Cannot ping pc behind router in vpn connection

I have set up a vpn tunnel using two wrv200 vpn routers. The lan and wan connection works fine and the tunnel is connected successful between two locations. I can ping the remote wrv200 router from the opposite side. However, I cannot ping remote pcs connected to the router from other side. I can ping the pcs from the router on the same side. Does anyone experience the same problem? Any suggestion or solution to it? Please help!

windows firewall is disabled on the pcs. I can ping the pcs on the side from the router. If I can ping remote pc from the tunnel, then I shouldn't have any problem with the vpn connection. When I ping remote pc from opposite side through the tunnel, the Request time out message displays. The same to the tracert command.
routing table of router a
Destination LAN IP Subnet Mask Gateway Interface
203.98.129.239 255.255.255.255 0.0.0.0 WAN
192.168.2.0 255.255.255.0 0.0.0.0 LAN&Wireless
Default Route (*) 0.0.0.0 203.98.129.239 WAN
127.0.0.1 0.0.0.0 127.0.0.1 LOOPBACK
routing table of router b
203.98.129.226 255.255.255.255 0.0.0.0 WAN
192.168.0.0 255.255.255.0 0.0.0.0 LAN&Wireless
Default Route (*) 0.0.0.0 203.98.129.226 WAN
127.0.0.1 0.0.0.0 127.0.0.1 LOOPBACK

Similar Messages

  • Cisco UC560 Not Clearing Static Routes When VPN Connections Drop

    We have a Cisco UC560 (UC560-FXO-K9) running "Cisco IOS Software, UC500 Software (UC500-ADVIPSERVICESK9-M),
    Version 15.1(2)T2, RELEASE SOFTWARE (fc1)"  The issue is when we have end users connecting with the Cisco VPN Client to this device sometimes we are unable to connect to any devices on our LAN or sometimes we can't connect to the LAN on the other end of our site-to-site VPN.  The one symptom I've observed when this happens is that old VPN sessions that have disconnected appear to leave static routes from the user's outside IP at their home to an IP on our LAN to a Virtual-Access interface.  When this starts to happen, I restart the firewall to clear out the stale static routes and the problem is fixed, for a while at least.  Below is the current state where we have the site-to-site VPN connected to our branch office and 2 user's connected with Cisco VPN clients.  Below that is the static route table which has 5 total Virtual-Access interface routes (one is an extra route for a user currently connected so that their outside IP is in the static route table with 2 inside IP's associated.)  Is there a way to fix the cleanup of VPN connections when they terminate?
    #sh crypto isakmp peers
    Peer: <branch office outside IP> Port: 500 Local: <firewall's outside IP>
    Phase1 id: <branch office outside IP>
    Peer: <users's outside IP #1> Port: 50420 Local: <firewall's outside IP>
    Phase1 id: EZVPN_GRP_437
    Peer: <user's outside IP #2> Port: 49345 Local: <firewall's outside IP>
    Phase1 id: EZVPN_GRP_437
    Bugsy#sh ip ro st
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
           + - replicated route, % - next hop override
    Gateway of last resort is <next hop of ISP for firewall> to network 0.0.0.0
    S*    0.0.0.0/0 [1/0] via <next hop of ISP for firewall>
          10.0.0.0/8 is variably subnetted, 12 subnets, 3 masks
    S        10.0.0.153/32 [1/0] via <non-connected IP of VPN user>, Virtual-Access2
    S        10.0.0.155/32 [1/0] via <non-connected IP of VPN user>, Virtual-Access2
    S        10.0.0.156/32 [1/0] via <user's outside IP #2>, Virtual-Access3
    S        10.0.0.158/32 [1/0] via <user's outside IP #1>, Virtual-Access3
    S        10.0.0.159/32 [1/0] via <user's outside IP #2 again>, Virtual-Access2
    S        10.1.10.1/32 is directly connected, Vlan90

    Hi Brian,
    This sounds like you are running into the following known issue:
      CSCtl03682 - EzVPN client: Several RRI routes  pointing to same virtual interface
    which is Dup'd to:
      CSCtf39056 - RRI routes not deleted
    This is fixed since 15.1(2)T4, so I would recommend upgrading to SWP 8.2 or higher.  The only other way to clean up the stuck routes is to reload the router.
    Thanks,
    Brandon

  • Cisco 1941w --cannot ping bvi1 from router

    I have  vlan 1 in 192.168.5.1 255.255.255.0 and bvi1 192.168.5.2 255.255.255.0. It was working before but something happened and I cannot figureout what. Vlan1 cannot ping bvi and viceversa. I need some help. Thank you!           

    Can you please lost the config of the router and AP?
    Steve
    Sent from Cisco Technical Support iPhone App

  • VPN connection drops after 1 minute or less

    Hi All,
    not sure if this is a server-side or client-side issue. Trying to establish a VPN connection from an MBP to my Mac Mini server (L2TP over IPSec, Shared Secret w/ Password authentication) I manage to connect, authenticate and establish a connection. However, after about 45-60 seconds I see no more traffic (from the remote LAN) coming through to the MBP. The status indicator still shows that the tunnel is up but I just don't get any further response from the server. I can still get to the web, however, the traceroute seems to indicate that this traffic is flowing outside the VPN tunnel (whether the "Send all traffic over VPN connection" option on the MBP is selected or not).
    I've tried this with all combinations of 10.6.5 and 10.6.6 to no avail. It is possible to keep the tunnel alive just a little longer if I keep a ping to the server going on the MBP, but this eventually gets lost as well.
    I've determined that there are some changes in the routing tables on the MBP whilst this is going on:
    Last login: Thu Jan 20 09:45:37 on ttys001
    guava:~ mark$ netstat -rn
    Routing tables
    ## Normal Connection
    Internet:
    Destination Gateway Flags Refs Use Netif Expire
    default 10.149.16.1 UGSc 13 0 en1
    10.149.16/22 link#6 UCS 2 0 en1
    10.149.16.1 0:0:5e:0:1:8e UHLWI 13 17 en1 1038
    10.149.18.96 127.0.0.1 UHS 0 0 lo0
    10.149.19.255 ff:ff:ff:ff:ff:ff UHLWbI 0 6 en1
    127 127.0.0.1 UCS 0 0 lo0
    127.0.0.1 127.0.0.1 UH 0 176 lo0
    169.254 link#6 UCS 0 0 en1
    192.168.0 link#8 UC 1 0 vmnet8
    192.168.0.255 ff:ff:ff:ff:ff:ff UHLWbI 0 6 vmnet8
    192.168.106 link#7 UC 1 0 vmnet1
    192.168.106.255 ff:ff:ff:ff:ff:ff UHLWbI 0 6 vmnet1
    guava:~ mark$ netstat -rn
    Routing tables
    ## VPN Connection Alive
    Internet:
    Destination Gateway Flags Refs Use Netif Expire
    default 10.149.16.1 UGSc 2 0 en1
    default 192.168.1.180 UGScI 0 0 ppp0
    10.149.16/22 link#6 UCS 3 0 en1
    10.149.16.1 0:0:5e:0:1:8e UHLWI 3 0 en1 1198
    10.149.18.96 127.0.0.1 UHS 0 0 lo0
    10.149.19.255 ff:ff:ff:ff:ff:ff UHLWbI 1 8 en1
    xx.xxx.xxx.xxx 10.149.16.1 UGHS 1 34 en1
    127 127.0.0.1 UCS 0 0 lo0
    127.0.0.1 127.0.0.1 UH 0 176 lo0
    169.254 link#6 UCS 0 0 en1
    192.168.0 link#8 UC 1 0 vmnet8
    192.168.0.255 ff:ff:ff:ff:ff:ff UHLWbI 0 6 vmnet8
    192.168.1 ppp0 USc 0 0 ppp0
    192.168.1.180 192.168.1.160 UH 7 33 ppp0
    192.168.106 link#7 UC 1 0 vmnet1
    192.168.106.255 ff:ff:ff:ff:ff:ff UHLWbI 0 6 vmnet1
    guava:~ mark$ netstat -rn
    Routing tables
    ## VPN Connection but no net traffic coming back from server
    Internet:
    Destination Gateway Flags Refs Use Netif Expire
    default 10.149.16.1 UGSc 11 0 en1
    default 192.168.1.180 UGScI 0 0 ppp0
    10.149.16/22 link#6 UCS 1 0 en1
    10.149.16.1 0:0:5e:0:1:8e UHLWI 13 0 en1 1154
    10.149.18.96 127.0.0.1 UHS 0 0 lo0
    xx.xxx.xxx.xxx 10.149.16.1 UGHS 2 1644 en1
    127 127.0.0.1 UCS 0 0 lo0
    127.0.0.1 127.0.0.1 UH 0 176 lo0
    169.254 link#6 UCS 0 0 en1
    192.168.0 link#8 UC 0 0 vmnet8
    192.168.1 ppp0 USc 1 0 ppp0
    192.168.1.180 192.168.1.160 UH 21 1635 ppp0
    192.168.106 link#7 UC 0 0 vmnet1
    The MBP is connected via WiFi to a router which gives it 10.149.18.96. The remote network is on 192.168.1.0/24. The VPN server (as well as the DNS and DHCP server) are on machine 192.168.1.180 (the Mac Mini).
    Neither the MBP nor the server logs really contain anything useful which would indicate why this is failing.
    It looks as though this issue has been there for quite a long time in some form:
    - http://discussions.apple.com/thread.jspa?threadID=1208715
    - http://discussions.apple.com/message.jspa?messageID=10958263
    - http://discussions.apple.com/thread.jspa?threadID=2462874
    This is incredibly frustrating and I cannot understand while Apple has not done anything about this. Is there anyone here that is having the same problem and has possibly made some headway on this? Any suggestions would be highly appreciated!
    Thanks.
    Mark

    First guess would be a faulty Openreach VDSL modem (the white box).
    Call 0800 111 4567, explain the problem. Be polite but firm and insist on an engineer visit. The engineer will test the line and probably replace the modem.

