ASA 5505 L2TP client connect problem
I am trying to connect MS l2tp clients to asa 5505 and am unsuccessful. I have tried the ASDM VPN Wizard as well as CLI and missing something. I have attached my current config. My client hits the interface and logs an error 713048 Error processing payload: Payload ID: 1. I know I am missing something simple, but I just can't see it. HELP!!!! Please
ASA configuration needs to have the following configured ...
- The preshared key needs to match the one configured in the windows client setup.
- The authentication needs to match what you have configured on the client, pap or chap ..
If chap is configured you need to readd the usernames to the ASA with the mschap keyword
at the end .. e.g
SV2-2(config)# username msclient password msclient mschap
- The DefaultRAGroup needs to be configured with the preshared key and point to a policy
that include this vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
The complete config is below ... DefaultRAGroup will be used if the preshared key is
added and nothing is specified on the client..
tunnel-group DefaultRAGroup general-attributes
address-pool vpnpool
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup ppp-attributes
authentication pap
authentication ms-chap-v2
Similar Messages
-
ASA 5505 - 2 Internet Connections, Problems with the Default Route
Hey there,
i have a Problem at a Customer Site at the moment. The customer uses an ASA 5505 with two internet connections attached to it. On the first connection (which is the only one in use at the moment) he has some Static-PAT's from Outside to Inside where he translates different services to the internal servers. He also has a site-2-site VPN terminating there and AnyConnect.
He now wants to switch the Internet Traffic from Inside to the new Internet Connection. Therefore changing the default route to that new ISPs Gateway. The problem now is, that no traffic recieved on the old "outside" Interface is transmitted back out of that old "outside" Interface. And this happens although the "same-security permit intra-interface" command is set.
Can you tell me what's wrong here? For every Static-PAT from outside to inside there is also a dynamic PAT from inside to outside. But the ASA seems to ignore this. I have not looked into the Logs yet, was too busy finding the problem because i had no real time window to test on the productive ASA.
Can it be achieved in any way? Having a default route on the ASA which leads any traffic to the second internet connection while still having connections on the first internet connection where no explicit route can be set? Because connections arrive from random IPs?
Many thanks for your help in advance!
SteffenPhillip, indeed , I have as well read may comments,it all depends on your environment as they all differ from one another, you best bet is to have a good solid plan for upgrade and fall back. You do have a justification to upgrade for features needed, so I would suggest the following:
1- Do a search again in forum for ASA code upgrades and look at comments from users that have gone through this process and note their impact in fuctionality if any. I believe this is good resource to collect information .
2- Very important , look into release notes for a particular version. For example version 8.0, look into open CAVEATS usually at the end of the link page, reading the open bugs gives you clues what has not yet been resolved for that particular code and if in fact could impact you in your environment, it is possible that a particular bug does not realy apply to your environment becuase you have yet not implemented that particualr configuration. Usually we all try to aim towards a GD (General Deployment) code which is what we all understand is most stable but not necesarily means you have to be stack in that code waiting for another GD release, in my personal experience I have upgraded our firewall from 7.2 to 8.0(3) long ago and had no issues, and recently upgraded to 8.0(4)when it was first release in August this year.
Release notes
http://www.cisco.com/en/US/products/ps6120/prod_release_notes_list.html
3- AS a good practice precaution -
a-Backup firewall configs in clear text as well as via tftp code.
b-Backup running code and ASDM version code currently running in firewall.
c- Save the output of " show version " to have as reference for all the feature licenses you currently have running as asll as activation keys - good info to have to compare with after upgrade.
d- Ensure that the code you will be using to upgrade also uses correct ASDM version code.
I think with thorough assesment and preparation you can indeed minimize impact.
Rgds
Jorge -
ASA 5505 & VPN Client blocking access to local lan
I have setup a IPSec vpn client connection to a Cisco ASA 5505, when I connect to the unit it fully authenticates and issues me an ip address on the local lan however when I attempt to connect to any service on the local lan the following message is displayed in the log can you help:
Teardown UDP connection 192.168.110.200 53785 192.168.110.21 53 outside:192.168.110.200/53785(LOCAL\username) to inside 192.168.110/53
See the attached file for a sanitised version of the config.This is a sanitised version of the crypto dump, I have changed the user and IP addresses
ASA5505MAN# debug crypto ikev1 7
ASA5505MAN# debug crypto ipsec 7
ASA5505MAN# Jul 24 15:49:03 [IKEv1]IP = x.x.x.x, IKE_DECODE RECEIVED Message (msgid=fbc167de) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jul 24 15:49:03 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, processing hash payload
Jul 24 15:49:03 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, processing notify payload
Jul 24 15:49:03 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, Received keep-alive of type DPD R-U-THERE (seq number 0xa6dcb72)
Jul 24 15:49:03 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0xa6dcb72)
Jul 24 15:49:03 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, constructing blank hash payload
Jul 24 15:49:03 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, constructing qm hash payload
Jul 24 15:49:03 [IKEv1]IP = x.x.x.x, IKE_DECODE SENDING Message (msgid=515fbf7e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jul 24 15:49:18 [IKEv1]IP = x.x.x.x, IKE_DECODE RECEIVED Message (msgid=2fe7cf10) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jul 24 15:49:18 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, processing hash payload
Jul 24 15:49:18 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, processing notify payload
Jul 24 15:49:18 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, Received keep-alive of type DPD R-U-THERE (seq number 0xa6dcb73)
Jul 24 15:49:18 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0xa6dcb73)
Jul 24 15:49:18 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, constructing blank hash payload
Jul 24 15:49:18 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, constructing qm hash payload
Jul 24 15:49:18 [IKEv1]IP = x.x.x.x, IKE_DECODE SENDING Message (msgid=e450c971) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jul 24 15:49:28 [IKEv1]IP = x.x.x.x, IKE_DECODE RECEIVED Message (msgid=e6c212e7) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jul 24 15:49:28 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, processing hash payload
Jul 24 15:49:28 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, processing notify payload
Jul 24 15:49:28 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, Received keep-alive of type DPD R-U-THERE (seq number 0xa6dcb74)
Jul 24 15:49:28 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0xa6dcb74)
Jul 24 15:49:28 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, constructing blank hash payload
Jul 24 15:49:28 [IKEv1 DEBUG]Group = VPN-Users, Username = username, IP = x.x.x.x, constructing qm hash payload
Jul 24 15:49:28 [IKEv1]IP = x.x.x.x, IKE_DECODE SENDING Message (msgid=af5953c7) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
This is the isakmp dump
ASA5505MAN# show crypto isakmp
IKEv1 SAs:
Active SA: 2
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2
1 IKE Peer: x.x.x.x
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
2 IKE Peer: x.x.x.x
Type : user Role : responder
Rekey : no State : AM_ACTIVE
There are no IKEv2 SAs
Global IKEv1 Statistics
Active Tunnels: 1
Previous Tunnels: 40
In Octets: 322076
In Packets: 2060
In Drop Packets: 84
In Notifys: 1072
In P2 Exchanges: 35
In P2 Exchange Invalids: 0
In P2 Exchange Rejects: 0
In P2 Sa Delete Requests: 24
Out Octets: 591896
Out Packets: 3481
Out Drop Packets: 0
Out Notifys: 2101
Out P2 Exchanges: 275
Out P2 Exchange Invalids: 0
Out P2 Exchange Rejects: 0
Out P2 Sa Delete Requests: 284
Initiator Tunnels: 231
Initiator Fails: 221
Responder Fails: 76
System Capacity Fails: 0
Auth Fails: 54
Decrypt Fails: 0
Hash Valid Fails: 0
No Sa Fails: 30
Global IKEv2 Statistics
Active Tunnels: 0
Previous Tunnels: 0
In Octets: 0
In Packets: 0
In Drop Packets: 0
In Drop Fragments: 0
In Notifys: 0
In P2 Exchange: 0
In P2 Exchange Invalids: 0
In P2 Exchange Rejects: 0
In IPSEC Delete: 0
In IKE Delete: 0
Out Octets: 0
Out Packets: 0
Out Drop Packets: 0
Out Drop Fragments: 0
Out Notifys: 0
Out P2 Exchange: 0
Out P2 Exchange Invalids: 0
Out P2 Exchange Rejects: 0
Out IPSEC Delete: 0
Out IKE Delete: 0
SAs Locally Initiated: 0
SAs Locally Initiated Failed: 0
SAs Remotely Initiated: 0
SAs Remotely Initiated Failed: 0
System Capacity Failures: 0
Authentication Failures: 0
Decrypt Failures: 0
Hash Failures: 0
Invalid SPI: 0
In Configs: 0
Out Configs: 0
In Configs Rejects: 0
Out Configs Rejects: 0
Previous Tunnels: 0
Previous Tunnels Wraps: 0
In DPD Messages: 0
Out DPD Messages: 0
Out NAT Keepalives: 0
IKE Rekey Locally Initiated: 0
IKE Rekey Remotely Initiated: 0
CHILD Rekey Locally Initiated: 0
CHILD Rekey Remotely Initiated: 0
IKEV2 Call Admission Statistics
Max Active SAs: No Limit
Max In-Negotiation SAs: 12
Cookie Challenge Threshold: Never
Active SAs: 0
In-Negotiation SAs: 0
Incoming Requests: 0
Incoming Requests Accepted: 0
Incoming Requests Rejected: 0
Outgoing Requests: 0
Outgoing Requests Accepted: 0
Outgoing Requests Rejected: 0
Rejected Requests: 0
Rejected Over Max SA limit: 0
Rejected Low Resources: 0
Rejected Reboot In Progress: 0
Cookie Challenges: 0
Cookie Challenges Passed: 0
Cookie Challenges Failed: 0
Global IKEv1 IPSec over TCP Statistics
Embryonic connections: 0
Active connections: 0
Previous connections: 0
Inbound packets: 0
Inbound dropped packets: 0
Outbound packets: 0
Outbound dropped packets: 0
RST packets: 0
Recevied ACK heart-beat packets: 0
Bad headers: 0
Bad trailers: 0
Timer failures: 0
Checksum errors: 0
Internal errors: 0
ASA5505MAN#
and this is the ipsec dump
ASA5505MAN# show crypto ipsec sa
interface: outside
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: x.x.x.x
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.110.200/255.255.255.255/0/0)
current_peer: x.x.x.x, username: username
dynamic allocated peer ip: 192.168.110.200
#pkts encaps: 778, #pkts encrypt: 778, #pkts digest: 778
#pkts decaps: 1959, #pkts decrypt: 1959, #pkts verify: 1959
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 778, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: x.x.x.x/4500, remote crypto endpt.: x.x.x.x/54599
path mtu 1500, ipsec overhead 82(52), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 532B60D0
current inbound spi : 472C8AE7
inbound esp sas:
spi: 0x472C8AE7 (1194101479)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 241664, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 26551
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x532B60D0 (1395351760)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 241664, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 26551
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Crypto map tag: outside_map0, seq num: 1, local addr: x.x.x.x
access-list outside_cryptomap_1 extended permit ip 192.168.110.0 255.255.255.0 192.168.0.0 255.255.0.0
local ident (addr/mask/prot/port): (192.168.110.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
current_peer: x.x.x.x
#pkts encaps: 39333117, #pkts encrypt: 39333117, #pkts digest: 39333117
#pkts decaps: 24914965, #pkts decrypt: 24914965, #pkts verify: 24914965
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 39333117, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: x.x.x.x/0, remote crypto endpt.: x.x.x.x/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: F6943017
current inbound spi : E6CDF924
inbound esp sas:
spi: 0xE6CDF924 (3872258340)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 163840, crypto-map: outside_map0
sa timing: remaining key lifetime (kB/sec): (3651601/15931)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xF6943017 (4136906775)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 163840, crypto-map: outside_map0
sa timing: remaining key lifetime (kB/sec): (3561355/15931)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
ASA5505MAN# -
A client connection problem....
Hi All,
I have a client connection problem.
The project which i did with C# (vs.net 2005) and Oracle XE , works well on my developer machine but i am getting a connection string error on the client side. The error comes from System.Exception class not from OracleException.
