Autologin of VPN Client (CLI or Otherwise)

When starting the vpn client with an autologin or a script I always get a "Do You wish to Continue?" dialoge or prompt. I need to have a automatic connection and disconnection through a script without any user intervention.
I have searched high and low for how to do this on both the concentrator and the cisco client and must be missing something.
Thanks in advance for your help.

This is a built in feature for the security.

Similar Messages

  • VPN client using CLI on windows 2003 server

    Hello, first time poster here. Have an interesting issue I'm hoping to find help with.
    I'm using the VPN client (I have version 4.8.01.0300) in CLI mode (called from a script) to connect to a remote site. Got the connection setup and all working fine except for one small detail. Hopefully I can explain this well...
    I want this connection to run fully unattended as it will run numerous times per day, every day. The issue is the little pop-up message saying "VPN has disconnected".
    When I first setup the connection, it was on windows XP and everything was golden. I could issue the command : vpnclient connect <name> user <userid> pwd <passwd> sd, <other stuff>, vpnclient disconnect and all worked as expected.
    Then I installed same stuff on Windows 2003 server. Issuing same connect command gives error: "user authentication failed". Then I discovered that if I first launched the vpn client GUI then the CLI command, it would connect without error - but then the "disconnected" pop-up window came along.
    So - can I either:
    - Run vpn client in CLI mode without the GUI running.
    - Suppress the pop-up.
    Thanks in advance.
    Scott

    Hi,
    Thank you for the post.
    Please try register MSI installer or clean boot your system to install FEP client.
    Registered MSI Installer following the steps below:
    1.Run "cmd"--Browse to the "%systemroot%\system32" directory and execute: "msiexec /regserver" 
    2.Change directories to "%systemroot%\SysWow64" and execute: "msiexec /regserver" 
    3.Reboot the server
    http://technet.microsoft.com/en-us/library/ff823833.aspx
    If there are more inquiries on this issue, please feel free to let us know.
    Regards
    Rick Tan
    TechNet Community Support

  • VPN Clients can't access DMZ Network

    Hello,
    I will try to describe my problem as best as possible. The title says VPN clients cannot access DMZ network, but that is not exactly the problem, the situation is this, a group of users are using an actual 10.x network where they have their servers and pretty much everything. The users must be relocated into a new network, the 172.16.x.  In a point in time they will not have to use 10.x anymore, but meanwhile, they need access to that network.
    I have an ASA 5510 as default gateway for the new network (172.16.x.x), one interface e0/0 connected to the outside (internet), interface e0/1 to the inside and other interface connected to the actual 10.x (which I call DMZ), so basically I am using the ASA as a bridge using NAT to grant access to the users in the network 172.16.x to the resources in the 10.x network while the migration is completed.
    All the users must use the path to the internet thru the ASA using the NAT overload to the outside interface and I put in place a NAT policy to 10.x to allow access to the 10.x network only when the internal users 172.16.x try to reach that path and so far, everything is working just fine for the internal users.
    Now for some reason, when I do VPN, the VPN clients cannot reach the 10.x network, even when they are supposed to be in the internal network (because they are doing VPN right?) .
    I have enabled split tunneling with NAT exempt the 172.16 network and I am not sure if that is causing the problem, because when I trace from my PC the 172.16.16.1 address using the VPN I get the proper route path, but when I try to reach 10.x, my PC is using its default gateway and not the VPN gateway which has a route to 10.x.
    I’m not even sure if what I am trying to do is possible, I want VPN users to be able to access a 10.x network using NAT overload with the Interface of the ASA plugged to the 10.x network, just like the internal users are doing right now.
    Any help or advice will be highly appreciated.

    Allow clients to access DMZ, add exempt NAT rule, add both the "same-security-traffic" thru cli. Please give it a try.
    Sent from Cisco Technical Support iPad App

  • SonicWall Global VPN Client and Split tunneling

    Hello All,
    I searched Google and the forums here and can't find someone with the same problem.
    Lets start at the beginning-Just started this job a couple months ago and people brought to my attention immediately an issue while they were on the VPN they could not get to the internet.  I know about the different security risks but we have multiple field reps that need internet access while using our CRM program.  So I setup Split Tunneling on the Sonicwall. Tested and works fine on my home PC using a WRT54GS Ver 2.1 and the SonicWall Global VPN Client.
    So I was sure everything was fine until I just sent out 2 laptops to 2 different sales reps and they are both having the same issue.  They can get into the internal network but can't access the internet.  They are both on WRT54G (different Vers.).  I tested the VPN client on both laptops with tethering on my cell phone and the split tunneling works. I have tried updating firmware thinking that was the issue.  I also tried to put their home network on a different subnet.  All with no joy.  I was wondering if anyone ever ran into something like this or have any clues what to try next. 
    -Thank You in advance for your time.
    Message Edited by Chris_F on 01-11-2010 07:41 AM
    Chris F.
    CCENT, CCNA, CCNA Sec

    Of course, you do as you are told. But I hope you keep written record of what you have been told and have it signed of whoever told you to set it up. It's essential that you stay on the safe side in these matters.
    I have read of too many cases where the system/security admin did not do so and in the end was held responsible for security incidents simply because he was told to do something to jeopardize security of the network. Remember, that usually the person who tells you do to so has no idea about the full security implication of a decision.
    Thus, I highly recommend to require your road staff to connect with no split tunneling. Refuse to do otherwise unless you have it in writing and you won't be held reliable in any way if something happens because of it.
    Just think what happens if the whole customer database gets stolen because of one of the remote sales reps... There is a reason why you apply this web site blocking on your firewalls and there is absolutely no reason that would justify why your remote sale reps don't go through the very same firewall while accessing company-sensitive data in your CRM.
    So put that straight with whoever told you to do otherwise and if you they still want to continue anyway get it in writing. Once you ask for the statement in writing many decision-makers come to their senses and let you do your job at the best you can and for what you were hired... And if not, well, at least you got rid of the responsibility in that aspect.

  • VPN Client and Dynamic isakmp keys not working

    Hi,
    I'm trying to enable DMVPN endpoints from dynamic IP addresses, e.g. adding in:
    crypto isakmp key XXXXXXX address 0.0.0.0 0.0.0.0 no-xauth
    The problem is when I add this line, it breaks our remote VPN Client.  Removing the line makes everything work fine again, except I can't add a DMVPN endpoint that has a dynamic IP.
    Presently all DMVPN spokes have static IP addresses configured and individual keys for each (I'm trying to simply/cut down our config and use a single key for all of them plus enable staff from home on dynamic IP's).
    I can't tell if this is an IOS bug, or if I need to configure something differently.
    Our VPN client is configured as a dynamic map, e.g.:
    crypto isakmp client configuration group vpnclient
    key RAH RAH RAH
    etc.
    crypto isakmp profile vpnclient
       match identity group vpnclient
       client authentication list vpnuser
       isakmp authorization list vpngroup
       client configuration address respond
    crypto ipsec transform-set VPNCLIENT esp-aes 256 esp-sha-hmac
    crypto dynamic-map vpnclient 10
    set transform-set VPNCLIENT
    set pfs group2
    set isakmp-profile vpnclient
    crypto map vpn 65535 ipsec-isakmp dynamic vpnclient
    And then attached to my WAN interface as crypto map.

    Hi Scott,
    What IOS Version are you using ? I don't see any reason that this command would break Remote VPN Connectivity.
    Maybe you can try
    crypto isakmp key XXXXXXX address 0.0.0.0 0.0.0.0 (remove the no-xauth, as it's not needed).
    Otherwise, you may share output of debug crypto isakmp to see exactly what is failing when the remote users are connecting.
    Regards,
    Bastien

