Adventures implementing NEM between 5520 and 5505...

So, help...
I'm unsure how to best solve my issue...
I have a 5520 acting as a VPN server... and 5505's acting as clients...
The 5505's connect fine when using "client mode" but things go sideways when I try and use NEM... Namely, they never complete a connection...
debug vpnclient shows this repeating rather fast... (this device is connected a Fios connection behind a gateway/router... (it's my test environment and it does work when I have the device setup in "vpnclient mode client-mode"...
Some of my remote sites are configured directly with a public IP (issued via DHCP) others are behind a 3rd party firewall/device that I have no control over... but again, these sites currently work as "vpnclient mode client-mode"...
VPNC INFO: Reconnect to new peer - 168.156.248.2
VPNC CLI: access-list _vpnc_acl permit ip host 10.1.10.33 host 168.156.248.2
VPNC CLI: crypto map _vpnc_cm 10 match address _vpnc_acl
VPNC CLI: crypto map _vpnc_cm 10 set peer 168.156.248.2
VPNC CLI: crypto map _vpnc_cm 10 set transform-set _vpnc_tset_1 _vpnc_tset_2 _vpnc_tset_3 _vpnc_tset_4 _vpnc_tset_5 _vpnc_tset_6 _vpnc_tset_7 _vpnc_tset_8 _vpnc_tset_9 _vpnc_tset_10 _vpnc_tset_11
VPNC CLI: crypto map _vpnc_cm 10 set security-association lifetime seconds 2147483647
VPNC CLI: crypto map _vpnc_cm 10 set security-association lifetime kilobytes 2147483647
VPNC CLI: crypto map _vpnc_cm 10 set phase1-mode aggressive
VPNC CLI: crypto map _vpnc_cm interface outside
VPNC CLI: tunnel-group 168.156.248.2 type ipsec-ra
VPNC CLI: tunnel-group 168.156.248.2 ipsec-attributes
pre-shared-key edcc
VPNC INFO: vpnc_unselect_peer()
VPNC CLI: clear configure tunnel-group
VPNC CLI: clear configure crypto map _vpnc_cm
VPNC CLI: no access-list _vpnc_acl permit ip host 10.1.10.33 host 168.156.248.2
VPNC INFO: Setting SUA state to 'idle'
The primary reason I'm trying to do this is so my server admin guy can see the clients who are behind the 5505's...
I don't know how much of the config file you need to be meaningful and I'm a bit leary of posting too much anyway...
From one of the 5505's (I'm running 8.2(3) )
dns server-group DefaultDNS
domain-name edcc.ctc.edu
access-list 110 extended permit ip any any
access-list inside_nat0_outbound extended permit ip any any
access-list outside_cryptomap_10 extended permit ip any any
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto isakmp enable outside
vpnclient server 168.156.248.2
vpnclient mode network-extension-mode
vpnclient vpngroup <group> password *****
vpnclient username <useraccount> password *****
vpnclient enable
On the 5520:
(running 8.2(5))
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto ipsec transform-set transform-amzn esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ipsec security-association replay window-size 128
crypto ipsec df-bit clear-df outside
crypto dynamic-map dyna 30 match address l2tp_acl
crypto dynamic-map dyna 30 set transform-set myset
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set TRANS_ESP_3DES_MD5 ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map mymap 1 match address 110
crypto map mymap 1 set peer x.x.x.68
crypto map mymap 1 set transform-set ESP-3DES-MD5
crypto map mymap 20 match address 200
crypto map mymap 20 set peer x.x.x.7
crypto map mymap 20 set transform-set ESP-AES-128-SHA
crypto map mymap 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map mymap interface outside
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 5
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 3600
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
group-policy edcc-split-tunnel internal
group-policy edcc-split-tunnel attributes
wins-server value 10.230.100.23 10.230.100.22
dns-server value 10.230.100.23 10.230.100.22
vpn-tunnel-protocol IPSec svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value edcc_splitTunnelAcl
default-domain value edcc.ctc.edu
group-policy edcc-no-split-tunnel internal
group-policy edcc-no-split-tunnel attributes
vpn-tunnel-protocol IPSec svc
split-tunnel-policy tunnelall
group-policy DfltGrpPolicy attributes
wins-server value 10.230.100.23 10.230.100.22
dns-server value 10.230.100.23 10.230.100.22
vpn-tunnel-protocol IPSec
password-storage enable
ip-comp enable
re-xauth enable
pfs enable
ipsec-udp enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value edcc_splitTunnelAcl
default-domain value edcc.ctc.edu
nac-settings value DfltGrpPolicy-nac-framework-create
group-policy l2tp-tunnel internal
group-policy l2tp-tunnel attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc
split-tunnel-policy tunnelall
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *****
tunnel-group DefaultRAGroup general-attributes
address-pool main-edcc-pool
authentication-server-group admin LOCAL
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *****
peer-id-validate cert
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
authentication ms-chap-v2
tunnel-group x.x.x.68 type ipsec-l2l
tunnel-group x.x.x.68 ipsec-attributes
pre-shared-key *****
tunnel-group outside type remote-access
tunnel-group outside general-attributes
address-pool main-edcc-pool
authentication-server-group admin LOCAL
default-group-policy edcc-split-tunnel
tunnel-group outside ipsec-attributes
pre-shared-key *****
tunnel-group edcc ppp-attributes
authentication ms-chap-v2
tunnel-group xinside type remote-access
tunnel-group xinside general-attributes
address-pool main-edcc-pool
authentication-server-group admin LOCAL
default-group-policy edcc-no-split-tunnel
tunnel-group xinside ipsec-attributes
pre-shared-key *****
tunnel-group xinside ppp-attributes
authentication ms-chap-v2
tunnel-group l2tp type remote-access
tunnel-group l2tp general-attributes
address-pool main-edcc-pool
authentication-server-group admin LOCAL
default-group-policy l2tp-tunnel
tunnel-group l2tp ipsec-attributes
pre-shared-key *****
isakmp ikev1-user-authentication none
tunnel-group l2tp ppp-attributes
authentication ms-chap-v2
tunnel-group x.x.x.7 type ipsec-l2l
tunnel-group x.x.x.7 ipsec-attributes
pre-shared-key *****
no tunnel-group-map enable ou
no tunnel-group-map enable ike-id
no tunnel-group-map enable peer-ip
Any idea's? Obviously I have a few adventures here...

