Can't Ping, SSH or HTTP to my Oracle Enterprise Linux install

Hi All,
I've got a 'brandnew' install of OEL running GridControl 10.2.0.3.
I've attempted to ping my new system and I get :
matt@Brutus:~$ ping stimpy
PING stimpy.us.oracle.com (192.168.0.4) 56(84) bytes of data.
From Brutus.local (192.168.0.10) icmp_seq=2 Destination Host Unreachable
From Brutus.local (192.168.0.10) icmp_seq=3 Destination Host Unreachable
From Brutus.local (192.168.0.10) icmp_seq=4 Destination Host Unreachable
And I've attempted to connect to the GridControl website and I get:
Firefox can't establish a connection to the server at stimpy.us.oracle.com:4889
I've disabled all the SELinux stuff but I still can not ssh, ping, etc...
Does OEL have any additional security lockdown measures that I can 'tweak' and disable?
Thanks,
Matt

there is no special, undocumented security implementation in EL
what is the file /etc/sysconfig/network-scripts/ifcfg-eth<*> containing?
what is ifconfig -a telling?
what is route -eev telling?
guido

Similar Messages

  • Can I Install SOA Suite 10.1.3.1 on Enterprise Linux 64 bit ?

    Hi everyone.
    I just downloaded and installed Oracle Enterprise Linux 5.1 for x86_64.
    I tried installing SOA suite 10.1.3.1 and failed the distro check. I then tried to do this with the ignoreSysPreReqs switch and got the following exception :
    /tmp/OraInstall2008-01-17_03-50-18PM/jre/1.4.2/lib/i386/libawt.so: libXp.so.6: cannot open shared object file: No such file or directory
    So is this instalation possible ?
    Thanassis

    With new products and point releases coming out so often (which is a good thing) from Oracle development, there would be no way that Development could forsee in advance every single package that might be needed to install the various Oracle technology stacks.
    But finding and installing whatever packages you need is pretty painless using Yum and Up2Date on Enterprise Linux.
    Take a look at the following and use in conjunction with the setup guide
    http://www.oracle.com/technology/tech/linux/htdocs/yum-repository-setup.html

  • RV120W can't open web management, can't open SSH/http to server on LAN port

    Hi,
    I just buy cisco RV120W, but seem I found alot of issue. Hope some one can help.
    Topology:
    Internet------RV120W(192.168.1.1/24)--------(192.168.1.5/24)PC
                          |---------------(192.168.1.2)L3switch(10.10.10.1/24)--------(10.10.10.2/24)Server
    Here is the issue:
    1. from PC after I login to 192.168.1.1 the WEB can't be opened. it show as web server not responding. I have try with 3browser 2PC but all same. But I use HP it can be opened.
    2. on RV120W I added static route and now I from PC I can ping to Server. I can telnet but SSH/HTTP always failed.
    On firewall I never set anything, all is permited.
    I try version 1.0.3.10 and 1.0.4.10 but all same.

    Hi Bernadi, thank you for using our forum, my name is Luis I am part of the Small business Support community. I have some question for you:
    1.1) What kind of computer are those that didn't work?
    1.2) If you connect those, are you receiving an IP address from DHCP?
    1.3) What gateway is showing?
    2.1) Do you have any debug or error?
    2.2) Did you try creating an Forwarding rule for 443 to the server address?
    I recommend you always use the last firmware.
    I hope you find this answer useful
    Greetings,
    Luis Arias.
    Cisco Network Support Engineer.

  • ASA 5505 VPN clients can't ping router or other clients on network

    I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
    Result of the command: "show running-config"
    : Saved
    ASA Version 7.2(4)
    hostname ASA
    domain-name default.domain.invalid
    enable password kdnFT44SJ1UFX5Us encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.4 Server
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list vpn_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
    static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface www Server www netmask 255.255.255.255
    static (inside,outside) tcp interface https Server https netmask 255.255.255.255
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable 480
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    group-policy vpn internal
    group-policy vpn attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_splitTunnelAcl
    username admin password wwYXKJulWcFrrhXN encrypted privilege 15
    username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
    username VPNuser attributes
    vpn-group-policy vpn
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool VPNpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:df7d1e4f34ee0e155cebe86465f367f5
    : end
    Any ideas what I need to add to get the vpn client to be able to ping the router and clients?
    Thanks.

    I tried that and it didn't work. As for upgrading the ASA version, I'd like to but this is an old router and I don't have a support contract with Cisco anymore, so I can't access the latest firmware.
    here is the runnign config again:
    Result of the command: "show startup-config"
    : Saved
    : Written by enable_15 at 01:48:37.789 MDT Wed Jun 20 2012
    ASA Version 7.2(4)
    hostname ASA
    domain-name default.domain.invalid
    enable password kdnFT44SJ1UFX5Us encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.4 Server
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list vpn_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    asdm location Server 255.255.255.255 inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
    static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface www Server www netmask 255.255.255.255
    static (inside,outside) tcp interface https Server https netmask 255.255.255.255
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable 480
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    group-policy vpn internal
    group-policy vpn attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_splitTunnelAcl
    username admin password wwYXKJulWcFrrhXN encrypted privilege 15
    username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
    username VPNuser attributes
    vpn-group-policy vpn
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool VPNpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:78864f4099f215f4ebdd710051bdb493

  • Cisco ASA 5505 can ping gateway but can't ping internet

    Good day to all!
    Sorry if I post this on the wrong group, I am having a bit of a problem on configuring an ASA 5505 firewall. And I scoured google but can't seem to find a specific link to my issues.
    It is on a routed mode, have successfully configured inside and outside vlans. Hosts inside vlan can ping each other. Hosts on outside vlan can also ping each other. Problem is, when I am pinging 8.8.8.8, I received ????? Please see config below.
    Any help greatly appreciated.
    TIA!
    : Saved
    ASA Version 8.4(3)
    hostname ciscoasan
    enable password bD3fGYMFeJJTATOJ encrypted
    passwd 2KF1w9ErdI.2KYOU encrypted
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     description INSIDE
     nameif inside
     security-level 100
     ip address 10.10.10.2 255.255.255.0
    interface Vlan2
     description OUTSIDE
     nameif outside
     security-level 0
     ip address 203.127.68.2 255.255.255.240
    ftp mode passive
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    access-list outside_access_in extended permit ip any any
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    object network obj_any
     nat (inside,outside) dynamic interface
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 203.127.68.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    http server enable
    http 10.10.10.0 255.255.255.0 inside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 10.10.10.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny  
      inspect sunrpc
      inspect xdmcp
      inspect sip  
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:6b3e0ce99eda3d2563cf9f392f8001b7
    : end