The properties of the Oracle.DataAccess reference are ;
Description: Oracle.DataAccess.dll
Runtime Version:v1.0.3705
Version: 10.2.0.100
Path: C:\oraclexe\app\oracle\product\10.2.0\server\bin\Oracle.DataAccess.dll
The sample code is:
using Oracle.DataAccess.Client;
using Oracle.DataAccess.Types;
private void button1_Click(object sender, EventArgs e)
OracleConnection cnn = new OracleConnection();
OracleCommand cmm = new OracleCommand();
try
cnn.ConnectionString = "USER ID=" + textEdit1.Text + ";PASSWORD=" + textEdit2.Text +
";DATA SOURCE=" + textEdit3.Text + ";";
DataSet ds = new DataSet();
cmm.Connection = cnn;
cmm.Connection.Open();
cmm.CommandType = CommandType.Text;
cmm.CommandText = "SELECT * FROM FORMS";
OracleDataAdapter ad = new OracleDataAdapter(cmm);
ad.Fill(ds);
gridControl1.DataSource = ds.Tables[0];
cmm.Connection.Close();
cnn.Dispose();
catch (OracleException oexx)
MessageBox.Show(oexx.Message,"From OracleException");
cmm.Connection.Close();
cnn.Dispose();
catch (Exception exx)
MessageBox.Show(exx.Message,"Fromn Exception");
cmm.Connection.Close();
cnn.Dispose();
And the error message is:
'user ıd' is an invalid connection string attribute --> Oracle.DataAccess
Any idea ?
Thanks in advance for your help.
Adam1. What is the client machine locale? Is it Turkish by any chance?
2. Try using lowe case "user id" in the connection string instead of upper case "USER ID". -
ASA 5505 - L2TP over IPsec - Remote Address shows outside interface address
Using an ASA 5505 for firewall and VPN. We've enabled L2TP over IPsec to allow Windows clients to connect without third party software.
The devices complete the connection and authenticate fine, but then are unable to hit any internal resources. Split tunneling seems to be working, as they can still hit outside resources. Packet tracer shows tcp flowing freely between VPN clients (192.168.102.0/24) and internal resources (192.168.100.0/24). Even the NAT translation looks good in packet tracer.
I pulled up the session details for one of the VPN clients in the ASDM and under the IPsecOverNatT details, it is showing the VPN client's remote address correctly, but displays the local address as the address assigned to the outside interface (which the client is using to connect.) This seems to be the problem, as viewing detailed connection logs shows the internal resources trying to send packets back to the outside interface rather than the VPN client's assigned internal addresses. Details:
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: [OUTSIDE INTERFACE ADDRESS]
local ident (addr/mask/prot/port): ([OUTSIDE INTERFACE ADDRESS]/255.255.255.255/17/1701)
remote ident (addr/mask/prot/port): ([VPN CLIENT ADDRESS]/255.255.255.255/17/0)
current_peer: [VPN CLIENT ADDRESS], username: vpnuser
dynamic allocated peer ip: 192.168.102.1 [This is what I think it should be showing for local ident]
dynamic allocated peer ip(ipv6): 0.0.0.0
#pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16
#pkts decaps: 18, #pkts decrypt: 18, #pkts verify: 18
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 16, #pkts comp failed: 0, #pkts decomp failed: 0
#post-frag successes: 0, #post-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (rcv): 0,
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: [OUTSIDE INTERFACE ADDRESS]/4500, remote crypto endpt.: [VPN CLIENT ADDRESS]/8248
path mtu 1500, ipsec overhead 82(52), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 05BFAE20
current inbound spi : CF85B895
inbound esp sas:
spi: 0xCF85B895 (3481647253)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Transport, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 77824, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (kB/sec): (4373998/3591)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x000FFFFD
outbound esp sas:
spi: 0x05BFAE20 (96448032)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Transport, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 77824, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (kB/sec): (4373999/3591)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Any ideas? The remote clients connect but when internal resources try to send traffic to the VPN clients, the packets are directed to the outside interface address instead of the local address assigned to the VPN client.I have what I believe to be a similar issue. Site to site vpn is working well. That is site b can ping and send traffic to site A but Site A can not. Site B is a 3rd party vpn router. Site A is a Cisco 5505.
It appears that when the crypto map inserts the route into the routing table it shows the route via the outside IP of the outside interface and not the IP of Site B. in the crypto map I can see the proper ip address for the peer. I can't figure out why when it inserts the route that it uses the wrong ip address -
ASA 5505 IPSEC VPN connected but can't access to LAN
ASA : 8.2.5
ASDM: 6.4.5
LAN: 10.1.0.0/22
VPN Pool: 172.16.10.0/24
Hi, we purcahsed a new ASA 5505 and try to setup IPSEC VPN via ASDM; i just simply run the Wizards, setup vpnpool, split tunnelling,etc.
I can connect to the ASA by using cisco VPN client and internet works fine on the local PC, but it cannot access to the LAN (can't ping. can't remote desktop). I tried the same thing on our Production ASA(those have both Remote VPN and Site-to-site VPN working), the new profile i created worked fine.
Below is my configure, do I mis-configure anything?
ASA Version 8.2(5)
hostname asatest
domain-name XXX.com
enable password 8Fw1QFqthX2n4uD3 encrypted
passwd g9NiG6oUPjkYrHNt encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 10.1.1.253 255.255.252.0
interface Vlan2
nameif outside
security-level 0
ip address XXX.XXX.XXX.XXX 255.255.255.240
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
domain-name vff.com
access-list vpntest_splitTunnelAcl standard permit 10.1.0.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 10.1.0.0 255.255.252.0 172.16.10.0 255.255.255.0
pager lines 24
logging enable
logging timestamp
logging trap warnings
logging asdm informational
logging device-id hostname
logging host inside 10.1.1.230
mtu inside 1500
mtu outside 1500
ip local pool vpnpool 172.16.10.1-172.16.10.254 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server AD protocol nt
aaa-server AD (inside) host 10.1.1.108
nt-auth-domain-controller 10.1.1.108
http server enable
http 10.1.0.0 255.255.252.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 10.1.0.0 255.255.252.0 inside
ssh timeout 20
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy vpntest internal
group-policy vpntest attributes
wins-server value 10.1.1.108
dns-server value 10.1.1.108
vpn-tunnel-protocol IPSec l2tp-ipsec
password-storage disable
ip-comp disable
re-xauth disable
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpntest_splitTunnelAcl
default-domain value XXX.com
split-tunnel-all-dns disable
backup-servers keep-client-config
address-pools value vpnpool
username admin password WeiepwREwT66BhE9 encrypted privilege 15
username user5 password yIWniWfceAUz1sUb encrypted privilege 5
username user3 password umNHhJnO7McrLxNQ encrypted privilege 3
tunnel-group vpntest type remote-access
tunnel-group vpntest general-attributes
address-pool vpnpool
authentication-server-group AD
authentication-server-group (inside) AD
default-group-policy vpntest
strip-realm
tunnel-group vpntest ipsec-attributes
pre-shared-key BEKey123456
peer-id-validate nocheck
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:447bbbc60fc01e9f83b32b1e0304c6b4
: endI change a Machine's gateway to this ASA and capture again, now we can see some reply.
All ohter PCs and switches gateway are point to another ASA, maybe that's the reason why i didn't work?
what's the recommanded way to make our LAN to have two 2 gateways(for load balance or backup router, etc)?
add two gateways to all PCs and swtichwes?
1: 18:15:48.307875 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
2: 18:15:49.777685 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
3: 18:15:51.377147 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
4: 18:15:57.445777 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
5: 18:15:58.856324 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
6: 18:16:00.395090 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
7: 18:16:06.483464 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
8: 18:16:08.082805 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
9: 18:16:09.542406 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 68
10: 18:16:20.640424 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
11: 18:16:20.642193 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
12: 18:16:21.169607 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
13: 18:16:21.171210 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
14: 18:16:22.179556 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
15: 18:16:22.181142 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
16: 18:16:23.237673 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
17: 18:16:23.239291 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
18: 18:16:27.676402 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 50
19: 18:16:29.246935 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 50
20: 18:16:30.676921 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137: udp 50
21: 18:16:49.539660 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request
22: 18:16:54.952602 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request
23: 18:17:04.511463 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request -
ASA 5505 & VPN Cellular connection
We have a ASA 5505 setup with VPN and using Cisco client 5.0. The VPN works without a problem if we use normal internet access (from home, motel, etc). However if we use a cellular wi-fi hotspot or tether a phone it will connect to the vpn but will not allow us to get on the office network. Anyone have this problem or know a solution
Hello greentw1972,
I have ran in to this issue several times. This is mainly caused by Cisco VPN client's compatibility issues with the 3G-Dongle/Tethering-device. I have seen several workarounds for this but the best one I have found is to use a Open source vpn client.
I have used Shrewsoft VPN client and it has worked nicely without any issues so far
Find the links below for further information.
The 3rd link will show you how exactly you need to transfer information from Cisco VPN client to Shrewsoft client.
Shrewsoft latest VPN client download link : www.shrew.net/download/vpn/vpn-client-2.2.0-rc-2.exe
Shrewsoft Web site : www.shrew.net
Installation instruction as Cisco VPN alternative : http://superuser.com/questions/312947/how-to-configure-shrewsoft-vpn-to-connect-to-cisco-vpn-server
Plese rate this post if helpful -
Cisco ASA 5505 L2TP Pass through
I am having trouble with L2TP pass through on an ASA 5505 device.
L2TP server: OSX 10.6
I can connect with any OSX system and it works fine straight away.
When connecting with a windows computer I get a 789 error. "Error 789: The L2TP connection attempt failed because the security layer encountere a processing error during the initial negotiations with the remote computer."
I did not setup or configure the device to start with and apart from this issue its working fine so I am hessitant at trying to just mess around too much to try and find the problem.
I am using the ASDM 6.4 to manage the device.
Ports look to be forwarded correctly; 1701, 4500 & 500 UDP.
Im just looking for other common issues?
RobBelow is the commands you wanted.
Where you see: IPNOTWHATIWASEXPECTING
This is an IP I dont know. possible and old IP address.
and
default-domain value domain-notcorrect.local
This is an old domain from years ago.
Result of the command: "show run crypto"
crypto ipsec transform-set aes-sha esp-aes esp-sha-hmac
crypto ipsec transform-set aes-192-sha esp-aes-192 esp-sha-hmac
crypto ipsec transform-set aes-256-sha esp-aes-256 esp-sha-hmac
crypto ipsec transform-set 3des-sha esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set transform-amzn esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map map-dynamic 1 set pfs group5
crypto dynamic-map map-dynamic 1 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto dynamic-map map-dynamic 2 set pfs
crypto dynamic-map map-dynamic 2 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto dynamic-map map-dynamic 3 set pfs
crypto dynamic-map map-dynamic 3 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto dynamic-map map-dynamic 4 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer IPNOTWHATIWASEXPECTING3
crypto map outside_map 1 set transform-set ESP-DES-SHA
crypto map outside_map 2 match address acl-amzn
crypto map outside_map 2 set pfs
crypto map outside_map 2 set peer IPNOTWHATIWASEXPECTING IPNOTWHATIWASEXPECTING
crypto map outside_map 2 set transform-set transform-amzn
crypto map outside_map 255 ipsec-isakmp dynamic map-dynamic
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto isakmp policy 2
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 3
authentication pre-share
encryption aes-256
hash sha
group 1
lifetime 86400
crypto isakmp policy 11
authentication pre-share
encryption aes-192
hash sha
group 5
lifetime 86400
crypto isakmp policy 12
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 13
authentication pre-share
encryption aes-192
hash sha
group 1
lifetime 86400
crypto isakmp policy 21
authentication pre-share
encryption aes
hash sha
group 5
lifetime 86400
crypto isakmp policy 22
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 23
authentication pre-share
encryption aes
hash sha
group 1
lifetime 86400
crypto isakmp policy 31
authentication pre-share
encryption 3des
hash sha
group 5
lifetime 86400
crypto isakmp policy 32
authentication rsa-sig
encryption des
hash sha
group 1
lifetime 86400
crypto isakmp policy 33
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 34
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
Result of the command: "show run group-policy"
group-policy evertest internal
group-policy evertest attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy petero internal
group-policy petero attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy awsfilter internal
group-policy awsfilter attributes
vpn-filter value amzn-filter
group-policy vpnpptp internal
group-policy vpnpptp attributes
dns-server value 10.100.25.252
vpn-tunnel-protocol l2tp-ipsec
group-policy vanheelm internal
group-policy vanheelm attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy ciscoVPNuser internal
group-policy ciscoVPNuser attributes
dns-server value 10.100.25.10
vpn-idle-timeout 720
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy chauhanv2 internal
group-policy chauhanv2 attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy oterop internal
group-policy oterop attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy Oterop internal
group-policy Oterop attributes
dns-server value 10.100.25.252
vpn-idle-timeout 30
group-policy chauhanv internal
group-policy chauhanv attributes
dns-server value 10.100.25.252
vpn-idle-timeout 30
vpn-tunnel-protocol IPSec l2tp-ipsec
group-policy bnixon2 internal
group-policy bnixon2 attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
Result of the command: "show run tunnel-group"
tunnel-group ciscoVPNuser type remote-access
tunnel-group ciscoVPNuser general-attributes
address-pool vpnippool
default-group-policy ciscoVPNuser
tunnel-group ciscoVPNuser ipsec-attributes
pre-shared-key *****
tunnel-group petero type remote-access
tunnel-group petero general-attributes
address-pool vpnippool
default-group-policy petero
tunnel-group petero ipsec-attributes
pre-shared-key *****
tunnel-group oterop type remote-access
tunnel-group oterop general-attributes
address-pool vpnippool
default-group-policy oterop
tunnel-group oterop ipsec-attributes
pre-shared-key *****
tunnel-group vanheelm type remote-access
tunnel-group vanheelm general-attributes
address-pool vpnippool
default-group-policy vanheelm
tunnel-group vanheelm ipsec-attributes
pre-shared-key *****
tunnel-group chauhanv type remote-access
tunnel-group chauhanv general-attributes
default-group-policy chauhanv
tunnel-group Oterop type remote-access
tunnel-group Oterop general-attributes
default-group-policy Oterop
tunnel-group chauhanv2 type remote-access
tunnel-group chauhanv2 general-attributes
address-pool vpnippool
default-group-policy chauhanv2
tunnel-group chauhanv2 ipsec-attributes
pre-shared-key *****
tunnel-group bnixon2 type remote-access
tunnel-group bnixon2 general-attributes
address-pool vpnippool
default-group-policy bnixon2
tunnel-group bnixon2 ipsec-attributes
pre-shared-key *****
tunnel-group vpnpptp type remote-access
tunnel-group vpnpptp general-attributes
address-pool vpnippool
default-group-policy vpnpptp
tunnel-group IPNOTWHATIWASEXPECTING4 type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING4 ipsec-attributes
pre-shared-key *****
tunnel-group evertest type remote-access
tunnel-group evertest general-attributes
address-pool vpnippool
default-group-policy evertest
tunnel-group evertest ipsec-attributes
pre-shared-key *****
tunnel-group evertest ppp-attributes
authentication ms-chap-v2
tunnel-group IPNOTWHATIWASEXPECTING3 type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING3 ipsec-attributes
pre-shared-key *****
tunnel-group IPNOTWHATIWASEXPECTING2 type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING2 general-attributes
default-group-policy awsfilter
tunnel-group IPNOTWHATIWASEXPECTING2 ipsec-attributes
pre-shared-key *****
isakmp keepalive threshold 10 retry 3
tunnel-group IPNOTWHATIWASEXPECTING type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING general-attributes
default-group-policy awsfilter
tunnel-group IPNOTWHATIWASEXPECTING ipsec-attributes
pre-shared-key *****
isakmp keepalive threshold 10 retry 3
Result of the command: "show vpn-sessiondb detail remote filter protocol L2TPOverIPsec"
INFO: There are presently no active sessions of the type specified
Result of the command: "show vpn-sessiondb detail remote filter protocol L2TPOverIPsecOverNAT"
INFO: There are presently no active sessions of the type specified -
Cisco ASA 5505 AnyConnect SSL VPN problem
Hi!
