connections on a 3005 Concentrator

Hello all,
I am trying to do AAA accounting for the Lan-to-Lan connections on a 3005 VPN concentrator. It does not seem to work. For incoming VPN client connections, it's working ok, I see the 3005 sending accounting data to our radius server. But nothig is sent for Lan-to-Lan connections.
Any ideas ? Is this not supported on the 3005 ?
Thanks,
Stefan

Ok, I have updated the image and now I can access all the SNMP info that was not there before. As before, no AAA data is sent for Lan-to-Lan connections and you only have access to current connection info via SNMP. So no historical data. But still, I can make a script that posts on a webpage the current connections, so people with no access to the concentrator can see it.
I see something weird tho, the snmpwalk is very slow. If I try to walk the interfaces.ifTable for example, it's very slow, one line every second. Must be something from the concentrator because the same snmpwalk on another router is very fast. Walking through the active vpn list takes longer than walking through the whole snmp tree on another router.
I only found something about SNMP reuqests queued ... but that didn't help. Any idea how I can speed up the snmp replies ?
Thanks,
Stefan

Similar Messages

Number of LAN-LAN VPN connections PIX515E

Anyone knows the total number of 3DES site-site VPNs that can be connected simultanously to a PIX515E?
I saw somewhere at Cisco the number 2000, but I'm curious if this is correct, because a Cisco VPN 3080 can do 1000 max...
Thanks in advance,
Edwin

there is this one but it looks very expensive.....its almost the price of the router itself..
http://www.tigerdirect.ca/applications/SearchTools/item-details.asp?EdpNo=2424193&csid=_61

Enable aaa accounting commands for all privilege levels?

Here is the command's syntax:
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} {start-stop | stop-only | none} [broadcast] group groupname
The "command" accounting type must include the privilege level of the commands you are logging. How do I log ALL commands?
Take the following example:
aaa accounting commands 15 default start-stop group mygroup
If I issue this command will that mean commands the user executes that have a privilege level lower than 15 will not be logged? Or only commands that require exactly privilege level 15 will be logged?
How can I log all commands regardless of privilege level?

Hi Red,
If you customize the command privilege level using the privilege command, you can limit which commands the appliance accounts for by specifying a minimum privilege level. The security appliance does not account for commands that are below the minimum privilege level.
The default privilege level is 0. So if you don't specify any privilege level then all should be accounted for.
You can find the command detail at. This is for ASA though.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/command/reference/cmd_ref/a1.html#wp1535253
Regards,
Kanwal
Note: Please mark answers if they are helpful.

ASA Remote Access VPN: internal LAN cannot connect to connected VPN clients

Hi community,
I configured IPSec remote Access VPN in ASA, and remote client use Cisco VPN client to connect to the HQ. The VPN is working now, VPN clients can connect to Servers inside and IT's subnet, but from my PC or Servers inside LAN cannot ping or initial a RDP to connected VPN clients. Below is my configuration:
object-group network RemoteVPN_LocalNet
network-object 172.29.168.0 255.255.255.0
network-object 172.29.169.0 255.255.255.0
network-object 172.29.173.0 255.255.255.128
network-object 172.29.172.0 255.255.255.0
access-list Split_Tunnel remark The Corporation network behind ASA
access-list Split_Tunnel extended permit ip object-group RemoteVPN_LocalNet 10.88.61.0 255.255.255.0
ip local pool remotevpnpool 10.88.61.10-10.88.61.15 mask 255.255.255.0
nat (inside,outside) source static Allow_Go_Internet Allow_Go_Internet destination static remotevpnpool remotevpnpool
crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac
crypto dynamic-map dyn1 1 set ikev1 transform-set myset
crypto map mymap 65000 ipsec-isakmp dynamic dyn1
crypto map mymap interface outside
tunnel-group remotevpngroup type remote-access
tunnel-group remotevpngroup general-attributes
address-pool remotevpnpool
authentication-server-group MS_LDAP LOCAL
default-group-policy Split_Tunnel_Policy
I don't know what I miss in order to have internal LANs initial connection to connected vpn clients. Please guide me.
Thanks in advanced.