  • VPN Client Cannot Access Anything at Main Site

    I am sure this problem has been solved a million times over but I can't get this to work.  Can someone take a look at this config quick and tell me what is wrong?
    The Cisco VPN client connects no problem but I can't access anything.
    ASA Version 8.4(4)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 15
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.43.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address a.a.a.a 255.255.255.248
    interface Vlan15
    no forward interface Vlan1
    nameif IPOffice
    security-level 100
    ip address 192.168.42.254 255.255.255.0
    boot system disk0:/asa844-k8.bin
    ftp mode passive
    object network obj-192.168.43.0
    subnet 192.168.43.0 255.255.255.0
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network NETWORK_OBJ_10.11.12.0_24
    subnet 10.11.12.0 255.255.255.0
    object network NETWORK_OBJ_192.168.43.160_28
    subnet 192.168.43.160 255.255.255.240
    object network IPOffice
    subnet 0.0.0.0 0.0.0.0
    access-list outside_access_in extended permit icmp any 192.168.42.0 255.255.255.0
    access-list vpn_SplitTunnel remark ACL for VPN Split Tunnel
    access-list vpn_SplitTunnel standard permit 192.168.43.0 255.255.255.0
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu IPOffice 1500
    ip local pool newvpnpool 10.11.12.100-10.11.12.150 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-649.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static any any destination static NETWORK_OBJ_10.11.12.0_24 NETWORK_OBJ_10.11.12.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.43.160_28 NETWORK_OBJ_192.168.43.160_28 no-proxy-arp route-lookup
    nat (IPOffice,outside) source static any any destination static NETWORK_OBJ_192.168.43.160_28 NETWORK_OBJ_192.168.43.160_28 no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    object network IPOffice
    nat (IPOffice,outside) dynamic interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 b.b.b.b 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication http console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http 192.168.43.0 255.255.255.0 inside
    http 192.168.42.0 255.255.255.0 IPOffice
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set strong-des esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set encrypt-method-1 esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map dynmap 30 set pfs group1
    crypto dynamic-map dynmap 30 set ikev1 transform-set strong-des
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map rpVPN 65535 ipsec-isakmp dynamic dynmap
    crypto map rpVPN interface outside
    crypto isakmp identity address
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 2
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.43.5-192.168.43.36 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy RPVPN internal
    group-policy RPVPN attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev1
    username admin password gP3lHsTOEfvj7Z3g encrypted privilege 15
    username mark password blPoPZBKFYhjYewF encrypted privilege 0
    tunnel-group RPVPN type remote-access
    tunnel-group RPVPN general-attributes
    address-pool newvpnpool
    default-group-policy RPVPN
    tunnel-group RPVPN ipsec-attributes
    ikev1 pre-shared-key *****
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:b3f15dda5472d65341d7c457f2e8b2a2
    : end

    Yup, you are totally correct, spot on!!
    Asymmetric routing is not supported on the firewall, as traffic in and out must be through the same interfaces, otherwise, it thinks it is an attack and drop the packet.
    Default gateway on the devices in IPOffice subnet should be the ASA IPOffice interface (192.168.42.254), not the switch if it is a shared switch with your inside network. And likewise for devices in the inside subnet, the default gateway should be the ASA 192.168.43.254.
    With regards to the switch, you can pick a default gateway either the ASA inside or the ASA IPOffice interface IP, and the return traffic needs to route via the same path