I have a small network, wiht ASA 5505, 8.4:
Inside network: 192.168.2.0/24
Outside: Static IP
I would like to deploy a SSL AnyConnect setup.
The state:
-I give the correct IP from my predefined VPN pool (10.10.10.0/24).
But, could not reach any resource, could not ping too. My host has given 10.10.10.1 IP, and I had a GW: 10.10.10.2. Where is this GW from?
Could you help me?
Here is my config (I omitted my PUBLIC IP, and GW):
Result of the command: "show running-config"
: Saved
ASA Version 8.4(4)1
hostname valamiASA
domain-name valami.local
enable password OeyyCrIqfUEmzen8 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 12
interface Vlan1
description LAN
no forward interface Vlan12
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
interface Vlan2
description WAN
nameif outside
security-level 0
ip address MY_STATIC_IP 255.255.255.248
interface Vlan12
description Vendegeknek a valamiHotSpot WiFi-hez
nameif guest
security-level 100
ip address 192.168.4.1 255.255.255.0
management-only
ftp mode passive
clock timezone GMT 0
dns domain-lookup inside
dns domain-lookup outside
dns domain-lookup guest
dns server-group DefaultDNS
name-server 62.112.192.4
name-server 195.70.35.66
domain-name valami.local
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network inside-net
subnet 192.168.2.0 255.255.255.0
object network guest-net
subnet 192.168.3.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.128_25
subnet 192.168.2.128 255.255.255.128
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object icmp
access-list global_access extended permit object-group DM_INLINE_PROTOCOL_3 any any
access-list AnyConnect_Client_Local_Print extended deny ip any any
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu guest 1500
ip local pool valami_vpn_pool 10.10.10.1-10.10.10.10 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
no asdm history enable
arp timeout 14400
object network inside-net
nat (inside,outside) dynamic interface
object network guest-net
nat (guest,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group global_access global
route outside 0.0.0.0 0.0.0.0 MY_STATIC_GW 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa local authentication attempts max-fail 16
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable inside
enable outside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_valami_VPN internal
group-policy GroupPolicy_valami_VPN attributes
wins-server value 192.168.2.2
dns-server value 192.168.2.2
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value valami.local
webvpn
anyconnect ssl rekey time 30
anyconnect ssl rekey method ssl
anyconnect ask enable default anyconnect timeout 30
customization none
deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.
username test password P4ttSyrm33SV8TYp encrypted
tunnel-group valami_VPN type remote-access
tunnel-group valami_VPN general-attributes
address-pool valami_vpn_pool
default-group-policy GroupPolicy_valami_VPN
tunnel-group valami_VPN webvpn-attributes
group-alias valami_VPN enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:d54de340bb6794d90a9ee52c69044753
: endFirst of all thanks your link.
I know your notes, but i don't understand 1 thing:
if i check nat exemption in the anyconnect wizad, why should i make nat exemption rule?
A tried creating a roule, but it is wrong.
My steps (on ASDM):
1: create network object (10.10.10.0/24), named VPN
2: create nat rule: source any, destination VPN, protocol any
Here is my config:
Result of the command: "show running-config"
: Saved
ASA Version 8.4(4)1
hostname companyASA
domain-name company.local
enable password OeyyCrIqfUEmzen8 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 12
interface Vlan1
description LAN
no forward interface Vlan12
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
interface Vlan2
description WAN
nameif outside
security-level 0
ip address 77.111.103.106 255.255.255.248
interface Vlan12
description Vendegeknek a companyHotSpot WiFi-hez
nameif guest
security-level 100
ip address 192.168.4.1 255.255.255.0
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup inside
dns domain-lookup outside
dns domain-lookup guest
dns server-group DefaultDNS
name-server 62.112.192.4
name-server 195.70.35.66
domain-name company.local
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network inside-net
subnet 192.168.2.0 255.255.255.0
object network guest-net
subnet 192.168.3.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.128_25
subnet 192.168.2.128 255.255.255.128
object network WEBSHOP
host 192.168.2.2
object network INSIDE_HOST
host 10.100.130.5
object network VOIP_management
host 192.168.2.215
object network Dev_1
host 192.168.2.2
object network Dev_2
host 192.168.2.2
object network RDP
host 192.168.2.2
object network Mediasa
host 192.168.2.17
object network VOIP_ePhone
host 192.168.2.215
object network NETWORK_OBJ_192.168.4.0_28
subnet 192.168.4.0 255.255.255.240
object network NETWORK_OBJ_10.10.10.8_29
subnet 10.10.10.8 255.255.255.248
object network VPN
subnet 10.10.10.0 255.255.255.0
object network VPN-internet
subnet 10.10.10.0 255.255.255.0
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object icmp
access-list global_access extended permit object-group DM_INLINE_PROTOCOL_3 any any
access-list AnyConnect_Client_Local_Print extended deny ip any any
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu guest 1500
ip local pool company_vpn_pool 10.10.10.10-10.10.10.15 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
no asdm history enable
arp timeout 14400
nat (any,any) source static any any destination static VPN VPN
nat (inside,outside) source static inside-net inside-net destination static VPN VPN
object network inside-net
nat (inside,outside) dynamic interface
object network guest-net
nat (guest,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group global_access global
route outside 0.0.0.0 0.0.0.0 77.111.103.105 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa local authentication attempts max-fail 16
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable inside
enable outside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_company_VPN internal
group-policy GroupPolicy_company_VPN attributes
wins-server value 192.168.2.2
dns-server value 192.168.2.2
vpn-tunnel-protocol l2tp-ipsec
split-tunnel-policy tunnelall
default-domain value company.local
webvpn
anyconnect ssl rekey time 30
anyconnect ssl rekey method ssl
anyconnect ask enable default anyconnect timeout 30
customization none
deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.
group-policy GroupPolicy_VPN internal
group-policy GroupPolicy_VPN attributes
wins-server none
dns-server value 62.112.192.4 195.70.35.66
vpn-tunnel-protocol ssl-client
default-domain value company.local
username test password P4ttSyrm33SV8TYp encrypted
tunnel-group company_VPN type remote-access
tunnel-group company_VPN general-attributes
address-pool company_vpn_pool
default-group-policy GroupPolicy_company_VPN
tunnel-group company_VPN webvpn-attributes
group-alias company_VPN enable
tunnel-group VPN type remote-access
tunnel-group VPN general-attributes
address-pool company_vpn_pool
default-group-policy GroupPolicy_VPN
tunnel-group VPN webvpn-attributes
group-alias VPN enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:33ee37a3722f228f9be9b84ef43f731e
: end
Could you give me a CLI-code?
(or ASDM steps). -
ASA 5505 unable to connect inside or outside
Hello,
I'm extremely new to router configurations, and am attempting to configure a backup ASA 5505 to use as a temporary access point in the event that our main ASA becomes unavailable. What I have done is loaded the running config from our main ASA onto the backup, and have made changes to necessary routes, IPs, etc. I can connect to it from a remote computer without problem, but I cannot access any of our servers, nor can I access the internet. I have also tried modifying the access list and NAT rules every which way from Sunday, but I still cannot get this thing to allow any information through. I keep getting "failed to locate egress interface for UDP from outside" errors.
We are using Cisco AnyConnect to connect , and mind you, since the config for this backup ASA was taken from our main, it still has the original certificate info and profiles. I was told that this wouldn't matter, but I thought I should mention in case I need to remove any of it from the config.
Here is part of the config file. I took out some information, but tried to keep it understandable. If anyone could point me in the right direction, it would be greatly appreciated!
ciscoasa# show running-config
: Saved
: Serial Number: xxxxxxxxxxx
: Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
ASA Version 9.2(2)
hostname ciscoasa
domain-name domain
enable password encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd encrypted
names
ip local pool pool1 x.x.9.22-x.x.9.254 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address x.x.8.10 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.237 255.255.255.248
boot system disk0:/asa922-k8.bin
boot config disk0:/startup-config
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group Default
name-server x.x.8.100
domain-name domain
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network pool1
subnet x.x.9.0 255.255.255.0
object network outside-network
host x.x.x.237
object network Remote-Network
subnet x.x.8.0 255.255.255.0
object network local
object network obj-x.x.9.24
host x.x.9.24
object-group network Outside-Network-Group
description Outside Network Group
network-object x.x.x.232 255.255.255.248
object-group network Inside-Network-Group
description Inside Network Group
network-object x.x.8.0 255.255.255.0
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list NONAT extended permit ip x.x.8.0 255.255.255.0 x.x.9.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 30000
logging buffered debugging
logging asdm informational
no logging message 106015
no logging message 313001
no logging message 313008
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020
flow-export destination inside x.x.8.132 2055
flow-export template timeout-rate 1
flow-export delay flow-create 50
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
asdm image disk0:/asdm-722.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static pool1 pool1 no-proxy-arp route-lookup
nat (inside,outside) source static any any destination static Remote-Network Remote-Network no-proxy-arp route-lookup
nat (outside,outside) source dynamic pool1 interface
object network obj_any
nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 x.x.x.232 1
route inside x.x.11.0 255.255.255.0 x.x.11.1 1
If you have any questions, or need any other information, please let me know.
Thanks!Am I posting this in the wrong section? Anyone?
-
ASA 5505 & VPN Client will not access remote lan
I have an ASA 5505 that is on the parimeter of a hub & spoke vpn network, when I connect to this device using the VPN client I can connect to any device accross the VPN ifrastructure with the exception of the subnet that the client is connected to, for instance:
VPN client internal network connects to 192.168.113.0 /24 and is issued that ip address 192.168.113.200, the VPN client can be pinged from another device in this network however the client cannot access anyting on this subnet, all other sites can be accesed ie. main site 192.168.16.0/24, second site 192.168.110/24 and third site 192.168.112/24. The ACL Manager has a single entry of "Source 192.168.113.0/24 Destination 192.168.0.0/16 and the "Standared ACL 192.168.8.8./16 permit.