Hi tranminhc,
Step 1: Create an object.
object network vpn_clients
subnet 10.88.61.0 mask 255.255.255.0
Step 2: Create a standard ACL.
access-list my-split standard permit ip object RemoteVPN_LocalNet
Step 3: Remove this line, because I am not sure what "Allow_Go_Internet" included for nat-exemption.
no nat (inside,outside) source static Allow_Go_Internet Allow_Go_Internet destination static remotevpnpool remotevpnpool
Step 4: Create new nat exemption.
nat (inside,outside) source static RemoteVPN_LocalNet RemoteVPN_LocalNet destination static vpn_clients vpn_clients
Step 5: Apply ACL on the tunnel.
group-policy Split_Tunnel_Policy attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value my-split
Step 6:
I assume you have a default route on your inside L3 switch point back to ASA's inside address. If you don't have one.
Please add a default or add static route as shown below.
route 10.88.61.0 mask 255.255.255.0 xxx.xxx.xxx.xxx
xxx.xxx.xxx.xxx = equal to ASA's inside interface address.
Hope this helps.
Thanks
Rizwan Rafeek

Connecting two remote LANs through a VPN connection

1)
I am trying to interconnect
two LANs as you see below.
2)
The scenario is to interconnecting two LANs with a
single domain “domain.local” in order to have
two domain controllers backing up each other. We already have a Domain Controller “SRVDC1.domain.local” in our local network “LAN1” and another Server which is going to be as both our
secondary domain controller and VPN Server “SRVDC3.domain.local” in our remote network “LAN2” where is the
Netelligent Network. I am trying to make these two servers (our two LANs)
visible to each other by a MikroTik Cloud Router Switch solution.
3)
I am using a
MikroTik Router as a PPTP Client to VPN to our
Remote Server SRVDC3 (87.75.45.66/29).
4)
All the computers in
LAN1, including Server SRVDC1, have a gateway set on “192.168.10.1” which is a
Asus WiFi Router as a core switch which is connected to our Fiber Optic Translator. <o:p></o:p>
5)
To prevent and minimize any down-time risk during the configuration, I have isolated one computer “table2pc5.domain.local” as sample of the
whole network; by changing its gateway set to 192.168.10.6 (the
Ether3-Slave-Lacal-interface on the MikroTikRouter).
I am going to replace the “Asus WiFi Router” shown in the map, by the
MikroTik Router later, after making sure that everything would work properly, so, everything is going to be naturalized after.
6)
My
solution simply can be explained as below:
a.
Providing
another interface in addition to “Netelligent Network” adapter.
b.
To
assign a LAN-based IP (in network range 192.168.10.0/24) to the added adapter (Microsoft Virtual Adapter)
c.
Configuring
SRVDC3 in Netelligent network “LAN2” as
a Remote Access Server (VPN Server).
d.
To provide a
MikroTik Router/Firewall on the Edge of the
LAN1 as VPN Client.
e.
Configure
MikroTik Router VPN PPTP connection to
SRVDC3 via the Internet.
f.
To have
two LANs connected through a permanent VPN connection.
7)
IP Addresses for the three EDGE-Devices (SRVDC1
ßàMikroTik
Router ßàSRVDC3)
are as below:
a.
SRVDC1:
Interface:
Local Area Connection
IP Address:
192.168.10.2/24
Gateway:
192.168.10.1/24
(Asus WiFi Router)
DHCP Server Pool:
192.168.10.1 – 192.168.10.254 (exclusions 10.1-10.50 , 10.50-10.99 , 10.200-10.254)
b.
MikroTikRouter:
Interface:
Local IP
IP Address:     192.168.88.1/24
Interface:
Ether1-gateway-master
IP Address:     192.168.0.1/24
Interface:
Ether2-master-local
IP Address:     192.168.88.1/24
Interface:
ether3-slave-local
IP Address:     192.168.10.6/24
DHCP Server Pool:
192.168.10.1 – 192.168.102.254
c.
SRVDC3:
Interface:
Netelligent Network
IP Address:     87.75.45.66/29
Gateway: 87.75.45.65/29
Interface:
Microsoft Network Adapter
IP Address:     192.168.10.50/24
Gateway: 192.168.11.1
Interface:
PPP Adapter RAS
IP Address:     192.168.11.1/24
gateway:
8)
The node “table7pc2.domain.local” is not able to see<o:p></o:p>
Now, I would ask you to help me to realise this solution by helping me to find the Bad-Routing problem, and letting me know how to fix it.
What NAT / Rout Paths or any configuration do I need to make this two LANs visible and recognizable to each other?
I would introduce you critical nodes which play important roles in this configuration. I have tried to colour-mark them in order to have a better recognition once you take a look at the “Ping Result” table.
The “Ping Result” table would give you an idea which nodes are able to see which others and where does problem hide itself?