  • VPN Clients cannot access remote site

    Hey there,
    I am pretty new in configuring Cisco devices and now I need some help.
    I have 2 site here:
    site A
    Cisco 891
    external IP: 195.xxx.yyy.zzz
    VPN Gateway for Remote users
    local IP: VLAN10 10.133.10.0 /23
    site B
    Cisco 891
    external IP: 62.xxx.yyy.zzz
    local IP VLAN10 10.133.34.0 /23
    Those two sites are linked together with a Site-to-Site VPN. Accessing files or ressources from one site to the other is working fine while connected to the local LAN.
    I configured VPN connection with Radius auth. VPN clients can connect to Site A, get an IP adress from VPN Pool (172.16.100.2-100) and can access files and servers on site A. But for some reason they cannot access ressources on site B. I already added the site B network to the ACL and when connecting with VPN it shows secured routes to 10.133.10.0 and 10.133.34.0 in the statistics. Same thing for other VPN Tunnels to ERP system.
    What is missing here to make it possible to reach remote sites when connected through VPN? I had a look at the logs but could not find anything important.
    Here is the config of site A
    Building configuration...
    Current configuration : 24257 bytes
    version 15.2
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname Englerstrasse
    boot-start-marker
    boot config usbflash0:CVO-BOOT.CFG
    boot-end-marker
    aaa new-model
    aaa group server radius Radius-AD
    server 10.133.10.5 auth-port 1812 acct-port 1813
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_2 group Radius-AD local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    clock timezone Berlin 1 0
    clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
    crypto pki trustpoint TP-self-signed-27361994
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-27361994
    revocation-check none
    rsakeypair TP-self-signed-27361994
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki certificate chain TP-self-signed-27361994
    certificate self-signed 01
      30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 32373336 31393934 301E170D 31323038 32373038 30343238
      5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
      2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D323733 36313939
      3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B709
      64CE1874 BF812A9F 0B761522 892373B9 10F0BB52 6263DCDB F9877AA3 7BD34E53
      BCFDA45C 2A991777 4DDC7E6B 1FCEE36C B6E35679 C4A18771 9C0F871F 38310234
      2D89A4FF 37B616D8 362B3103 A8A319F2 10A72DC7 490A04AC 7955DF68 32EF9615
      9E1A3B31 2A1AB243 B3ED3E35 F4AAD029 CDB1F941 5E794300 5C5EF8AE 5C890203
      010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
      18301680 14D0F5E7 D3A9311D 1675AA8F 38F064FC 4D04465E F5301D06 03551D0E
      04160414 D0F5E7D3 A9311D16 75AA8F38 F064FC4D 04465EF5 300D0609 2A864886
      F70D0101 05050003 818100AB 2CD4363A E5ADBFB0 943A38CB AC820801 117B52CC
      20216093 79D1F777 2B3C0062 4301CF73 094B9CA5 805F585E 04CF3301 9B839DEB
      14A334A2 F5A5316F C65EEF21 0B0DF3B5 F4322440 F28B984B E769876D 6EF94895
      C3D5048A A4E2A180 12DF6652 176942F8 58187D7B D37B1F1A 4DDD7AE9 5189F9AF
      AF3EF676 26AD3F31 D368F5
          quit
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    no ip source-route
    ip auth-proxy max-login-attempts 5
    ip admission max-login-attempts 5
    no ip bootp server
    no ip domain lookup
    ip domain name yourdomain.com
    ip inspect log drop-pkt
    ip inspect name CCP_MEDIUM appfw CCP_MEDIUM
    ip inspect name CCP_MEDIUM ftp
    ip inspect name CCP_MEDIUM h323
    ip inspect name CCP_MEDIUM sip
    ip inspect name CCP_MEDIUM https
    ip inspect name CCP_MEDIUM icmp
    ip inspect name CCP_MEDIUM netshow
    ip inspect name CCP_MEDIUM rcmd
    ip inspect name CCP_MEDIUM realaudio
    ip inspect name CCP_MEDIUM rtsp
    ip inspect name CCP_MEDIUM sqlnet
    ip inspect name CCP_MEDIUM streamworks
    ip inspect name CCP_MEDIUM tftp
    ip inspect name CCP_MEDIUM udp
    ip inspect name CCP_MEDIUM vdolive
    ip inspect name CCP_MEDIUM imap reset
    ip inspect name CCP_MEDIUM smtp
    ip cef
    no ipv6 cef
    appfw policy-name CCP_MEDIUM
      application im aol
        service default action allow alarm
        service text-chat action allow alarm
        server permit name login.oscar.aol.com
        server permit name toc.oscar.aol.com
        server permit name oam-d09a.blue.aol.com
        audit-trail on
      application im msn
        service default action allow alarm
        service text-chat action allow alarm
        server permit name messenger.hotmail.com
        server permit name gateway.messenger.hotmail.com
        server permit name webmessenger.msn.com
        audit-trail on
      application http
        strict-http action allow alarm
        port-misuse im action reset alarm
        port-misuse p2p action reset alarm
        port-misuse tunneling action allow alarm
      application im yahoo
        service default action allow alarm
        service text-chat action allow alarm
        server permit name scs.msg.yahoo.com
        server permit name scsa.msg.yahoo.com
        server permit name scsb.msg.yahoo.com
        server permit name scsc.msg.yahoo.com
        server permit name scsd.msg.yahoo.com
        server permit name cs16.msg.dcn.yahoo.com
        server permit name cs19.msg.dcn.yahoo.com
        server permit name cs42.msg.dcn.yahoo.com
        server permit name cs53.msg.dcn.yahoo.com
        server permit name cs54.msg.dcn.yahoo.com
        server permit name ads1.vip.scd.yahoo.com
        server permit name radio1.launch.vip.dal.yahoo.com
        server permit name in1.msg.vip.re2.yahoo.com
        server permit name data1.my.vip.sc5.yahoo.com
        server permit name address1.pim.vip.mud.yahoo.com
        server permit name edit.messenger.yahoo.com
        server permit name messenger.yahoo.com
        server permit name http.pager.yahoo.com
        server permit name privacy.yahoo.com
        server permit name csa.yahoo.com
        server permit name csb.yahoo.com
        server permit name csc.yahoo.com
        audit-trail on
    parameter-map type inspect global
    log dropped-packets enable
    multilink bundle-name authenticated
    redundancy
    ip tcp synwait-time 10
    class-map match-any CCP-Transactional-1
    match dscp af21
    match dscp af22
    match dscp af23
    class-map match-any CCP-Voice-1
    match dscp ef
    class-map match-any sdm_p2p_kazaa
    match protocol fasttrack
    match protocol kazaa2
    class-map match-any CCP-Routing-1
    match dscp cs6
    class-map match-any sdm_p2p_edonkey
    match protocol edonkey
    class-map match-any CCP-Signaling-1
    match dscp cs3
    match dscp af31
    class-map match-any sdm_p2p_gnutella
    match protocol gnutella
    class-map match-any CCP-Management-1
    match dscp cs2
    class-map match-any sdm_p2p_bittorrent
    match protocol bittorrent
    policy-map sdm-qos-test-123
    class class-default
    policy-map sdmappfwp2p_CCP_MEDIUM
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    policy-map CCP-QoS-Policy-1
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    class CCP-Voice-1
      priority percent 33
    class CCP-Signaling-1
      bandwidth percent 5
    class CCP-Routing-1
      bandwidth percent 5
    class CCP-Management-1
      bandwidth percent 5
    class CCP-Transactional-1
      bandwidth percent 5
    class class-default
      fair-queue
      random-detect
    crypto ctcp port 10000
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key REMOVED address 62.20.xxx.yyy 
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 83.140.xxx.yyy  
    crypto isakmp client configuration group VPN_local
    key REMOVED
    dns 10.133.10.5 10.133.10.7
    wins 10.133.10.7
    domain domain.de
    pool SDM_POOL_2
    acl 115
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group VPN_local
       client authentication list ciscocp_vpn_xauth_ml_2
       isakmp authorization list ciscocp_vpn_group_ml_2
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA11 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA5 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA1 esp-des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA11
    set isakmp-profile ciscocp-ike-profile-1
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to62.20.xxx.xxx
    set peer 62.20.xxx.xxx
    set transform-set ESP-3DES-SHA
    match address 105
    crypto map SDM_CMAP_1 2 ipsec-isakmp
    description Tunnel to195.243.xxx.xxx
    set peer 195.243.xxx.xxx
    set transform-set ESP-3DES-SHA4
    match address 107
    crypto map SDM_CMAP_1 3 ipsec-isakmp
    description Tunnel to83.140.xxx.xxx
    set peer 83.140.xxx.xxx
    set transform-set ESP-DES-SHA1
    match address 118
    interface Loopback2
    ip address 192.168.10.1 255.255.254.0
    interface Null0
    no ip unreachables
    interface FastEthernet0
    switchport mode trunk
    no ip address
    spanning-tree portfast
    interface FastEthernet1
    no ip address
    spanning-tree portfast
    interface FastEthernet2
    no ip address
    spanning-tree portfast
    interface FastEthernet3
    no ip address
    spanning-tree portfast
    interface FastEthernet4
    description Internal LAN
    switchport access vlan 10
    switchport trunk native vlan 10
    no ip address
    spanning-tree portfast
    interface FastEthernet5
    no ip address
    spanning-tree portfast
    interface FastEthernet6
    no ip address
    spanning-tree portfast
    interface FastEthernet7
    no ip address
    spanning-tree portfast
    interface FastEthernet8
    description $FW_OUTSIDE$$ETH-WAN$
    ip address 62.153.xxx.xxx 255.255.255.248
    ip access-group 113 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip inspect CCP_MEDIUM out
    no ip virtual-reassembly in
    ip verify unicast reverse-path
    duplex auto
    speed auto
    crypto map SDM_CMAP_1
    service-policy input sdmappfwp2p_CCP_MEDIUM
    service-policy output CCP-QoS-Policy-1
    interface Virtual-Template1 type tunnel
    ip unnumbered FastEthernet8
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface GigabitEthernet0
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    no ip address
    interface Vlan10
    description $FW_INSIDE$
    ip address 10.133.10.1 255.255.254.0
    ip access-group 112 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat inside
    ip virtual-reassembly in
    interface Async1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    encapsulation slip
    ip local pool SDM_POOL_1 192.168.10.101 192.168.10.200
    ip local pool VPN_Pool 192.168.20.2 192.168.20.100
    ip local pool SDM_POOL_2 172.16.100.2 172.16.100.100
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip forward-protocol nd
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet8 overload
    ip route 0.0.0.0 0.0.0.0 62.153.xxx.xxx
    ip access-list extended VPN1
    remark VPN_Haberstrasse
    remark CCP_ACL Category=4
    permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    ip radius source-interface Vlan10
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 10.10.10.0 0.0.0.7
    access-list 23 remark CCP_ACL Category=17
    access-list 23 permit 195.243.xxx.xxx
    access-list 23 permit 10.133.10.0 0.0.1.255
    access-list 23 permit 10.10.10.0 0.0.0.7
    access-list 100 remark CCP_ACL Category=4
    access-list 100 permit ip 10.133.10.0 0.0.1.255 any
    access-list 101 remark CCP_ACL Category=16
    access-list 101 permit udp any eq bootps any eq bootpc
    access-list 101 deny   ip 10.10.10.0 0.0.0.255 any
    access-list 101 permit icmp any any echo-reply
    access-list 101 permit icmp any any time-exceeded
    access-list 101 permit icmp any any unreachable
    access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 101 deny   ip host 255.255.255.255 any
    access-list 101 deny   ip any any
    access-list 102 remark auto generated by CCP firewall configuration
    access-list 102 remark CCP_ACL Category=1
    access-list 102 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 102 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 102 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 102 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 102 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 102 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 102 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 102 deny   ip host 255.255.255.255 any
    access-list 102 deny   ip host 0.0.0.0 any
    access-list 102 deny   ip any any log
    access-list 103 remark auto generated by CCP firewall configuration
    access-list 103 remark CCP_ACL Category=1
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp any host 62.153.xxx.xxx
    access-list 103 permit ahp any host 62.153.xxx.xxx
    access-list 103 permit udp host 194.25.0.60 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 103 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 103 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 103 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 103 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 103 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 103 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 103 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 103 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 103 deny   ip host 255.255.255.255 any
    access-list 103 deny   ip host 0.0.0.0 any
    access-list 103 deny   ip any any log
    access-list 104 remark CCP_ACL Category=4
    access-list 104 permit ip 10.133.10.0 0.0.1.255 any
    access-list 105 remark CCP_ACL Category=4
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 remark CCP_ACL Category=2
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 permit ip 10.10.10.0 0.0.0.7 any
    access-list 106 permit ip 10.133.10.0 0.0.1.255 any
    access-list 107 remark CCP_ACL Category=4
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 108 remark Auto generated by SDM Management Access feature
    access-list 108 remark CCP_ACL Category=1
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq telnet
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 22
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq www
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 443
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq cmd
    access-list 108 deny   tcp any host 10.133.10.1 eq telnet
    access-list 108 deny   tcp any host 10.133.10.1 eq 22
    access-list 108 deny   tcp any host 10.133.10.1 eq www
    access-list 108 deny   tcp any host 10.133.10.1 eq 443
    access-list 108 deny   tcp any host 10.133.10.1 eq cmd
    access-list 108 deny   udp any host 10.133.10.1 eq snmp
    access-list 108 permit ip any any
    access-list 109 remark CCP_ACL Category=1
    access-list 109 permit ip 10.133.10.0 0.0.1.255 any
    access-list 109 permit ip 10.10.10.0 0.0.0.7 any
    access-list 109 permit ip 192.168.10.0 0.0.1.255 any
    access-list 110 remark CCP_ACL Category=1
    access-list 110 permit ip host 195.243.xxx.xxx any
    access-list 110 permit ip host 84.44.xxx.xxx any
    access-list 110 permit ip 10.133.10.0 0.0.1.255 any
    access-list 110 permit ip 10.10.10.0 0.0.0.7 any
    access-list 110 permit ip 192.168.10.0 0.0.1.255 any
    access-list 111 remark CCP_ACL Category=4
    access-list 111 permit ip 10.133.10.0 0.0.1.255 any
    access-list 112 remark CCP_ACL Category=1
    access-list 112 permit udp host 10.133.10.5 eq 1812 any
    access-list 112 permit udp host 10.133.10.5 eq 1813 any
    access-list 112 permit udp any host 10.133.10.1 eq non500-isakmp
    access-list 112 permit udp any host 10.133.10.1 eq isakmp
    access-list 112 permit esp any host 10.133.10.1
    access-list 112 permit ahp any host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1645 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1646 host 10.133.10.1
    access-list 112 remark auto generated by CCP firewall configuration
    access-list 112 permit udp host 10.133.10.5 eq 1812 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1813 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.7 eq domain any
    access-list 112 permit udp host 10.133.10.5 eq domain any
    access-list 112 deny   ip 62.153.xxx.xxx 0.0.0.7 any
    access-list 112 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 112 deny   ip host 255.255.255.255 any
    access-list 112 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 112 permit ip any any
    access-list 113 remark CCP_ACL Category=1
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ahp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ip host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit ip host 84.44.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark auto generated by CCP firewall configuration
    access-list 113 permit udp host 194.25.0.60 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp host 194.25.0.60 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp any host 62.153.xxx.xxx
    access-list 113 permit ahp any host 62.153.xxx.xxx
    access-list 113 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 remark Pop3
    access-list 113 permit tcp host 82.127.xxx.xxx eq 8080 host 62.153.xxx.xxx
    access-list 113 remark Pop3
    access-list 113 permit tcp any eq pop3 host 62.153.xxx.xxx
    access-list 113 remark SMTP
    access-list 113 permit tcp any eq 465 host 62.153.xxx.xxx
    access-list 113 remark IMAP
    access-list 113 permit tcp any eq 587 host 62.153.xxx.xxx
    access-list 113 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 113 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 113 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 113 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 113 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 113 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 113 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 113 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 113 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 113 deny   ip host 255.255.255.255 any
    access-list 113 deny   ip host 0.0.0.0 any
    access-list 113 deny   ip any any log
    access-list 114 remark auto generated by CCP firewall configuration
    access-list 114 remark CCP_ACL Category=1
    access-list 114 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 114 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 114 permit icmp any any echo-reply
    access-list 114 permit icmp any any time-exceeded
    access-list 114 permit icmp any any unreachable
    access-list 114 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 114 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 114 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 114 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 114 deny   ip host 255.255.255.255 any
    access-list 114 deny   ip host 0.0.0.0 any
    access-list 114 deny   ip any any log
    access-list 115 remark VPN_Sub
    access-list 115 remark CCP_ACL Category=5
    access-list 115 permit ip 10.133.10.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.34.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.20.0 0.0.0.255 any
    access-list 116 remark CCP_ACL Category=4
    access-list 116 remark IPSec Rule
    access-list 116 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 117 remark CCP_ACL Category=4
    access-list 117 remark IPSec Rule
    access-list 117 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark CCP_ACL Category=4
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    no cdp run
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    control-plane
    mgcp profile default
    line con 0
    transport output telnet
    line 1
    modem InOut
    speed 115200
    flowcontrol hardware
    line aux 0
    transport output telnet
    line vty 0 4
    session-timeout 45
    access-class 110 in
    transport input telnet ssh
    line vty 5 15
    access-class 109 in
    transport input telnet ssh
    scheduler interval 500
    end