What am I doing wrong?Thanks for getting back to me, I have carried out the steps as instructed, one interesting point is that the IP address that was issued to the VPN Client 192.168.113.200 does not appear in the output.
Result of the command: "show run all sysopt"
no sysopt connection timewait
sysopt connection tcpmss 1380
sysopt connection tcpmss minimum 0
sysopt connection permit-vpn
sysopt connection reclassify-vpn
no sysopt connection preserve-vpn-flows
no sysopt radius ignore-secret
no sysopt noproxyarp inside
no sysopt noproxyarp outside
========================================================================
Result of the command: "show capture drop"
3862 packets captured
1: 16:20:12.552675 eb4f.1df5.0453 1503.0100.16d1 0x97da 27: Drop-reason: (np-socket-closed) Dropped pending packets in a closed socket
2: 16:20:12.565980 802.1Q vlan#1 P0 192.168.113.2.1351 > 192.168.113.1.443: F 344642397:344642397(0) ack 2841808872 win 64834 Drop-reason: (tcp-not-syn) First TCP packet not SYN
3: 16:20:18.108469 df4c.9238.6de4 1503.0100.1615 0x80e6 27: Drop-reason: (np-socket-closed) Dropped pending packets in a closed socket
4: 16:20:49.326505 802.1Q vlan#1 P0 802.3 encap packet
5: 16:20:50.326582 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000 Drop-reason: (l2_acl) FP L2 rule drop
6: 16:20:51.326643 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
7: 16:20:52.326734 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
8: 16:20:53.326780 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
9: 16:20:54.326811 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
10: 16:20:55.326933 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
11: 16:20:56.327024 802.1Q vlan#1 P0 802.3 encap packet
12: 16:20:57.327116 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
13: 16:20:58.327131 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000 Drop-reason: (l2_acl) FP L2 rule drop
14: 16:20:59.327207 802.1Q vlan#1 P0 802.3 encap packet
15: 16:21:00.327253 802.1Q vlan#1 P0 802.3 encap packet
16: 16:21:46.298202 802.1Q vlan#2 P0 188.47.231.204.4804 > x.x.x.x: S 1269179881:1269179881(0) win 65535 Drop-reason: (acl-drop) Flow is denied by configured rule
17: 16:21:49.249971 802.1Q vlan#2 P0 188.47.231.204.4804 >x.x.x.x: S 1269179881:1269179881(0) win 65535 Drop-reason: (acl-drop) Flow is denied by configured rule
18: 16:22:01.331449 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
19: 16:22:02.331541 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000 Drop-reason: (l2_acl) FP L2 rule drop
20: 16:22:02.847002 802.1Q vlan#1 P0 192.168.113.102.3601 > 192.168.16.7.389: . ack 776344922 win 0 Drop-reason: (tcp-3whs-failed) TCP failed 3 way handshake
21: 16:22:03.331617 802.1Q vlan#1 P0 802.3 encap packet
22: 16:22:04.331693 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
23: 16:22:05.331769 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
24: 16:22:06.331830 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
25: 16:22:07.331907 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
26: 16:22:08.331937 802.1Q vlan#1 P0 802.3 encap packet
27: 16:22:09.332029 802.1Q vlan#1 P0 802.3 encap packet
28: 16:22:10.332075 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
29: 16:22:11.332136 802.1Q vlan#1 P0 802.3 encap packet
30: 16:22:12.332258 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
31: 16:22:24.346081 802.1Q vlan#2 P0 46.108.60.22.80 > x.x.x.x: S 3922541222:3922541222(0) ack 1002562688 win 8192 Drop-reason: (sp-security-failed) Slowpath security checks failed
32: 16:22:30.981119 802.1Q vlan#1 P0 192.168.113.102.3597 > 192.168.16.7.135: . ack 2880086683 win 0 Drop-reason: (tcp-3whs-failed) TCP failed 3 way handshake
33: 16:22:33.120583 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209 Drop-reason: (sp-security-failed) Slowpath security checks failed
34: 16:22:55.556016 802.1Q vlan#1 P0 192.168.113.103.56162 > 192.168.16.6.135: . ack 1318982887 win 0 Drop-reason: (tcp-3whs-failed) TCP failed 3 way handshake
35: 16:23:13.102671 802.1Q vlan#2 P0 192.168.16.24.2222 > 192.168.113.2.1358: . ack 965718404 win 65103
36: 16:23:13.336423 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
37: 16:23:14.336515 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000 Drop-reason: (l2_acl) FP L2 rule drop
38: 16:23:15.336591 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
39: 16:23:16.336621 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
40: 16:23:17.336698 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
41: 16:23:18.336774 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000 Drop-reason: (l2_acl) FP L2 rule drop
42: 16:23:19.336850 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
43: 16:23:20.336911 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
44: 16:23:21.337033 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
45: 16:23:22.337033 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000 Drop-reason: (l2_acl) FP L2 rule drop
46: 16:23:23.337125 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
47: 16:23:24.337156 802.1Q vlan#1 P0 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
48: 16:23:25.838900 788c.24f4.af1e 1503.0100.1644 0x6336 27:
49: 16:23:25.902602 802.1Q vlan#1 P0 192.168.113.2.1360 > 192.168.113.1.443: F 1261179433:1261179433(0) ack 346419241 win 65535 Drop-reason: (tcp-not-syn) First TCP packet not SYN
50: 16:23:26.172491 8aa9.7eaf.b518 1503.0100.162a 0xcc22 27:
51: 16:23:26.183858 802.1Q vlan#1 P0 192.168.113.2.1361 > 192.168.113.1.443: F 3073385160:3073385160(0) ack 330255452 win 65535
52: 16:23:26.411447 ac6e.3686.6139 1503.0100.16aa 0x15c4 27:
53: 16:23:26.412225 802.1Q vlan#1 P0 192.168.113.2.1362 > 192.168.113.1.443: F 3114673537:3114673537(0) ack 2528250261 win 65535
54: 16:23:54.887695 802.1Q vlan#1 P0 192.168.113.100.53324 > 192.168.16.5.1433: . ack 2023126490 win 0
55: 16:23:55.944577 802.1Q vlan#1 P0 192.168.113.100.53325 > 192.168.16.5.1433: . ack 94487779 win 0
56: 16:23:58.797871 802.1Q vlan#1 P0 192.168.113.2.1364 > 192.168.113.1.443: F 1356011818:1356011818(0) ack 2268294164 win 64505
57: 16:23:58.799153 580a.0f16.0e1a 1503.0100.1625 0x6642 27:
58: 16:24:12.472265 802.1Q vlan#1 P0 192.168.113.2.1366 > 192.168.113.1.443: F 2587530253:2587530253(0) ack 997846426 win 64501
59: 16:24:12.473059 c38c.f9d3.267b 1503.0100.16c9 0xe516 27:
60: 16:24:20.997476 802.1Q vlan#2 P0 192.168.16.7.1025 > 192.168.113.100.53333: . ack 3487921852 win 64975
61: 16:24:25.341443 802.1Q vlan#1 P0 802.3 encap packet
62: 16:24:26.341443 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
63: 16:24:27.341535 802.1Q vlan#1 P0 802.3 encap packet
64: 16:24:28.341565 802.1Q vlan#1 P0 802.3 encap packet
65: 16:24:29.341687 802.1Q vlan#1 P0 802.3 encap packet
66: 16:24:30.341748 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
67: 16:24:31.341779 802.1Q vlan#1 P0 802.3 encap packet
68: 16:24:31.744285 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.103.56171: . ack 712258524 win 65535
69: 16:24:32.341870 802.1Q vlan#1 P0 802.3 encap packet
70: 16:24:33.209385 802.1Q vlan#1 P0 192.168.113.103.56173 > 192.168.16.6.389: . ack 154944525 win 0
71: 16:24:33.341916 802.1Q vlan#1 P0 802.3 encap packet
72: 16:24:34.341962 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
73: 16:24:35.342084 802.1Q vlan#1 P0 802.3 encap packet
74: 16:24:36.342160 802.1Q vlan#1 P0 802.3 encap packet
75: 16:24:46.196843 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
76: 16:24:47.981196 802.1Q vlan#1 P0 192.168.113.101.138 > 192.168.113.255.138: udp 214
77: 16:25:24.513370 802.1Q vlan#1 P0 192.168.113.2.1370 > 192.168.113.1.443: F 2400826:2400826(0) ack 249202338 win 64383
78: 16:25:24.514377 8684.9fef.d151 1503.0100.1680 0xdf2e 27:
79: 16:25:37.346326 802.1Q vlan#1 P0 802.3 encap packet
80: 16:25:38.346417 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
81: 16:25:39.230350 802.1Q vlan#1 P0 192.168.113.100.53340 > 192.168.16.6.135: . ack 188710898 win 0
82: 16:25:39.230395 802.1Q vlan#1 P0 192.168.113.100.53341 > 192.168.16.7.135: . ack 2767236437 win 0
83: 16:25:39.232257 802.1Q vlan#1 P0 192.168.113.100.53343 > 192.168.16.7.1025: . ack 689444713 win 0
84: 16:25:39.346478 802.1Q vlan#1 P0 802.3 encap packet
85: 16:25:40.346509 802.1Q vlan#1 P0 802.3 encap packet
86: 16:25:41.346631 802.1Q vlan#1 P0 802.3 encap packet
87: 16:25:42.346661 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
88: 16:25:43.346738 802.1Q vlan#1 P0 802.3 encap packet
89: 16:25:44.346844 802.1Q vlan#1 P0 802.3 encap packet
90: 16:25:45.346936 802.1Q vlan#1 P0 802.3 encap packet
91: 16:25:46.346936 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
92: 16:25:47.347043 802.1Q vlan#1 P0 802.3 encap packet
93: 16:25:48.347119 802.1Q vlan#1 P0 802.3 encap packet
94: 16:25:59.497197 802.1Q vlan#1 P0 192.168.113.100.53350 > 192.168.16.8.1168: . ack 1640347657 win 0
95: 16:26:09.189016 802.1Q vlan#2 P0 112.204.234.145.39894 >x.x.x.x.5900: S 3415732392:3415732392(0) win 65535
96: 16:26:09.192906 802.1Q vlan#2 P0 112.204.234.145.39893 > x.x.x.x.5900: S 4277351748:4277351748(0) win 65535
97: 16:26:09.415917 802.1Q vlan#2 P0 112.204.234.145.39902 > x.x.x.x.5900: S 2622006339:2622006339(0) win 65535
98: 16:26:12.062389 802.1Q vlan#2 P0 112.204.234.145.39894 > x.x.x.x.5900: S 3415732392:3415732392(0) win 65535
99: 16:26:12.176840 802.1Q vlan#2 P0 112.204.234.145.39893 >x.x.x.x.5900: S 4277351748:4277351748(0) win 65535
100: 16:26:12.277222 802.1Q vlan#2 P0 112.204.234.145.39902 >x.x.x.x.5900: S 2622006339:2622006339(0) win 65535
101: 16:26:18.090418 802.1Q vlan#2 P0 79.26.104.252.2960 > x.x.x.x.445: S 2362092149:2362092149(0) win 65535
102: 16:26:21.016097 802.1Q vlan#2 P0 79.26.104.252.2960 > x.x.x.x.445: S 2362092149:2362092149(0) win 65535
103: 16:26:29.047269 802.1Q vlan#1 P0 192.168.113.100.53349 > 192.168.16.8.135: . ack 1602664145 win 0
104: 16:26:29.047315 802.1Q vlan#1 P0 192.168.113.100.53351 > 192.168.16.6.135: . ack 2983532581 win 0
105: 16:26:30.854707 802.1Q vlan#1 P0 192.168.113.103.138 > 192.168.113.255.138: udp 201
106: 16:26:31.566697 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 211
107: 16:26:49.351254 802.1Q vlan#1 P0 802.3 encap packet
108: 16:26:50.351269 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
109: 16:26:51.351345 802.1Q vlan#1 P0 802.3 encap packet
110: 16:26:52.351391 802.1Q vlan#1 P0 802.3 encap packet
111: 16:26:53.351498 802.1Q vlan#1 P0 802.3 encap packet
112: 16:26:54.351529 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
113: 16:26:55.351681 802.1Q vlan#1 P0 802.3 encap packet
114: 16:26:56.351696 802.1Q vlan#1 P0 802.3 encap packet
115: 16:26:57.351742 802.1Q vlan#1 P0 802.3 encap packet
116: 16:26:58.351910 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
117: 16:26:59.351925 802.1Q vlan#1 P0 802.3 encap packet
118: 16:27:00.352002 802.1Q vlan#1 P0 802.3 encap packet
119: 16:27:40.086131 802.1Q vlan#1 P0 192.168.113.2.1376 > 192.168.113.1.443: F 66250328:66250328(0) ack 15807648 win 64600
120: 16:27:40.086665 c969.9bb4.8522 1503.0100.160b 0xaa70 27:
121: 16:27:49.601043 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
122: 16:27:56.085536 802.1Q vlan#2 P0 192.168.16.113.61369 > 192.168.113.2.3389: . 1356749934:1356750395(461) ack 2198032306 win 32768
123: 16:28:01.356106 802.1Q vlan#1 P0 802.3 encap packet
124: 16:28:02.356198 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
125: 16:28:03.356274 802.1Q vlan#1 P0 802.3 encap packet
126: 16:28:04.356320 802.1Q vlan#1 P0 802.3 encap packet
127: 16:28:05.356426 802.1Q vlan#1 P0 802.3 encap packet
128: 16:28:06.356487 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
129: 16:28:07.356533 802.1Q vlan#1 P0 802.3 encap packet
130: 16:28:08.356625 802.1Q vlan#1 P0 802.3 encap packet
131: 16:28:09.356671 802.1Q vlan#1 P0 802.3 encap packet
132: 16:28:10.356747 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
133: 16:28:11.356808 802.1Q vlan#1 P0 802.3 encap packet
134: 16:28:11.623350 802.1Q vlan#2 P0 192.168.16.113.61370 > 192.168.113.2.3389: . ack 236838803 win 32764
135: 16:28:12.356884 802.1Q vlan#1 P0 802.3 encap packet
136: 16:28:13.517597 802.1Q vlan#1 P0 192.168.113.2.1384 > 192.168.16.24.2222: . ack 358563673 win 0
137: 16:28:36.442390 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1388: . ack 3605529264 win 65535
138: 16:28:41.392862 802.1Q vlan#1 P0 192.168.113.2.1402 > 192.168.16.6.389: . ack 3155576226 win 0
139: 16:28:46.584808 802.1Q vlan#2 P0 192.168.16.113.61370 > 192.168.113.2.3389: . ack 236894788 win 32682
140: 16:28:54.008468 802.1Q vlan#2 P0 195.57.0.146.18831 >x.x.x.x.445: S 3177136782:3177136782(0) win 65535
141: 16:28:56.157813 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 174