I got my own answer :D
1) I have to right-click on my "Routing and Remote Access" Server.
2) on IPv4 tab, I should define a static IP Pool. I had it done before; but since that I had chosen a wide range as 192.168.11.0/24, every time the router was taking a different IP address; so I should define a very small pool with two 2
nodes as 192.168.11.1 and 192.168.11.2. In this way, I'll have the local address (router) as 192.168.11.2 and the remote address (my remote server) as 192.168.11.1
3) After establishment of the PPTP connection successfully, I should add an static route to the "Netelligent Network" adapter. I had it done but in the RRAS routes, so that's why it didn't work. so:
C:\SRVDC3>_ route -p add 192.168.10.0 mask 255.255.255.0 192.168.11.2
[Enter]
Now, I would be able to ping all of the computers whose their gateways are set on 192.168.10 (router)
and If I wand to see all of the computers at the first LAN, I have to put my router at the edge of the network, instead of the ASUS WiFi Router, then change it's IP address to 192.168.10.1 or alternatively set all of the computers gateways on 192.168.10.6.

VPN Connect Kills LAN iChat Jabber

We use Jabber for internal LAN communications. I have a VPN set up to another office for file sharing and ARD.
As soon as I connect the VPN, Jabber goes down on my computer.
If I terminated the VPN connection, Jabber re-connects. It's repeatable each time.
Sounds like a port conflict but I don't know where to start looking...

Jabber in iChat users ports 5220, 5222, 5223 on TCP.
5223 is older Jabber servers and GoogleTalk logins.
5222 is most Jabber Logins
5220 is for other stuff like file sending within Jabber.
http://support.apple.com/kb/HT1507?viewlocale=en_US
Apple Remote Desktop normally uses port 5988 where as VPN usually uses port 5900
http://support.apple.com/kb/TS1629
That should get you started.
10:39 PM Tuesday; May 5, 2009
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

VPN connects when on LAN but not via WAN

Hi Guys,
I've recently configured a VPN on my SLS. I uses the following settings:
L2TP over IPsec
PPP Authentication: Directory Services: MS-CHAPv2
Shared Secret: xxxxxxxxx
Client Information:
DNS Servers: 10.0.1.250 (my server) 10.0.1.1 (my airport extreme) - This is where I think I'm going wrong
In my SLS firewall I've open every possible port for both L2TP, PPTP and all required directory authentication ports I believe. If there are any tricky ones please let me know
I am able to successfully connect to the VPN and route all traffic to the delegated IP when on my local network. However when ever I'm away from that network - friends, work, and various other tested internet connections - I am unable to connect to the VPN.
I've ruled out the SLS firewall by turning it of for several days and trying to connect at several locations. I've checked the log on the VPN and there is no record of even an attempt to connect.
In Security of Server Preferences i have exposed the VPN on the airport extreme. I've tried both with and without port forwarding. As far as i know (correct me if I'm wrong) because I have my domain name resolving to my server then I don't need port forwarding. My DNS works for all other services on the SLS.
Any ideas at to what I might be doing wrong? Things I could try to isolate the problem?
Any suggestions would be very handy!
Best
-J

Your Airport Extreme does not contain a DNS server.
Ensure MobileMe is disabled at your Airport. That messes up VPN pass-through.
From a remote network, confirm that all of the necessary ports are open via nmap or Applications > Utilities > Network Utility or other tools.
Quadruple-check the list of ports (and preferably with a second and third technical resource), as the Apple documentation around L2TP port pass-through with Airport and Time Capsule is murky.
Ensure that you don't have the same subnet on both ends of the VPN connection as that can interfere with IP routing.
Also try testing with PPTP, in place of L2TP.
I'm in the midst of tussling with a recalcitrant VPN router myself, but that's another topic.

Remote access VPN access across LAN-to-LAN VPN

I have two sites (site 1 & site 2) connected by a LAN-to-LAN VPN. At site 1, users connect with a remote access VPN and need to be able to access resources at site 2.