    Hi badingdong,
    Remove these lines:
    no nat (inside,outside) after-auto source dynamic any interface
    no access-group outside_access_in in interface outside
    If you have more inside subnets need access to internet, please make sure that you have a static route in place as shown below.
    route inside 10.0.0.0 255.0.0.0 10.10.10.1
    Also make sure that you have a correct DNS server is assigned on your internal hosts.
    Thanks
    Rizwan Rafeek

  • Subnet mask 255.255.255.255 assigned to VPN client - can't ping LAN

    Hi,
    I configured PIX 501 with PPTP VPN to connect to the small office (PIX FW, Win 2000 Server, several Win clients, LAN IP 10.0.0.X/24):
    ip local pool mypool 10.0.0.101-10.0.0.105
    vpdn group mygroup accept dialin pptp
    vpdn group mygroup ppp authentication mschap
    vpdn group mygroup ppp encryption mppe 128 required
    vpdn group mygroup client configuration address local mypool
    vpdn group mygroup client configuration dns 10.0.0.15
    vpdn group mygroup pptp echo 60
    vpdn group mygroup client authentication local
    vpdn username xxxx password *********
    vpdn enable outside
    I can connect to the office using Win VPN client, but I can't ping any hosts in the office network. I suspect that the reason for that is subnet mask assigned to the VPN client: 255.255.255.255. ipconfig of the VPN client:
    PPP adapter Office:
    Connection-specific DNS Suffix . :
    IP Address. . . . . . . . . . . . : 10.0.0.101
    Subnet Mask . . . . . . . . . . . : 255.255.255.255
    Default Gateway . . . . . . . . . :
    Default GW is missing too, but I think this is not the main problem.
    Any way, what is wrong with my config? How to fix subnet mask assigned to clients? Or may be my assumption is wrong and this mask is ok? What is wrong then?
    Any input will be greatly appreciated!
    George

    Thanks for the prompt reply.
    Here it does:
    PIX Version 6.3(4)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password xxxxxxxxxxxxxx encrypted
    passwd xxxxxxxxxxxxxx encrypted
    hostname OSTBERG-PIX
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list 80 permit ip 10.0.0.0 255.255.255.0 10.0.20.0 255.255.255.0
    access-list inbound permit icmp any any
    access-list inbound permit tcp any any eq pptp
    access-list inbound permit gre any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside 66.189.xxx.xxx 255.255.252.0
    ip address inside 10.0.0.23 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool mypool 10.0.0.101-10.0.0.105
    pdm location 10.0.0.0 255.255.255.0 inside
    pdm location 10.0.0.15 255.255.255.255 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    access-group inbound in interface outside
    route outside 0.0.0.0 0.0.0.0 66.189.yyy.yyy 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt connection permit-pptp
    telnet 10.0.0.23 255.255.255.255 inside
    telnet 10.0.0.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group mygroup accept dialin pptp
    vpdn group mygroup ppp authentication mschap
    vpdn group mygroup ppp encryption mppe 128 required
    vpdn group mygroup client configuration address local mypool
    vpdn group mygroup client configuration dns 10.0.0.15
    vpdn group mygroup pptp echo 60
    vpdn group mygroup client authentication local
    vpdn username ********* password *********
    vpdn enable outside
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    terminal width 80
    Cryptochecksum:xxx
    : end
    There are remnants of old config, I just recently took over this network, some lines look odd to me, but I did not touch what works. VPN config is all mine.
    PIX internal 10.0.0.23 - is a gateway for the network. DNS server in LAN - 10.0.0.15.
    I've been reading about the problem and came across several posts that this subnet mask is normal, but it puzzles me - how can this host communicate with anyone else if there is no room for other hosts in this network (according to the mask)?!
    Thanks again!
    George

  • WinXp Pro as Virtualbox Guest can't ping router/internet

    Hi:
    I am running Arch 64 and installed virtualbox_bin 2.0.4-1 from AUR and guest additions 2.0.2-1 from AUR.
    I have installed as a guest os, WinXP Pro and set up bridge networking per
    http://mychael.gotdns.com/blog/2007/05/ … -bridging/.
    My Arch host works fine (it can access the internet and ping the guest WinXP Pro). My WinXP Pro guest can ping my Arch host and other local machines on my network. However it cannot ping my router or access or ping the internet.
    I log onto the WinXP Pro as the Administrator and I have the firewall disabled, so I don't think it is being blocked on the XP side by anything.
    As far as Arch goes, I have tried adding the host name of the WinXP Pro machine to /etc/hosts and put the ip adress of the XP machine into /etc/hosts.allow. Neither of these actions resulted in success. I don't think I have a firewall or other special security measures on my Arch? I just did a fresh ftp install yesterday and did not add ssh or other security measures that weren't included in the default install and the base-devel install.
    My search of the forums turned up a similar problem to mine that was solved by removing the firewall in the WinXP guest. I have already done that still without success.
    My uneducated guess is that the gateway ip is not getting to the guest. I am using static ip for both the Arch host and the WinXP guest. The WinXP guest says that it is connected and reports no problems. I tried using dhcp on the XP guest but that didn't work either.
    Here is the network section of my /etc/rc.conf
    lo="lo 127.0.0.1"
    BRIDGE_INTERFACES=(br0)
    bridge_br0=(eth0)
    br0="br0 192.168.1.201 netmask 255.255.255.0 broadcast 192.168.0.255"
    eth0="eth0 0.0.0.0 promisc"
    INTERFACES=(lo br0 eth0)
    gateway="default gw 192.168.1.1"
    ROUTES=(gateway)
    Any help would be much appreciated.
    bdika

    Hi Floris:
    Thanks for the reply.
    I originally tried the Arch Way without success, that is why I tried the other way.
    However at your suggestion, I have tried the Arch Way again, with the same results. That is I can ping other computers on my network but I can't ping my router nor access the internet from my guest.
    Seeing that I have the same problem regardless of which method I use leads me to believe that it must be something simple and obvious that I am doing wrong. But what??! I have no idea.
    Any thoughts you have would be much appreciated.
    bdika

  • Cisco ASA 5510 - Cisco Client Can Connect To VPN But Can't Ping!