  • 2851 router vpn to 851 router lan clients cannot ping

    Greets - I'm expanding my lab experience by adding a 2851 router to my mix of 18xx and 851/871 units. Some of this infrastructure is in production, some just lab work. I have established good connectivity between 18xx's and 851/871's with IPSEC VPNs (site-to-site static and dynamic), but my problem is with adding in a 2851.
    Setup: 2851 with 12.4 ADVENTK9, WAN on GE0/0 as 216.189.223.bbb/26, LAN on GE0/1 as 172.20.0.1/20 (VPN module, but no additional HWIC modules)
    851 with 12.4 ADVENTK9, WAN on FE4 as 216.53.254.aaa/24, LAN on FE0..3 via BVI1 as 172.21.1.1/24
    The two router WAN ports are bridged via a 3rd router (a Zywall with 216.0.0.0/8 route, with the router at 216.1.1.1) affectionately called the "InterNOT", which provides a surrogate to the great web, minus actual other hosts and dns, but it doesn't matter. As both my WAN addresses are within 216.x.x.x, this works quite well. This surrogate has tested fine and is known to not be part of a problem.
    The 851 has been tested against another 851 with complementary setup and a successful VPN can run between the two.
    I have good LAN-WAN connections on each router. I do have a "Good" VPN connection between the two routers.
    The problem: I cannot ping from a LAN host on 172.20.x.x on the 2851 to any 172.21.1.x (eg 172.21.1.1) host on the 851, and vice versa.
    From a LAN host, I can ping to my InterNOT - for example a dhcp host 172.20.6.2 on the 2851 LAN can ping 216.1.1.1 fine. I can also ping the 851's WAN address at 216.53.254.aaa.
    To complicate matters, if I connect to the routers via console, I CAN ping across the vpn to the destination LAN hosts, in both directions.
    This seems to indicate that there is a bridging problem between the LAN interfaces to the VPN interfaces. I suspect this is a config problem on the 2851, as I have had a similar config working on my 851 to 851 site-to-site setups. I also suspect it is in the 2851's config as I'm still just starting out with this particular router.
    So some stripped-down configs:
    For the 2851:
    no service config
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname router2851
    boot-start-marker
    boot-end-marker
    no logging buffered
    no logging console
    enable password mypassword2
    no aaa new-model
    dot11 syslog
    no ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 172.20.0.1 172.20.6.1
    ip dhcp excluded-address 172.20.6.254 172.20.15.254
    ip dhcp pool Internal_2000
       import all
       network 172.20.0.0 255.255.240.0
       domain-name myseconddomain.int
       default-router 172.20.0.1
       lease 7
    no ip domain lookup
    multilink bundle-name authenticated
    voice-card 0
     no dspfarm
    crypto pki <<truncated>>
    crypto pki certificate chain TP-self-signed-2995823027
     <<truncated>>
          quit
    username myusername privilege 15 password 0 mypassword2
    archive
     log config
      hidekeys
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp key mysharedkey address 216.53.254.aaa
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
     description Tunnel to216.53.254.aaa
     set peer 216.53.254.aaa
     set transform-set ESP-3DES-SHA
     match address 100
    interface GigabitEthernet0/0
     description $ETH-WAN$
     ip address 216.189.223.bbb 255.255.255.192
     ip nat outside
     ip virtual-reassembly
     duplex auto
     speed auto
     crypto map SDM_CMAP_1
     no shut
    interface GigabitEthernet0/1
     description $FW_INSIDE$$ETH-LAN$
     ip address 172.20.0.1 255.255.240.0
     ip nat inside
     ip virtual-reassembly
     no ip route-cache
     duplex auto
     speed auto
     no mop enabled
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
    ip http server
    ip http authentication local
    ip http secure-server
    ip dns server
    ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.20.0.0 0.0.15.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
    access-list 101 permit ip 172.20.0.0 0.0.15.255 any
    route-map SDM_RMAP_1 permit 1
     match ip address 101
    control-plane
    banner motd ~This is a private computer system for authorized use only. And Stuff~
    line con 0
    line aux 0
    line vty 0 4
     privilege level 15
     password mypassword
     login local
     transport input telnet ssh
    scheduler allocate 20000 1000
    end
    And for the 851:
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname router851
    boot-start-marker
    boot-end-marker
    logging buffered 52000 debugging
    no logging console
    enable password mypassword
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa session-id common
    resource policy
    clock timezone PCTime -5
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    no ip dhcp use vrf connected
    ip dhcp excluded-address 172.21.1.1 172.21.1.100
    ip dhcp pool Internal_2101
       import all
       network 172.21.1.0 255.255.255.0
       default-router 172.21.1.1
       domain-name mydomain.int
       dns-server 172.21.1.10
       lease 4
    ip cef
    ip domain name mydomain.int
    ip name-server 172.21.1.10
    crypto pki <<truncated>>
    crypto pki certificate chain TP-self-signed-3077836316
     <<truncated>>
      quit
    username myusername privilege 15 password 0 mypassword2
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp key mysharedkey address 216.189.223.aaa
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
     description Tunnel to216.189.223.bbb
     set peer 216.189.223.bbb
     set transform-set ESP-3DES-SHA2
     match address 100
    bridge irb
    interface FastEthernet0
     spanning-tree portfast
    interface FastEthernet1
     spanning-tree portfast
    interface FastEthernet2
     spanning-tree portfast
    interface FastEthernet3
     spanning-tree portfast
    interface FastEthernet4
     description $ETH-WAN$
     ip address 216.53.254.aaa 255.255.254.0
     ip nat outside
     ip virtual-reassembly
     ip tcp adjust-mss 1460
     duplex auto
     speed auto
     no cdp enable
     crypto map SDM_CMAP_1
     no shut
    interface Vlan1
     description Internal Network
     no ip address
     ip nat inside
     ip virtual-reassembly
     bridge-group 1
     bridge-group 1 spanning-disabled
    interface BVI1
     description Bridge to Internal Network
     ip address 172.21.1.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    ip route 0.0.0.0 0.0.0.0 FastEthernet4
    ip route 172.21.1.0 255.255.255.0 BVI1
    ip http server
    ip http secure-server
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.21.1.0 0.0.0.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.21.101.0 0.0.0.31
    access-list 101 permit ip 172.21.1.0 0.0.0.255 any
    route-map SDM_RMAP_1 permit 1
     match ip address 101
    control-plane
    bridge 1 route ip
    banner motd ~This is a private computer system for authorized use only. And Stuff.~
    line con 0
     password mypassword
     no modem enable
    line aux 0
    line vty 0 4
     password mypassword
    scheduler max-task-time 5000
    end
    Note that the above are somewhat stripped-down configs, without firewall or WAN ACL's - interestingly my default WAN-Inbound ACLs seem to break connectivity when included, so I realize I have some more cleanup to do there, but the 2851 LAN bridging seems to be what I should concentrate on first.
    I'm still googling some of the particulars with the 2851, but any assistance is appreciated.
    Regards,
    Ted.