I started out with same-security-traffic intra-interface configured.
Here is the output from both ASAs:
NM-ASA# show crypto isakmp sa
   Active SA: 6
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 6
1   IKE Peer: 3.3.3.3
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
2   IKE Peer: 74.138.171.237
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
3   IKE Peer: 96.28.201.133
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
4   IKE Peer: 1.1.1.1
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
5   IKE Peer: 74.138.126.195
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
6   IKE Peer: 96.28.201.133
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
NM-ASA#
NM-ASA# sho crypto ipsec sa
interface: outside
    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.5/255.255.255.255/0/0)
      current_peer: 96.28.201.133, username: joneal
      dynamic allocated peer ip: 10.1.20.5
      #pkts encaps: 50, #pkts encrypt: 50, #pkts digest: 50
      #pkts decaps: 33, #pkts decrypt: 33, #pkts verify: 33
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 50, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 96.28.201.133
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 5E0D76C9
    inbound esp sas:
      spi: 0x969790AD (2526515373)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 315392, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28618
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000003 0xFFFFFFFF
    outbound esp sas:
      spi: 0x5E0D76C9 (1577940681)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 315392, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28618
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.6/255.255.255.255/0/0)
      current_peer: 96.28.201.133, username: joneal
      dynamic allocated peer ip: 10.1.20.6
      #pkts encaps: 1368, #pkts encrypt: 1368, #pkts digest: 1368
      #pkts decaps: 945, #pkts decrypt: 945, #pkts verify: 945
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 1368, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 96.28.201.133
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 968FF103
    inbound esp sas:
      spi: 0xA49C8920 (2761722144)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 331776, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28703
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x968FF103 (2526015747)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 331776, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28702
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: vpnmap, seq num: 20, local addr: 2.2.2.2
      access-list peak10-vpn permit ip 192.168.100.0 255.255.255.0 172.16.0.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/0/0)
      current_peer: 3.3.3.3
      #pkts encaps: 352, #pkts encrypt: 352, #pkts digest: 352
      #pkts decaps: 270, #pkts decrypt: 270, #pkts verify: 270
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 352, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 3.3.3.3
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 773AB6C7
    inbound esp sas:
      spi: 0xD34E0435 (3545105461)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914940/28605)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x773AB6C7 (2000336583)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914941/28605)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: vpnmap, seq num: 20, local addr: 2.2.2.2
      access-list peak10-vpn permit ip 192.168.128.0 255.255.224.0 172.16.0.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.128.0/255.255.224.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/0/0)
      current_peer: 3.3.3.3
      #pkts encaps: 26, #pkts encrypt: 26, #pkts digest: 26
      #pkts decaps: 24, #pkts decrypt: 24, #pkts verify: 24
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 26, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 3.3.3.3
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 66CD02A3
    inbound esp sas:
      spi: 0x531B430A (1394295562)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914990/28666)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x01FFFFFF
    outbound esp sas:
      spi: 0x66CD02A3 (1724711587)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914990/28666)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.7/255.255.255.255/0/0)
      current_peer: 74.138.126.195, username: jnord
      dynamic allocated peer ip: 10.1.20.7
      #pkts encaps: 990, #pkts encrypt: 990, #pkts digest: 990
      #pkts decaps: 1429, #pkts decrypt: 1429, #pkts verify: 1429
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 990, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 3
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 74.138.126.195
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 62241B76
    inbound esp sas:
      spi: 0xB1F2F97B (2985490811)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 327680, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28674
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x62241B76 (1646533494)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 327680, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28674
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.4/255.255.255.255/0/0)
      current_peer: 74.138.171.237, username: cbulmahn
      dynamic allocated peer ip: 10.1.20.4
      #pkts encaps: 832, #pkts encrypt: 832, #pkts digest: 832
      #pkts decaps: 620, #pkts decrypt: 620, #pkts verify: 620
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 832, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 74.138.171.237
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 64CD5FBE
    inbound esp sas:
      spi: 0xCDFCE528 (3455903016)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 311296, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28613
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x64CD5FBE (1691180990)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 311296, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28613
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2
      access-list sg-vpn permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1
      #pkts encaps: 5228, #pkts encrypt: 5228, #pkts digest: 5228
      #pkts decaps: 5246, #pkts decrypt: 5246, #pkts verify: 5246
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 5229, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 3200F1CB
    inbound esp sas:
      spi: 0x10DEE5CE (283043278)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373446/28613)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x3200F1CB (838922699)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373496/28613)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2
      access-list sg-vpn permit ip 192.168.111.0 255.255.255.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.111.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1
      #pkts encaps: 321, #pkts encrypt: 321, #pkts digest: 321
      #pkts decaps: 296, #pkts decrypt: 296, #pkts verify: 296
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 321, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: EC77AF32