Or any suggestions on an alternative configuration for the remote sites?

Similar Messages

How the implementation differs between BW and BI , Is BI takes more time fo

Hi All,
I would like to know difference between implemenation and time lines for MM as mentioned below.
How the implementation differs between BW and BI , Is BI takes more time for implementing MM module than on BW?
Thanks in advanced. (Full points will be awarded)
With Regards,
PCR

Hi Timo,
Thanks for response!
But as i read from the following url: http://docs.oracle.com/cd/E15051_01/apirefs.1111/e10653/oracle/jbo/ViewObject.html, the setQueryTimeOut(int timeOutMills), the timeOut is mentioned in milliseconds. Please correct me if I am wrong.
and i have overriden the executeQuery() method in the View Object Impl class as shown below:
public void executeQuery() {
Map sessionScope = ADFContext.getCurrent().getSessionScope();
sessionScope.put("MyQuery", this);
try {
super.executeQuery();
} finally {
sessionScope.remove("MyQuery");
throw new JboException("Query Taking too long to respond");
and in the JAVA class i am calling the above method like this:
monitor.setQueryTimeOut(6);
monitor.executeQuery();
But the issue is:
1. The above exception message is getting carried forward to other pages as well. I mean somewhere in the session/ADFContext this message is being saved and error comes up/pops up when i click on other tabs of the page. How do i clear this?
2. The above exception message is coming for the first time but when i click the 'Submit' button second time, i am getting the results and also the message that 'Query is taking too long to respond'. This should not be the case, everytime it should show the same message as the timeout limit is less and the query should end without fetching the results.
Kindly let me know how to resolve the above issues, any pointers will be helpful.
Thanks in advance.
Edited by: user9223904 on Nov 3, 2012 4:42 AM