    Hi,
    I have an ASA 5510 with the configuration below. I have configure the ASA as remote access vpn server with cisco vpn client, my problem now is I can connect but I can't ping.
    Config
    ciscoasa# sh run
    : Saved
    ASA Version 8.0(3)
    hostname ciscoasa
    enable password 5QB4svsHoIHxXpF/ encrypted
    names
    name xxx.xxx.xxx.xxx SAP_router_IP_on_SAP
    name xxx.xxx.xxx.xxx ISA_Server_second_external_IP
    name xxx.xxx.xxx.xxx Mail_Server
    name xxx.xxx.xxx.xxx IncomingIP
    name xxx.xxx.xxx.xxx SAP
    name xxx.xxx.xxx.xxx WebServer
    name xxx.xxx.xxx.xxx cms_eservices_projects_sharepointold
    name 192.168.2.2 isa_server_outside
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address IncomingIP 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.253 255.255.255.0
    management-only
    passwd 123
    ftp mode passive
    clock timezone EEST 2
    clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
    object-group service TCP_8081 tcp
    port-object eq 8081
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq 3389
    port-object eq ftp
    port-object eq www
    port-object eq https
    port-object eq smtp
    port-object eq pop3
    port-object eq 3200
    port-object eq 3300
    port-object eq 3600
    port-object eq 3299
    port-object eq 3390
    port-object eq 50000
    port-object eq 3396
    port-object eq 3397
    port-object eq 3398
    port-object eq imap4
    port-object eq 587
    port-object eq 993
    port-object eq 8000
    port-object eq 8443
    port-object eq telnet
    port-object eq 3901
    group-object TCP_8081
    port-object eq 1433
    port-object eq 3391
    port-object eq 3399
    port-object eq 8080
    port-object eq 3128
    port-object eq 3900
    port-object eq 3902
    port-object eq 7777
    port-object eq 3392
    port-object eq 3393
    port-object eq 3394
    port-object eq 3395
    port-object eq 92
    port-object eq 91
    port-object eq 3206
    port-object eq 8001
    port-object eq 8181
    port-object eq 7778
    port-object eq 8180
    port-object eq 22222
    port-object eq 11001
    port-object eq 11002
    port-object eq 1555
    port-object eq 2223
    port-object eq 2224
    object-group service RDP tcp
    port-object eq 3389
    object-group service 3901 tcp
    description 3901
    port-object eq 3901
    object-group service 50000 tcp
    description 50000
    port-object eq 50000
    object-group service Enable_Transparent_Tunneling_UDP udp
    port-object eq 4500
    access-list inside_access_in remark connection to SAP
    access-list inside_access_in extended permit ip 192.168.2.0 255.255.255.0 host SAP_router_IP_on_SAP
    access-list inside_access_in remark VPN Outgoing - PPTP
    access-list inside_access_in extended permit tcp 192.168.2.0 255.255.255.0 any eq pptp
    access-list inside_access_in remark VPN Outgoing - GRE
    access-list inside_access_in extended permit gre 192.168.2.0 255.255.255.0 any
    access-list inside_access_in remark VPN - GRE
    access-list inside_access_in extended permit gre any any
    access-list inside_access_in remark VPN Outgoing - IKE Client
    access-list inside_access_in extended permit udp 192.168.2.0 255.255.255.0 any eq isakmp
    access-list inside_access_in remark VPN Outgoing - IPSecNAT - T
    access-list inside_access_in extended permit udp 192.168.2.0 255.255.255.0 any eq 4500
    access-list inside_access_in remark DNS Outgoing
    access-list inside_access_in extended permit udp any any eq domain
    access-list inside_access_in remark DNS Outgoing
    access-list inside_access_in extended permit tcp any any eq domain
    access-list inside_access_in remark Outoing Ports
    access-list inside_access_in extended permit tcp 192.168.2.0 255.255.255.0 any object-group DM_INLINE_TCP_1
    access-list inside_access_in extended permit ip 172.16.1.0 255.255.255.0 any
    access-list outside_access_in extended permit ip any any
    access-list outside_access_in extended permit tcp any any eq pptp
    access-list outside_access_in extended permit gre any any
    access-list outside_access_in extended permit gre any host Mail_Server
    access-list outside_access_in extended permit tcp any host Mail_Server eq pptp
    access-list outside_access_in extended permit esp any any
    access-list outside_access_in extended permit ah any any
    access-list outside_access_in extended permit udp any any eq isakmp
    access-list outside_access_in extended permit udp any any object-group Enable_Transparent_Tunneling_UDP
    access-list VPN standard permit 192.168.2.0 255.255.255.0
    access-list corp_vpn extended permit ip 192.168.2.0 255.255.255.0 172.16.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool POOL 172.16.1.10-172.16.1.20 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-603.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 2 Mail_Server netmask 255.0.0.0
    global (outside) 1 interface
    global (inside) 2 interface
    nat (inside) 0 access-list corp_vpn
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp Mail_Server 8001 ISA_Server_second_external_IP 8001 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 8000 ISA_Server_second_external_IP 8000 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server pptp isa_server_outside pptp netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server smtp isa_server_outside smtp netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 587 isa_server_outside 587 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 9444 isa_server_outside 9444 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 9443 isa_server_outside 9443 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 3389 isa_server_outside 3389 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 3390 isa_server_outside 3390 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 3901 isa_server_outside 3901 netmask 255.255.255.255
    static (inside,outside) tcp SAP 50000 isa_server_outside 50000 netmask 255.255.255.255
    static (inside,outside) tcp SAP 3200 isa_server_outside 3200 netmask 255.255.255.255
    static (inside,outside) tcp SAP 3299 isa_server_outside 3299 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server www isa_server_outside www netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server https isa_server_outside https netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server pop3 isa_server_outside pop3 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server imap4 isa_server_outside imap4 netmask 255.255.255.255
    static (inside,outside) tcp cms_eservices_projects_sharepointold 9999 isa_server_outside 9999 netmask 255.255.255.255
    static (inside,outside) 192.168.2.0  access-list corp_vpn
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set transet esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set pfs
    crypto dynamic-map dynmap 10 set transform-set transet ESP-3DES-SHA
    crypto map cryptomap 10 ipsec-isakmp dynamic dynmap
    crypto map cryptomap interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    no crypto isakmp nat-traversal
    telnet 192.168.2.0 255.255.255.0 inside
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd dns xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx interface inside
    dhcpd domain domain.local interface inside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    tftp-server management 192.168.1.123 /
    group-policy mypolicy internal
    group-policy mypolicy attributes
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN
    username vpdn password 123
    username vpdn attributes
    vpn-group-policy mypolicy
    service-type remote-access
    tunnel-group mypolicy type remote-access
    tunnel-group mypolicy general-attributes
    address-pool POOL
    default-group-policy mypolicy
    tunnel-group mypolicy ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:b8bb19b6cb05cfa9ee125ad7bc5444ac
    : end
    Thank you very much.