    The crypto ACL for the site to site vpn should also include the vpn client pool, otherwise, traffic from the vpn client does not match the interesting traffic for the site to site vpn.
    On Site A:
    should include "access-list 107 permit ip 172.16.100.0 0.0.0.255 10.133.34.0 0.0.1.255"
    You should also remove the following line as the pool is incorrect:
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    On Site B:
    should include: permit ip 10.133.34.0 0.0.1.255 172.16.100.0 0.0.0.255"
    NAT exemption on site B should also be configured with deny on the above ACL.

  • Is there really a Cisco VPN client for Linux? _Really?_

    Hello folks,           
            I've finally after almost experiencing a brain aneurysm by trying to think too hard got my Cisco 881-SEC-K9 router properly configured for a multipoint IPSec VPN tunnel to my Amazon Virtual Private Cloud, so that hurdle is finally passed and I actually feel it was a very important milestone in my life somehow. I never thought I'd see the day I actually got my hands on a legitimate Cisco non-stink... erm.. I mean, non-linksys router. Now I just can't seem to find a 'client' VPN program for Linux. I'm currently running a Xen Hypervisor environment on openSUSE Linux because it's the only Linux distribution that completes all of my strenous requirements in a Linux server environment. It's also the most mature, and secure Linux on this planet, making it the most appreciable Linux distribution for my research needs.  Using NetworkManager is not really an option for a basic Linux server environment, and OpenVPN is just too confusing to comprehend for my tiny little head.  I've heard mention of some mysterious "Easy VPN" but after hours of digging online can't find any information about it, even the Cisco download link leads to a Page Not Found error.  I do see a Linux VPN API for the AnyConnect program, but is that an actual VPN client, or just an API?  It seems to want my money to download it but I don't have any money nor do I really know what it is because it's all secretive-like, closed source, and I can't even find a simple README file on it explaining what it is exactly.  I'm just an out-of-work software developer trying to connect to my home router for personal use and I can't really afford to fork over a million and a half dollars for a single program that I'm only going to need to download once in my lifetime that should have been included with the router in the first place. I more than likely won't even be able to figure out how to use the program anyways because I don't know anything about VPN connections which is why I bought this router so I can try to figure it all out as part of the not-for-profit open source, volunteer research I'm presently trying to conduct.  Is there some kind of evaluation or trial period for personal use? That would be really nice so I could at least figure out if I'm going to be able to figure it out or not.  I hate throwing money away when it's in such short supply these days. There's really no alternative to a Cisco router.  It's an absolute necessity for the things I'm trying to accomplish, so trying to settle for something else and going on with my life is not really an option. No, this is something I just need to face head on and get it over with.
    <Rant>
           Maybe I have a little too much crazy in me for my own good, but I don't see why it should take so much money just to learn how to do something for personal reference, it's not really a skill I would ever use otherwise.  Wouldn't it be great if Cisco made their VPN client open source and free to the public to use and modify, to improve on, to learn and to grow and bring the whole world closer together as a community? Even the source code to the old discontinued Cisco VPN client could be used as a valuable learning tool for some poor starving college student or Open Source Software developer somewhere trying to get by on Ramen Noodles and Ramen Noodle Sauce on Toast (don't tell me you never thought about it).  Through the ripple effect, It would drastically improve sales over the course of time, because it would open the door to a whole new market where those who previously could not afford to participate now could. That's the true power of Open Source. It creates a more skilled work force for the future by openly contributing and sharing knowledge together. What if the next big internet technology and the solution to world tyranny - the solution to end all wars forever - were locked in the mind of an unemployed software developer who couldn't afford to upgrade their cisco router software or access the software they needed because it was closed source and required committing to an expensive service contract to download?  That would be just terrible, wouldn't it?  I guess there's no way to ever know for sure. I suppose I'd be just as happy if some kind soul out there could point me to an easy to use alternative to an always on VPN connection that runs in the background which doesn't require NetworkManager or having to spend days upon days digging through and trying to comprehend either some really poor or extremely complex documentation?  I apologize for all the run on sentences posed as questions, but I've just got some serious mental burnout from all of this, being unemployed is some hard work folks. I could really use a vacation.  Perhaps a camping trip to the coast is in order after I get this working, that sounds nice, doesn't it? Nothing like a good summer thunder storm on the ocean beach - far away from technology - to refresh the mind.
    </Rant>

    I do tend to talk too much and I don't mince any words either.  What I am however, is really appreciative for the help. I know you hear that all the time, but you have no idea how much time and headache you just saved me.  I think vpnc might be just what I've been looking for, unless someone can think of a client for Linux that I might be able to throw a little further.  I'm very security minded now, after the backlash of Blackhat 2013, there's no telling which direction the internet might head next. Oh, you didn't hear? Well wether they realize it or not, DARPA basically declared war with other government agencies by releasing their own version of a spy program for civilians to use against the whoever -- possibly even the governmnet itself. They even went so far as to suggest it's private usage to blanket entire cities in information gathering. Civilians are a powerful foe, as they are not bound by the oath of office, any evidence they obtain is admissible in court, wether they know that or not. There's a very important reason for that. It's to prevent another civil war from ever happening, we shed enough blood the first time around less people forgot.  It's something that can and will be avoided because our civilization has advanced beyond the need for bloodshed. The courts have to obey the majority rule, no matter what. For the first time in history, cyberwarfare can reach into the physical world to cause serious damage to physical structures like the nuclear facility incident in Iran.  There's scarry bills trying to sneak through congress that are changing the landscape of technology forever for the entire world. We're at a pivotal point now where things can happen. It will be interesting to see how it all plays out over the next decade or so. No matter which way you look at it, just be preparerd to sell a whole lot of routers.