NIO Socket implementation - delay between select and get data from socket

Hi all,
I have implemented a internal CallAPI for RPC over a socket connection. It works fine but if there are more than five clients and some load I have the phenomena that the READ selector returns a SelectorKey but I did not get any data from the socket.
My implementation is based on NIO has following components:
+ Accept-Thread
Thread handles new clients.
+ Read-Thread
Thread handles the data from the socket for the registered client. Each request is handled in an own Process-Thread. A Thread-Pool implementation is used for processing.
+ Process-Thread
The Process-Thread reads the data from the socket and starts the processing of the logical request.
In my tests I get the notification of data at the socket. The Process-Thread want to read the data for the socket, but no data are available. In some situations if have to read about 20 times and more to get the data. Between each read attempt I have inserted a sleep in the Process-Thread if no data was available. This have improved the problem, but it already exists. I tested the problem with several systems and jvm's but it seams that it is independent from the system.
What can I to do improve the situation?
I already include the read implementation from the grizzly-Framework. But it doesn't improve the situation.
Socket - Init
     protected void openSocket( String host, int port ) throws IOException
          serverChannel = ServerSocketChannel.open();
          serverChannel.configureBlocking( false );
          serverSocket = serverChannel.socket();
          serverSocket.setReuseAddress( true );
          this.serverhost = host;
          this.serverport = port;
          this.srvAcceptSelector = Selector.open();
          this.srvReadSelector = Selector.open();
          InetSocketAddress isa = null;
          if ( serverhost != null )
               isa = new InetSocketAddress( this.serverhost, this.serverport );
          else
               isa = new InetSocketAddress( this.serverport );
          serverSocket.bind( isa, 50 );
          serverChannel.register( this.srvAcceptSelector, SelectionKey.OP_ACCEPT );
     }New Client � Init
     // New Client
     if ( key.isAcceptable())
          keyCountConnect++;
          ServerSocketChannel actChannel =
               (ServerSocketChannel) key.channel();
          // Socket akteptieren
          SocketChannel actSocket = actChannel.accept();
          if ( actSocket != null )
               actSocket.finishConnect();
               actSocket.configureBlocking( false );
               actSocket.socket().setTcpNoDelay( true );
               this.registerSocketList.add( actSocket );
               this.srvReadSelector.wakeup();
     }Read Data from Socket
    protected int readDatafromSocket( ByteArrayOutputStream socketdata )
         throws IOException
         int readedChars = 0;
        int count = -1;
        Selector readSelector = null;
        SelectionKey tmpKey = null;
        if ( sc.isOpen())
              ByteBuffer inputbuffer = null;
             try
                  inputbuffer = bufferpool.getBuffer();
                  while (( count = sc.read( inputbuffer )) > 0 )
                       readedChars += count;
                      inputbuffer.flip();
                       byte[] tmparray=new byte[inputbuffer.remaining()];
                       inputbuffer.get( tmparray );
                       socketdata.write( tmparray );
                      inputbuffer.clear();
                  if ( count < 0 )
                       this.closeSocket();
                       if( readedChars == 0 )
                            readedChars = -1;
                       if ( log.isDebug())
                              log.debug( "Socket is closed! " );
                  else if ( readedChars == 0 )
                       if ( log.isDebug())
                              log.debug( "Reread with TmpSelector" );
                       // Glassfish/Grizzly-Implementation
                     readSelector = SelectorFactory.getSelector();
                     if ( readSelector == null )
                          return 0;
                      count = 1;
                      tmpKey = this.sc.register( readSelector, SelectionKey.OP_READ );
                     tmpKey.interestOps(
                          tmpKey.interestOps() | SelectionKey.OP_READ );
                     int code = readSelector.select( 500 );
                     tmpKey.interestOps(
                         tmpKey.interestOps() & ( ~SelectionKey.OP_READ ));
                     if ( code == 0 )
                         return 0;
                         // Return on the main Selector and try again.
                       while (( count = sc.read( inputbuffer )) > 0 )
                            readedChars += count;
                           inputbuffer.flip();
                            byte[] tmparray=new byte[inputbuffer.remaining()];
                            inputbuffer.get( tmparray );
                            socketdata.write( tmparray );
                           inputbuffer.clear();
                       if ( count < 0 )
                            this.closeSocket();
                            if( readedChars == 0 )
                                 readedChars =-1;
                       else if ( count == 0 )
                              // No data
             finally
                  if ( inputbuffer != null )
                       bufferpool.releaseBuffer( inputbuffer );
                       inputbuffer = null;
                  // Glassfish-Implementierung
                if ( tmpKey != null )
                    tmpKey.cancel();
                if ( readSelector != null)
                    // Bug 6403933
                     try
                        readSelector.selectNow();
                     catch (IOException ex)
                    SelectorFactory.returnSelector( readSelector );
        return readedChars;
    }Thanks for your time.