    Here is the output:
    ciscoasa# packet-tracer input outside icmp 172.16.1.10 8 0 192.168.2.1
    Phase: 1
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 2
    Type: UN-NAT
    Subtype: static
    Result: ALLOW
    Config:
    static (inside,outside) 192.168.2.0  access-list corp_vpn
    nat-control
      match ip inside 192.168.2.0 255.255.255.0 outside 172.16.1.0 255.255.255.0
        static translation to 192.168.2.0
        translate_hits = 0, untranslate_hits = 139
    Additional Information:
    NAT divert to egress interface inside
    Untranslate 192.168.2.0/0 to 192.168.2.0/0 using netmask 255.255.255.0
    Phase: 3
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group outside_access_in in interface outside
    access-list outside_access_in extended permit ip any any
    Additional Information:
    Phase: 4
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 5
    Type: CP-PUNT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 6
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    Additional Information:
    Phase: 7
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 8
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 9
    Type: NAT-EXEMPT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 10
    Type: NAT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    static (inside,outside) 192.168.2.0  access-list corp_vpn
    nat-control
      match ip inside 192.168.2.0 255.255.255.0 outside 172.16.1.0 255.255.255.0
        static translation to 192.168.2.0
        translate_hits = 0, untranslate_hits = 140
    Additional Information:
    Phase: 11
    Type: ACCESS-LIST
    Subtype:
    Result: DROP
    Config:
    Implicit Rule
    Additional Information:
    Result:
    input-interface: outside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule

  • ASA 5505 AnyConnect VPN Can RDP to clients but can't ping/icmp

    Hello all,
    I've been searching all day for a solution to this problem. I setup and SSL anyconnect VPN on my Cisco ASA 5505. It works well and connects with out a problem. However, I can't ping any internal clients, but I can RDP to them. It may be something simple and I would appreciate any help. Most of the time people end up posting their config so I will as well.
    MafSecASA# show run
    : Saved
    ASA Version 8.2(1)
    hostname MafSecASA
    domain-name mafsec.com
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.4.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 7.3.3.2 255.255.255.248
    interface Vlan3
    no forward interface Vlan1
    nameif dmz
    security-level 50
    ip address 172.20.1.1 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    speed 100
    duplex full
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 3
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns server-group DefaultDNS
    domain-name mafsec.com
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object tcp
    protocol-object udp
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object udp
    protocol-object tcp
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_4
    protocol-object ip
    protocol-object icmp
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in remark allow remote users to internal users
    access-list inside_access_in remark allow remote users to internal users
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_4 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_3 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list outside_access_in extended permit icmp any any
    access-list inside_split_tunnel standard permit 10.4.0.0 255.255.255.0
    access-list inside_split_tunnel standard permit 10.5.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.4.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list inside_nat0_outbound_1 extended permit ip 10.4.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list inside_nat0_outbound_1 extended permit ip 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
    access-list inside_nat0_outbound_1 extended permit ip 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    ip local pool SSLVPNPool2 10.5.0.1-10.5.0.254 mask 255.255.255.0
    ip verify reverse-path interface outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound_1
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 7.3.3.6 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication enable console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 10.4.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 10.4.0.0 255.255.255.0 inside
    ssh timeout 5
    ssh version 2
    console timeout 0
    dhcpd option 6 ip 8.8.8.8 8.8.4.4
    dhcpd address 10.4.0.15-10.4.0.245 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd lease 86400 interface inside
    dhcpd option 3 ip 10.4.0.1 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.5.3055-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.5.3055-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy SSLVPN internal
    group-policy SSLVPN attributes
    dns-server value 8.8.8.8 8.8.4.4
    vpn-tunnel-protocol svc
    group-lock none
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value inside_split_tunnel
    vlan none
    address-pools value SSLVPNPool2
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    username user1 password
    username user1 attributes
    service-type remote-access
    username user2 password
    tunnel-group SSLVPNGROUP type remote-access
    tunnel-group SSLVPNGROUP general-attributes
    address-pool SSLVPNPool2
    default-group-policy SSLVPN
    tunnel-group SSLVPNGROUP webvpn-attributes
    group-alias SSLVPN enable
    prompt hostname context
    Cryptochecksum:3b16cbc9bbdfa20e6987857c1916a396
    : end
    Thank in advance for any help!

    Your config actually looks good (you have the ACL that would allow the echo-reply back since you don't have inspection turned on) - are you sure this isn't a windows firewall issue on the PCs?  I'd try pinging a router or switch just to make sure.
    --Jason

  • Intermittent Internet Connection and VPN clients can't ping internal LAN but connected after installating cisco ASA5512x