142: 16:28:57.070537 802.1Q vlan#2 P0 195.57.0.146.18831 > x.x.x.47.445: S 3177136782:3177136782(0) win 65535
143: 16:29:00.678492 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
144: 16:29:01.428475 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
145: 16:29:02.178625 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
146: 16:29:03.067943 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
147: 16:29:03.180090 802.1Q vlan#1 P0 192.168.113.2.1409 > 255.255.255.255.1434: udp 1
148: 16:29:03.196950 802.1Q vlan#2 P0 195.57.0.146.18831 > x.x.x.47.445: S 3177136782:3177136782(0) win 65535
149: 16:29:10.270951 802.1Q vlan#1 P0 192.168.113.21.138 > 192.168.113.255.138: udp 201
150: 16:29:13.361080 802.1Q vlan#1 P0 802.3 encap packet
151: 16:29:14.361156 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
152: 16:29:15.361202 802.1Q vlan#1 P0 802.3 encap packet
153: 16:29:16.361263 802.1Q vlan#1 P0 802.3 encap packet
154: 16:29:17.361370 802.1Q vlan#1 P0 802.3 encap packet
155: 16:29:18.361431 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
156: 16:29:19.361462 802.1Q vlan#1 P0 802.3 encap packet
157: 16:29:20.361523 802.1Q vlan#1 P0 802.3 encap packet
158: 16:29:21.361645 802.1Q vlan#1 P0 802.3 encap packet
159: 16:29:22.361675 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
160: 16:29:23.361767 802.1Q vlan#1 P0 802.3 encap packet
161: 16:29:24.361828 802.1Q vlan#1 P0 802.3 encap packet
162: 16:29:26.454276 802.1Q vlan#1 P0 192.168.113.2.1379 > 192.168.16.6.135: . ack 1950662540 win 0
163: 16:29:55.650326 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1413: . ack 1437557360 win 65535
164: 16:30:06.193486 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
165: 16:30:06.275788 802.1Q vlan#1 P0 192.168.113.2.1419 > 192.168.113.1.443: F 2901932674:2901932674(0) ack 2194877438 win 65535
166: 16:30:06.276108 f51d.deb4.fe29 1503.0100.1667 0xef26 27:
167: 16:30:06.458624 802.1Q vlan#1 P0 192.168.113.101.63801 > 23.51.192.60.443: R 2143801199:2143801199(0) ack 856889377 win 0
168: 16:30:06.943447 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
169: 16:30:07.693857 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
170: 16:30:11.228595 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.101.60989: . ack 1672597860 win 65535
171: 16:30:11.300765 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.101.60990: . ack 3222644503 win 64285
172: 16:30:11.535677 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.101.60992: . ack 4073444089 win 65535
173: 16:30:12.626234 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1395: . ack 1607137060 win 64650
174: 16:30:12.626676 802.1Q vlan#1 P0 192.168.113.2.1414 > 192.168.16.6.135: . ack 1802016687 win 0
175: 16:30:14.321028 802.1Q vlan#1 P0 192.168.113.100.53382 > 192.168.16.8.1168: . ack 3656217567 win 0
176: 16:30:20.957622 802.1Q vlan#1 P0 192.168.113.101.138 > 192.168.113.255.138: udp 214
177: 16:30:22.886520 802.1Q vlan#1 P0 192.168.113.101.137 > 192.168.113.255.137: udp 50
178: 16:30:23.650906 802.1Q vlan#1 P0 192.168.113.101.137 > 192.168.113.255.137: udp 50
179: 16:30:24.415261 802.1Q vlan#1 P0 192.168.113.101.137 > 192.168.113.255.137: udp 50
180: 16:30:25.366024 802.1Q vlan#1 P0 802.3 encap packet
181: 16:30:26.366069 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
182: 16:30:27.366192 802.1Q vlan#1 P0 802.3 encap packet
183: 16:30:28.366298 802.1Q vlan#1 P0 802.3 encap packet
184: 16:30:29.366314 802.1Q vlan#1 P0 802.3 encap packet
185: 16:30:30.366344 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
186: 16:30:31.366405 802.1Q vlan#1 P0 802.3 encap packet
187: 16:30:32.366512 802.1Q vlan#1 P0 802.3 encap packet
188: 16:30:33.366588 802.1Q vlan#1 P0 802.3 encap packet
189: 16:30:34.366603 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
190: 16:30:35.366726 802.1Q vlan#1 P0 802.3 encap packet
191: 16:30:36.366787 802.1Q vlan#1 P0 802.3 encap packet
192: 16:30:41.354550 802.1Q vlan#2 P2 86.144.206.150.4500 > x.x.x.42.4500: udp 1
193: 16:31:41.317641 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
194: 16:31:41.410135 802.1Q vlan#2 P2 86.144.206.150.4500 > x.x.x.42.4500: udp 1
195: 16:31:42.067531 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
196: 16:31:42.625211 802.1Q vlan#1 P0 192.168.113.2.1425 > 192.168.16.6.1026: . ack 324632995 win 0
197: 16:31:42.817447 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
198: 16:31:43.621641 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
199: 16:31:44.364391 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
200: 16:31:45.114373 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
201: 16:32:17.514194 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P ack 705237681 win 64410
202: 16:32:17.712991 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: . ack 705237697 win 64394
203: 16:32:19.914289 802.1Q vlan#1 P0 192.168.113.2.1441 > 192.168.113.1.443: F 3616971343:3616971343(0) ack 2537053001 win 64501
204: 16:32:19.914976 0aee.f71f.4e9f 1503.0100.1693 0x6f0c 27:
205: 16:32:29.859559 802.1Q vlan#1 P0 192.168.113.2.1442 > 192.168.113.1.443: F 1397115987:1397115987(0) ack 4256161373 win 64503
206: 16:32:29.860749 dd44.a305.9308 1503.0100.1656 0x8911 27:
207: 16:32:37.739189 802.1Q vlan#1 P0 192.168.113.100.50120 > 192.168.16.5.1433: . ack 2902970569 win 0
208: 16:32:44.122887 802.1Q vlan#1 P0 192.168.113.2.1443 > 192.168.113.1.443: F 2657615761:2657615761(0) ack 4200892746 win 64503
209: 16:32:44.124062 f6a1.d7ab.e83a 1503.0100.1680 0xc43a 27:
210: 16:32:47.656719 802.1Q vlan#1 P0 192.168.113.100.49261 > 192.168.16.7.1025: . ack 3158609488 win 0
211: 16:33:04.969783 802.1Q vlan#1 P0 192.168.113.2.1445 > 192.168.113.1.443: F 814444399:814444399(0) ack 1634267102 win 64503
212: 16:33:04.970881 aa38.dfad.c613 1503.0100.1676 0x82be 27:
213: 16:33:12.628095 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1435: . ack 2283288029 win 65171
214: 16:33:27.120065 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P 1127604049:1127604142(93) ack 2305443558 win 64394
215: 16:33:27.720421 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P 1127604049:1127604142(93) ack 2305443558 win 64394
216: 16:33:28.925199 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P 1127604049:1127604142(93) ack 2305443558 win 65535
217: 16:33:30.033689 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P 1127604049:1127604142(93) ack 2305443558 win 65535
218: 16:33:31.240466 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P 1127604049:1127604142(93) ack 2305443558 win 65535
219: 16:33:33.658123 802.1Q vlan#2 P0 192.168.16.8.1145 > 192.168.113.102.1106: P 1127604049:1127604142(93) ack 2305443558 win 65535
220: 16:34:28.894362 802.1Q vlan#2 P0 78.8.246.9.4932 > x.x.x.47.445: S 3906206304:3906206304(0) win 65535
221: 16:34:31.868103 802.1Q vlan#2 P0 78.8.246.9.4932 > x.x.x.47.445: S 3906206304:3906206304(0) win 65535
222: 16:34:39.949657 802.1Q vlan#1 P0 192.168.113.102.138 > 192.168.113.255.138: udp 201
223: 16:35:01.222492 802.1Q vlan#1 P0 192.168.113.100.68 > 255.255.255.255.67: udp 300
224: 16:35:01.650952 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
225: 16:35:02.400995 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
226: 16:35:03.151084 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
227: 16:35:04.022093 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
228: 16:35:04.772146 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
229: 16:35:05.522220 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
230: 16:35:20.168295 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
231: 16:35:20.524264 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
232: 16:35:20.918333 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
233: 16:35:21.274354 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
234: 16:35:21.668346 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
235: 16:35:22.024412 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
236: 16:35:41.391978 802.1Q vlan#1 P0 192.168.113.102.138 > 192.168.113.255.138: udp 201
237: 16:35:41.734932 802.1Q vlan#2 P0 192.168.16.10.445 > 192.168.113.102.3524: . ack 2927988043 win 63730
238: 16:35:44.540041 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
239: 16:35:45.290100 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
240: 16:35:45.678050 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
241: 16:35:46.040143 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
242: 16:35:46.220005 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 211
243: 16:35:46.428124 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
244: 16:35:47.178213 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
245: 16:35:48.479345 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
246: 16:35:49.229373 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
247: 16:35:49.979380 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
248: 16:36:01.674388 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 180
249: 16:36:01.674952 802.1Q vlan#1 P0 192.168.113.103.138 > 192.168.113.255.138: udp 181
250: 16:36:01.675074 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
251: 16:36:31.389170 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.103.56182: . ack 1459294663 win 65535
252: 16:36:31.674174 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 180
253: 16:36:32.426354 802.1Q vlan#1 P0 192.168.113.103.56183 > 192.168.16.6.389: . ack 3653264448 win 0
254: 16:36:32.426384 802.1Q vlan#1 P0 192.168.113.103.56183 > 192.168.16.6.389: . ack 3653264448 win 0
255: 16:37:01.673808 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 180
256: 16:37:05.540468 802.1Q vlan#1 P0 192.168.113.103.56179 > 192.168.16.6.1026: . ack 2381360421 win 0
257: 16:37:29.018050 802.1Q vlan#1 P0 0.0.0.0.68 > 255.255.255.255.67: udp 323
258: 16:37:29.019545 802.1Q vlan#1 P0 192.168.113.2.67 > 255.255.255.255.68: udp 327
259: 16:37:31.263887 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49158: . ack 978836481 win 65297
260: 16:37:31.442710 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49167: . ack 4028718881 win 65221
261: 16:37:31.524920 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49170: . ack 1787569991 win 65535
262: 16:37:31.631391 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49171: . ack 1175931771 win 65221
263: 16:37:31.673472 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 180
264: 16:37:31.910536 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49175: . ack 1489216443 win 65535
265: 16:37:32.324140 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49173: . ack 3658936090 win 65458
266: 16:37:32.368785 802.1Q vlan#1 P0 192.168.113.100.49165 > 192.168.16.6.389: . ack 72233897 win 0
267: 16:37:32.483510 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 211
268: 16:37:32.531146 802.1Q vlan#1 P0 192.168.113.100.49157 > 192.168.16.7.389: . ack 4263416637 win 0
269: 16:37:32.736488 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
270: 16:37:32.998788 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49182: . ack 3004547102 win 64245
271: 16:37:33.069179 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49184: . ack 3786025013 win 65535
272: 16:37:33.111429 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
273: 16:37:33.486501 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
274: 16:37:34.236529 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
275: 16:37:34.548982 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.49190: . ack 713312844 win 65535
276: 16:37:35.396524 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
277: 16:37:36.149940 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
278: 16:37:36.914289 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
279: 16:37:37.630094 802.1Q vlan#1 P0 192.168.113.100.55930 > 192.168.16.7.53: . ack 1516588584 win 0
280: 16:37:37.727364 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
281: 16:37:38.477529 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
282: 16:37:39.227527 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
283: 16:37:39.458716 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 181
284: 16:37:39.458853 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
285: 16:37:39.499577 802.1Q vlan#1 P0 192.168.113.100.68 > 255.255.255.255.67: udp 300
286: 16:37:39.548280 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 211
287: 16:37:39.972529 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
288: 16:37:40.040555 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
289: 16:37:40.722618 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
290: 16:37:40.790608 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
291: 16:37:41.332029 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55936: . ack 764822756 win 65297