I've commented on that blog before. It is rubbish:
- what does 'overloading the main Selector' actually mean? if anything?
- 'Although this not clearly stated inside the NIO API documentation': The API documentation doesn't say anything about which Selector you should register channels with. Why would it? Register it with any Selector you like ...
- 'the cost of maintaining multiple Selectors can reduce scalability instead of improving it' Exactly. So what is the point again?
- 'wrapping a ByteBuffer inside a ByteBufferInputStream:' Code is rubbish and redundant. java.nio.channels.Channels has methods for this.
There is no a priori advantage to using multiple Selectors and threads unless you have multiple CPUs. And even then not much, as non-blocking reads and writes don't consume significant amounts of CPU. It's the processing of the data once you've got it that takes the CPU, and that should be done in a separate thread.
So I would re-evaluate your strategy. I suspect you're getting the channel registered with more than one Selector at a time. Implement it the simple way first then see if you really have a problem with 'overloading the main Selector' ...

Site-to-site between 5510 and 5505

I'm having some issues getting a l2l VPN up. I have never had any issues before. I've always used the ASDM and it just pops right up. These are the IKE statistics I'm getting, but I can't find any info on what the failures mean.... The initiator fails and auth fails.
Thanks for any help
Global IKE Statistics
Active Tunnels: 0
Previous Tunnels: 0
In Octets: 56896
In Packets: 206
In Drop Packets: 154
In Notifys: 18
In P2 Exchanges: 0
In P2 Exchange Invalids: 0
In P2 Exchange Rejects: 0
In P2 Sa Delete Requests: 0
Out Octets: 24456
Out Packets: 142
Out Drop Packets: 0
Out Notifys: 0
Out P2 Exchanges: 0
Out P2 Exchange Invalids: 0
Out P2 Exchange Rejects: 0
Out P2 Sa Delete Requests: 0
Initiator Tunnels: 34
Initiator Fails: 34
Responder Fails: 0
System Capacity Fails: 0
Auth Fails: 34
Decrypt Fails: 0
Hash Valid Fails: 16
No Sa Fails: 0

This sounds like a Phase 1 issue. I would double check the crypto-map, shared key, ACL, and encryptions to see if they all match. Also I've learned that the ASDM does not show everything. Check the config in the CLI by doing a "more system:running-config"

Site-to-Site VPN between Cisco ASA 5505 (8.4) and Cisco Router (IOS 15.2)

Hi, I'm trying to create Site-to-Site VPN between Cisco ASA 5505 and Cisco Router 3945.
I've tried create configuration with and without ASA wizard, but anyway it doesn't work.
Please help me to find where is the issue.
I have two sites and would like to get access from 192.168.83.0 to 192.168.17.0
192.168.17.0 --- S1.S1.S1.S1 (IOS Router) ==================== S2.S2.S2.S2 (ASA 5505) --- 192.168.83.0
Here is my current configuration.
Thanks for your help.
IOS Configuration
version 15.2
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key cisco address 198.0.183.225
crypto isakmp invalid-spi-recovery
crypto ipsec transform-set AES-SET esp-aes esp-sha-hmac
mode transport
crypto map static-map 1 ipsec-isakmp
set peer S2.S2.S2.S2
set transform-set AES-SET
set pfs group2
match address 100
interface GigabitEthernet0/0
ip address S1.S1.S1.S1 255.255.255.240
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map static-map
interface GigabitEthernet0/1
ip address 192.168.17.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
access-list 100 permit ip 192.168.17.0 0.0.0.255 192.168.83.0 0.0.0.255
ASA Configuration
ASA Version 8.4(3)
interface Ethernet0/0
switchport access vlan 2
interface Vlan1
nameif inside
security-level 100
ip address 192.168.83.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address S2.S2.S2.S2 255.255.255.248
ftp mode passive
same-security-traffic permit intra-interface
object network inside-network
subnet 192.168.83.0 255.255.255.0
object network datacenter
host S1.S1.S1.S1
object network datacenter-network
subnet 192.168.17.0 255.255.255.0
object network NETWORK_OBJ_192.168.83.0_24
subnet 192.168.83.0 255.255.255.0
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended deny ip any any log
access-list outside_cryptomap extended permit ip 192.168.83.0 255.255.255.0 object datacenter-network
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpn_pool 192.168.83.200-192.168.83.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic inside-network interface
nat (inside,outside) source static inside-network inside-network destination static inside-network inside-network no-proxy-arp route-lookup
nat (inside,outside) source static inside-network inside-network destination static datacenter-network datacenter-network no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.83.0_24 NETWORK_OBJ_192.168.83.0_24 destination static datacenter-network pdatacenter-network no-proxy-arp route-lookup
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY 1
crypto ipsec ikev1 transform-set vpn-transform-set esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set vpn-transform-set mode transport
crypto ipsec ikev1 transform-set L2L_SET esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set L2L_SET mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set vpn-transform-set
crypto map vpn 1 match address outside_cryptomap
crypto map vpn 1 set pfs
crypto map vpn 1 set peer S1.S1.S1.S1
crypto map vpn 1 set ikev1 transform-set L2L_SET
crypto map vpn 20 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto isakmp nat-traversal 3600
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
group-policy GroupPolicy_S1.S1.S1.S1 internal
group-policy GroupPolicy_S1.S1.S1.S1 attributes
vpn-tunnel-protocol ikev1
group-policy remote_vpn_policy internal
group-policy remote_vpn_policy attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec
username artem password 8xs7XK3To4s5WfTvtKAutA== nt-encrypted
username admin password rqiFSVJFung3fvFZ encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
address-pool vpn_pool
default-group-policy remote_vpn_policy
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
tunnel-group S1.S1.S1.S1 type ipsec-l2l
tunnel-group S1.S1.S1.S1 general-attributes
default-group-policy GroupPolicy_S1.S1.S1.S1
tunnel-group S1.S1.S1.S1 ipsec-attributes
ikev1 pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:f55f10c19a0848edd2466d08744556eb
: end