    Hi,
    First,please delete NAT.If we configured the NAT in the RRAS,the source IP address in all packets sent to 192.168.1.0/24 would be translated to 192.168.1.224.
    Second,please enable the LAN routing in RRAS server.To enable LAN routing,please follow the steps below,
    1.In the RRAS server,Open Routing and Remote Access.
    2.Right-click the server name,then click
    properties.
    3.On the General tab,select
    IPv4 Router check box,and then click Local area network(LAN) routing only.
    Then,announce the 172.16.0.0 network to the router.
    To learn more details about enabling LAN routing, please refer to the link below,
    http://technet.microsoft.com/en-us/library/dd458974.aspx
    Best Regards,
    Tina

  • Cant ping behind cisco router (site2site vpn)

    Dears;
    After configure site to site vpn between cisco router and fortigate firewall,
    site A : 10.0.0.0/24     behind fortigate
    site B: 10.10.10.0/24  behind cisco router
    the tunnel is up and I can ping 10.0.0.1 from site B and can ping 10.10.10.1 from site A but I cant ping any ip inside 10.0.0.0/24 form site B or network 10.10.10.0/24 from site A
    my cisco router configuration is
    Current configuration : 2947 bytes
    ! No configuration change since last restart
    version 15.1
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    boot-start-marker
    boot-end-marker
    enable secret 4 EE103as6FtdocdBefpgugX6P9eGaDKDyBvwz7AywH5Q
    no aaa new-model
    memory-size iomem 10
    clock timezone cairo 2 0
    crypto pki token default removal timeout 0
    ip source-route
    ip dhcp excluded-address 192.168.16.1
    ip dhcp excluded-address 10.10.10.1 10.10.10.10
    ip dhcp pool GUEST
     network 192.168.16.0 255.255.255.0
     default-router 192.168.16.1
     dns-server 8.8.8.8 8.8.4.4
    ip dhcp pool LAN
     network 10.10.10.0 255.255.255.0
     default-router 10.10.10.1
     dns-server 8.8.8.8 8.8.4.4
    ip cef
    controller VDSL 0
    ip ssh version 2
    crypto isakmp policy 10
     encr aes
     hash sha256
     authentication pre-share
     group 5
    crypto isakmp key 6 *********** address 4.x.x.x no-xauth
    crypto ipsec transform-set myset esp-aes esp-sha256-hmac
    crypto map kon-map 10 ipsec-isakmp
     set peer 4.x.x.x
     set transform-set myset
     set pfs group5
     match address 105
    interface Ethernet0
     no ip address
     no fair-queue
    interface ATM0
     no ip address
     ip mtu 1452
     ip tcp adjust-mss 1452
     no atm ilmi-keepalive
    interface ATM0.1 point-to-point
     ip flow ingress
     pvc 0/35
      encapsulation aal5snap
      pppoe-client dial-pool-number 1
    interface FastEthernet0
     switchport mode trunk
     no ip address
    interface FastEthernet1
     no ip address
    interface FastEthernet2
     switchport access vlan 2
     no ip address
    interface FastEthernet3
     no ip address
    interface Vlan1
     ip address 10.10.10.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface Vlan2
     ip address 192.168.16.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface Dialer1
     ip address negotiated
     ip mtu 1492
     ip nat outside
     ip virtual-reassembly in
     encapsulation ppp
     ip tcp adjust-mss 1452
     dialer pool 1
     ppp authentication chap pap callin
     ppp chap hostname
     ppp chap password 0
     ppp pap sent-username
     crypto map kon-map
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat inside source list 100 interface Dialer1 overload
    ip route 0.0.0.0 0.0.0.0 Dialer1
    access-list 100 deny   ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
    access-list 100 permit ip 10.10.10.0 0.0.0.255 any
    access-list 100 permit ip 192.168.16.0 0.0.0.255 any
    access-list 105 permit ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
    banner motd ^C^C
    end
    when ping from cisco router
    konsuler#ping 10.0.0.27 source vlan1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.0.0.27, timeout is 2 seconds:
    Packet sent with a source address of 10.10.10.1
    Success rate is 0 percent (0/5)
    help please

    Thank you karsten
    I can ping interface of router from remote site but cant ping any device behind the router and can ping firewall interface but cant ping any device behind the firewall
    -counters in
    # sh crypto ipsec sa
    increased only while ping 10.0.0.1 or 10.10.10.1 from both sides
    r#show crypto session detail
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection     
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation     
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Dialer1
    Uptime: 00:03:12
    Session status: UP-ACTIVE     
    Peer: 4.x.x.x port 500 fvrf: (none) ivrf: (none)
          Phase1_id: 4.x.x.x
          Desc: (none)
      IKEv1 SA: local 6.x.x.x/500 remote 4.x.x.x/500 Active
              Capabilities:(none) connid:2001 lifetime:22:39:59
      IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0 10.0.0.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 9 drop 0 life (KB/Sec) 4605776/3407
            Outbound: #pkts enc'ed 14 drop 0 life (KB/Sec) 4605775/3407

  • Aiport Extreme cannot establish VPN connection through router must bypass

    Hello - I own an Airport Extreme with the latest firmware update. I cannot connect to my work VPN through the Airport Extreme router. If I bypass the router and connect directly to my modem the VPN works fine. My VPN connections also work fine in any other internet hotspot. Any ideas Apple folks? I am using MacPro, and MacBook with bootcamp MacOSX and Windows XP Pro.

    My workaround was taking the router back and getting a D-Link router.  Had it set up in 10 minutes with the VPN working, and staying connected.  I agree, there is something with the firmware on the router.  Good luck!

  • ASA 5505 8.2 - SSL VPN - Cannot Ping inside host's

    Hello All,
    I'm an ASA Newb. 
    I feel like I have tried everything posted and still no success.
    PROBLEM:  When connected to the SSL VPN I cannot ping any internal host's.  I cannot ping anything on this inside?
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.2(5)
    hostname MCASA01
    domain-name mydomain.org
    enable password xxbtzv6P4Hqevn4N encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.2.0 VLAN
    name 192.168.5.0 VPNPOOL
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ddns update hostname MC_DNS
    dhcp client update dns server both
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    no forward interface Vlan1
    nameif outside
    security-level 0
    ip address 11.11.11.202 255.255.255.252
    interface Vlan3
    no nameif
    security-level 50
    ip address 192.168.2.1 255.255.255.0
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name mydomain.org
    access-list SPLIT-TUNNEL standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNPOOL 192.168.5.1-192.168.5.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 74.7.217.201 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    subject-name CN=vpn.mydomain.org,OU=IT,O="mydomain",C=US,St=CA,L=Chino
    keypair digicert.key
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 00b63edadf5efa057ea49da56b179132e8
        3082051c 30820404 a0030201 02021100 b63edadf 5efa057e a49da56b 179132e8
        300d0609 2a864886 f70d0101 05050030 72310b30 09060355 04061302 4742311b
        30190603 55040813 12477265 61746572 204d616e 63686573 74657231 10300e06
        03550407 13075361 6c666f72 64311a30 18060355 040a1311 434f4d4f 444f2043
        41204c69 6d697465 64311830 16060355 0403130f 45737365 6e746961 6c53534c
        20434130 1e170d31 33313130 35303030 3030305a 170d3134 30323033 32333539
        35395a30 52312130 1f060355 040b1318 446f6d61 696e2043 6f6e7472 6f6c2056
        616c6964 61746564 3111300f 06035504 0b130846 72656520 53534c31 1a301806
        03550403 13117670 6e2e6d65 74726f63 656c6c2e 6f726730 82012230 0d06092a
        864886f7 0d010101 05000382 010f0030 82010a02 82010100 a0d97d51 fcd18293
        eaf8e9b2 d632b2e3 e4d92eb1 5b639766 52677a26 2aa7d09d 437be3b6 dfb8649c
        4d715278 e1745955 27e8aab2 9c9da997 694a73e8 c1c426f3 a519adba acc2ad94
        aa0e09af 6db7bfc6 bad90bf2 b057dc56 c69a4276 1b826c83 6cd7ae09 af39bd7d
        4abe60b4 9b04613a 287a1ae6 9d117d05 c7cdc15f 09d588b0 fcc05c47 c1cb6d67
        c3701389 d3b7691d b05ff82c b0be475d 746a4916 0bbf11a6 7ee1b7ec bd05e1d2
        dda305a6 918bfd35 17447b04 bca1e6d9 10955649 d8211878 168c4c21 279a6584
        4b560a9f 414aea15 91e21581 a71d6b98 86d9eac3 47ea3a1d a172c71a ecf77aaa
        536d73e4 bc53eb68 c7bfacdd fab87ea5 121baf55 067dbd19 02030100 01a38201
        cb308201 c7301f06 03551d23 04183016 8014dacb eaad5b08 5dccfffc 2654ce49
        e555c638 f4f8301d 0603551d 0e041604 14fabb1d f439c41f e59207c7 202c2fda
        b46bcacc ee300e06 03551d0f 0101ff04 04030205 a0300c06 03551d13 0101ff04
        02300030 34060355 1d25042d 302b0608 2b060105 05070301 06082b06 01050507
        0302060a 2b060104 0182370a 03030609 60864801 86f84204 01304f06 03551d20
        04483046 303a060b 2b060104 01b23101 02020730 2b302906 082b0601 05050702
        01161d68 74747073 3a2f2f73 65637572 652e636f 6d6f646f 2e636f6d 2f435053
        30080606 67810c01 0201303b 0603551d 1f043430 323030a0 2ea02c86 2a687474
        703a2f2f 63726c2e 636f6d6f 646f6361 2e636f6d 2f457373 656e7469 616c5353
        4c43412e 63726c30 6e06082b 06010505 07010104 62306030 3806082b 06010505
        07300286 2c687474 703a2f2f 6372742e 636f6d6f 646f6361 2e636f6d 2f457373
        656e7469 616c5353 4c43415f 322e6372 74302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e63 6f6d6f64 6f63612e 636f6d30 33060355 1d11042c
        302a8211 76706e2e 6d657472 6f63656c 6c2e6f72 67821577 77772e76 706e2e6d
        6574726f 63656c6c 2e6f7267 300d0609 2a864886 f70d0101 05050003 82010100
        2484b72c 56161585 c9caa1a3 43cbc754 d3b43cef 7902a775 d40d064f 6918d52f
        0aaaea0c ad873124 11b68847 406812da fd0c5d71 6e110898 1ebddcab ddf980e4
        b95be4e2 0633cc23 7a4cbc27 f1f5e4e8 1de3c127 2b28a364 f1f26764 98afe871
        45547855 c0ceaf39 256f46db 4ac412a7 2b594817 a967ba5a 24986b24 57002ce4
        f046c6b3 5f7c9cc2 e6cd8ede 8fbcac60 b87fd497 71328783 8b148f7f affec249
        191c460b 3d46d352 0651f35e 96a60fbe 7b22e057 06aa7722 da447cd3 0ea72e7f
        5ec8c13c b550f502 b020efdc 35f62b89 52d7e6e3 14ade632 802dee70 1cdbf7ad
        a39a173b 916406e4 887ba623 4813b925 8a63a300 fd016981 a8d70651 a736267a
      quit
    no crypto isakmp nat-traversal
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 66.180.96.12 64.238.96.12 interface inside
    dhcpd lease 86400 interface inside
    dhcpd ping_timeout 4000 interface inside
    dhcpd domain mydomain.org interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 64.147.116.229 source outside
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy VPNGP internal
    group-policy VPNGP attributes
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    username GaryC password TGbvzEO3d6HlfU66 encrypted privilege 15
    username GaryC attributes
    vpn-group-policy VPNGP
    tunnel-group MCVPN type remote-access
    tunnel-group MCVPN general-attributes
    address-pool VPNPOOL
    default-group-policy VPNGP
    tunnel-group MCVPN webvpn-attributes
    group-alias MCVPN enable
    group-url https://11.11.11.202/MCVPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:1e950c041cc2c25116d30e5c884abbfc
    : end
    My goal is to allow Remote Users to RDP(3389) through VPN.
    Thank you,
    Gary
    Message was edited by: Gary Culwell