    inbound esp sas:
      spi: 0x16C7E578 (382199160)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373950/28636)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xEC77AF32 (3967266610)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373936/28636)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2
      access-list sg-vpn permit ip 192.168.112.0 255.255.240.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.112.0/255.255.240.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1
      #pkts encaps: 2910, #pkts encrypt: 2910, #pkts digest: 2910
      #pkts decaps: 3794, #pkts decrypt: 3794, #pkts verify: 3794
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 2996, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: EEDD3278
    inbound esp sas:
      spi: 0x9FAA12E6 (2678723302)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4370659/28610)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xEEDD3278 (4007473784)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373556/28610)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2
      access-list sg-vpn permit ip 192.168.128.0 255.255.224.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.128.0/255.255.224.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1
      #pkts encaps: 3034, #pkts encrypt: 3034, #pkts digest: 3034
      #pkts decaps: 3748, #pkts decrypt: 3748, #pkts verify: 3748
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 3034, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: D1F3CBED
    inbound esp sas:
      spi: 0x7C688B5D (2087226205)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4370712/28609)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xD1F3CBED (3522415597)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373429/28609)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
NM-ASA#
QSRCORPFW# sho crypto isakmp sa
   Active SA: 2
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2
1   IKE Peer: 3.3.3.3
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
2   IKE Peer: 2.2.2.2
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE
QSRCORPFW# sho crypto ipsec sa
interface: WAN
    Crypto map tag: outside_map, seq num: 1, local addr: 1.1.1.1
      access-list PEAK10VPN permit ip 192.168.0.0 255.255.192.0 172.16.0.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/0/0)
      current_peer: 3.3.3.3
      #pkts encaps: 2162, #pkts encrypt: 2162, #pkts digest: 2162
      #pkts decaps: 1761, #pkts decrypt: 1761, #pkts verify: 1761
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 2162, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 3.3.3.3
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: BDC6A8EE
    inbound esp sas:
      spi: 0x966B78C0 (2523625664)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6328320, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914547/28485)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xBDC6A8EE (3183913198)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6328320, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914652/28485)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: outside_dyn_map, seq num: 20, local addr: 1.1.1.1
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.10.6/255.255.255.255/0/0)
      current_peer: 74.128.145.69, username: administrator
      dynamic allocated peer ip: 10.1.10.6
      #pkts encaps: 10, #pkts encrypt: 10, #pkts digest: 10
      #pkts decaps: 16, #pkts decrypt: 16, #pkts verify: 16
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 10, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 74.128.145.69
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 0ED4D561
    inbound esp sas:
      spi: 0x70133356 (1880306518)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 6332416, crypto-map: outside_dyn_map
         sa timing: remaining key lifetime (sec): 28521
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x0001FFFF
    outbound esp sas:
      spi: 0x0ED4D561 (248829281)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 6332416, crypto-map: outside_dyn_map
         sa timing: remaining key lifetime (sec): 28508
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1
      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.111.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.111.0/255.255.255.0/0/0)
      current_peer: 2.2.2.2
      #pkts encaps: 350, #pkts encrypt: 350, #pkts digest: 350
      #pkts decaps: 379, #pkts decrypt: 379, #pkts verify: 379
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 350, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 16C7E578
    inbound esp sas:
      spi: 0xEC77AF32 (3967266610)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914923/28493)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x16C7E578 (382199160)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914939/28493)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1
      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.112.0 255.255.240.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.112.0/255.255.240.0/0/0)
      current_peer: 2.2.2.2
      #pkts encaps: 5270, #pkts encrypt: 5270, #pkts digest: 5270
      #pkts decaps: 4314, #pkts decrypt: 4314, #pkts verify: 4314
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 5270, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 9FAA12E6
    inbound esp sas:
      spi: 0xEEDD3278 (4007473784)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914358/28463)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x9FAA12E6 (2678723302)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3911355/28463)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1
      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.100.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
      current_peer: 2.2.2.2
      #pkts encaps: 11323, #pkts encrypt: 11323, #pkts digest: 11323
      #pkts decaps: 11262, #pkts decrypt: 11262, #pkts verify: 11262
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 11323, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 10DEE5CE
    inbound esp sas:
      spi: 0x3200F1CB (838922699)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914033/28461)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x10DEE5CE (283043278)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3913939/28459)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1
      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.128.0 255.255.224.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.128.0/255.255.224.0/0/0)
      current_peer: 2.2.2.2
      #pkts encaps: 4206, #pkts encrypt: 4206, #pkts digest: 4206
      #pkts decaps: 3490, #pkts decrypt: 3490, #pkts verify: 3490
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 4206, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 7C688B5D
    inbound esp sas:
      spi: 0xD1F3CBED (3522415597)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914326/28457)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x7C688B5D (2087226205)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3911559/28457)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001
QSRCORPFW#