    Hi!
    I wish someone can help me on this, I'm a new guy on cisco firewalls and I'm currently implementing cisco asa 5512x, here are the details:
    ISP ->  Firewall -> Core switch -> Internal LAN
    after installing the cisco asa and terminating the appropriate lan for the outside and inside interfaces, internet seems intermittent and cisco vpn client can connect with internet connection but can't ping internal LAN.
    here's my configuration from my firewall.
    ASA Version 8.6(1)2
    hostname ciscofirewall
    enable password 2KFQnbNIdI.2KYOU encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 203.x.x.x 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 10.152.11.15 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 4.2.2.2 -------> public DNS
    name-server 8.8.8.8 -------> public
    name-server 203.x.x.x   ----> Clients DNS
    name-server 203.x.x.x  -----> Clients DNS
    same-security-traffic permit intra-interface
    object network net_access
    subnet 10.0.0.0 255.0.0.0
    object network citrix_server
    host 10.152.11.21
    object network NETWORK_OBJ_10.10.10.0_28
    subnet 10.10.10.0 255.255.255.240
    object network NETWORK_OBJ_10.0.0.0_8
    subnet 10.0.0.0 255.0.0.0
    object network InterconHotel
    subnet 10.152.11.0 255.255.255.0
    access-list net_surf extended permit ip any any
    access-list net_surf extended permit ip object NETWORK_OBJ_10.10.10.0_28 object InterconHotel
    access-list outside_access extended permit tcp any object citrix_server eq www
    access-list outside_access extended permit ip object NETWORK_OBJ_10.10.10.0_28 any
    access-list outsidevpn_splitTunnelAcl standard permit 10.152.11.0 255.255.255.0
    access-list LAN_Users remark LAN_clients
    access-list LAN_Users standard permit any
    access-list vpnpool extended permit ip 10.10.10.0 255.255.255.248 any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu outside 1500
    mtu inside 1500
    ip local pool vpnpool 10.10.10.1-10.10.10.6 mask 255.255.255.248
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static NETWORK_OBJ_10.10.10.0_28 NETWORK_OBJ_10.10.10.0_28 destination static NETWORK_OBJ_10.10.10.0_28 NETWORK_OBJ_10.10.10.0_28 no-proxy-arp route-lookup
    object network net_access
    nat (inside,outside) dynamic interface
    object network citrix_server
    nat (inside,outside) static 203.177.18.234 service tcp www www
    object network NETWORK_OBJ_10.10.10.0_28
    nat (any,outside) dynamic interface
    object network InterconHotel
    nat (inside,outside) dynamic interface dns
    access-group outside_access in interface outside
    access-group net_surf out interface outside
    route outside 0.0.0.0 0.0.0.0 203.x.x.x 1
    route outside 10.10.10.0 255.255.255.248 10.152.11.15 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 10.0.0.100 255.255.255.255 inside
    http 10.10.10.0 255.255.255.240 outside
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet 10.152.11.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    webvpn
    enable outside
    anyconnect-essentials
    group-policy outsidevpn internal
    group-policy outsidevpn attributes
    dns-server value 203.x.x.x 203.x.x.x
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client
    split-tunnel-policy tunnelall
    split-tunnel-network-list value outsidevpn_splitTunnelAcl
    default-domain value interconti.com
    address-pools value vpnpool
    username test1 password i1lji/GiOWB67bAs encrypted privilege 5
    username test1 attributes
    vpn-group-policy outsidevpn
    username mnlha password WlzjmENGEEZmT9LA encrypted
    username mnlha attributes
    vpn-group-policy outsidevpn
    username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
    tunnel-group outsidevpn type remote-access
    tunnel-group outsidevpn general-attributes
    address-pool (inside) vpnpool
    address-pool vpnpool
    authentication-server-group (outside) LOCAL
    default-group-policy outsidevpn
    tunnel-group outsidevpn ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect http
      inspect ipsec-pass-thru
    class class-default
      user-statistics accounting
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:edc30dda08e5800fc35b72dd6e1d88d7
    : end
    thanks. please help.

    I think you should change your nat-exemption rule to smth more general, like
    nat (inside,outside) source static any any destination static NETWORK_OBJ_10.10.10.0_28  NETWORK_OBJ_10.10.10.0_28 no-proxy-arp route-lookup
    'cause your inside networks are not the same as your vpn-pool subnet.
    Plus, if you're trying to reach inside subnets, different from 10.152.11.0 255.255.255.0 (ip from wich subnet is assignet to your inside interface, and for wich above nat exception should be enough), you should check if routing is configured from that subnets to your vpn-pool-subnet through the ASA.

  • VPN Clients Can't Ping Hosts

    I will include a post of my config. I have the clients connecting through the VPN tunnel on the 180.0.0.0/24 network, 192.168.1.0/24 is the primary network for the office.
    I can connect to the VPN and I do recieve the correct address assignment. I belive tunneling may be setup correct in the aspect that I can still connect to the internet while on the VPN, but I can not ping any hosts on the 192.168.1.0 network. In the debug log from the ASDM I can see pings reaching the ASA, but no responce is received on the client.
    6
    Feb 21 2013
    21:54:26
    180.0.0.1
    53508
    192.168.1.1
    0
    Built inbound ICMP connection for faddr 180.0.0.1/53508 gaddr 192.168.1.1/0 laddr 192.168.1.1/0 (christopher)
    Any help would be greatly appreciated, I am currently presuring my CCNP so I would like to get a deeper understanding of how to solve these issues.
    -Chris
    hostname RegencyRE-ASA
    domain-name regencyrealestate.info
    enable password 2/VA7dRFkv6fjd1X encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 180.0.0.0 Regency
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    description link to REGENCYSERVER
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    description link to RegencyRE-AP
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.120 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.248
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.220.220
    name-server 208.67.222.222
    domain-name regencyrealestate.info
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 Regency 255.255.255.224
    access-list RegencyRE_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list outside_access_in extended permit icmp any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool Regency 180.0.0.1-180.0.0.20 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm location Regency 255.255.255.0 inside
    asdm location 192.168.0.0 255.255.0.0 inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 12.186.110.2 1
    route inside 192.0.0.0 255.0.0.0 192.168.1.102 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication serial console LOCAL
    http server enable 8443
    http 0.0.0.0 0.0.0.0 outside
    http 0.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 15
    ssh version 2
    console timeout 0
    dhcprelay server 192.168.1.102 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 69.25.96.13 source outside prefer
    ntp server 216.171.124.36 source outside prefer
    webvpn
    group-policy RegencyRE internal
    group-policy RegencyRE attributes
    dns-server value 208.67.220.220 208.67.222.222
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value RegencyRE_splitTunnelAcl
    username adriana password  encrypted privilege 0
    username christopher password  encrypted privilege 15
    username irene password  encrypted privilege 0
    tunnel-group RegencyRE type remote-access
    tunnel-group RegencyRE general-attributes
    address-pool Regency
    default-group-policy RegencyRE
    tunnel-group RegencyRE ipsec-attributes
    pre-shared-key R3&eNcY1.
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:35bc3a41701f7f8e9dde5fa35532896d
    : end