    Hello Jon,
      Thank you so much for your response. Clients will not be connect to a specific RDP server.  I was hoping if we were to establish a VPN Client tunnel I would like that tunnel to provide full local are access.  So the way the clients are used to is while in the field they use RDP to connect to their desktops on the internal LAN.
    Would you say this would work:
    route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
    Do you have examples?
    Thank you,
    Gary

  • I cannot establish VPN connection with rv120w to shrew soft client

    1. I bought 2 rv120w router and install one direct to WAN and one behind router-hub.
    2. one behind router is set DMZ, and each are conneted Site to Site vpn
    3. I need to connect each site with my mobile devices(1 notebook, 2 Win8 tablets, 2 android devices )
    4. i use wibro mobile router, win8 devices're behind router, and their fort is fowarded(DMZ)
    5. I'll take care of Android devices later, here now, my trouble is Win8 devices
    6. i installed cisco QuickVPN software. frankly,that software is shit. i don't know why but it even cannot reach router, no log generated on rv120w. and i dont want PPTP connection. sorry for criticism but I'm sure many of QuickVPN users(and people who fail to be a user) agree with me. it's 2014. not 1998.
     Cisco should be shamed for that software. it looks like a second grade collage student's 2nd semester project(Many of them're batter nowadays.) and doesn't work.
    more amazing fact is that's only software that RV series provides officialy. What the...so in conclusion, Cisco does not provide any IPSec client connection tool at all. does that makes any sense?
    7. i tried 10 or more hours to make IPSec client connection with many vpn client soft ware, this is my closest shot.
    RV120W log : 
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Configuration found for 175.xxx.xxx.xxx[500].
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received request for new phase 1 negotiation: 11x.xxx.xxx.xxx[500]<=>175.xxx.xxx.xxx[500]
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Beginning Aggressive mode.
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received Vendor ID: RFC 3947
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received Vendor ID: DPD
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received Vendor ID: DPD
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received Vendor ID: CISCO-UNITY
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  Received unknown Vendor ID
    2014-10-02 15:03:05: [rv120w][IKE] INFO:  For 175.xxx.xxx.xxx[500], Selected NAT-T version: RFC 39472014-10-02 15:03:06: [rv120w][IKE] INFO:  Floating ports for NAT-T with peer 175.xxx.xxx.xxx[4500]
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  NAT-D payload does not match for 11x.xxx.xxx.xxx[4500]
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  NAT-D payload does not match for 175.xxx.xxx.xxx[4500]
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  NAT detected: Local is behind a NAT device. and alsoPeer is behind a NAT device
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  Sending Xauth request to 175.xxx.xxx.xxx[4500]
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  ISAKMP-SA established for 11x.xxx.xxx.xxx[4500]-175.xxx.xxx.xxx[4500] with spi:90dd9f6bf4d51d95:70f7c62456edef9e
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  Received attribute type "ISAKMP_CFG_REPLY" from 175.xxx.xxx.xxx[4500]
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  Login succeeded for user "fxxxxxxxxX1"
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  Received attribute type "ISAKMP_CFG_REQUEST" from 175.xxx.xxx.xxx[4500]
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] WARNING:  Ignored attribute 5
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] WARNING:  Ignored attribute 28678
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] ERROR:  Local configuration for 175.xxx.xxx.xxx[4500] does not have mode config
    2014-10-02 15:03:06: [rv120w][IKE] INFO:  Purged ISAKMP-SA with proto_id=ISAKMP and spi=90dd9f6bf4d51d95:70f7c62456edef9e.
    2014-10-02 15:03:07: [rv120w][IKE] INFO:  ISAKMP-SA deleted for 11x.xxx.xxx.xxx[4500]-175.xxx.xxx.xxx[4500] with spi:90dd9f6bf4d51d95:70f7c62456edef9e
    Phase 1 Setting
    Selected IKE Policy View
    General
    Policy Name
    FDCStD
    Direction / Type
    Responder
    Exchange Mode
    Aggresive
    Enable XAUTH Client
    Local Identification
    Identifier Type
    Local Wan IP
    FQDN
    112.167.xxx.xxx
    Peer IKE Identification
    Identifier Type
    Remote Wan IP
    FQDN
    175.xxx.xxx.xxx
    IKE SA Parameters
    Encryption Algorithm
    3DES
    Authentication Algorithm
    SHA-1
    Authentication Method
    Pre-Shared Key
    Pre-Shared Key
    qpwoeiruty
    Diffie-Hellman (DH) Group
    Group 2 (1024bit )
    SA-Lifetime
    28800 Seconds
    Phase2 setting
    Add / Edit VPN Policy Configuration
    Policy Name
    Policy Type
                                 Auto Policy                             Manual Policy                             
    Remote Endpoint
                                 IP Address                             FQDN                             
    NETBIOS
    Enable
    Local Traffic Selection
    Local IP
                                 Any                             Single                             Range                             Subnet                             
    Start Address
    End Address
    Subnet Mask
    Remote Traffic Selection
    Remote IP
                                     Any                                 Single                                    Range                                 Subnet                             
    This field is not editable, because netbios is selected.
    Start Address
    End Address
    Subnet Mask
    Split DNS
    Split DNS
    Enable
    Domain Name Server 1
    Domain Name Server 2
    (Optional)
    Domain Name 1
    Domain Name 2
    (Optional)
    Manual Policy Parameters
    SPI-Incoming
    SPI-Outgoing
    Encryption Algorithm
                                 3DES                             None                             DES                             AES-128                             AES-192                             AES-256                             AES-CCM                             AES-GCM                             
    Key-In
    Key-Out
    Integrity Algorithm
                                 SHA-1                             SHA2-256                             SHA2-384                             SHA2-512                             MD5                             
    Key-In
    Key-Out
    Auto Policy Parameters
    SA-Lifetime
                                 Seconds                             KBytes                             
    Encryption Algorithm
                                 3DES                             None                             DES                             AES-128                             AES-192                             AES-256                             AES-CCM                             AES-GCM                                                        
    Integrity Algorithm
                                 SHA-1                             SHA2-256                             SHA2-384                             SHA2-512                             MD5                             
    PFS Key Group
    Enable
                                 DH-Group 1 (768 bit)                             DH-Group 2 (1024 bit)                             DH-Group 5 (1536 bit)                             
    Select IKE Policy
                                                              FDCStSFKS                                                                                      FDCStD                                                                                      
    Shres client setting 
    Phase 1 Setting
    Selected IKE Policy View
    General
    Policy Name
    FDCStD
    Direction / Type
    Responder
    Exchange Mode
    Aggresive
    Enable XAUTH Client
    Local Identification
    Identifier Type
    Local Wan IP
    FQDN
    112.167.xxx.xxx
    Peer IKE Identification
    Identifier Type
    Remote Wan IP
    FQDN
    175.xxx.xxx.xxx
    IKE SA Parameters
    Encryption Algorithm
    3DES
    Authentication Algorithm
    SHA-1
    Authentication Method
    Pre-Shared Key
    Pre-Shared Key
    qpwoeiruty
    Diffie-Hellman (DH) Group
    Group 2 (1024bit )
    SA-Lifetime
    28800 Seconds
    Phase2 setting
    Add / Edit VPN Policy Configuration
    Policy Name
    Policy Type
                                 Auto Policy                             Manual Policy                             
    Remote Endpoint
                                 IP Address                             FQDN                             
    NETBIOS
    Enable
    Local Traffic Selection
    Local IP
                                 Any                             Single                             Range                             Subnet                             
    Start Address
    End Address
    Subnet Mask
    Remote Traffic Selection
    Remote IP
                                     Any                                 Single                                    Range                                 Subnet                             
    This field is not editable, because netbios is selected.
    Start Address
    End Address
    Subnet Mask
    Split DNS
    Split DNS
    Enable
    Domain Name Server 1
    Domain Name Server 2
    (Optional)
    Domain Name 1
    Domain Name 2
    (Optional)
    Manual Policy Parameters
    SPI-Incoming
    SPI-Outgoing
    Encryption Algorithm
                                 3DES                             None                             DES                             AES-128                             AES-192                             AES-256                             AES-CCM                             AES-GCM                             
    Key-In
    Key-Out
    Integrity Algorithm
                                 SHA-1                             SHA2-256                             SHA2-384                             SHA2-512                             MD5                             
    Key-In
    Key-Out
    Auto Policy Parameters
    SA-Lifetime
                                 Seconds                             KBytes                             
    Encryption Algorithm
                                 3DES                             None                             DES                             AES-128                             AES-192                             AES-256                             AES-CCM                             AES-GCM                                                        
    Integrity Algorithm
                                 SHA-1                             SHA2-256                             SHA2-384                             SHA2-512                             MD5                             
    PFS Key Group
    Enable
                                 DH-Group 1 (768 bit)                             DH-Group 2 (1024 bit)                             DH-Group 5 (1536 bit)                             
    Select IKE Policy
                                                              FDCStSFKS                                                                                      FDCStD                                                                                      
    Shres client setting 
    8. in rv120w setting for advanced seup> Policy Type>
    there's two option FQDN and IP Adress
     when I'm in none static IP Adress environment, how should I set that field?
    RV120w do not support none static IP Adress?