Configuration help for 2nd lan to lan vpn link

Hello,
I have successfully configured a lan to lan vpn link between two offices. I am attempting to add another link to a 3rd office from my home office but am having some trouble. I have attached my configuration and am hoping someone can help me fix my problem. Right now I have a working vpn to 172.16.0.0/24 network and am trying to set up the link to 172.16.3.0/24 as well. To the new vpn connection I can ping the outside interfaces but can't ping anything internally.
Thanks for your time and help,
Jason

Jason
There is one significant mistake that is easy to fix. You have correctly created a second instance of the crypto map to create a VPN tunnel to the second site. But as currently configured both instances of the crypto map use the same access list:
crypto map clientmap 1 ipsec-isakmp
match address 100
crypto map clientmap 5 ipsec-isakmp
match address 100
But each VPN session/tunnel needs its own access list. So I suggest that you make the following changes:
crypto map clientmap 5 ipsec-isakmp
match address 101
no access-list 100
access-list 100 permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 172.16.3.0 0.0.0.255
This provides a separate access list for each session/tunnel and should resolve that issue. Give it a try and let us know the result.
HTH
Rick

IMac slows down wifi/LAN cable connection

Hello,
I came across a quiet unique and annoying problem, that I have not seen being discussed so far.
I spend the last 3 weeks trying to solve my internet/wifi connection following all kinds of posts here.
Problem: Wifi/Lan internet connection is slow (less than 0.8mbit/s)
Problem only appears when I login with an iMac via wifi OR lag cable
iMac, 2011 27`` Mac OS 10.7.5
Background:
I have a 20mbit/s internet connection with my provider. works fine on iPad, iPhone, appleTV HTC one mini, etc… BUT as soon, as I login with my iMac, the internet connection slows down to less than 1 mbit/s
I have tried following solutions:
- live box (router) was exchanged and is brand new
- security settings on router changes (wpa2 etc)
- all channels on router tested from 1-13
- keychain saved passwords for Wifi and router deleted, PRAM reset
- renewed lease of connected devices (no IP conflict)
- shut down wifi on iMac - connection with all devices great, as soon as i switch wifi on, all devices lose their high speed connection and go down to less than 1mbit/s
- connected iMac via LAN cable: same problem, all speed is lost
- iMac is not in the network - speed is great
- connected iMac via time capsule wifi, same problem. connected iMac via netgear extender, same problem
also, if I open network preferences and start the "assist me" app and run diagnostics, all dots are green except the ISP and server, bit most of the time they switch to green immediately, but connection is still slow.
Reception bar is on "3", so signal strength is no problem, and I´d like to emphasize that this is also happening on LAN cable. and again, if the iMac is disconnected from wifi AND / OR LAN, all other devices work fine.
Would love to hear your thoughts!
Thanks!

Although I have been on Mac OS for a while now, I have never had to troubleshoot faulty network in the mac itself.
OSX does apparently have a safe mode boot..
OS X: What is Safe Boot, Safe Mode?
Try that.. as that gives you the same thing as windows with all the extras left out, so you get a basic operating system only and you can see if the problem still exists.. if it does.. I would simply bite the bullet.. wipe the Mac.. reinstall the OS and then carefully reinstall your applications from original disks/downloads and move your operating files back .. but start a different user on the computer and copy back the min you need to get working again.
If the problem still happens even in safe mode boot then do a hardware test.. because it is possible something has actually failed at the hardware level.
Using Apple Hardware Test

I am having trouble with exchange account connection .the vpn connects fine but the exchange account is still showing the yellow light .can anyone help?

i am having trouble with exchange account connection .the vpn connects fine but the exchange account is still showing the yellow light .can anyone help?

I had a similar problem. Here is how I resolved the issue.
1. Remove Network Connect
2. Run Terminal and remove /usr/local/juniper and everything within the juniper directory.
3. Reboot the machine and reinstall Network Connect
4. Test if you can now connect.
During removal, you may encounter permission denied error, you will need to change the permission to 777. For example "sudo chmod 777 nc".