  • Installing VPN Client 5.0.07.0240 on Win 7 Pro 64 bit error 1720

    I purchased a new laptop last week. It is Win 7 Pro SP1 64 Bit. Old laptop Win XP Pro. Used Laplink's PCMover to move apps rather than to have to re-install. One of the apps was VPN Client 4.8.02.0010 This app did not work properly on new pc after migration. Had customer send me VPN Client 5.0.07.0240 for 64 Bit. They did so. I installed. I believe it uninstalled the old (migrated) VPN Client but did not do the install of the new VPN Client. Every time I attempt to install, I get error 1720. There is a problem with this Windows Installer Package.A script required for this install to complete could not be run. I called Cisco support and they led me here. I am pretty desperate, been trying to get this done for 18 hours. The reason I called support was I thought I could purchase my own VPN Client, whichever one would be best for me to access several sites that use Cisco VPN's (I have sites that use openvpn, etc), perhaps AnyConnect that I have seen herein, and then Cisco could help me install the client. If that is a good path to take, please let me know, otherwise how do I get this vpn client installed, please. John

    Hello John, and everyone.
    I am aslo face this issue. I tried to install software cisco VPN client "vpnclient-winx64-msi-5.0.07.0290-k9.exe" in my customer's labtop that installed window 7 64bit and it shows message  "cisco vpn client not support 64bits". but why in descript say that  "vpnclient-winx64-msi-5.0.07.0290-k9.exe"
    "VPN Client Software for x86 64-bit version of Vista/Windows 7 - Microsoft Installer"and when I tried to install it why it shows message can not support with 64 bits? what wrong ? Do anyone have experiences with this issue?
    Could anyone help me on this issue or do anyone have other version of Cisco vpn client that can support with window 7 64 bits?
    I am happy to see your ideas and answers!!
    Thanks
    sarem

  • PPTP VPN - Clients inside Cisco877w - server at workplace

    I am trying to connect to my workplace PPTP server from my home that has a Cisco 877w ADSL/Wireless router.  I configured the majority of the setup via CLI and just started playing with CCP.  I've used version 2.5 and 2.7 on a virtual Windows station that resides on my primary Linux box.
    Background in  trying things out.  PPTP works fine without CCP firewall wizard having been run - with just a vanilla interfaces configured kind of setting. 
    I ran the CCP Advanced Firewall task, specified that I had PPTP clients on the LAN and went with it.  The proposed changes included GRE and PPTP stuff, but being green in the IOS Firewall, I have no idea what  I was looking at. 
    My configuration as it gave me is as follows:
    version 12.4no service padservice timestamps debug datetime msecservice timestamps log datetime msecservice password-encryption!hostname HomeRouter!boot-start-markerboot-end-marker!logging message-counter syslogno logging bufferedenable secret 5 MyPass!no aaa new-modelclock timezone Chicago -6clock summer-time Chicago date Apr 6 2003 2:00 Oct 26 2003 2:00!crypto pki trustpoint TP-self-signed-904815991 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-904815991 revocation-check none rsakeypair TP-self-signed-904815991!!crypto pki certificate chain TP-self-signed-904815991 certificate self-signed 01  30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030   30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274   69666963 6174652D 39303438 31353939 31301E17 0D313430 32313632 33323035   315A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F   532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3930 34383135   39393130 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100   B192CA33 08917B1D 8237C7BB 00E38CA6 4BE8B394 4A3C9A40 F7087B15 F5C9D7CB   50F15F43 1084859D CB14F438 5352A1BC BF38C005 15FD518D 362D5769 EFB2528D   1DCF2239 1F2F66CD 5B67B1FF 40108483 740EEB0F D9098DCA 82616014 884E4630   96391ED4 A6B5575B E46BA5FB 2F4FFC32 A7855C59 86B2EBFA FAE485D3 56AF5D5B   02030100 01A36A30 68300F06 03551D13 0101FF04 05300301 01FF3015 0603551D   11040E30 0C820A48 6F6D6552 6F757465 72301F06 03551D23 04183016 8014F385   49957AD6 804D76D9 AD5DADF7 C1BAF9E6 12C6301D 0603551D 0E041604 14F38549   957AD680 4D76D9AD 5DADF7C1 BAF9E612 C6300D06 092A8648 86F70D01 01040500   03818100 387142CF 1B60955E D7D63134 E07E381F BF5491CD 571D718D A8B73E2E   327C81C8 35E33754 67662C59 0FDD3F8E 9B0F8B69 4BF95AD8 E8484EC6 C00A7BE2   5D168C98 818812AF B9490F55 C19257B4 8FE70B49 1D5F0772 5F0550E1 DE7C17DB   02DBA7DB 233AFF65 B381970E 3DEAFF79 482D2914 788665BF 0ED9117F 8ADB6844 2A1854E0            quitdot11 syslog!dot11 ssid Wireless1 vlan 1 authentication open authentication key-management wpa mbssid guest-mode wpa-psk ascii 7 097F46080E0B57310A1E1D6A0F3D24323B623006130F1858!dot11 ssid Wireless2 vlan 2 authentication open mbssid guest-mode!ip source-route!!ip dhcp excluded-address 10.0.0.1 10.0.0.99ip dhcp excluded-address 10.0.1.1 10.0.1.99!ip dhcp pool Local-Network   network 10.0.0.0 255.255.255.0   default-router 10.0.0.1    dns-server 8.8.8.8 8.8.4.4 !ip dhcp pool Guest-Network   network 10.0.1.0 255.255.255.0   dns-server 8.8.8.8 8.8.4.4    default-router 10.0.1.1 !!ip cefip name-server 8.8.8.8ip name-server 8.8.4.4ip name-server 4.2.2.2ip name-server 4.2.2.1ip ddns update method NO-IP HTTP  add http://MyUser:[email protected]/nic/[email protected]/nic/update?hostname=<h>&myip=<a> interval maximum 1 0 0 0 interval minimum 0 0 5 0!no ipv6 cef!multilink bundle-name authenticated!vpdn enable!vpdn-group pppoe request-dialin  protocol pppoe!!!username MyLocalUser privilege 15 password 7 01010101011010101! !!archive log config  hidekeys!!no ip ftp passive!class-map type inspect match-all SDM_GRE match access-group name SDM_GREclass-map type inspect match-any CCP_PPTP match class-map SDM_GRE match protocol pptpclass-map type inspect match-any ccp-skinny-inspect match protocol skinnyclass-map type inspect match-any ccp-cls-insp-traffic match protocol pptp match protocol cuseeme match protocol dns match protocol ftp match protocol https match protocol icmp match protocol imap match protocol pop3 match protocol netshow match protocol shell match protocol realmedia match protocol rtsp match protocol smtp extended match protocol sql-net match protocol streamworks match protocol tftp match protocol vdolive match protocol tcp match protocol udpclass-map type inspect match-all ccp-insp-traffic match class-map ccp-cls-insp-trafficclass-map type inspect match-any ccp-h323nxg-inspect match protocol h323-nxgclass-map type inspect match-any ccp-cls-icmp-access match protocol icmp match protocol tcp match protocol udpclass-map type inspect match-any ccp-h225ras-inspect match protocol h225rasclass-map type inspect match-any ccp-h323annexe-inspect match protocol h323-annexeclass-map type inspect match-any ccp-h323-inspect match protocol h323class-map type inspect match-all ccp-invalid-src match access-group 100class-map type inspect match-all ccp-icmp-access match class-map ccp-cls-icmp-accessclass-map type inspect match-any ccp-sip-inspect match protocol sipclass-map type inspect match-all sdm-nat-ssh-1 match access-group 101 match protocol sshclass-map type inspect match-all ccp-protocol-http match protocol http!!policy-map type inspect ccp-permit-icmpreply class type inspect ccp-icmp-access  inspect class class-default  passpolicy-map type inspect sdm-pol-NATOutsideToInside-1 class type inspect sdm-nat-ssh-1  inspect class type inspect CCP_PPTP  pass class class-default  drop logpolicy-map type inspect ccp-inspect class type inspect ccp-invalid-src  drop log class type inspect ccp-protocol-http  inspect class type inspect ccp-insp-traffic  inspect class type inspect ccp-sip-inspect  inspect class type inspect ccp-h323-inspect  inspect class type inspect ccp-h323annexe-inspect  inspect class type inspect ccp-h225ras-inspect  inspect class type inspect ccp-h323nxg-inspect  inspect class type inspect ccp-skinny-inspect  inspect class class-default  droppolicy-map type inspect ccp-permit class class-default  droppolicy-map QoS_Out_BVI2 class class-default   police rate 500000 !zone security in-zonezone security out-zonezone-pair security ccp-zp-self-out source self destination out-zone service-policy type inspect ccp-permit-icmpreplyzone-pair security ccp-zp-in-out source in-zone destination out-zone service-policy type inspect ccp-inspectzone-pair security ccp-zp-out-self source out-zone destination self service-policy type inspect ccp-permitzone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zone service-policy type inspect sdm-pol-NATOutsideToInside-1!bridge irb!!interface ATM0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress no atm ilmi-keepalive!interface ATM0.1 point-to-point no ip redirects no ip unreachables no ip proxy-arp ip flow ingress pvc 8/35   pppoe-client dial-pool-number 1 !!interface FastEthernet0!interface FastEthernet1!interface FastEthernet2!interface FastEthernet3 switchport access vlan 2!interface Dot11Radio0 no ip address ! encryption vlan 1 mode ciphers aes-ccm ! ssid Wireless1 ! ssid Wireless2 ! mbssid speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root world-mode dot11d country US outdoor no cdp enable!interface Dot11Radio0.1 encapsulation dot1Q 1 ip virtual-reassembly no cdp enable bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding!interface Dot11Radio0.2 encapsulation dot1Q 2 native bridge-group 2 bridge-group 2 subscriber-loop-control bridge-group 2 spanning-disabled bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding!interface Vlan1 no ip address ip virtual-reassembly bridge-group 1!interface Vlan2 no ip address bridge-group 2!interface Dialer0 description $FW_OUTSIDE$ ip ddns update hostname me.domain.com ip ddns update NO-IP ip address negotiated no ip redirects no ip unreachables no ip proxy-arp ip mtu 1492 ip nat outside ip virtual-reassembly zone-member security out-zone encapsulation ppp no ip route-cache cef no ip route-cache ip tcp adjust-mss 1452 dialer pool 1 dialer-group 1 no cdp enable ppp authentication pap callin ppp pap sent-username MyUsername password 7 MyPassword!interface BVI1 description $FW_INSIDE$ ip address 10.0.0.1 255.255.255.0 ip nat inside ip virtual-reassembly zone-member security in-zone!interface BVI2 description $FW_INSIDE$ ip address 10.0.1.1 255.255.255.0 ip nat inside ip virtual-reassembly zone-member security in-zone service-policy output QoS_Out_BVI2!ip forward-protocol ndip route 0.0.0.0 0.0.0.0 Dialer0ip http serverip http authentication localip http secure-server!!ip dns serverip nat inside source list 1 interface Dialer0 overloadip nat inside source static tcp 10.1.1.10 22 interface Dialer0 xxxxx!ip access-list extended SDM_GRE remark CCP_ACL Category=1 permit gre any any!no logging trapaccess-list 1 permit 10.0.0.0 0.0.0.255access-list 1 permit 10.0.1.0 0.0.0.255access-list 100 remark CCP_ACL Category=128access-list 100 permit ip host 255.255.255.255 anyaccess-list 100 permit ip 127.0.0.0 0.255.255.255 anyaccess-list 101 remark CCP_ACL Category=0access-list 101 permit ip any host 10.1.1.10!!!!!control-plane!bridge 1 protocol ieeebridge 1 route ipbridge 2 protocol ieeebridge 2 route ipbanner login ^CUnauthorized access is STRICTLY PROHIBITED!  ^C!line con 0 exec-timeout 15 0 password 7 01010101010101010101 no modem enableline aux 0line vty 0 4 exec-timeout 5 0 privilege level 15 login local transport preferred none transport input ssh!scheduler max-task-time 5000ntp server 199.102.46.73end
    Any clues as to what I would have to do to allow the PPTP connection to complete?  It appears as though GRE may not be getting through?  I haven't found much in the way of fixing this.  My Google-fu might be lacking.