292: 16:37:41.472631 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
293: 16:37:41.540667 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
294: 16:37:41.864167 802.1Q vlan#2 P0 192.168.16.6.389 > 192.168.113.100.55934: . ack 181110485 win 64773
295: 16:37:42.355694 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
296: 16:37:43.105829 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
297: 16:37:43.855821 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
298: 16:37:58.170080 802.1Q vlan#1 P0 192.168.113.100.49155 > 192.168.16.7.135: . ack 1966960952 win 0
299: 16:37:58.172064 802.1Q vlan#1 P0 192.168.113.100.49156 > 192.168.16.7.1025: . ack 1273630770 win 0
300: 16:38:01.673198 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 180
301: 16:38:01.673549 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 181
302: 16:38:01.673655 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
303: 16:38:01.739082 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
304: 16:38:07.355511 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
305: 16:38:08.105554 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
306: 16:38:08.855592 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
307: 16:38:09.680613 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
308: 16:38:10.430748 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
309: 16:38:11.180776 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
310: 16:38:12.134957 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.100.55944: . ack 2246367695 win 65237
311: 16:38:12.209217 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55945: . ack 2494919019 win 64264
312: 16:38:12.561845 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
313: 16:38:12.966197 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55948: . ack 2086593126 win 65535
314: 16:38:13.311949 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
315: 16:38:13.761389 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55950: . ack 2045545802 win 65535
316: 16:38:14.061977 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
317: 16:38:14.223499 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55953: . ack 1713858377 win 64292
318: 16:38:14.736351 802.1Q vlan#1 P0 192.168.113.2.1460 > 192.168.16.24.2222: . ack 1683177201 win 0
319: 16:38:14.932019 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
320: 16:38:15.682093 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
321: 16:38:16.432137 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
322: 16:38:22.554490 802.1Q vlan#2 P0 84.233.195.62.80 > x.x.x.42.41099: . ack 4144961094 win 4824
323: 16:38:22.590560 802.1Q vlan#2 P0 84.233.195.62.80 > x.x.x.42.41099: R 2988301725:2988301725(0) win 0
324: 16:38:28.171164 802.1Q vlan#1 P0 192.168.113.100.55946 > 192.168.16.6.135: . ack 1977991697 win 0
325: 16:38:28.696192 802.1Q vlan#1 P0 192.168.113.103.56188 > 192.168.16.24.2222: . ack 2408117423 win 0
326: 16:38:31.672877 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 180
327: 16:38:32.107965 802.1Q vlan#1 P0 192.168.113.103.138 > 192.168.113.255.138: udp 201
328: 16:38:35.048642 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
329: 16:38:36.682948 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55960: . ack 4217273847 win 65535
330: 16:38:37.418145 802.1Q vlan#1 P0 192.168.113.100.55959 > 192.168.16.8.1168: . ack 2927102471 win 0
331: 16:38:39.650906 802.1Q vlan#2 P0 192.168.16.7.88 > 192.168.113.100.55965: . ack 3654544597 win 64245
332: 16:38:58.170798 802.1Q vlan#1 P0 192.168.113.100.55947 > 192.168.16.6.1026: . ack 2221560240 win 0
333: 16:39:39.647915 802.1Q vlan#2 P0 46.214.148.199.6237 > x.x.x.42.445: S 4290339150:4290339150(0) win 65535
334: 16:39:42.649868 802.1Q vlan#2 P0 46.214.148.199.6237 > x.x.x.42.445: S 4290339150:4290339150(0) win 65535
335: 16:40:05.249987 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
336: 16:40:06.000000 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
337: 16:40:06.749976 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
338: 16:40:07.344052 802.1Q vlan#1 P0 192.168.113.100.138 > 192.168.113.255.138: udp 211
339: 16:40:08.801716 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
340: 16:40:09.252031 802.1Q vlan#2 P0 192.168.16.6.139 > 192.168.113.2.1483: P 3217152810:3217152814(4) ack 4243483819 win 65463
341: 16:40:09.566087 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
342: 16:40:10.330564 802.1Q vlan#1 P0 192.168.113.100.137 > 192.168.113.255.137: udp 50
343: 16:40:11.073436 802.1Q vlan#2 P0 189.4.30.188.4049 > x.x.x.47.445: S 583807781:583807781(0) win 65535
344: 16:40:14.013030 802.1Q vlan#2 P0 189.4.30.188.4049 > x.x.x.47.445: S 583807781:583807781(0) win 65535
345: 16:40:21.073253 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1465: . ack 1572968133 win 64691
346: 16:40:53.498631 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.103.56193: . ack 2614204448 win 65535
347: 16:40:54.113168 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.103.56195: . ack 3619711523 win 65535
348: 16:42:05.264024 802.1Q vlan#1 P0 192.168.113.21.138 > 192.168.113.255.138: udp 201
349: 16:42:05.990610 802.1Q vlan#1 P0 802.3 encap packet
350: 16:42:06.582886 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
351: 16:42:07.831057 802.1Q vlan#1 P0 802.3 encap packet
352: 16:42:08.623075 802.1Q vlan#1 P0 802.3 encap packet
353: 16:42:09.624509 802.1Q vlan#1 P0 802.3 encap packet
354: 16:42:10.593231 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
355: 16:42:11.703485 802.1Q vlan#1 P0 802.3 encap packet
356: 16:42:12.813693 802.1Q vlan#1 P0 802.3 encap packet
357: 16:42:13.923383 802.1Q vlan#1 P0 802.3 encap packet
358: 16:42:14.963329 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
359: 16:42:15.995477 802.1Q vlan#1 P0 802.3 encap packet
360: 16:42:17.103647 802.1Q vlan#1 P0 802.3 encap packet
361: 16:42:18.103495 802.1Q vlan#1 P0 802.3 encap packet
362: 16:42:19.203511 802.1Q vlan#1 P0 0000.74da.ed6f ffff.ffff.ffff 0x8100 64:
0001 8137 ffff 0022 0004 0000 0000 ffff
ffff ffff 0452 0000 0000 0000 74da ed6f
4100 0003 0004 0000 0000 0000 0000 0000
0000
363: 16:42:20.203572 802.1Q vlan#1 P0 802.3 encap packet
364: 16:42:21.203755 802.1Q vlan#1 P0 802.3 encap packet
365: 16:43:34.032896 802.1Q vlan#2 P0 210.4.15.147.1983 > x.x.x.42.445: S 4060018625:4060018625(0) win 65535
366: 16:43:36.924375 802.1Q vlan#2 P0 210.4.15.147.1983 > x.x.x.42.445: S 4060018625:4060018625(0) win 65535
367: 16:43:51.279053 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
368: 16:43:52.028944 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
369: 16:43:52.778905 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
370: 16:43:53.583481 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
371: 16:43:54.325849 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
372: 16:43:55.075771 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
373: 16:44:43.299133 802.1Q vlan#2 P0 84.46.240.12.4739 > x.x.x.42.445: S 2644276309:2644276309(0) win 65535
374: 16:44:46.355358 802.1Q vlan#2 P0 84.46.240.12.4739 > x.x.x.42.445: S 2644276309:2644276309(0) win 65535
375: 16:45:13.762640 802.1Q vlan#2 P0 14.136.113.23.58068 > x.x.x.42.23: S 628177666:628177666(0) win 5840
376: 16:45:13.764746 802.1Q vlan#2 P0 14.136.113.23.35631 > x.x.x.47.23: S 633610575:633610575(0) win 5840
377: 16:45:13.764914 802.1Q vlan#2 P0 14.136.113.23.36646 >x.x.x.x: S 627103517:627103517(0) win 5840
378: 16:46:47.038068 802.1Q vlan#1 P0 192.168.113.103.56196 > 192.168.16.6.135: . ack 1047348019 win 0
379: 16:47:35.921812 802.1Q vlan#2 P0 50.22.199.212.80 >x.x.x.x.48383: S 1930513355:1930513355(0) ack 1004916503 win 16384
380: 16:47:36.554201 802.1Q vlan#2 P0 66.231.182.111.80 > x.x.x.x.1024: S 2203310160:2203310160(0) ack 2592535424 win 5840
381: 16:48:57.603774 802.1Q vlan#2 P0 142.4.58.113.1859 >x.x.x.x.445: S 3585080814:3585080814(0) win 65535
382: 16:49:00.493123 802.1Q vlan#2 P0 142.4.58.113.1859 > x.x.x.x.445: S 3585080814:3585080814(0) win 65535
383: 16:49:23.626462 802.1Q vlan#1 P0 192.168.113.2.1536 > x.x.x.x.53: . ack 136785297 win 0
384: 16:49:26.492848 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1537: . ack 2966267924 win 65535
385: 16:49:45.827883 802.1Q vlan#2 P0 62.75.244.214.80 > x.x.x.x.40215: S 2919672066:2919672066(0) ack 760938497 win 5840
386: 16:49:56.653225 802.1Q vlan#2 P0 220.132.215.144.4822 > x.x.x.x.23: S 2534918729:2534918729(0) win 5808
387: 16:49:56.655086 802.1Q vlan#2 P0 220.132.215.144.3935 > x.x.x.x.23: S 2538528904:2538528904(0) win 5808
388: 16:49:56.665477 802.1Q vlan#2 P0 220.132.215.144.3892 >x.x.x.x.23: S 2530221481:2530221481(0) win 5808
389: 16:50:05.196980 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
390: 16:50:05.946926 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
391: 16:50:06.696954 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
392: 16:50:33.087489 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
393: 16:50:34.330854 802.1Q vlan#1 P0 192.168.113.103.138 > 192.168.113.255.138: udp 201
394: 16:51:48.139961 802.1Q vlan#2 P0 41.84.159.34.3753 > x.x.x.x.445: S 1632777117:1632777117(0) win 65535
395: 16:51:51.117700 802.1Q vlan#2 P0 41.84.159.34.3753 >x.x.x.x.445: S 1632777117:1632777117(0) win 65535
396: 16:52:16.155723 802.1Q vlan#2 P0 118.157.40.230.17343 > x.x.x.x.45093: udp 30
397: 16:52:16.173620 802.1Q vlan#2 P0 118.157.40.230.17343 > x.x.x.x.45093: udp 20
398: 16:52:19.312148 802.1Q vlan#2 P0 118.157.40.230.17343 > x.x.x.x.45093: udp 20
399: 16:52:25.864243 802.1Q vlan#2 P0 118.157.40.230.17343 > x.x.x.x.45093: udp 20
400: 16:52:33.102457 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
401: 16:52:38.334028 802.1Q vlan#2 P0 118.157.40.230.17343 > x.x.x.x.45093: udp 20
402: 16:53:02.396128 802.1Q vlan#2 P0 118.157.40.230.17343 >x.x.x.x.45093: udp 20
403: 16:53:13.157355 802.1Q vlan#1 P0 192.168.113.2.1554 > 192.168.16.24.2222: . ack 460543479 win 0
404: 16:53:31.871552 802.1Q vlan#2 P0 118.157.40.230.17343 > x.x.x.x.45093: udp 20
405: 16:55:40.103220 802.1Q vlan#2 P0 79.13.79.231.2042 > x.x.x.x.445: S 3623912103:3623912103(0) win 65535
406: 16:55:42.940411 802.1Q vlan#2 P0 79.13.79.231.2042 > x.x.x.40.445: S 3623912103:3623912103(0) win 65535
407: 16:56:01.209049 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
408: 16:56:01.814548 802.1Q vlan#1 P0 192.168.113.2.1561 > 192.168.16.6.1026: . ack 3029302484 win 0
409: 16:56:01.958995 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
410: 16:56:02.709008 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
411: 16:56:03.515110 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
412: 16:56:04.255891 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
413: 16:56:05.005874 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
414: 16:56:35.329649 802.1Q vlan#2 P0 192.168.16.6.389 > 192.168.113.2.1573: . ack 2011530329 win 65280
415: 16:57:18.817050 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.103.56207: . ack 3180698784 win 65535
416: 16:57:18.887191 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.103.56208: . ack 2540987118 win 65535
417: 16:58:00.045529 802.1Q vlan#2 P0 192.168.16.6.135 > 192.168.113.2.1570: . ack 1936024672 win 65263
418: 16:58:03.923337 802.1Q vlan#1 P0 192.168.113.2.1571 > 192.168.16.6.1026: . ack 4000727925 win 0
419: 16:58:24.150276 802.1Q vlan#1 P0 192.168.113.2.1584 > 192.168.16.24.2222: . ack 1251414172 win 0
420: 16:58:39.814090 802.1Q vlan#2 P0 192.168.16.6.389 > 192.168.113.2.1231: R 3143068825:3143068825(0) win 0
421: 16:58:48.666560 802.1Q vlan#1 P0 192.168.113.103.56210 > 192.168.16.6.389: . ack 1501688799 win 0
422: 17:00:05.206547 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
423: 17:00:05.956508 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
424: 17:00:06.706506 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
425: 17:00:28.431206 802.1Q vlan#2 P0 71.244.82.240.4041 >x.x.x.x.445: S 362528713:362528713(0) win 65535
426: 17:00:31.485356 802.1Q vlan#2 P0 71.244.82.240.4041 > x.x.x.x.445: S 362528713:362528713(0) win 65535
427: 17:02:34.845735 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
428: 17:02:50.268998 802.1Q vlan#2 P0 128.68.207.98.1642 > x.x.x.x.445: S 3558079521:3558079521(0) win 65535
429: 17:02:51.441536 802.1Q vlan#2 P0 95.37.124.146.2470 > x.x.x.x.445: S 3847235035:3847235035(0) win 65535
430: 17:02:53.252779 802.1Q vlan#2 P0 128.68.207.98.1642 > x.x.x.x.445: S 3558079521:3558079521(0) win 65535
431: 17:02:54.298949 802.1Q vlan#2 P0 95.37.124.146.2470 > x.x.x.x.445: S 3847235035:3847235035(0) win 65535
432: 17:03:24.651104 802.1Q vlan#1 P0 192.168.113.2.1604 > 192.168.16.24.2222: . ack 927286160 win 0