Thanks for helping me again. I really appreciate.
I don't hve any NAT-exemptions in Cisco IOS Router. Transform-set I will change soon, but I've tried with tunnel mode and it didn't work.
Maybe NAT-exemptions is the issue. Can you advice me which exemptions should be in Cisco IOS Router?
Because on Cisco ASA I guess I have everything.
Here is show crypto session detail
router(config)#do show crypto session detail
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
Interface: GigabitEthernet0/0
Session status: DOWN
Peer: 198.0.183.225 port 500 fvrf: (none) ivrf: (none)
      Desc: (none)
      Phase1_id: (none)
IPSEC FLOW: permit ip 192.168.17.0/255.255.255.0 192.168.83.0/255.255.255.0
        Active SAs: 0, origin: crypto map
        Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Should I see something in crypto isakmp sa?
pp-border#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
IPv6 Crypto ISAKMP SA
Thanks again for your help.

Difference between extends and implements

hi
i am new to java. i need to know the difference between extends class implement class.
can anybody explain in simple words? i am new too oops concept also?
what are the conditions to use extends class, implement and interface?
class b extends a implements c
i know class a is a super class and class b is a sub class.
if class b extends class a means how should be the class a, what about the methods?
and class a implements class c means what should be the conditions?
i searched in Internet but the explanation is not very to me.can body explain me please?
thank you

sarcasteak wrote:
Your class can implement an interface, which means it must use the methods defined in the interface.No, it doesn't need to use them. It needs to implement them. Or be declared abstract.
Note that the methods in the interface are empty,No, they're not. They're abstract.
// empty method
void foo() {}
// abstract method
abstract void foo();(The abstract keyword is optional for interface methods, since they're all abstract.
and you have to define what they do in your class that implements the interface.Just like they have to for abstract methods in a class you extend, if the child class is not declared abstract.
There really isn't any difference between "extends" and "implements." There is no situation where you can choose. Any case where one is legal, only that one is legal. They could just as easily be a single keyword.
Presumably the OP's real question is, "When do I use a class for a supertype vs. using an interface for a supertype?" The answer to that, of course, is:
Use a class when at least some of the methods have valid default implementations. Use an interface when that is not the case. And of course the two are not mutually exclusive. It's quite common to do both.
At the end of the day, an interface is really nothing more than a class that has no non-final or non-static member variables and whose instance methods are all abstract, and from which you can multiply inherit.
Edited by: jverd on Feb 4, 2010 1:56 PM

Difference between Photosmart 5520 and 5524?

Hi,
I'm potentially going to purchase one of the HP printers listed above but I'm a little confused, they're both the same series and have apparently exactly the same spec, but model numbers are different?
In Currys too, they're £10 apart but one comes with extra sets of ink?
If anyone has any answers I'd love to hear them.
Thanks.
This question was solved.
View Solution.