    Looking at a previous ASA 5520 I configured when I ping hosts I see the following in the logs. I know there is something obvious I am missing.
    6
    Feb 21 2013
    22:01:49
    302020
    170.0.0.1
    13317
    172.16.0.253
    0
    Built inbound ICMP connection for faddr 170.0.0.1/13317 gaddr 172.16.0.253/0 laddr 172.16.0.253/0 (cxv1)
    6
    Feb 21 2013
    22:01:49
    302020
    172.16.0.253
    0
    170.0.0.1
    13317
    Built outbound ICMP connection for faddr 170.0.0.1/13317 gaddr 172.16.0.253/0 laddr 172.16.0.253/0

  • One router on ASA 5505 Site to Site VPN can't ping other router

    I have two Cisco ASA routers and I have a site to site vpn set up between the two. The VPN link works but Site A can't ping anything on Site B. Site B can ping Site A. Site B can ping other pcs on it's own network. Site A has been in place for a while and has other site to site VPNs that work fine, so I think the problem is with Site B. Here is the config for Site B:
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(4)1
    hostname SaskASA
    enable password POgOWyKyb0jgJ1Hm encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.16.1 255.255.254.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    ftp mode passive
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network NETWORK_OBJ_192.168.16.0_23
    subnet 192.168.16.0 255.255.254.0
    object network NETWORK_OBJ_192.168.2.0_23
    subnet 192.168.2.0 255.255.254.0
    access-list outside_cryptomap extended permit ip 192.168.16.0 255.255.254.0 192.168.2.0 255.255.254.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static NETWORK_OBJ_192.168.16.0_23 NETWORK_OBJ_192.168.16.0_23 destination static NETWORK_OBJ_192.168.2.0_23 NETWORK_OBJ_192.168.2.0_23 no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    nat (inside,outside) after-auto source dynamic any interface
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable 444
    http 192.168.16.0 255.255.254.0 inside
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 207.228.xx.xx
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map interface outside
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcp-client client-id interface outside
    dhcpd auto_config outside
    dhcpd address 192.168.16.100-192.168.16.200 inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy GroupPolicy_207.228.xx.xxinternal
    group-policy GroupPolicy_207.228.xx.xx attributes
    vpn-tunnel-protocol ikev1 ikev2
    username User password shbn5zbLkuHP/mJX encrypted privilege 15
    tunnel-group 207.228.xx.xxtype ipsec-l2l
    tunnel-group 207.228.xx.xxgeneral-attributes
    default-group-policy GroupPolicy_207.228.xx.xx
    tunnel-group 207.228.xx.xxipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:f06bd1d6d063318339d98417b171175e
    : end
    Any ideas? Thanks.

    I looked over the config for Site A, but couldn't find anything unusual. Perhaps I'm overlooking something. Here is the config for site A:
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.2(1)
    hostname SiteA
    domain-name domain
    enable password POgOWyKyb0jgJ1Hm encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.254.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 192.168.2.6
    domain-name domain
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.14.0 255.255.254.0
    network-object 192.168.4.0 255.255.254.0
    network-object 192.168.6.0 255.255.254.0
    network-object 192.168.8.0 255.255.254.0
    object-group network DM_INLINE_NETWORK_2
    network-object 192.168.12.0 255.255.254.0
    network-object 192.168.14.0 255.255.254.0
    network-object 192.168.4.0 255.255.254.0
    network-object 192.168.6.0 255.255.254.0
    network-object 192.168.8.0 255.255.254.0
    access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.254.0 object-group DM_INLINE_NETWORK_1
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.254.0 object-group DM_INLINE_NETWORK_2
    access-list inside_nat0_outbound extended permit ip any 192.168.15.192 255.255.255.192
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.254.0 192.168.16.0 255.255.254.0
    access-list VPNGeo_splitTunnelAcl standard permit any
    access-list outside_2_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.6.0 255.255.254.0
    access-list outside_3_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.4.0 255.255.254.0
    access-list outside_4_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.8.0 255.255.254.0
    access-list outside_5_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.16.0 255.255.254.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool GeoVPNPool 192.168.15.200-192.168.15.254 mask 255.255.254.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable 444
    http 192.168.2.0 255.255.254.0 inside
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 207.228.xx.xx
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map 2 match address outside_2_cryptomap
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer 208.119.xx.xx
    crypto map outside_map 2 set transform-set ESP-3DES-SHA
    crypto map outside_map 3 match address outside_3_cryptomap
    crypto map outside_map 3 set pfs group1
    crypto map outside_map 3 set peer 208.119.xx.xx
    crypto map outside_map 3 set transform-set ESP-3DES-SHA
    crypto map outside_map 4 match address outside_4_cryptomap
    crypto map outside_map 4 set pfs
    crypto map outside_map 4 set peer 208.119.xx.xx
    crypto map outside_map 4 set transform-set ESP-3DES-SHA
    crypto map outside_map 5 match address outside_5_cryptomap
    crypto map outside_map 5 set pfs group1
    crypto map outside_map 5 set peer 70.64.xx.xx
    crypto map outside_map 5 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcp-client client-id interface outside
    dhcpd auto_config outside
    dhcpd address 192.168.2.100-192.168.2.254 inside
    dhcpd auto_config outside interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy VPNGeo internal
    group-policy VPNGeo attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPNGeo_splitTunnelAcl
    username user password shbn5zbLkuHP/mJX encrypted privilege 15
    username namepassword vP98Lj8Vm5SLs9PW encrypted
    username nameattributes
    vpn-group-policy VPNGeo
    tunnel-group 207.228.xx.xxtype ipsec-l2l
    tunnel-group 207.228.xx.xxipsec-attributes
    pre-shared-key *
    tunnel-group VPNGeo type remote-access
    tunnel-group VPNGeo general-attributes
    address-pool GeoVPNPool
    default-group-policy VPNGeo
    tunnel-group VPNGeo ipsec-attributes
    pre-shared-key *
    tunnel-group 208.119.xx.xxtype ipsec-l2l
    tunnel-group 208.119.xx.xxipsec-attributes
    pre-shared-key *
    tunnel-group 208.119.xx.xx type ipsec-l2l
    tunnel-group 208.119.xx.xx ipsec-attributes
    pre-shared-key *
    tunnel-group 208.119.xx.xxtype ipsec-l2l
    tunnel-group 208.119.xx.xxipsec-attributes
    pre-shared-key *
    tunnel-group 70.64.xx.xxtype ipsec-l2l
    tunnel-group 70.64.xx.xxipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:e3adf4e597198f58cd21e508aabdbab9
    : end