433: 17:05:23.439979 802.1Q vlan#2 P0 221.132.33.39.3471 > x.x.x.x.445: S 2983629597:2983629597(0) win 65535
434: 17:05:25.237002 802.1Q vlan#2 P0 204.111.67.69.4533 > x.x.x.x.445: S 1412418025:1412418025(0) win 65535
435: 17:05:26.407663 802.1Q vlan#2 P0 221.132.33.39.3471 > x.x.x.x.445: S 2983629597:2983629597(0) win 65535
436: 17:05:28.156669 802.1Q vlan#2 P0 204.111.67.69.4533 >x.x.x.x.445: S 1412418025:1412418025(0) win 65535
437: 17:05:41.544069 802.1Q vlan#2 P0 106.3.103.188.40760 > x.x.x.x.445: S 1656511640:1656511640(0) win 65535
438: 17:05:44.548021 802.1Q vlan#2 P0 106.3.103.188.40760 > x.x.x.x.445: S 1656511640:1656511640(0) win 65535
439: 17:06:11.262620 802.1Q vlan#2 P0 95.51.201.5.2510 > x.x.x.x.445: S 3351917967:3351917967(0) win 65535
440: 17:06:14.298766 802.1Q vlan#2 P0 95.51.201.5.2510 > x.x.x.x.445: S 3351917967:3351917967(0) win 65535
441: 17:07:16.002975 802.1Q vlan#2 P0 37.59.0.72.22 > x.x.x.x.80: S 1208637086:1208637086(0) ack 1 win 14600
442: 17:07:33.093028 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
443: 17:08:11.139015 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
444: 17:08:11.888961 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
445: 17:08:12.638959 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
446: 17:08:13.446571 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
447: 17:08:14.185842 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
448: 17:08:14.935788 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
449: 17:10:05.434685 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
450: 17:10:06.184698 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
451: 17:10:06.934628 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
452: 17:13:48.562791 802.1Q vlan#2 P0 45.131.126.147.53949 >x.x.x.x.14768: . win 16384
453: 17:14:33.697626 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
454: 17:17:41.242846 802.1Q vlan#2 P0 174.138.175.180.5139 > x.x.x.x.5060: udp 417
455: 17:17:41.260789 802.1Q vlan#2 P0 174.138.175.180.5139 > x.x.x.x.5060: udp 418
456: 17:17:41.293014 802.1Q vlan#2 P0 174.138.175.180.5139 > x.x.x.x.5060: udp 418
457: 17:18:26.144813 802.1Q vlan#1 P0 192.168.113.2.1665 > 192.168.16.24.2222: . ack 3674161483 win 0
458: 17:18:47.300216 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1651: . ack 963481079 win 65535
459: 17:19:40.849702 802.1Q vlan#2 P0 93.63.181.21.62986 > x.x.x.x.445: S 274304149:274304149(0) win 65535
460: 17:19:43.733055 802.1Q vlan#2 P0 93.63.181.21.62986 > x.x.x.x.445: S 274304149:274304149(0) win 65535
461: 17:20:01.536120 802.1Q vlan#2 P0 31.47.40.58.2982 > x.x.x.x.445: S 2578199672:2578199672(0) win 16384
462: 17:20:04.582275 802.1Q vlan#2 P0 31.47.40.58.2982 > x.x.x.x.445: S 2578199672:2578199672(0) win 16384
463: 17:20:04.943875 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
464: 17:20:05.693888 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
465: 17:20:06.443900 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
466: 17:20:16.571320 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
467: 17:20:17.318800 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
468: 17:20:18.068798 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
469: 17:20:18.875885 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
470: 17:20:19.615645 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
471: 17:20:20.365627 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
472: 17:20:21.752738 802.1Q vlan#2 P0 192.168.16.6.139 > 192.168.113.2.1678: P 640741668:640741672(4) ack 2410017920 win 65463
473: 17:21:27.330320 802.1Q vlan#2 P0 109.3.51.11.80 >x.x.x.x.40328: R 0:0(0) ack 987376948 win 0
474: 17:22:33.083537 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
475: 17:23:13.037092 802.1Q vlan#1 P0 192.168.113.2.1686 > 192.168.16.24.2222: . ack 2164880831 win 0
476: 17:23:23.507862 802.1Q vlan#2 P0 192.168.16.24.2222 > 192.168.113.2.1687: . ack 3400485149 win 64451
477: 17:24:03.007293 802.1Q vlan#2 P0 114.34.110.185.35787 > x.x.x.x.23: S 475586745:475586745(0) win 5808
478: 17:24:03.013381 802.1Q vlan#2 P0 114.34.110.185.56372 > x.x.x.x.23: S 471207272:471207272(0) win 5808
479: 17:24:03.015410 802.1Q vlan#2 P0 114.34.110.185.37824 > x.x.x.x.23: S 470577274:470577274(0) win 5808
480: 17:25:10.359997 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x.56490: udp 30
481: 17:25:10.379939 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x..56490: udp 20
482: 17:25:13.498478 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x.56490: udp 20
483: 17:25:19.907927 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x.56490: udp 20
484: 17:25:32.359631 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x.56490: udp 20
485: 17:25:56.363415 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x.56490: udp 20
486: 17:26:25.632077 802.1Q vlan#2 P0 126.91.113.22.33902 > x.x.x.x.56490: udp 20
487: 17:26:36.299468 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
488: 17:29:27.531863 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1703: . ack 3505140564 win 65535
489: 17:29:28.061977 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1704: . ack 1723398161 win 65535
490: 17:30:04.984583 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
491: 17:30:05.734565 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
492: 17:30:06.484594 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
493: 17:31:08.448676 802.1Q vlan#1 P0 192.168.113.2.1705 > 192.168.16.6.135: . ack 329930795 win 0
494: 17:32:26.498753 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
495: 17:32:27.248720 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
496: 17:32:27.998681 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
497: 17:32:28.805210 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
498: 17:32:29.545565 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
499: 17:32:30.295669 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
500: 17:33:15.029081 802.1Q vlan#2 P0 37.59.0.72.22 > x.x.x.x.80: S 1846440469:1846440469(0) ack 1 win 14600
501: 17:34:32.666683 802.1Q vlan#2 P0 186.210.159.134.1497 >x.x.x.x.445: S 731294763:731294763(0) win 65535
502: 17:34:35.327314 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1738: . ack 4248243050 win 65516
503: 17:34:35.604262 802.1Q vlan#2 P0 186.210.159.134.1497 > x.x.x.x.445: S 731294763:731294763(0) win 65535
504: 17:34:36.750998 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1748: . ack 1292574253 win 65535
505: 17:34:37.026670 802.1Q vlan#1 P0 192.168.113.2.1741 > 192.168.16.6.389: . ack 3709459071 win 0
506: 17:34:53.094096 802.1Q vlan#2 P0 81.191.253.254.1679 > x.x.x.x.23: S 1795047884:1795047884(0) win 5840
507: 17:34:53.094126 802.1Q vlan#2 P0 81.191.253.254.1160 > x.x.x.x.23: S 1792069562:1792069562(0) win 5840
508: 17:34:53.102182 802.1Q vlan#2 P0 81.191.253.254.4513 > x.x.x.x.23: S 1799422964:1799422964(0) win 5840
509: 17:36:39.992441 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1739: . ack 577382098 win 64563
510: 17:36:43.723198 802.1Q vlan#2 P0 173.199.71.146.22 > x.x.x.x.80: R 0:0(0) ack 1 win 0
511: 17:37:33.073894 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
512: 17:38:24.955700 802.1Q vlan#1 P0 192.168.113.2.1761 > 192.168.16.24.2222: . ack 1222119482 win 0
513: 17:38:34.073040 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
514: 17:38:35.042249 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
515: 17:40:04.993661 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
516: 17:40:05.743674 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
517: 17:40:06.493718 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
518: 17:44:36.412759 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
519: 17:44:37.162757 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
520: 17:44:37.912886 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
521: 17:44:38.717217 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
522: 17:44:39.459616 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
523: 17:44:40.209766 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
524: 17:44:41.660412 802.1Q vlan#2 P0 46.108.60.22.80 > x.x.x.x.23736: S 1810069934:1810069934(0) ack 1517738109 win 8192
525: 17:46:36.157737 802.1Q vlan#1 P0 192.168.113.2.1789 > 192.168.16.6.135: . ack 89468705 win 0
526: 17:46:36.157782 802.1Q vlan#1 P0 192.168.113.2.1790 > 192.168.16.6.1026: . ack 3579387297 win 0
527: 17:47:40.965648 802.1Q vlan#2 P0 78.139.165.57.4297 > x.x.x.x.445: S 2908035217:2908035217(0) win 65535
528: 17:47:43.945385 802.1Q vlan#2 P0 78.139.165.57.4297 > x.x.x.x.445: S 2908035217:2908035217(0) win 65535
529: 17:49:57.610640 802.1Q vlan#2 P0 31.31.89.9.22 > x.x.x.x.80: S 1417858380:1417858380(0) ack 1 win 14600
530: 17:50:05.143699 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
531: 17:50:05.893630 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
532: 17:50:06.643658 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
533: 17:50:35.205967 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
534: 17:52:12.181204 802.1Q vlan#2 P0 91.227.122.90.80 > x.x.x.x.35714: S 3170841931:3170841931(0) ack 4036991100 win 5840
535: 17:52:33.064190 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
536: 17:53:09.887390 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1822: . ack 2934231246 win 65171
537: 17:53:12.554857 802.1Q vlan#1 P0 192.168.113.2.1826 > 192.168.16.24.2222: . ack 972433877 win 0
538: 17:56:46.342297 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
539: 17:56:47.092326 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
540: 17:56:47.842272 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
541: 17:56:48.648236 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
542: 17:56:49.389170 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
543: 17:56:50.139168 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
544: 17:57:13.840181 802.1Q vlan#2 P0 50.22.199.212.80 > x.x.x.x.56495: S 99028886:99028886(0) ack 4216075886 win 16384
545: 17:57:39.906081 802.1Q vlan#2 P0 114.26.202.181.4346 > x.x.x.x.445: S 1063524641:1063524641(0) win 65535
546: 17:57:43.000442 802.1Q vlan#2 P0 114.26.202.181.4346 > x.x.x.x.445: S 1063524641:1063524641(0) win 65535
547: 17:58:13.018858 802.1Q vlan#1 P0 192.168.113.2.1864 > 192.168.16.24.2222: . ack 4207183994 win 0
548: 17:59:39.260194 802.1Q vlan#2 P0 192.168.16.6.88 > 192.168.113.2.1872: . ack 1374926765 win 65535
549: 18:00:04.949566 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
550: 18:00:05.699579 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
551: 18:00:06.449576 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
552: 18:00:44.472158 802.1Q vlan#2 P0 212.70.128.163.2239 >x.x.x.x.445: S 490660798:490660798(0) win 65535
553: 18:00:47.456076 802.1Q vlan#2 P0 212.70.128.163.2239 > x.x.x.x.445: S 490660798:490660798(0) win 65535
554: 18:01:18.987894 802.1Q vlan#2 P0 114.43.54.76.3486 > x.x.x.x.445: S 4082553752:4082553752(0) win 65535
555: 18:01:21.981745 802.1Q vlan#2 P0 114.43.54.76.3486 > x.x.x.x.445: S 4082553752:4082553752(0) win 65535
556: 18:02:33.932477 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 218
557: 18:03:01.819980 802.1Q vlan#2 P0 46.108.60.22.80 > x.x.x.x.30843: S 1487269552:1487269552(0) ack 569782833 win 8192
558: 18:04:43.108270 802.1Q vlan#2 P0 192.168.16.6.389 > 192.168.113.2.1902: . ack 2909854688 win 65130
559: 18:05:26.707894 802.1Q vlan#2 P0 61.160.247.40.6000 > x.x.x.47.3389: S 476708864:476708864(0) win 16384
560: 18:05:26.715813 802.1Q vlan#2 P0 61.160.247.40.6000 > x.x.x.42.3389: S 983564288:983564288(0) win 16384
561: 18:05:26.731941 802.1Q vlan#2 P0 61.160.247.40.6000 > x.x.x.40.3389: S 1910964224:1910964224(0) win 16384
562: 18:06:12.440528 802.1Q vlan#2 P0 192.168.16.6.1026 > 192.168.113.2.1899: . ack 3842669121 win 64563
563: 18:07:27.736488 802.1Q vlan#2 P2 81.196.79.244.40632 > x.x.x.42.445: S 1550760725:1550760725(0) win 65535
564: 18:07:30.656155 802.1Q vlan#2 P2 81.196.79.244.40632 > x.x.x.42.445: S 1550760725:1550760725(0) win 65535
565: 18:07:33.054654 802.1Q vlan#1 P0 192.168.113.2.138 > 192.168.113.255.138: udp 209
566: 18:08:13.949017 802.1Q vlan#1 P0 192.168.113.2.1915 > 192.168.16.24.2222: . ack 1717558933 win 0
567: 18:08:56.271973 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
568: 18:08:57.021956 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
569: 18:08:57.771902 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
570: 18:08:58.593307 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
571: 18:08:59.334394 802.1Q vlan#1 P0 192.168.113.2.137 > 192.168.113.255.137: udp 50
572: 18:09:00.0843 -
Cisco ASA 5505 - 2 PPPoE connection
Hi,
Please I would be very pleased if someone could give me a hand in this matter.