Hey Callumh003,
HP has made several different models of the same base design. The Photosmart 5520 and Photosmart 5524 are the same printer model, however what comes in the box is the difference. Similarly, there is a Photosmart 5522 in some regions and the difference is also what comes in the box from the base Photosmart 5520.
I hope this helps to clarify.
Jason
-------------How do I give Kudos? | How do I mark a post as Solved? --------------------------------------------------------
I am not an HP employee.

What is difference between abstraction and encapsulation ?

Hi,
I am trying to figure out the difference between abstraction and encapsulation but confused.
Both are used for data hiding then what is the exact difference ?
Thanks.

Tushar-Patel wrote:
I am trying to figure out the difference between abstraction and encapsulation but confused.
Both are used for data hiding then what is the exact difference ?This is the picture I have:
When you encapsulate something you get an inside and an outside. The outside is the abstraction. It describes how the encapsulated entity behaves viewed from the outside. This is also called the type. Hidden inside is the implementation. It holds detail information about how the type's behaviour is accomplished.
It's a very simplified picture but I think it's quite accurate and it works for me.

What is difference between modify and update i am using

hi
what is difference between mofify and update
my requiremen is to have three condition checkec while mofifying or updating from a internal table
the three fields are
cus no
status
date these all are primary key in the database table
so which sould i use modify or update
there might be entry already existing in database table or new entry to be created if already existin it should check on the primary keys and updatat if not it should add a record
pls suggest whihc to use and how to implement the check on teh threee primary key
like if modify ztable from table it_test
now where condition ? can be used or not with modify? and if yes how
if not should i use update will update create a new entry if no entry is there and please give syntex
regards
Arora

Hi Nishant Arora,
Modify: It works in performing two actions.
They are: Insert + Update.
For Example If a record that is exited in database, so you are modifying that record, it updates that particular record.
Similarly, If the is not existed in the database, you are modifying it, it inserts a new record.
Update: Update means just it updates the status, I mean it only updates the record. It doesn't inserts any new record if that particular record is not present in the database.
These are the cases you need to write these statements.
Syntaxes: :
Go through this links please.,
http://help.sap.com/saphelp_nw04/helpdata/en/e7/968aa8b2384dd9835f91e7f8470064/content.htm
http://help.sap.com/saphelp_nw70/helpdata/en/fc/eb35eb358411d1829f0000e829fbfe/content.htm
Reward points if useful
Cheers,
Swamy Kunche
Edited by: Swamy Kunche on Jun 11, 2008 2:41 PM

What's difference between ASC and DESC index

1 select count(*)
2* from big_emp e where hiredate >= to_date('1980-01-01', 'YYYY-MM-DD') and hiredate <= to_date('1983-12-31', 'YYYY-MM-DD')
COUNT(*)
11971
SQL> create index i_big_emp_hiredate on big_emp(hiredate);
Index created.
SQL> set autot trace
SQL> select empno, ename, hiredate
2 from big_emp e where hiredate >= to_date('1980-01-01', 'YYYY-MM-DD') and hiredate <= to_date('1983-12-31', 'YYYY-MM-DD') ;
11971 rows selected.
Execution Plan
| Id | Operation | Name | Rows | Bytes | Cost |
| 0 | SELECT STATEMENT | | 11766 | 218K| 19 |
|* 1 | TABLE ACCESS FULL| BIG_EMP | 11766 | 218K| 19 |
SQL> drop index i_big_emp_hiredate;
Index dropped.
SQL> create index i_big_emp_hiredate on big_emp(hiredate desc);
Index created.
SQL> select empno, ename, hiredate
2 from big_emp e where hiredate >= to_date('1980-01-01', 'YYYY-MM-DD') and hiredate <= to_date('1983-12-31', 'YYYY-MM-DD') ;
11971 rows selected.
Execution Plan
| Id | Operation | Name | Rows | Bytes | Cost |
| 0 | SELECT STATEMENT | | 29 | 551 | 4 |
| 1 | TABLE ACCESS BY INDEX ROWID| BIG_EMP | 29 | 551 | 4 |
|* 2 | INDEX RANGE SCAN | I_BIG_EMP_HIREDATE | 53 | | 2 |
i have 2 questions
1. In "Expert one-on-one Oracle", Tom said, there is no deference between ASC and DESC index in case of one column because Oracle can just read in reverse order. but my test made me confused. why Oracle did "full table scan" only in ASC index???
2. using "set autot trace" command. i believed the the "Rows" column mean the rows that Oracle access. Can you explain why the rows are 29(DESC) and 11766(ASC) in spite of the result is 11971. what is the exact meaning of "Rows" column in execution plan