  • Can not ping internal network from ASA

    I can not ping internal computer from ASA. Comp IP address 192.168.187.15, gateway is 192.168.187.14 which is ASA internal interface. I've got an IP Phone connected to the same ASA with Ip address 192.168.185.15 and internal ASA interface 192.168.185.14 and everything works fine. We are doing testing, do not be surprised of configuration.
    ASA Version 8.2(1)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    dns-guard
    interface GigabitEthernet0/0
    nameif ouside3
    security-level 0
    ip address 10.254.17.25 255.255.255.248
    interface GigabitEthernet0/1
    nameif outside
    security-level 0
    ip address 10.254.17.9 255.255.255.248
    interface GigabitEthernet0/2
    nameif Lan
    security-level 100
    ip address 192.168.185.14 255.255.255.0
    interface GigabitEthernet0/3
    nameif comp
    security-level 50
    ip address 192.168.187.14 255.255.255.0
    interface Management0/0
    nameif management
    security-level 100
    no ip address
    management-only
    boot system disk0:/asa821-k8.bin
    ftp mode passive
    access-list 110 extended permit ip any any
    access-list nat extended permit ip any any
    access-list allow_ping extended permit icmp any any echo-reply
    access-list allow_ping extended permit icmp any any source-quench
    access-list allow_ping extended permit icmp any any unreachable
    access-list allow_ping extended permit icmp any any time-exceeded
    access-list allow_ping extended permit udp any any eq isakmp
    access-list allow_ping extended permit esp any any
    access-list allow_ping extended permit ah any any
    access-list allow_ping extended permit gre any any
    access-list nonat extended permit ip any any
    access-list nat2 extended permit ip any any
    access-list nonat2 extended permit ip any any
    pager lines 24
    logging asdm informational
    mtu ouside3 1500
    mtu outside 1500
    mtu Lan 1500
    mtu comp 1500
    mtu management 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (Lan) 0 access-list nonat
    nat (Lan) 1 access-list nat
    nat (comp) 0 access-list nonat
    nat (comp) 1 access-list nat
    access-group allow_ping in interface outside
    router eigrp 2008
    neighbor 10.254.17.10 interface outside
    network 10.254.17.8 255.255.255.248
    network 192.168.185.0 255.255.255.0
    network 192.168.187.0 255.255.255.0
    route outside 0.0.0.0 0.0.0.0 10.254.17.10 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mymap 10 match address 110
    crypto map mymap 10 set peer 10.254.17.10
    crypto map mymap 10 set transform-set myset
    crypto map mymap interface outside
    crypto map mymap2 20 match address 110
    crypto map mymap2 20 set peer 10.254.17.18
    crypto map mymap2 20 set transform-set myset
    crypto map mymap2 interface comp
    crypto map mymap3 30 match address 110
    crypto map mymap3 30 set peer 10.254.17.26
    crypto map mymap3 30 set transform-set myset
    crypto map mymap3 interface ouside3
    crypto isakmp identity address
    crypto isakmp enable ouside3
    crypto isakmp enable outside
    crypto isakmp enable comp
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    no crypto isakmp nat-traversal
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    priority-queue outside
    threat-detection basic-threat

    This is what I get, looks like ASA does not reply. Why?
    ciscoasa# sh capture cpi
    5 packets captured
    1: 05:20:14.494908 192.168.187.15 > 192.168.187.14: icmp: echo request
    2: 05:20:19.526935 192.168.187.15 > 192.168.187.14: icmp: echo request
    3: 05:20:25.026320 192.168.187.15 > 192.168.187.14: icmp: echo request
    4: 05:20:30.525699 192.168.187.15 > 192.168.187.14: icmp: echo request
    5: 05:20:36.025084 192.168.187.15 > 192.168.187.14: icmp: echo request

  • VPN - Can't ping the next hop

    Next some advise... i've configured a VPN server -pptp on my router,  create a vpn for client to site. At the moment, client computer can connect and established a connection to router. I can ping from client to router (192.168.5.1) but can't ping 192.168.5.2(switch) or 192.168.10.X (workstations)
    What i'm trying to achieve is to access the internal network (192.168.10.X) which is from the layer 3 switch's end. Any help/extra eye would be good.
    Here are my network design and config below:
    Client Computer ---> Internet ---> (1.1.1.1) Cisco Router 881 (192.168.5.1) ---> Dell Powerconnect 6248 switch (192.168.5.2) --> Workstation(192.168.10.x)
    Cisco 881 Router
    aaa new-model
    aaa authentication ppp default local
    vpdn enable
    vpdn-group PPTP-VPDN
    accept-dialin
    protocol pptp
    virtual-template 1
    interface FastEthernet0
    description Link to Switch
    switchport access vlan 5
    interface FastEthernet1
    no ip address
    interface FastEthernet2
    no ip address
    interface FastEthernet3
    switchport access vlan 70
    no ip address
    interface FastEthernet4
    description INTERNET WAN PORT
    ip address [EXTERNAL IP]
    ip nat outside
    ip virtual-reassembly in
    duplex full
    speed 100
    crypto map VPN1
    interface Vlan1
    no ip address
    interface Vlan5
    description $ES_LAN$
    ip address 192.168.5.1 255.255.255.248
    no ip redirects
    no ip unreachables
    ip nat inside
    ip virtual-reassembly in
    interface Vlan70
    ip address [EXTERNAL IP]
    ip virtual-reassembly in
    ip tcp adjust-mss 1452
    interface Virtual-Template1
    ip unnumbered FastEthernet4
    encapsulation ppp
    peer default ip address pool defaultpool
    ppp authentication chap ms-chap
    ip local pool defaultpool 192.168.10.200 192.168.10.210
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 600 life 86400 requests 10000
    ip nat inside source list NO-NAT interface FastEthernet4 overload
    ip route 0.0.0.0 0.0.0.0 [EXTERNAL IP]
    ip route 192.168.0.0 255.255.0.0 192.168.5.2
    ip access-list extended NO-NAT
    deny ip 192.168.0.0 0.0.255.255 10.1.0.0 0.0.255.255
    permit ip 192.168.0.0 0.0.255.255 any
    ip access-list extended VLAN70
    permit ip [EXTERNAL IP] 0.0.0.15 192.168.10.0 0.0.1.255
    permit tcp [EXTERNAL IP] 0.0.0.15 any eq smtp
    permit tcp [EXTERNAL IP] 0.0.0.15 any eq www
    permit tcp [EXTERNAL IP] 0.0.0.15 any eq 443
    permit tcp [EXTERNAL IP] 0.0.0.15 any eq domain
    permit udp [EXTERNAL IP] 0.0.0.15 any eq domain
    ip access-list extended VPN
    permit ip 192.168.10.0 0.0.1.255 10.1.0.0 0.0.1.255
    permit ip [EXTERNAL IP] 0.0.0.15 10.1.0.0 0.0.1.255
    ip access-list extended WAN
    Layer 3 Switch - Dell Powerconnect 6224
    ip routing
    ip route 0.0.0.0 0.0.0.0 192.168.5.1
    interface vlan 5
    name "Connect to Cisco Router"
    routing
    ip address 192.168.5.2 255.255.255.248
    exit
    interface vlan 10
    name "internal network"
    routing
    ip address 192.168.10.1 255.255.255.0
    exit
    interface ethernet 1/g12
    switchport mode acesss vlan 5
    exit
    interface ethernet 1/g29
    switchport mode access vlan 10
    exit