I have a Cisco ASA 5505 9.0(2), 2 dial-up connection (ADSL) with fix IP from the same ISP. I have 2 Linksys router (each dial-up has a router) as well. Both Linksys are connected directly to ASA configured in bridge mode.
I set up one dial-up on interface called “outside” with PPPoE configuration which is, in fact, up and running. I’m able to get my fix public IP.
My problem come from when I try to set up the second dial-up on interface called “outside-other”. I configure properly all PPPoE parameters however I’m not able to get my second fix public IP. Somehow, it’s not able to establish a connection with the ISP. (PPPoE session has not been established yet)
This could be useful information: the PPPoE Username is the same in both dial-up connection (given by my ISP).
I hope someone can shed light on this issue.
Thanks in advance,
Apologies for my lack of awareness.
AntonioHi,
This is my schema:
connection A ( interface outside) --> DSL --> Router Linksys mode bridge --> Cisco ASA , up and running with IP fix.
connection B ( interface outside-other) --> DSL --> Router Linksys mode bridge --> Cisco ASA, down : Status PADR_SENT
I tried to use two different VPDN_groups for the two connections A and B. However, B is still not working. Just one of them is able to get IP from ISP, connection A.
When I set up the Linksys router (connection B) in PPPoE, the connection works and get an IP fix from ISP.
What I want to do is set up a VPN on connection B so I need to configure this second dial-up on Cisco ASA. I cannot use connection A due to security reasons.
Thanks -
ASA 5505 VPN clients can't ping router or other clients on network
I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
Result of the command: "show running-config"
: Saved
ASA Version 7.2(4)
hostname ASA
domain-name default.domain.invalid
enable password kdnFT44SJ1UFX5Us encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.0.0.4 Server
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
clock timezone MST -7
clock summer-time MDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list vpn_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
static (inside,outside) tcp interface www Server www netmask 255.255.255.255
static (inside,outside) tcp interface https Server https netmask 255.255.255.255
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable 480
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
group-policy vpn internal
group-policy vpn attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn_splitTunnelAcl
username admin password wwYXKJulWcFrrhXN encrypted privilege 15
username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
username VPNuser attributes
vpn-group-policy vpn
tunnel-group vpn type ipsec-ra
tunnel-group vpn general-attributes
address-pool VPNpool
default-group-policy vpn
tunnel-group vpn ipsec-attributes
pre-shared-key *
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
service-policy global_policy global
prompt hostname context
Cryptochecksum:df7d1e4f34ee0e155cebe86465f367f5
: end
Any ideas what I need to add to get the vpn client to be able to ping the router and clients?
Thanks.I tried that and it didn't work. As for upgrading the ASA version, I'd like to but this is an old router and I don't have a support contract with Cisco anymore, so I can't access the latest firmware.
here is the runnign config again:
Result of the command: "show startup-config"
: Saved
: Written by enable_15 at 01:48:37.789 MDT Wed Jun 20 2012
ASA Version 7.2(4)
hostname ASA
domain-name default.domain.invalid
enable password kdnFT44SJ1UFX5Us encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.0.0.4 Server
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
clock timezone MST -7
clock summer-time MDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list vpn_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
asdm location Server 255.255.255.255 inside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
static (inside,outside) tcp interface www Server www netmask 255.255.255.255
static (inside,outside) tcp interface https Server https netmask 255.255.255.255
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable 480
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
group-policy vpn internal
group-policy vpn attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn_splitTunnelAcl
username admin password wwYXKJulWcFrrhXN encrypted privilege 15
username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
username VPNuser attributes
vpn-group-policy vpn
tunnel-group vpn type ipsec-ra
tunnel-group vpn general-attributes
address-pool VPNpool
default-group-policy vpn
tunnel-group vpn ipsec-attributes
pre-shared-key *
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
service-policy global_policy global
prompt hostname context
Cryptochecksum:78864f4099f215f4ebdd710051bdb493 -
Firewall Cisco ASA 5505 new interface license problem
Hi
I have one ASA 5505 with a Base License
The problem is when i want to use a new named interface the system says "With current License maximum number of named interfaces allowed is 3. Name cannot be set for this interface"
And the question is if with this base license the interface cannot be used or only cannot be named?
here the output of my firewall:
Cisco Adaptive Security Appliance Software Version 8.2(5)
Device Manager Version 6.4(5)
Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
0: Int: Internal-Data0/0 : address is e02f.6de6.7843, irq 11
1: Ext: Ethernet0/0 : address is e02f.6de6.783b, irq 255
2: Ext: Ethernet0/1 : address is e02f.6de6.783c, irq 255
3: Ext: Ethernet0/2 : address is e02f.6de6.783d, irq 255
4: Ext: Ethernet0/3 : address is e02f.6de6.783e, irq 255
5: Ext: Ethernet0/4 : address is e02f.6de6.783f, irq 255
6: Ext: Ethernet0/5 : address is e02f.6de6.7840, irq 255
7: Ext: Ethernet0/6 : address is e02f.6de6.7841, irq 255
8: Ext: Ethernet0/7 : address is e02f.6de6.7842, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : Unlimited
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
SSL VPN Peers : 2
Total VPN Peers : 10
Dual ISPs : Disabled
VLAN Trunk Ports : 0
Shared License : Disabled
AnyConnect for Mobile : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials : Disabled
Advanced Endpoint Assessment : Disabled
UC Phone Proxy Sessions : 2
Total UC Proxy Sessions : 2
Botnet Traffic Filter : DisabledHi,
The ASA5505 has with Base License the limitation of 3 Vlan interface of which 1 is also limited in access (shown by the above output mentioning DMZ Restricted)
For an interface on the ASA to operate it must have a name with the command "nameif"
If you already have 3 Vlan interfaces in use then with this license you wont be able to configure 4th Vlan interface without getting a license that supports more interfaces. I guess that would be the Security Plus license.
I know that this has come as a surprise to several users that have posted here on the forums. I too think that its a needles "feature" in the ASA to limit the use of the device in such a way.
- Jouni -
2504 controller + 2602 APs = wireless clients connectivity problems
Hello, everybody!
I have a connectivity problems of wireless clients. The symptoms are:
1) Some clients receive 169.254.x.x., instead a correct DHCP addresses, less in a minute connection drops, and in controller's "Monitor" > "Clients" tab these clients are marked as "Excluded".
2) Most of the clients receive the correct addresses from DHCP (192.168.2.x), but also loose connection soon.
3) Wireless clients with correct addresses can't ping each other, gateway and an address of the controller's dynamic interface (all of them are in same subnet).
4) And the most suspicious problem is that some machines are unable to connect to APs after several attemps to do that. I mean, I configure controller and change some options, trying to understand, whether they were applied or not and constantly connect and disconnet certain PC to the SSID. After five or ten attempts I can't connect to the SSID. During these attempts, the others PCs stay connected, without interruptions, and they could be reconnected again. It's like some kind of port security works, but I'm not sure...
Do you have any ideas which options should I configure?
My configuration:
I have three interfaces on the controller: virtual, management (default) and dynamic (it is set to the WLAN)
I have one SSID, WPA/WPA2, AES/TKIP, authentication PSK.
My clients are a/b/g/n, all are permitted on the controller. No custom security policies were applied.
All the devices are in a single room: controller, one AP and different clients: desktop, notebooks, iPad, Nokia Lumia, etc.
I have an internal DHCP Server on the controller and it works perfectly well.
I can provide all the screenshots required from web-interface of the controller...
Many thanks in advance for all ideas that you have about these problems...Hi, there!
The problem was solved.
1) APIPA address receives only single machine with Win8 - I think there are some firewall issues
2) Other devices have been loosing connection because they were mobile devices, like iPad and Lumia. If you keep working with it, it doesn't drop the connection
3) The dynamic interface address and gateway address were inaccessible because i had not used an appropriate port on the controller. =)))) Firstly, it was just a guess, but it proved.
Now, everything works with WPA2, AES, PSK...
It is a very good day!)
The only question remains: why I can't connect machines, which have a static IP? During the controller initialization, I said "yes" for permitting static IPs...
Guys, many thanks for your help!
Maybe you are looking for
-
I have this old apple studio display CRT 17" (eww I know). I just use it for my tibook as an external mirror because its brighter and bigger than the tibook's display. No until recently did the display start up very tilted, its hard to explain but ba
-
Proper way to test the dual GPU cards?
I'll be receiving my Mac Pro tomorrow and I wanted to know if there is a way to properly put both GPU's through their paces to make sure they are both functioning properly? I've found a few threads where people realize their second GPU ( not used mos
-
SRM 7.0 extended classic - attachments to backend
Hi, We are in SRM 7.0 and have a requirement to store SRM attachments in the backend ERP. This is for the extended scenario going through Badi BBP_ECS_PO_OUT. Has anyone got a solution for moving the attachments to the backend? Kind regards, Alexande
-
Access You local Scanner in Air Application
is it possible to access your local scanner and scan a document using air application?
-
I'm considering an iPod touch but I want to ask some questions about it concerning the use of Skype. I have a mono (for one ear), wired head set with mic. The kind you'd use with a cell phone. Will that work with the new 64Gig iPod touch and Skype? I