I think what you're seeing is a bug in the optimizer. If you had printed up the predicate section of the execution plan, this would be more obvious. I have the query:
select *
from   t1
where d1 between to_date('01-jan-2001')
          and     to_date('31-dec-2003')
;This returns one row per day for 3 years, and when a normal index is created on it, the optimizer calculates the correct cardinality and uses a sensible set of predicates. But when I use a descending index, this is what I get:
Execution Plan
Plan hash value: 1429545322
| Id | Operation                   | Name | Rows | Bytes | Cost |
|   0 | SELECT STATEMENT            |       | 1097 | 21940 |     2 |
|   1 | TABLE ACCESS BY INDEX ROWID| T1    | 1097 | 21940 |     2 |
|* 2 |   INDEX RANGE SCAN          | T1_I1 |     5 |       |     2 |
Predicate Information (identified by operation id):
   2 - access(SYS_OP_DESCEND("D1")>=HEXTORAW('8798F3E0FEF8FEFAFF') AND
              SYS_OP_DESCEND("D1")<=HEXTORAW('879AFEF8FEF8FEFAFF') )
       filter(SYS_OP_UNDESCEND(SYS_OP_DESCEND("D1"))>=TO_DATE('2001-01-0
              1 00:00:00', 'yyyy-mm-dd hh24:mi:ss') AND
              SYS_OP_UNDESCEND(SYS_OP_DESCEND("D1"))<=TO_DATE('2003-12-31 00:00:00',
              'yyyy-mm-dd hh24:mi:ss'))Note the introduction of the strange sys_op_descend() function - which is related to the descending index implemention, and the extra FILTER predicates which introduce a significant extra selectivity effect. The optimizer is double-counting on selectivity effects, and introducing extra factors of 1% and 5% (I haven't checked exact details) due to the functions applied to columns and the range-based predicates.
Regards
Jonathan Lewis
http://jonathanlewis.wordpress.com
http://www.jlcomp.demon.co.uk

What is the diffrence between multicasting and broadcasting?

hi friends
What is the diffrence between multicasting and broadcasting?
i'm bit confused in multicasting and broadcasting.

Broadcasts go everywhere within a range determined by the sender.
Broadcasting is deprecated and unliikely to go beyond the nearest router.
Multicasts go everywhere where receivers have declared they are present.
Multicast can be implemented beyond routers in a WAN which you control but ISP routers generally don't support it.

SSO between ITS and EP

We are implementing ESS MSS on 4.7 , ITS 4.7 with EP 6.0
Can some one point me as to how to configure the SSO between these various landscapes. I Think we would require SSO between EP and ITS for ESS in MSS services.
regards
Sam
Message was edited by:
sameer chilama

Hi Sameer,
All the information you are looking for is in the help.sap.com
http://help.sap.com/saphelp_nw04/helpdata/en/89/6eb8e1af2f11d5993700508b6b8b11/frameset.htm
This help guide is really very clear and thorough.
Regards
Daniel

SSO Between EP and R/3 6.4

Hi,
I am trying to implement SSO between SAP EP 6.0 and SAP R/3 6.4 using logon tickets.
I've downloaded the .pse and .der files from Portal,uploaded the .pse in the backend system,added it to the ACL,but when i tried to test the connection in portal using system admin->system configuration->UM configuration->SAP system
i am getting an error----
(System ID): com.sap.mw.jco.JCO$Exception: (101) RFC_ERROR_PROGRAM: 'mshost' missing
(System ID & System Number): com.sap.mw.jco.JCO$Exception: (102) RFC_ERROR_COMMUNICATION: Connect to SAP gateway failed Connect_PM TYPE=A ASHOST=ctsgvcsap3 SYSNR=03 GWHOST=ctsgvcsap3 GWSERV=sapgw03 PCS=1 LOCATION CPIC (TCP/IP) on local host with Unicode ERROR service '?' unknown TIME Thu Feb 23 16:24:39 2006 RELEASE 640 COMPONENT NI (network interface) VERSION 37 RC -3 COUNTER 2
Where am i going wrong?Please help.
If anyone is having detailed documentation please forward the same.
Thanks in advance
SwarnaDeepika.
Message was edited by: SwarnaDeepika