Qosmio X500: Lan/Internet connection get lost after period of time

Hi all,.
I got the qosmio x500 for about half a year now...
I got this problem where after about 5 hours or less the lan/internet connection get lost.
I disabled the wireless connection and is using only the wired connnection now.
When it get disconnected... all devices seems to work seemlessly, no problem can be found. I checked the win7 network adaptor --and it seems to be connected properly.
I haven't got a slightest idea how to fix that.... Only a reset of the system and reloading the os results with a valid connection.
It is even stranger,. When using it for a piriod of time (listeding to audio streams from the web)... when getting back to the machine the audio connection seems to work properly.... but when trying to access other sites, or other machines in the homegroup, or network (under explorer). It result faulty.
Please guide me somehow how to fix the issue, it is bugging me a lot (all these resets to the machine probably doesn't do it any good as well).
thanks in advance,.

Hi,
It could be the energy saving feature of your network card.
Right click Network Icon on the status bar, choose 'Open Network Center and Sharing', Click on 'Connection', Click on 'Properties' (low left button), you'll see the tab with your Network Properties. Click 'Configure' (Upper right button), choose 'Power Management' (last right tab).
Uncheck 'Allow computer to shut down this device to save energy'. Probably your problem will now be solved.
If the names I write aren't exactly right, I'm on a French language computer so my translations can be slightly wrong.
Bye,
Ton
Message was edited by: Tonio78370

Window 8.1 system unable to access network shares via VPN connection

Is there something inherent to Windows 8.1 that prevents it from accessing shares on a domain?
I know that it cannot join a domain, but does that also mean that it cannot access shares which are on a domain?
My problem is that I have several user that are running windows 8.1 that are connecting to our network via a VPN.
The users have domain accounts but their computers as windows 8.1 cannot joined to the domain.
So to access network shares they have to use their domain credentials to create a VPN connection.
Once connected the user can RDP to systems on the domain using their domain accounts, so I know that their user names/passwords and permissions are correct. They can access these systems using the computer name, so I don't feel that I have a DNS issue.
They can see the shares on our file server, but when they try to access their departments shared file, they receive an access denied message. There are a few shares that are completely wide open, shared to all users and all departments but they cannot access
those shares either.
You can ping the file server, from the the client when they are connected to the VPN but you just cannot access any of the shares.
So...
I am thinking that it has something to do with windows 8.1 and not being able to join a domain, but I cannot find anything to explicitly support this thought.
Other users running a variety different OS (windows 7, OSX, Linux) can all access the shares without any problems via the VPN, so I am a little stumped.

I have done some more testing and oddly enough I can map a drive if I use the IPaddress, but not the computer name, when checking the check box "connect using different credentials"and providing they users domain credentials.
This seems to point to a DNS issue, one would think, but I can hit the file share server by name \\fileserver.dev.lan
I can see all the shares, so dns seems to be fine right?
So I don't understand why I can map a drive using do the IPaddress and not the machine name, but yet I can see and ping the server by name?
When I try to create a mapped drive by machine name I receive the following message:
Windows cannot access \\fileserver.dev.lan\all
You do not have permissions to access \\fileserver.dev.lan. contact your network administrator to request access.
But if I use the \\x.x.x.x\all using the very same user and password I get connected with no problem.
This only seems to happen on windows 8.1, which leads me to think that has something to do with OS.
I am thinking about upgrading to windows 8.1 pro, but I don't want to go though the hassle and expanse is the OS is not the problem.

Traffic only allowed one-way for VPN connected computers

Hello,
I currently have an ASA 5505. I have set it up as a remote access SSL VPN. My computers can connect to the VPN just fine. They just can't access the internal LAN (192.168.250.0). They can't ping the inside interface of the ASA, or any of the machines. It seems like all traffic is blocked for them. The strange thing is that when someone is connected to the VPN, I can ping that VPN-connect machine from the ASA and other machines inside the LAN. It seems the traffic only allows one way. I have messed with ACL's with no avail. Any suggestions please?
DHCP Pool: 192.168.250.20-50 --> For LAN
VPN Pool: 192.168.250.100 and 192.168.250.101
Outside interface grabs DHCP from modem
Inside interface: 192.168.1.1
Current Running Config:
: Saved
ASA Version 8.2(5)
hostname HardmanASA
enable password ###### encrypted
passwd ####### encrypted
names
interface Ethernet0/0
switchport access vlan 20
interface Ethernet0/1
switchport access vlan 10
interface Ethernet0/2
switchport access vlan 10
interface Ethernet0/3
shutdown
interface Ethernet0/4
shutdown
interface Ethernet0/5
shutdown
interface Ethernet0/6
shutdown
interface Ethernet0/7
switchport access vlan 10
interface Vlan1
no nameif
no security-level
no ip address
interface Vlan10
nameif inside
security-level 100
ip address 192.168.250.1 255.255.255.0
interface Vlan20
nameif outside
security-level 0
ip address dhcp setroute
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
pager lines 24
mtu inside 1500
mtu outside 1500
ip local pool VPN_Pool 192.168.250.100-192.168.250.101 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 192.168.250.0 255.255.255.0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.250.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 192.168.250.0 255.255.255.0 inside
ssh timeout 5
ssh version 2
console timeout 0
dhcpd dns 8.8.8.8
dhcpd address 192.168.250.20-192.168.250.50 inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2
svc image disk0:/anyconnect-linux-2.5.2014-k9.pkg 3
svc enable
tunnel-group-list enable
group-policy DfltGrpPolicy attributes
dns-server value 8.8.8.8
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
tunnel-group AnyConnect type remote-access
tunnel-group AnyConnect general-attributes
address-pool VPN_Pool
tunnel-group AnyConnect webvpn-attributes
group-alias AnyConnect enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:30fadff4b400e42e73e17167828e046f
: end