    Hi kastwf001,
    My name is Mehdi from Cisco Technical Support, just want to inform you regarding QuickVPN is an light software using IPsec service of windows, so here it depend of windows and firewall ... IPsec setting on windows, encryption ... 
    anyhow for RV120W it's open for 3rd party software as ShrewVPN , TheGreenBow ... and working as expected since those software are using their ip sec services ..
    Please follow configuration steps on RV120W and ShrewVPN (screenshots taken from you post) :
    Please let me know if you have any question
    Please rate the post or mark as answered to help other Cisco Customers
    Regards
    Mehdi 

  • Concentrator cannot ping to router

    Hi,
    I have a Cisco 1700 VPN router connection to a concentrator VPN 3005 located in overseas via a 256k lease line.
    The concentrator can ping to the Cisco 1700 VPN router ethernet port (private IP) during office hours 0900 - 1800 hrs but cannot ping after 1800 hrs, but it can ping to the router serial port (public IP).
    Pls advice how can I resolve this issue.
    Thanks

    There's obviously a time bound filter applied here, check for any time based filter in the concentrator.

  • VPN connections: impossible to ping network's machines

    Hello,
    I have configured a Cisco 857 device. I can connect to the internet. I can also establish VPN connections remotely.
    However, once I have established a VPN connection, I cannot ping any system on the company LAN.
    I have seen several posts on these forums but I couldn't configure properly my router.
    I attach my config. Is it possible to know what corrections I should do?
    My LAN IPs are 10.0.0.x with a subnet mask 255.0.0.0.
    For my remote clients, I have now configured it to use 255.0.1.x.
    Thanks and regards,
    MaC

    I can see in your configuration that you use
    split-tunneling, which is fine.
    However, I think you need add the following
    line in the configuration so that your router
    will NOT NAT traffics when going from 10.0.0.0/8 to 255.0.1.x/24:
    no access-list 120
    access-list 120 remark SDM_ACL Category=18
    access-list 120 deny ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255
    access-list 120 deny ip 10.0.0.0 0.255.255.255 255.0.1.0 0.0.0.255
    access-list 120 permit ip 10.0.0.0 0.0.0.255 any
    That way, the traffics from 10.0.0.0/8 will not be NATted when going to
    255.0.1.0/24 for the VPN.
    CCIE Security

  • Need HELPS! ASA 5505 8.4 Cisco VPN Client cannot ping any internal host

    Hi:
    Need your great help for my new ASA 5505 (8.4)
    I just set a new ASA 5505 with 8.4. However, I cannot ping any host after VPN in with Cisco VPN client. Please see below posted configuration file, thanks for any suggestion.
    ASA Version 8.4(3)
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 2
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 172.29.8.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 177.164.222.140 255.255.255.248
    ftp mode passive
    clock timezone GMT 0
    dns server-group DefaultDNS
    domain-name ABCtech.com
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 172.29.8.0 255.255.255.0
    object service RDP
    service tcp source eq 3389
    object network orange
    host 172.29.8.151
    object network WAN_173_164_222_138
    host 177.164.222.138
    object service SMTP
    service tcp source eq smtp
    object service PPTP
    service tcp source eq pptp
    object service JT_WWW
    service tcp source eq www
    object service JT_HTTPS
    service tcp source eq https
    object network obj_lex
    subnet 172.29.88.0 255.255.255.0
    description Lexington office network
    object network obj_HQ
    subnet 172.29.8.0 255.255.255.0
    object network guava
    host 172.29.8.3
    object service L2TP
    service udp source eq 1701
    access-list VPN_Tunnel_User standard permit 172.29.8.0 255.255.255.0
    access-list VPN_Tunnel_User standard permit 172.29.88.0 255.255.255.0
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended deny tcp any any eq 135
    access-list inside_access_in extended deny tcp any eq 135 any
    access-list inside_access_in extended deny udp any eq 135 any
    access-list inside_access_in extended deny udp any any eq 135
    access-list inside_access_in extended deny tcp any any eq 1591
    access-list inside_access_in extended deny tcp any eq 1591 any
    access-list inside_access_in extended deny udp any eq 1591 any
    access-list inside_access_in extended deny udp any any eq 1591
    access-list inside_access_in extended deny tcp any any eq 1214
    access-list inside_access_in extended deny tcp any eq 1214 any
    access-list inside_access_in extended deny udp any any eq 1214
    access-list inside_access_in extended deny udp any eq 1214 any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in extended permit tcp any any eq www
    access-list inside_access_in extended permit tcp any eq www any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq 33
    89
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq sm
    tp
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq pp
    tp
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq ww
    w
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq ht
    tps
    access-list outside_access_in extended permit gre any host 177.164.222.138
    access-list outside_access_in extended permit udp any host 177.164.222.138 eq 17
    01
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit icmp any any
    access-list inside_access_out extended permit ip any any
    access-list outside_cryptomap extended permit ip 172.29.8.0 255.255.255.0 172.29
    .88.0 255.255.255.0
    access-list inside_in extended permit icmp any any
    access-list inside_in extended permit ip any any
    access-list inside_in extended permit udp any any eq isakmp
    access-list inside_in extended permit udp any eq isakmp any
    access-list inside_in extended permit udp any any
    access-list inside_in extended permit tcp any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool ABC_HQVPN_DHCP 172.29.8.210-172.29.8.230 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm history enable
    arp timeout 14400
    nat (inside,outside) source static orange interface service RDP RDP
    nat (inside,outside) source static obj_HQ obj_HQ destination static obj_lex obj_
    lex route-lookup
    nat (inside,outside) source static guava WAN_173_164_222_138 service JT_WWW JT_W
    WW
    nat (inside,outside) source static guava WAN_173_164_222_138 service JT_HTTPS JT
    _HTTPS
    nat (inside,outside) source static guava WAN_173_164_222_138 service RDP RDP
    nat (inside,outside) source static guava WAN_173_164_222_138 service SMTP SMTP
    nat (inside,outside) source static guava WAN_173_164_222_138 service PPTP PPTP
    nat (inside,outside) source static guava WAN_173_164_222_138 service L2TP L2TP
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group inside_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 177.164.222.142 1
    route inside 172.29.168.0 255.255.255.0 172.29.8.253 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server Guava protocol nt
    aaa-server Guava (inside) host 172.29.8.3
    timeout 15
    nt-auth-domain-controller guava
    user-identity default-domain LOCAL
    http server enable
    http 172.29.8.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set Remote_VPN_Set esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set Remote_vpn_set esp-3des esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set Remote_VPN_Set
    crypto dynamic-map outside_dyn_map 20 set reverse-route
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set peer 173.190.123.138
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5
    ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ES
    P-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.1.0 255.255.255.0 inside
    telnet 172.29.8.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcprelay server 172.29.8.3 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    group-policy ABCtech_VPN internal
    group-policy ABCtech_VPN attributes
    dns-server value 172.29.8.3
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Tunnel_User
    default-domain value ABCtech.local
    group-policy GroupPolicy_10.8.8.1 internal
    group-policy GroupPolicy_10.8.8.1 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username who password eicyrfJBrqOaxQvS encrypted
    tunnel-group 10.8.8.1 type ipsec-l2l
    tunnel-group 10.8.8.1 general-attributes
    default-group-policy GroupPolicy_10.8.8.1
    tunnel-group 10.8.8.1 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 remote-authentication certificate
    ikev2 local-authentication pre-shared-key *****
    tunnel-group ABCtech type remote-access
    tunnel-group ABCtech general-attributes
    address-pool ABC_HQVPN_DHCP
    authentication-server-group Guava
    default-group-policy ABCtech_VPN
    tunnel-group ABCtech ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 173.190.123.138 type ipsec-l2l
    tunnel-group 173.190.123.138 general-attributes
    default-group-policy GroupPolicy_10.8.8.1
    tunnel-group 173.190.123.138 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 remote-authentication certificate
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect pptp
      inspect ftp
      inspect netbios
    smtp-server 172.29.8.3
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:6a26676668b742900360f924b4bc80de
    : end