Hi Swarna
the procedure for importing portal certificate in r3 system i already mentioned
u have a authorization for strustsso2 on r3 system
ask for that to basis person or done with their id
after importing portal certificate into r3 system u have to restart the r3 system no need to restart the portal system
and make sure for SSO both portal and R3 system are in same domain.
i.e
sapr3.mydomain.com
portal.mydomain.com
if not u have to specify the DNS entry for that by creating alias.
regards,
kaushal

Difference between implicit and explicit enhancement points

Hi Folks,
I had learned many documents to findout the difference between explicit and implicit enhancement point.I got the theoritical knowledge on that but losing on the practical side..
Can anybody help me out with one real time scenario where the explicit enhancement points have been implemented and the step by step procedure to implement it..
Hoping for the positive response from you..
Regards,
Rohan.

Hi Rohan,
In implicit they are available at the beginning of subroutines defined in the standard reports.
Edit-> Enhancement operations->show implicit enhancement options.
This will highlight all the implicit enhancements in the report.
In Explicit enhancement we have two different types of enhancements -
Enhancement point and Enhancement section.
Enhancement point - SAP has some standard functionality defined for a report , but it may be required that you'll need to add your own code. In this case the code that you'll add will be executed along with the standard code.
Enhancement section - SAP has its standard functionality defines but it may not suit your requirement, in that case you may need to add your code and you'll need that code to be executed only. By this method the existing code is automatically commented and a copy of the same code is available to edit.
After executing the report only your code will be executed and the standard code will be bypassed.
For Practicle implementation, follow this link.
Link : [http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/bb54c452-0801-0010-0e84-a653307fc6fc]
i hope it will give you some clear picture....
Thanks.
Anurag

Difference between BAPI and RFC?

Difference between BAPI and RFC?
also where to use BAPI and where to use RFC?

Hi,
BAPI are RFC enabled function modules. the difference between RFc and BAPI are business objects. You create business objects and those are then registered in your BOR (Business Object Repository) which can be accessed outside the SAP system by using some other applications (Non-SAP) such as VB or JAVA. in this case u only specify the business object and its method from external system in BAPI there is no direct system call. while RFC are direct system call Some BAPIs provide basic functions and can be used for most SAP business object types. These BAPIs should be implemented the same for all business object types. Standardized BAPIs are easier to use and prevent users having to deal with a number of different BAPIs. Whenever possible, a standardized BAPI must be used in preference to an individual BAPI.
The following standardized BAPIs are provided:
Reading instances of SAP business objects
GetList ( ) With the BAPI GetList you can select a range of object key values, for example, company codes and material numbers.
The BAPI GetList() is a class method.
GetDetail() With the BAPI GetDetail() the details of an instance of a business object type are retrieved and returned to the calling program. The instance is identified via its key. The BAPI GetDetail() is an instance method. BAPIs that can create, change or delete instances of a business object type
The following BAPIs of the same object type have to be programmed so that they can be called several times within one transaction. For example, if, after sales order 1 has been created, a second sales order 2 is created in the same transaction, the second BAPI call must not affect the consistency of the sales order 2. After completing the transaction with a COMMIT WORK, both the orders are saved consistently in the database.
Create( ) and CreateFromData! ( )
The BAPIs Create() and CreateFromData() create an instance of an SAP business object type, for example, a purchase order. These BAPIs are class methods.
Change( )
The BAPI Change() changes an existing instance of an SAP business object type, for example, a purchase order. The BAPI Change () is an instance method.
Delete( ) and Undelete( ) The BAPI Delete() deletes an instance of an SAP business object type from the database or sets a deletion flag.
The BAPI Undelete() removes a deletion flag. These BAPIs are instance methods.
Cancel ( ) Unlike the BAPI Delete(), the BAPI Cancel() cancels an instance of a business object type. The instance to be cancelled remains in the database and an additional instance is created and this is the one that is actually canceled. The Cancel() BAPI is an instance method.
Add<subobject> ( ) and Remove<subobject> ( ) The BAPI Add<subobject> adds a subobject to an existing object inst! ance and the BAPI and Remove<subobject> removes a subobject from an object instance. These BAPIs are instance methods.
Regards,
Prakash

Adventures implementing NEM between 5520 and 5505...

Similar Messages

Maybe you are looking for