Hello,
I seem to be having the same kind of issue although I cannot ping from either end.
Ive set up a l2tp/ipsec vpn which I am able to connect to and get ip from my ip pool (radius authentication is working).
I tried running:
access-list NAT_0 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
nat (inside) 0 access-list NAT_0
but i get an error msg saying that the syntax of the nat command is deprecated. Im running ASA version 8.4.
Ive fiddled around abit to find the correct syntax but have been unsuccessfull so far.
Any help would be much appreciated
This is a part of my config:
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network AD1
host 192.168.1.31
description AD/RADIUS
object network NETWORK_OBJ_192.168.1.0_24
subnet 192.168.1.0 255.255.255.0
object network vpn_hosts
subnet 192.168.2.0 255.255.255.0
access-list AD_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list split-acl standard permit 192.168.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.1.0 255.255.255.0
access-list inside_0_outbound extended permit ip object NETWORK_OBJ_192.168.1.0_24 object vpn_hosts
ip local pool POOL2 192.168.2.2-192.168.2.10 mask 255.255.255.0
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.1.0_25 NETWORK_OBJ_192.168.1.0_25 no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.0_25 NETWORK_OBJ_192.168.1.0_25 no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static vpn_hosts vpn_hosts
object network obj_any
nat (inside,outside) dynamic interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 ########## 1
no vpn-addr-assign aaa
no vpn-addr-assign dhcp

Entering Correct info for VPN connection

please suggest the correct configuration for entering information in order for my laptop to connect via VPN to my newly installed Leopard Server software. On my laptop, I have entered the following info on the System Preferences> network tab...
Configuration: Default
Server Address: 76.173.xx.xxx (my public IP address - do I need anything else?)
Account name: XXXXXX (same as the account name in Server)
under Authentication Settings, my password is fine and my shared secret is the same as on the Server.
Am I entering in everything correctly? i am most concerned as to how the server address is supposed to be written. thanks!!

Hi
If Appletalk is enabled server side and you simply enter the IP address afp is assumed as the protocol to be used. If you prefer the extra effort involved in typing afp:// followed by the IP address you can use that as well. If you want to use the smb service rather than afp simply type smb://followed by the IP address. The same thing applies to ftp services. The Finder supports reads only for ftp services.
If you are using VPN services you simply type in the private IP (LAN-side) address of the server rather than the public IP (WAN-side) address. Once a VPN connection has been established, the remote client behaves as if it is on the same LAN.
You can make a connection using the Public WAN address if you enable port forwarding to a single LAN IP address for services you are interested in. For example if you wanted to access your server remotely using afp you configure your router to forward requests for port 548 to the internal IP address of your server. You can use this method for as many services you like as well as how many your router supports. Most commercially available routers support 10-20. Depending on the router you may have to configure an appropriate firewall rule as well. When faced with that it makes more sense to use a single VPN connection.
I may be in danger of teaching granny to suck eggs but for what its worth for VPN connections to work successfully the remote client’s private IP address has to be different from the host site. For example if the remote site is on 192.168.1.x/24 as is the server then you won’t establish a connection. As far as the remote site is concerned its already connected to that network, why look elsewhere? 192.168.1.x/24 to 192.168.2.x/24 or 10.10.10.x/24 to 192.168.0.x/24 should result in successful VPN connections.
For a list or IP addresses reserved for private use:
http://www.iana.org/faqs/abuse-faq.htm#SpecialUseAddresses
Hope this helps, Tony

AAA accounting of Lan-to-Lan VPN connections on a 3005 Concentrator

Similar Messages

Maybe you are looking for