    Hello Wayne,
    Can you use a different subnet range than the internal interface, this could cause you a LOT of issues and hours on troubleshooting, so use a dedicated different Ip address range...
    I can see that the local Pool range is included into the inside interface Ip address subnet range, change that and the related config ( NAT,etc, ) and let us know what happens,
    Regards,
    Julio
    Security Trainer

  • Anyconnect VPN peers cannot ping, RDP each other

    I have an ASA5505 running ASA 8.3(1) and ASDM 7.1(1).  I have a remote access VPN set up and the remote access users are able to log in and access LAN resources.   I can ping the VPN peers from the remote LAN.    My problem that the VPN peers cannot ping (RDP, ectc..) each other.   Pinging one VPN peer from another reveals the following error in the ASA Log.
    Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src outside:10.10.10.8 dst outside:10.10.10.9 (type 8, code 0) denied due to NAT reverse path failure. 
    Below is my ASA running-config:
    ASA Version 8.3(1)
    hostname ciscoasa
    domain-name dental.local
    enable password 9ddwXcOYB3k84G8Q encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 192.168.1.128
    domain-name dental.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network RAVPN
    subnet 10.10.10.0 255.255.255.0
    object network NETWORK_OBJ_10.10.10.0_28
    subnet 10.10.10.0 255.255.255.240
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    access-list Local_LAN_Access remark VPN client local LAN access
    access-list Local_LAN_Access standard permit host 0.0.0.0
    access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list VpnPeers remark allow vpn peers to ping each other
    access-list VpnPeers extended permit ip object NETWORK_OBJ_10.10.10.0_28 object NETWORK_OBJ_10.10.10.0_28
    pager lines 24
    logging enable
    logging asdm informational
    logging mail informational
    logging from-address [email protected]
    logging recipient-address [email protected] level informational
    logging rate-limit 1 600 level 6
    mtu outside 1500
    mtu inside 1500
    ip local pool VPNPool 10.10.10.5-10.10.10.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static any any destination static RAVPN RAVPN
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.10.10.0_28 NETWORK_OBJ_10.10.10.0_28
    nat (inside,outside) source static any any destination static NETWORK_OBJ_10.10.10.0_28 NETWORK_OBJ_10.10.10.0_28
    object network obj_any
    nat (inside,outside) dynamic interface
    object network RAVPN
    nat (any,outside) dynamic interface
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint LOCAL-CA-SERVER
    keypair LOCAL-CA-SERVER
    crl configure
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=ciscoasa
    keypair billvpnkey
    proxy-ldc-issuer
    crl configure
    crypto ca server
    cdp-url http://ciscoasa/+CSCOCA+/asa_ca.crl
    issuer-name CN=ciscoasa
    smtp from-address admin@ciscoasa
    crypto ca certificate chain LOCAL-CA-SERVER
    certificate ca 01
       **hidden**
      quit
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 10bdec50
        **hidden**
      quit
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet 192.168.1.1 255.255.255.255 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    dhcpd address 192.168.1.50-192.168.1.99 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-3.1.04072-k9.pkg 1
    svc profiles DellStudioClientProfile disk0:/dellstudioclientprofile.xml
    svc enable
    tunnel-group-list enable
    internal-password enable
    smart-tunnel list SmartTunnelList RDP mstsc.exe platform windows
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 192.168.1.128
    vpn-tunnel-protocol l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl
    default-domain value dental.local
    webvpn
      svc modules value vpngina
    group-policy DefaultRAGroup_1 internal
    group-policy DefaultRAGroup_1 attributes
    dns-server value 192.168.1.128
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value dental.local
    group-policy DfltGrpPolicy attributes
    dns-server value 192.168.1.128
    vpn-simultaneous-logins 4
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-lock value RAVPN
    split-tunnel-network-list value Local_LAN_Access
    default-domain value dental.local
    webvpn
      url-list value DentalMarks
      svc modules value vpngina
      svc profiles value dellstudio type user
      svc ask enable default webvpn
      smart-tunnel enable SmartTunnelList
    username wketchel1 password 5c5OoeNtCiX6lGih encrypted
    username wketchel1 attributes
    vpn-group-policy DfltGrpPolicy
    webvpn
      svc profiles value DellStudioClientProfile type user
    username wketchel password 5c5OoeNtCiX6lGih encrypted privilege 15
    username wketchel attributes
    vpn-group-policy DfltGrpPolicy
    webvpn
      svc modules none
      svc profiles value DellStudioClientProfile type user
    username jenniferk password 5.TcqIFN/4yw0Vq1 encrypted privilege 0
    username jenniferk attributes
    vpn-group-policy DfltGrpPolicy
    webvpn
      svc profiles value DellStudioClientProfile type user
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNPool
    authorization-server-group LOCAL
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *****
    tunnel-group DefaultRAGroup ppp-attributes
    authentication pap
    authentication ms-chap-v2
    authentication eap-proxy
    tunnel-group RAVPN type remote-access
    tunnel-group RAVPN general-attributes
    address-pool VPNPool
    authorization-server-group LOCAL
    tunnel-group RAVPN webvpn-attributes
    group-alias RAVPN enable
    tunnel-group RAVPN ipsec-attributes
    pre-shared-key *****
    tunnel-group RAVPN ppp-attributes
    authentication pap
    authentication ms-chap-v2
    authentication eap-proxy
    tunnel-group WebSSLVPN type remote-access
    tunnel-group WebSSLVPN webvpn-attributes
    group-alias WebSSLVPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    smtp-server 173.194.64.108
    prompt hostname context
    hpm topN enable
    Cryptochecksum:3304bf6dcf6af5804a21e9024da3a6f8
    : end

    Hi,
    Seems to me that you could clean up the current NAT configuration a bit and make it a bit clearer.
    I would suggest the following changes
    object network VPN-POOL
    subnet 10.10.10.0 255.255.255.0
    object network LAN
    subnet 192.168.1.0 255.255.255.0
    object-group network PAT-SOURCE
    network-object 192.168.1.0 255.255.255.0
    network-object 10.10.10.0 255.255.255.0
    nat (inside,outside) source static LAN LAN destination static VPN-POOL VPN-POOL
    nat (outside,outside) 1 source static VPN-POOL VPN-POOL destination static VPN-POOL VPN-POOL
    nat (any,outside) after-auto source dynamic PAT-SOURCE interface
    The above should enable
    Dynamic PAT for LAN and VPN users
    NAT0 for the traffic between LAN and VPN
    NAT0 for traffic between VPN users
    You could then remove the previous NAT configurations. Naturally please do backup the configuration before doing the change if you wish to move back to the original configuration.
    no nat (inside,any) source static any any destination static RAVPN RAVPN
    no nat  (inside,outside) source static NETWORK_OBJ_192.168.1.0_24  NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.10.10.0_28  NETWORK_OBJ_10.10.10.0_28
    no nat (inside,outside) source static any any destination static NETWORK_OBJ_10.10.10.0_28 NETWORK_OBJ_10.10.10.0_28
    no object network obj_any
    no object network RAVPN
    In the event that you dont want to change the configurations that much you might be fine just by adding this
    object network VPN-POOL
    subnet 10.10.10.0 255.255.255.0
    nat (outside,outside) 1 source static VPN-POOL VPN-POOL destination static VPN-POOL VPN-POOL
    But the other above configurations changes would make the current NAT configurations simpler and clearer to see each "nat" configurations purpose.
    - Jouni