    Remote VPN client is not showing any default gateway
    PPP adapter VPN Connection:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : VPN Connection
       Physical Address. . . . . . . . . :
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
       IPv4 Address. . . . . . . . . . . : 192.168.1.100(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.255
       Default Gateway . . . . . . . . . :
       DNS Servers . . . . . . . . . . . : 203.134.24.70
                                           203.134.26.70
       NetBIOS over Tcpip. . . . . . . . : Enabled

  • Support IPSec VPN Client in ASA Multiple Context Mode

    I've looked at under "Cisco ASA Series CLI Configuration Guide, 9.0" on "Configuring Multiple Context Mode", it says
    "IPsec sessions—5 sessions. (The maximum per context.) ".  Does it mean in ASA Multiple Contest Mode support IPSec VPN Client? I just want to confirm it because I can't seem find any doc that clearly spell it out.  I'll appreciate anyone who can clarify it.
    Thank Jason.
    ( Please direct me to the right group if I'm not for the first time I post it in the Cisco support forum)

    This is from the v9.3 config-guide:
    Unsupported Features
    Multiple context mode does not support the following features:
    Remote access VPN. (Site-to-site VPN is supported.)

  • IPhone OS 3.0 - internet tethering and Cisco VPN Client

    Hello,
    The latest OS for the iPhone allows users to tether their iPhone to a Mac/PC so that the user can browse the internet through the carriers mobile 3G network.
    I can confirm that internet tethering works on my Macbook Pro, but the following error is displayed when i load the CiscoVPN Client (version 4.9.01 (0100))
    "Error 51: Unable to communicate with the VPN subsystem.
    Please make sure that you have at least one network interface that is cuurently active and has an ip address and start this application again."
    Does this mean that the Cisco VPN client cannot see the internet connection supplied by the iPhone even though i can browse the internet while this error is being displayed??
    Regards,
    Eddie S

    Same problem here and I'm wondering the same. I also noticed that the same error comes also when my ethernet connection and iPhone tethering are active at the same time. Then there really should be a connection.
    Despite that, I have the same problem and using bluetooth tethering doesn't solve this. Still the same error even though Internet connection works otherwise fine.
    Any suggestions? Have Cisco tested this?
    I'm using MacBook Pro 13" OS X 10.5.8, iPhone 3GS 3.0.1 with official finnish carrier Sonera, Cisco Systems VPN Client 4.9.01 (0100)

  • RV320 and Shrew Soft vpn client - cannot get it to connect

    Hi,
    I have been trying to configure Shrew vpn client 2.2.2 to connect to the RV320 but i cant even get phase1 to work. I would be very grateful is someone has managed this and could post the configuration (tunnel, groupvpn or easyvpn). I use:
    RV320 with fw 1.1.1.19
    Windows 8.1 Pro x64
    Shrew Soft vpn-client 2.2.2

    Okay here you go please see attached images.
    Please note the following:
    In this example NAT Traversal is enabled if you're RV320 isn't setup behind another router i think you can disable it.
    Under "Local Group Setup" enter the IP Address and Subnet Mask of the LAN you're RV320 is part of.
    The preshared key you enter under IPSec setup is entered in Shrew in the "Authentication" --> "Credentials" tab.
    We use Extended Authetication (Xauth+PSK in Shrew Soft) you need to have a user + password setup under "User Management" tab on the RV320. Once you connect with Shrew Soft it will prompt for a username + password that is setup on the RV320 under the User Management Tab
    We're using "Mode Config" the IPSEC cliënt will be assigned a address from the Virtual IP Address range.
    In this example DNS nor WINS Server have been configured.

  • Certificate authentication for Cisco VPN client

    I am trying to configure the cisco VPN client for certificate authentication on my ASA 5512-X. I have it setup currently for group authentication with shared pass. This works fine. But in order for you to pass pci compliance you cannot allow aggresive mode for ikev1. the only way to disable aggresive mode (and use main mode) is to use certificate authentication for the vpn client. I know that some one out there must being doing this already. I am goign round and round with this. I am missing some thing.
    I have tried as I might and all I can get are some cryptic error messages from the client and nothing on the firewall. IE failed to genterate signature, invalid remote signature id. I have tried using different signatures (one built on ASA and bought from Godaddy, and one built from Windows CA, and one self signed).
    Can some one provide the instructions on seting this up (asdm or cli). Can this even be done? I would love to just use the AnyConnect client but I believe you need licensing for that since our system states only 2 allowed. Thank you for your help.                    