    Hi Samuel,
    I went through your configuration and picked up some problematic lines..
    First of all you can't have your vpn-pool to be in the 192.168.10.x/24 range because you already have that subnet used behind the switch ( this would only be possible if you had 192.168.10.x range directly connected to the router ). Also, you can't bind your Virtual Template to the WAN ip, it should bind to a interface with a subnet that includes your vpn-pool IP range.
    The cleanest way to do this is,
    Create a new loop back interface with a new subnet
    interface loopback 0
    ip address 192.168.99.1 255.255.255.0
    Have new vpn pool defined,
    ip local pool defaultpool 192.168.99.200 192.168.99.210
    Change your Template to point the new loopback interface,
    interface Virtual-Template1
    ip unnumbered loopback0
    encapsulation ppp
    peer default ip address pool defaultpool
    ppp authentication chap ms-chap
    All the vpn clients will get an IP from 192.168.99.200 192.168.99.210 range. And they will be able to get in to the router and up to the desired 192.168.10.x/24 range behind the router. Packets will get in to the switch and then in to the host. Host will reply through the gateway( switch ) -> router -> Client.
    PS: Earlier, even if your packets get to the host, the host will never try to send the reply packets back through the gateway ( switch ) because from its(hosts) point of view, the packet came from the same Lan, so the host will just try to "arp" for the senders MAC  and will eventually time out)
    Hope  this helps.
    Please don't forget to rate/mark helpful posts
    Shamal

  • Can't ping from DC1 behind TMG1 to DC2 behind TMG2 on a site-to-site VPN connection

    Hi,
    I have a weird problem. I have two TMG servers on each site in a hyper-v lab environment. I have been able to establish the site-to-site VPN successfully however when I ping from DC1 behind TMG1(on site 1) to TMG2, DC2, i am able to ping. However the opposite
    doesn't work. After some trial and error, I figured out that the one initiating the demand-dial request is able to ping the other site, not vice-versa..very strange. I would like to know whether ICMP requests could be achieved bi-directionally..
    Secondly, I am able to ping from TMG1 to all the clients sitting behind TMG2 (including the TMG host), however the clients sitting behind TMG1 can't ping TMG2 neither any of the clients behind it. I tried every possible combination under the firewall policies
    but of complete vain. hell, I am starting to develop a very bad feeling about this product because of making such simple tasks overly complex. I mean, if it were a Cisco or Sonicwall, we could have done this so easily. 
    What my final motive is to send LDAP requests from DC1 to DC2 and vice-versa over a site-to-site VPN so that I could set up 2 different sites in AD on different subnets and then proceed with configuring DAG. But if this simple thing turns out to be such
    major roadblock, dunno how am I gonna pass DAG traffic over it.
    Can someone PLEASE help me!! I am completely exhausted researching on this issue.
    Regards,
    Dman

    Hi，
    For site2site VPN, you must create proper network rule and network set and you need to create proper access rule to allow or deny the traffic between VPN network and any other network.
    http://technet.microsoft.com/en-us/library/bb838949.aspx
    Best Regards
    Quan Gu

Maybe you are looking for

  • My MAC won't display images from websites, all of a sudden. Any ideas?

    My e-mail works fine and includes pictures, but websites only download text.

  • TimesTen Release 11.2.1.8.0 (32 bit Linux/x86): PLSQL_MEMORY_ADDRESS

    Hi! I am trying to setup TT 11.2.1.8.0 (32 bit Linux/x86) with jboss-4.2.3.GA using JRockit JVM. The problem I get is: TT8517: Cannot attach PL/SQL shared memory; PLSQL_MEMORY_ADDRESS not valid or already in use -- file "db.c", lineno 9856, procedure

  • AAA/Radius failures

    Have a couple of switches setup for AAA/Radius (Microsoft IAS running Radius). All authentication fails when I configure it with a radius key (matching on switch and server). When I remove the key, I still cant authenticate with my domain credentials

  • Basic 1000v for Hyper-V questions

    Hi All, I have a Hyper-V 2012 R2 server (free version of Hyper-V) and I am in the process of deploying the Cisco 1000v virtual switch. I have a few questions, however: 1) My server has a single NIC with 4 uplinks. At the Hyper-V parent OS level, ther

  • Doing background processing in a servlet

    Hello folks I'm new here, I wonder if someone can give me an advice in an architecture problem I encountered. This text looks long, but the problem is quite simple � how to allow a servlet to do something independent by the doXXXX() methods invocatio