  • Cisco 1941 Router-on-a-Stick w/ 11VLANs trunked to a Cisco 2960: Can Ping a device in another VLAN, that device cannot ping back

    Cisco 1941 Router-on-a-Stick w/ 11VLANs trunked to a Cisco 2960: From the Switch I can Ping a device in another VLAN, that device cannot ping back. Some devices can ping devices in other VLANs and the device in the other VLAN can successfully return the Ping. Have a look at the attached diagram.
    Router Config:
    show run
    Building configuration...
    Current configuration : 7224 bytes
    ! Last configuration change at 09:05:48 EDT Wed Aug 6 2014
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname ROUTER
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone EDT -8 0
    ip cef
    ip name-server 8.8.8.8
    no ipv6 cef
    multilink bundle-name authenticated
    license udi pid CISCO1941/K9
    object-group network Net_Obj_Group1 
     description This network group allows all 10.0.0.0 and Email Forwarder server through to the Plt PCs
     205.191.0.0 255.255.0.0
     10.0.0.0 255.0.0.0
    object-group network Net_Obj_Group2 
     description This Network Group includes the Host IPs allowed through the Plant Router
     host 10.194.28.23
     host 10.194.28.25
     host 10.194.28.26
     host 10.194.28.27
     host 10.194.28.28
     host 10.194.28.29
     host 10.194.28.37
     host 10.194.28.39
     host 10.194.28.40
     host 10.194.28.70
     host 10.194.28.130
     host 10.194.28.131
     host 10.194.28.132
     host 10.194.28.133
     host 10.194.28.134
     host 10.194.28.135
     host 10.194.28.136
     host 10.194.28.137
     host 10.194.28.138
     host 10.194.28.139
     host 10.194.28.140
     host 10.194.28.141
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0
     description Port Ge0/0 to IT Enterprise network Switch GE1/0/38
     ip address 10.194.28.111 255.255.255.0
     ip access-group 105 in
     ip access-group 106 out
     ip nat outside
     ip virtual-reassembly in
     shutdown
     duplex full
     speed auto
     no mop enabled
    interface GigabitEthernet0/1
     description Port to Plant PCN-K/L24 Sw1 Port 0/24
     no ip address
     duplex auto
     speed auto
     no mop enabled
    interface GigabitEthernet0/1.102
     description Port to VLAN 102
     encapsulation dot1Q 102
     ip address 192.168.102.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.104
     description Port to VLAN 104
     encapsulation dot1Q 104
     ip address 192.168.104.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.105
     description Port to VLAN 105
     encapsulation dot1Q 105
     ip address 192.168.105.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.106
     description Port to VLAN 106
     encapsulation dot1Q 106
     ip address 192.168.106.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.107
     description Port to VLAN 107
     encapsulation dot1Q 107
     ip address 192.168.107.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.111
     description Port to VLAN 111
     encapsulation dot1Q 111
     ip address 192.168.111.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.117
     description Port to VLAN 117
     encapsulation dot1Q 117
     ip address 192.168.117.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.121
     description Port to VLAN 121
     encapsulation dot1Q 121
     ip address 192.168.121.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.125
     description Port to VLAN 125
     encapsulation dot1Q 125
     ip address 192.168.125.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.150
     description Port to to VLAN 150
     encapsulation dot1Q 150
     ip address 192.168.150.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.999
     description Port to VLAN 999
     encapsulation dot1Q 999
     ip address 192.168.0.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip nat inside source static 192.168.102.201 10.194.28.23
    ip nat inside source static 192.168.121.201 10.194.28.25
    ip nat inside source static 192.168.106.251 10.194.28.26
    ip nat inside source static 192.168.107.245 10.194.28.27
    ip nat inside source static 192.168.102.251 10.194.28.28
    ip nat inside source static 192.168.150.201 10.194.28.29
    ip nat inside source static 192.168.107.179 10.194.28.37
    ip nat inside source static 192.168.111.201 10.194.28.39
    ip nat inside source static 192.168.105.201 10.194.28.40
    ip nat inside source static 192.168.106.21 10.194.28.70
    ip nat inside source static 192.168.107.146 10.194.28.130
    ip nat inside source static 192.168.107.156 10.194.28.131
    ip nat inside source static 192.168.107.161 10.194.28.132
    ip nat inside source static 192.168.107.181 10.194.28.133
    ip nat inside source static 192.168.107.191 10.194.28.134
    ip nat inside source static 192.168.106.202 10.194.28.135
    ip nat inside source static 192.168.106.212 10.194.28.136
    ip nat inside source static 192.168.117.190 10.194.28.137
    ip nat inside source static 192.168.117.100 10.194.28.138
    ip nat inside source static 192.168.106.242 10.194.28.139
    ip nat inside source static 192.168.125.100 10.194.28.140
    ip nat inside source static 192.168.125.99 10.194.28.141
    ip nat outside source static 10.194.28.23 10.194.28.23
    ip nat outside source static 10.194.28.25 10.194.28.25
    ip nat outside source static 10.194.28.26 10.194.28.26
    ip nat outside source static 10.194.28.27 10.194.28.27
    ip nat outside source static 10.194.28.28 10.194.28.28
    ip nat outside source static 10.194.28.29 10.194.28.29
    ip nat outside source static 10.194.28.37 10.194.28.37
    ip nat outside source static 10.194.28.39 10.194.28.39
    ip nat outside source static 10.194.28.40 10.194.28.40
    ip nat outside source static 10.194.28.70 10.194.28.70
    ip nat outside source static 10.194.28.130 10.194.28.130
    ip nat outside source static 10.194.28.131 10.194.28.131
    ip nat outside source static 10.194.28.132 10.194.28.132
    ip nat outside source static 10.194.28.133 10.194.28.133
    ip nat outside source static 10.194.28.134 10.194.28.134
    ip nat outside source static 10.194.28.135 10.194.28.135
    ip nat outside source static 10.194.28.136 10.194.28.136
    ip nat outside source static 10.194.28.137 10.194.28.137
    ip nat outside source static 10.194.28.138 10.194.28.138
    ip nat outside source static 10.194.28.139 10.194.28.139
    ip nat outside source static 10.194.28.140 10.194.28.140
    ip nat outside source static 10.194.28.141 10.194.28.141
    ip route 0.0.0.0 0.0.0.0 10.194.28.1
    access-list 105 permit ip object-group Net_Obj_Group1 object-group Net_Obj_Group2
    access-list 106 permit ip object-group Net_Obj_Group2 object-group Net_Obj_Group1
    dialer-list 1 protocol ip permit
    control-plane
    banner login ^CC
    Login banner for Plant Router #01^C
    banner motd ^CC
    MOTD Banner for Plant Router^C
    line con 0
     password XXXXXXXXX
     logging synchronous
     login
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
     stopbits 1
    line vty 0 4
     password XXXXXXXXX
     logging synchronous
     login
     transport input all
    scheduler allocate 20000 1000
    ntp server 10.199.100.92
    end
    Switch Config:
    sh ru
    Building configuration...
    Current configuration : 6513 bytes
    version 12.2
    no service pad
    service timestamps debug uptime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname K24Sw01
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone EDT -5
    clock summer-time EDT recurring
    udld aggressive
    crypto pki trustpoint TP-self-signed-593746944
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-593746944
     revocation-check none
     rsakeypair TP-self-signed-593746944
      4B58BCE9 44
      quit
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface FastEthernet0
     no ip address
    interface GigabitEthernet0/1
     description Trunk port for vlans 105, 111, 125 and 999 from K24Sw01 port Ge0/1 to P22Sw01 port Ge0/24
     switchport trunk allowed vlan 105,111,125,999
     switchport mode trunk
    interface GigabitEthernet0/2
     description Trunk port for vlans 150 and 999 from K24Sw01 port Ge0/2 to N25Sw01 port Ge0/26
     switchport trunk allowed vlan 150,999
     switchport mode trunk
    interface GigabitEthernet0/3
     description Trunk port for vlans 102, 104, 106, 107, 117 and 999 from K24Sw01 port Ge0/3 to K28Sw01 port Ge0/26
     switchport trunk allowed vlan 102,104,106,107,117,999
     switchport mode trunk
    interface GigabitEthernet0/4
     description Trunk port for vlans 102, 106, 107 and 999 from K24Sw01 port Ge0/4 to H23Sw01 port Ge0/26
     switchport trunk allowed vlan 102,106,107,999
     switchport mode trunk
    interface GigabitEthernet0/5
     description Trunk port for vlans 121, 125 and 999 from K24Sw01 port Ge0/5 to M21Sw01 port Ge0/24
     switchport trunk allowed vlan 121,125,999
     switchport mode trunk
    interface GigabitEthernet0/6
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/7
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/8
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/9
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/10
     description VLan 102 access port
     switchport access vlan 102
     spanning-tree portfast
    interface GigabitEthernet0/11
     description - VLan 104 access port
     switchport access vlan 104
     spanning-tree portfast
    interface GigabitEthernet0/12
     description - VLan 105 access port
     switchport access vlan 105
     spanning-tree portfast
    interface GigabitEthernet0/13
     description - VLan 106 access port
     switchport access vlan 106
     spanning-tree portfast
    interface GigabitEthernet0/14
     description - VLan 107 access port
     switchport access vlan 107
     spanning-tree portfast
    interface GigabitEthernet0/15
     description - VLan 111 access port
     switchport access vlan 111
     spanning-tree portfast
    interface GigabitEthernet0/16
     description - VLan 117 access port
     switchport access vlan 117
     spanning-tree portfast
    interface GigabitEthernet0/17
     description - VLan 121 access port
     switchport access vlan 121
     spanning-tree portfast
    interface GigabitEthernet0/18
     description - VLan 125 access port
     switchport access vlan 125
     spanning-tree portfast
    interface GigabitEthernet0/19
     description - VLan 150 access port
     switchport access vlan 150
     spanning-tree portfast
    interface GigabitEthernet0/20
     description - VLan 999 access port
     switchport access vlan 999
     spanning-tree portfast
    interface GigabitEthernet0/21
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/22
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/23
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/24
     description From ROUTER Gw ge0/1
     switchport trunk allowed vlan 102,104-107,111,117,121,125,150,999
     switchport mode trunk
    interface GigabitEthernet0/25
    interface GigabitEthernet0/26
    interface Vlan1
     no ip address
     no ip route-cache
     shutdown
    interface Vlan102
     ip address 192.168.102.253 255.255.255.0
    interface Vlan104
     no ip address
     no ip route-cache
    interface Vlan105
     no ip address
     no ip route-cache
    interface Vlan106
     no ip address
     no ip route-cache
    interface Vlan107
     no ip address
     no ip route-cache
    interface Vlan111
     no ip address
     no ip route-cache
    interface Vlan117
     no ip address
     no ip route-cache
    interface Vlan121
     no ip address
     no ip route-cache
    interface Vlan125
     no ip address
     no ip route-cache
    interface Vlan150
     no ip address
     no ip route-cache
    interface Vlan999
     no ip address
     no ip route-cache
    ip default-gateway 192.168.102.1
    ip http server
    ip http secure-server
    snmp-server engineID local 00000009020000019634C2C0
    snmp-server community public RO
    snmp-server location 
    snmp-server contact 
    banner motd ^CCC ADMIN USE ONLY! ^C
    line con 0
     session-timeout 10 
     password xxxxxx
     logging synchronous
     login
     stopbits 1
    line vty 0 4
     session-timeout 10 
     password xxxxxxx
     login
    line vty 5 15
     session-timeout 10 
     password xxxxxxxx
     login
    ntp server 10.199.100.92
    end
    K24Sw01#