    Dear Doug ,
              What is asa code your are running on ASA hardware , for cisco anyconnect you need have Code 8.0 on your hardware with cisco anyconnect essential license enabled .Paste your me show version i will help you whether you need to procure license for your hardware . By default your hardware will be shipped with any connect essential license when you have order your hardware with asa code above 8.0 .
    With Any connect essential you are allowed to use upto total VPN peers allowed based on your hardware
    1)  What is the AnyConnect Essentials License?
    The Anyconnect Essentials is a license that allows you to connect up to your 'Total VPN Peers"  platform limit with AnyConnect.  Without an AnyConnect Essentials license, you are limited to the 'SSLVPN Peers' limit on your device.  With the Anyconnect Essentials License, you can only use Anyconnect for SSL - other features such as CSD (Cisco Secure Desktop) and using the SSLVPN portal page for anything other than launching AnyConnect are restricted.
    You can see your limits for the various licensing by issuing the 'show version' command on your ASA.
    Licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited
    Maximum VLANs                  : 150      
    Inside Hosts                   : Unlimited
    Failover                       : Active/Active
    VPN-DES                        : Enabled  
    VPN-3DES-AES                   : Enabled  
    Security Contexts              : 2        
    GTP/GPRS                       : Disabled 
    SSL VPN Peers                  : 2        
    Total VPN Peers                : 750      
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled 
    AnyConnect for Cisco VPN Phone : Disabled 
    AnyConnect Essentials          : Disabled 
    Advanced Endpoint Assessment   : Disabled 
    UC Phone Proxy Sessions        : 2        
    Total UC Proxy Sessions        : 2        
    Botnet Traffic Filter          : Disabled
    Licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited
    Maximum VLANs                  : 150      
    Inside Hosts                   : Unlimited
    Failover                       : Active/Active
    VPN-DES                        : Enabled  
    VPN-3DES-AES                   : Enabled  
    Security Contexts              : 2        
    GTP/GPRS                       : Disabled 
    SSL VPN Peers                  : 2        
    Total VPN Peers                : 750      
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled 
    AnyConnect for Cisco VPN Phone : Disabled 
    AnyConnect Essentials          :  Enabled
    Advanced Endpoint Assessment   : Disabled 
    UC Phone Proxy Sessions        : 2        
    Total UC Proxy Sessions        : 2        
    Botnet Traffic Filter          : Disabled
    Any connect VPN Configuration .
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808efbd2.shtml