    HI Mark,
    Here is the my config:
    Create sub-interfaces, set 802.1Q trunking protocol and ip address on each sub-interface
    Router(config)#interface f0/0
    Router(config-if)#no shutdown
    (Note: The main interface f0/0 doesn’t need an IP address but it must be turned on)
    Router(config)#interface f0/0.10
    Router(config-subif)#encapsulation dot1q 10
    Router(config-subif)#ip address 192.168.10.1 255.255.255.0
    Router(config-subif)#interface f0/0.20
    Router(config-subif)#encapsulation dot11 20
    Router(config-subif)#ip address 192.168.20.1 255.255.255.0
    (Note: In the “encapsulation dot1q 10″ command, 10 is the VLAN ID this interface operates in)
    Configure VLAN
    Switch(config)#vlan 10
    Switch(config-vlan)#name SALES
    Switch(config-vlan)#vlan 20
    Switch(config-vlan)#name TECH
    Set ports to access mode & assign ports to VLAN
    Switch(config)#interface range fa0/1
    Switch(config-if)#no shutdown
    Switch(config-if)# switchport mode access
    Switch(config-if)# switchport access vlan 15
    Switch(config-if)#interface range fa0/3
    Switch(config-if)#no shutdown
    Switch(config-if)#switchport mode access
    Switch(config-if)# switchport access vlan 20
    Switch(config-if)#interface range fa0/5
    Switch(config-if)#no shutdown
    Switch(config-if)#switchport mode trunk
    1. Please check all your port are up.
    2. Check the config once again.
    3. Make sure the swicth and router connection port configured as trunk and it should be up.
    This config is working for me,
    Regards
    Dont forget to rate helpful posts.

  • Internet stops with PPTP VPN connections to ASUS RT-N66U VPN Router

    I have a client with a small office network that has a few people working remotely from Windows 7 and 8 PCs. As an inexpensive solution the client opted to use a VPN router (ASUS RT-N66U) that supports PPTP so remote users could access the shared
    files and SQL DB server. 
    The VPN connectivity for one client was working fine and then stopped working altogether so when the VPN connection is established all Internet and VPN access is stopped. This was especially troubling for me since I work remotely and cannot test or debug after
    the VPN session has been connected. I checked the error logs and found nothing. Also there had been no new programs installed. And finally, I ran a full system antivirus scan with no issues found.
    In case you are facing a similar issue, before trying something remotely that may not work, use the shutdown with reboot command in a COMMAND window and set a timer for something like 3 minutes to reboot in case you get stuck. (e.g. shutdown -r -t 180). 
    Problem: The two symptoms of the VPN connection failure are:
    1) All Internet browsing stops working locally 
    2) No data can pass through the VPN tunnel
    I created a virtual machine on my local network and replicated the client's environment. I experimented with nearly every setting in the VPN dialogue until and came to the final solution. 
    Solution: For the VPN adapter on the remote machines I configured DNS settings and used the remote as the default gateway.
    * VPN adapter Networking IPV4 Properties for:
    - DNS server 1: Main Office VPN Router IP Address
    - DNS server 2: A public DNS server (Google is 8.8.8.8)
    - I also checked the box to "register this connection addresses in DNS"
    Note: Perhaps the local router would also have worked and DNS2 but I didn't test it.
    I have documented this because after reading and searching among many Technical articles and the Microsoft support website, I was unable to find the solution that I came up with so I hope to help someone else. 
    Question1: - Can anyone tell me why the connectivity only works when 'use default gateway on remote network' is checked?
    - I have disabled this option with some business class VPN routers and the connectivity still worked to the remote network but it does not work to the Asus router.
    Question2: From the information provided can I determine where the problem lies?
    Is it the:
    1) Remote client PC
    2) Remote client router
    3) Home office VPN router (Asus RT-N66U)
    If the true culprit cannot be determined yet, what steps do you recommend so I can isolate the true cause of the failure.
    I appreciate any help so that I can be sure my solution is valid and pass along the findings to ASUS if it is their issue.

    Thank you for the suggestion. I have successfully connected through the VPN router when the one client was unable to get VPN throughput working.
    I looked at the routing tables with and without the VPN connection established. The differences are that:
    1) when VPN is NOT active, there is a route from the local NIC IP to the Internet IP address of the local gateway
    destination 68.109.82.xx
    mask 255.255.255.0
    gateway 192.168.0.1
    interface 192.168.0.11
    metric 21
    2) when VPN IS active, the route to the Internet IP address of the local gateway is deleted and a persistent route to the VPN router local network has been added
    Persistent route:
    destination 192.168.21.0
    mask 255.255.255.0
    gateway 192.168.0.1
    interface 192.168.0.11
    metric 1

Maybe you are looking for

  • Can't import photos from Canon 7D after updating to Mavericks

    I can no longer import photos or MOV's shot on my Canon 7D to iPhoto OR open them in Preview or Finder after upgrading to Mavericks. Can still import from my iPhone, and the same card and camera still work great on my iMac that I have yet to upgrade

  • Which truststore for SAML Sender Vouches signatures in SOAP message

    Hi Experts, I try to consume a Web Service provided by SAP Portal 7.3 EHP 2, which is secured using SAML 2.0. My intention is to send SAML assertion using the Sender Vouches confirmation method and looking at the sample message from the Wiki and my m

  • OWSM install problems

    Hi! I run into following problem. I have 2 Windows XP PC-s, on one SOA Suite 10.1.3.1, on the other PC I Installed with the same installer only the J2EE Server and HTTP Server. The PC with SOA suite uses the WS-es deployed on the other PC. This works

  • Error: An attempt was made to load a program with an incorrect format. (Exception from HRRESULT:0x8007000b)

    Hi All, I am trying to install 64 bit addon on SAP9 64 bit client. But i am getting following error: Error: An attempt was made to load a program with an incorrect format. (Exception from HRRESULT:0x8007000b) Please give some solution.

  • Order release

    Hello all experts, I am new to  SAP. I m trying out the pp cycle. Here ,we have a scenario where in the reqrmnt is that the during order creation  the sytem should automatically release the order. Kindly advice on this Regards