  • Cannot connect using VPN client

    Hi, I have a problem configuring my CISCO ASA 5515-x for VPN client. I succesfully configure AnyConnect and SSL VPN but when client using VPN Client software, they cannot establish the VPN connection. This is my configuration and attached is the error occured when connecting to the firewall. Can anyone help me solve this problem?
    : Saved
    ASA Version 9.1(1)
    hostname ciscoasa
    domain-name g
    ip local pool vpn_client 192.168.2.200-192.168.2.254 mask 255.255.255.0
    ip local pool vpn_250 192.168.3.1-192.168.3.254 mask 255.255.255.0
    interface GigabitEthernet0/0
    nameif DIGI
    security-level 0
    ip address 210.48.*.* 255.255.255.0
    interface GigabitEthernet0/1
    nameif LAN
    security-level 0
    ip address 192.168.2.5 255.255.255.0
    interface GigabitEthernet0/2
    nameif Pone
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    management-only
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    ftp mode passive
    clock timezone MYT 8
    dns domain-lookup DIGI
    dns server-group DefaultDNS
    name-server 8.8.8.8
    domain-name g
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network NETWORK_OBJ_113.20.*.*_24
    subnet 113.20.*.* 255.255.255.0
    object network NETWORK_OBJ_210.48.*.*_24
    subnet 210.48.*.* 255.255.255.0
    object network CsHiew
    host 192.168.2.9
    object network ERPServer
    host 192.168.2.2
    object network Giap
    host 192.168.2.126
    object network Jennifer
    host 192.168.2.31
    object network KCTan
    host 192.168.2.130
    object network KCTan-NB
    host 192.168.2.77
    object network MailServer
    host 192.168.2.6
    object network YHKhoo
    host 192.168.2.172
    object network Aslina
    host 192.168.2.59
    object network Law
    host 192.168.2.38
    object network Nurul
    host 192.168.2.127
    object network Laylee
    host 192.168.2.17
    object network Ms_Pan
    host 192.168.2.188
    object network Peck_Ling
    host 192.168.2.248
    object network Pok_Leng
    host 192.168.2.36
    object network UBS
    host 192.168.2.21
    object network Ainie
    host 192.168.2.11
    object network Angie
    host 192.168.2.116
    object network Carol
    host 192.168.2.106
    object network ChunKit
    host 192.168.2.72
    object network KKPoong
    host 192.168.2.121
    object network Ben
    host 192.168.2.147
    object network Eva
    host 192.168.2.37
    object network Jacklyn
    host 192.168.2.135
    object network Siew_Peng
    host 192.168.2.149
    object network Suki
    host 192.168.2.61
    object network Yeow
    host 192.168.2.50
    object network Danny
    host 192.168.2.40
    object network Frankie
    host 192.168.2.101
    object network Jamal
    host 192.168.2.114
    object network OcLim
    host 192.168.2.177
    object network Charles
    host 192.168.2.210
    object network Ho
    host 192.168.2.81
    object network YLChow
    host 192.168.2.68
    object network Low
    host 192.168.2.58
    object network Sfgan
    host 192.168.2.15
    object network Joey
    host 192.168.2.75
    object network Rizal
    host 192.168.2.79
    object network 190
    host 192.168.2.190
    object network 191
    host 192.168.2.191
    object network 192
    host 192.168.2.192
    object network 193
    host 192.168.2.193
    object network 194
    host 192.168.2.194
    object network 199
    host 192.168.2.199
    object network 201
    host 192.168.2.201
    object network 203
    host 192.168.2.203
    object network 204
    host 192.168.2.204
    object network 205
    host 192.168.2.205
    object network CNC214
    host 192.168.2.214
    object network Liyana
    host 192.168.2.16
    object network Aipin
    host 192.168.2.22
    object network Annie
    host 192.168.2.140
    object network Ikah
    host 192.168.2.54
    object network Sue
    host 192.168.2.113
    object network Zaidah
    host 192.168.2.32
    object network CKWong
    host 192.168.2.33
    object network KhooSC
    host 192.168.2.47
    object network Neexon-PC
    host 192.168.2.179
    object network Neexon_NB
    host 192.168.2.102
    object network kc
    host 192.168.2.130
    object network P1
    subnet 192.168.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.0_24
    subnet 192.168.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.192_26
    subnet 192.168.2.192 255.255.255.192
    object network NETWORK_OBJ_192.168.10.192_26
    subnet 192.168.10.192 255.255.255.192
    object network VPN
    subnet 192.68.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.3.0_24
    subnet 192.168.3.0 255.255.255.0
    object-group network HPTM_DIGI
    network-object object CsHiew
    network-object object ERPServer
    network-object object Giap
    network-object object Jennifer
    network-object object KCTan
    network-object object KCTan-NB
    network-object object MailServer
    network-object object YHKhoo
    object-group network Inventory
    network-object object Aslina
    network-object object Law
    network-object object Nurul
    object-group network Account
    network-object object Laylee
    network-object object Ms_Pan
    network-object object Peck_Ling
    network-object object Pok_Leng
    network-object object UBS
    object-group network HR
    network-object object Ainie
    network-object object Angie
    object-group network Heeroz
    network-object object Carol
    network-object object ChunKit
    network-object object KKPoong
    object-group network Sales
    network-object object Ben
    network-object object Eva
    network-object object Jacklyn
    network-object object Siew_Peng
    network-object object Suki
    network-object object Yeow
    object-group network Production
    network-object object Danny
    network-object object Frankie
    network-object object Jamal
    network-object object OcLim
    object-group network Engineering
    network-object object Charles
    network-object object Ho
    network-object object YLChow
    network-object object Joey
    network-object object Rizal
    object-group network Purchasing
    network-object object Low
    network-object object Sfgan
    object-group network Wireless
    network-object object 190
    network-object object 191
    network-object object 192
    network-object object 193
    network-object object 194
    network-object object 199
    network-object object 201
    network-object object 203
    network-object object 204
    network-object object 205
    object-group network IT
    network-object object CNC214
    network-object object Liyana
    object-group network Skype
    network-object object Aipin
    network-object object Annie
    network-object object Ikah
    network-object object Sue
    network-object object Zaidah
    object-group network HPTM-P1
    network-object object CKWong
    network-object object KhooSC
    network-object object Neexon-PC
    network-object object Neexon_NB
    object-group service DM_INLINE_SERVICE_1
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_2
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    access-list DIGI_access_in extended permit ip any any
    access-list DIGI_access_in extended permit icmp any any echo
    access-list LAN_access_in extended deny object-group DM_INLINE_SERVICE_2 object-group Skype any
    access-list LAN_access_in extended deny object-group DM_INLINE_SERVICE_1 object 205 any
    access-list LAN_access_in extended permit ip any any
    access-list DIGI_cryptomap extended permit ip object VPN 113.20.*.* 255.255.255.0
    access-list Pq_access_in extended permit ip any any
    access-list splittun-vpngroup1 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    logging recipient-address aaa@***.com level errors
    mtu DIGI 1500
    mtu LAN 1500
    mtu Pone 1500
    mtu management 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711(1).bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (DIGI,LAN) source static any interface
    nat (Pone,LAN) source static any interface
    nat (DIGI,DIGI) source static NETWORK_OBJ_210.48.*.*_24 NETWORK_OBJ_210.48.*.*_24 destination static NETWORK_OBJ_113.20.*.*_24 NETWORK_OBJ_113.20.*.*_24 no-proxy-arp route-lookup
    nat (LAN,DIGI) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.2.192_26 NETWORK_OBJ_192.168.2.192_26 no-proxy-arp route-lookup
    nat (LAN,DIGI) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.10.192_26 NETWORK_OBJ_192.168.10.192_26 no-proxy-arp route-lookup
    nat (LAN,any) source static any any destination static VPN VPN
    nat (LAN,DIGI) source static any any destination static NETWORK_OBJ_192.168.3.0_24 NETWORK_OBJ_192.168.3.0_24 no-proxy-arp route-lookup
    nat (LAN,DIGI) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.3.0_24 NETWORK_OBJ_192.168.3.0_24 no-proxy-arp route-lookup
    object network VPN
    nat (any,DIGI) dynamic interface
    nat (LAN,Pone) after-auto source dynamic any interface dns
    nat (LAN,DIGI) after-auto source dynamic any interface dns
    access-group DIGI_access_in in interface DIGI
    access-group LAN_access_in in interface LAN
    access-group Pq_access_in in interface Pone
    route Pone 0.0.0.0 0.0.0.0 10.1.*.* 2
    route DIGI 0.0.0.0 0.0.0.0 210.48..*.* 3
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.2.0 255.255.255.0 LAN
    http 0.0.0.0 0.0.0.0 DIGI
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto dynamic-map DIGI_access_in 20 set ikev1 transform-set ESP-3DES-SHA
    crypto map DIGI_map 65535 ipsec-isakmp dynamic DIGI_access_in
    crypto map DIGI_map interface DIGI
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn sslvpn.cisco.com
    subject-name CN=sslvpn.cisco.com
    keypair hpmtkeypair
    crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
    certificate ed15c051
        308201ef 30820158 a0030201 020204ed 15c05130 0d06092a 864886f7 0d010105
        0500303c 31193017 06035504 03131073 736c7670 6e2e6369 73636f2e 636f6d31
        1f301d06 092a8648 86f70d01 09021610 73736c76 706e2e63 6973636f 2e636f6d
        301e170d 31333036 32313038 30343438 5a170d32 33303631 39303830 3434385a
        303c3119 30170603 55040313 1073736c 76706e2e 63697363 6f2e636f 6d311f30
        1d06092a 864886f7 0d010902 16107373 6c76706e 2e636973 636f2e63 6f6d3081
        9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100a9 7715ca9e
        4d63204e 66e6517b 9a560be8 188603cc 90bb39a7 c61ef0d8 cd74bf19 8ec33146
        5176547f f43615a2 b8917a03 3a5a9dd6 e087a78a 74bf3a8e 6d7cfad2 0678253d
        b03a677a 52e9ebc0 8e044353 e9fe2055 3cafafa3 3ec74ef9 45eaf8d6 8e554879
        db9bf2fb ebcdb5c3 011bf61f 8c139ed1 a00d300a 8fe4784f 173c7702 03010001
        300d0609 2a864886 f70d0101 05050003 81810046 d32b20a6 a1efb0b5 29c7ed00
        11c0ce87 c58228c9 aae96197 eb275f9a f9da57a1 fc895faf 09a24c0c af43772b
        2818ec29 0a56eb33 c0e56696 dd1fa3bb 151ee0e4 18d27366 92177a31 b2f7842b
        4f5145b9 942fbc49 c785f925 3a909c17 2593efcc 2e410b5c d3026fe1 f48d93c1
        744333e2 c377e5d3 62eebb63 abca4109 d57bb0
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable DIGI client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable DIGI
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    track 1 rtr 123 reachability
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 DIGI
    ssh timeout 5
    console timeout 0
    vpn-sessiondb max-other-vpn-limit 250
    vpn-sessiondb max-anyconnect-premium-or-essentials-limit 2
    vpn load-balancing
    interface lbpublic DIGI
    interface lbprivate DIGI
    dhcp-client client-id interface Pone
    dhcpd address 192.168.2.10-192.168.2.150 LAN
    dhcpd dns 210.48.*.* 210.48.*.* interface LAN
    dhcpd enable LAN
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ssl trust-point ASDM_TrustPoint0 DIGI
    webvpn
    enable DIGI
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles anyhpmt_client_profile disk0:/anyhpmt_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    tunnel-group-preference group-url
    group-policy sslpolicy internal
    group-policy sslpolicy attributes
    vpn-tunnel-protocol ssl-clientless
    webvpn
      url-list none
    group-policy GroupPolicy_anyhpmt internal
    group-policy GroupPolicy_anyhpmt attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
    default-domain value g
    webvpn
      anyconnect profiles value anyhpmt_client_profile type user
    group-policy vpngroup1 internal
    group-policy vpngroup1 attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value splittun-vpngroup1
    default-domain value g
    address-pools value vpn_250
    group-policy newvpn internal
    group-policy newvpn attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    default-domain value g
    username cshiew password KK1oQOhoxfwWvya4 encrypted
    username cshiew attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect ask none default anyconnect
    username newuser password GJrqM3H2KqQZv/MI encrypted privilege 1
    tunnel-group vpngroup1 type remote-access
    tunnel-group vpngroup1 general-attributes
    address-pool vpn_250
    default-group-policy vpngroup1
    tunnel-group vpngroup1 webvpn-attributes
    group-alias vpngroup1 enable
    tunnel-group vpngroup1 ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group sslhpmt type remote-access
    tunnel-group sslhpmt general-attributes
    default-group-policy sslpolicy
    tunnel-group sslhpmt webvpn-attributes
    group-alias sslhpmt enable
    tunnel-group anyhpmt type remote-access
    tunnel-group anyhpmt general-attributes
    address-pool vpn_client
    default-group-policy GroupPolicy_anyhpmt
    tunnel-group anyhpmt webvpn-attributes
    group-alias anyhpmt enable
    tunnel-group-map default-group vpngroup1
    class-map global-class
    match any
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    class global-class
      cxsc fail-open
    class class-default
      user-statistics accounting
    policy-map global-policy
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:7a5ee8ff016e63420802423269da864b
    : end

    Hi,
    Safwan Hashan napisano:i dont know which output you referring but this is output from the VPN client.
    We need more information.
    I expect debug output from the ASA.
    To enable debugging and syslog messages, perform the following CLI steps:
    1.
    ASA#configure terminal
    ASA(config)# debug crypto ikev1 127
    ASA(config)# debug crypto ipsec 127
    Enable debuging messages for IKEv1 and IPSec.
    2.
    ASA(config)# logging monitor debug
    Sets syslog messages to be sent to Telnet or SSH sessions.
    Note: You can alternately use the logging buffer debug command to send log messages to a buffer, and then view them later using the show logging command.
    3.
    ASA(config)# terminal monitor
    Sends the syslog messages to a Telnet or SSH session.
    4.
    ASA(config)# logging on
    Enables syslog message generation.
    NOTE: This you have enabled.
    Cleanup CLI
    ASA(config)# no debug crypto ikev1
    ASA(config)# no debug crypto ipsec
    ASA(config)# no logging monitor debug
    ASA(config)# no terminal monitor
    More information: Sensible Debugging and Logging
    I have one suggestion. Change and try.
    group-policy vpngroup1 internal
    group-policy vpngroup1 attributes
    no vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    vpn-tunnel-protocol ikev1
    Best regards,
    MB
    Please rate all helpful posts. Thx

Maybe you are looking for