Configuring PAT for VoIP got a Turn Up today!!!

Good Morning all,
I have a question, I've researched around the internet to find the CLI commands to open ports TCP 5060/5061 and UDP ports 1024 to 65535 to my SIP provider. I'm a voice guy so i'm VERY new to Security and I would like some assistance.
I'm using a ASA 5505, and below is my Show Run:
------------------ show running-config ------------------
: Saved
ASA Version 8.3(2)
hostname ECSASA-5505
domain-name hostedatandvoice.local
enable password <removed>
passwd <removed>
names
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.252
interface Ethernet0/0
description COMCAST
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
banner exec EnterCloud Solutions ASA
banner login AAA is enabled, Local access has been restricted to local Administrators and Engineers of ECS, LLC.
banner motd EnterCloud Solutions ASA Applicance. Unauthorized users will be logged and flagged for unauthorized access. IP's are tracked and logged and will be reported to local State and Federal agencies.
banner motd Contact [email protected] for additional help or support.
banner asdm WELCOME TO ECS ASA 5505 SECURITY APPLICANCE!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name hostedatandvoice.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network Internet
subnet 0.0.0.0 0.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object service NTP
service tcp source eq 123 destination eq 123
description Time Clock
object network STATIC-PAT
subnet 192.168.1.0 255.255.255.0
object network VPN-Pool
subnet 190.168.10.0 255.255.255.240
description VPN IP Address
object network SSL-VPN-POOL
description SSL-VPN-POOL
object network SSL-VPN-POOL1
object network SSL-VPN-NET1
subnet 192.168.10.0 255.255.255.240
object network outside_to_inside_VoIP
host 192.168.1.8
object-group network PRIVATE-LAN
network-object 192.168.1.0 255.255.255.0
object-group network SSL-VPN-NETWORKS
description SSL VPN NETWORKS
object-group network VPN-NETWORK
network-object object SSL-VPN-NET1
access-list OUTSIDE-IN extended permit udp any object STATIC-PAT eq ntp
access-list ECSSLVPN remark Allow VPN Access to LAN
access-list ECSSLVPN standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 1000000
logging buffered debugging
logging asdm debugging
mtu inside 1500
mtu outside 1500
ip local pool VPN-Pool 192.168.10.1-192.168.10.12 mask 255.255.255.240
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-712.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static PRIVATE-LAN PRIVATE-LAN destination static VPN-NETWORK VPN-NETWORK
object network STATIC-PAT
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.x.x1
route inside 192.168.10.0 255.255.255.255 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
email [email protected]
subject-name CN=ESCASA-5505
ip-address x.x.x.x
keypair ECS-KP
proxy-ldc-issuer
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 59203f51
    308202a8 30820211 a0030201 02020459 203f5130 0d06092a 864886f7 0d010105
    05003066 31143012 06035504 03130b45 53434153 412d3535 3035314e 301b0609
    2a864886 f70d0109 08130e35 302e3139 342e3234 352e3138 35302f06 092a8648
    86f70d01 09021622 45534341 53412d35 3530352e 686f7374 65646174 616e6476
    6f696365 2e6c6f63 616c301e 170d3133 30333132 31333233 34375a17 0d323330
    33313031 33323334 375a3066 31143012 06035504 03130b45 53434153 412d3535
    3035314e 301b0609 2a864886 f70d0109 08130e35 302e3139 342e3234 352e3138
    35302f06 092a8648 86f70d01 09021622 45534341 53412d35 3530352e 686f7374
    65646174 616e6476 6f696365 2e6c6f63 616c3081 9f300d06 092a8648 86f70d01
    01010500 03818d00 30818902 818100dd 432f3bbc 24f0329f 81f0faea 27555dd6
    972dfcc0 697dd74b 8ebdfe7a b7adb611 a97b3881 baef9373 d6442571 7da6d0b1
    f74e9ff9 6602d832 6a092719 2460ecb1 0088a4f0 fbf0c2b0 13586c87 c23d69b2
    08525422 f66e735c 46f3b3c8 d3f41c21 5a204fea cd798c7b e15c018a 6f6d344d
    de24ac87 12cc69a7 b07023a4 302a0702 03010001 a3633061 300f0603 551d1301
    01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06 03551d23
    04183016 80149724 66a81b45 e402da6f f9e47a87 6c01af08 5476301d 0603551d
    0e041604 14972466 a81b45e4 02da6ff9 e47a876c 01af0854 76300d06 092a8648
    86f70d01 01050500 03818100 517b691a 285b035e 5e4ffaba 02467a5a 45d1d4fd
    0e39838d caf77bf1 4cc2f5a6 2fefb926 d0a2fdc4 ebabc75a 28380c06 60df23ee
    8be72ddc b3587956 1eb1df89 d7b4293a ad0db500 bf651885 0a44ba2c 4b94f8ce
    e27b8242 4abead6b a1af0468 5ed4a8ef 013f2d08 59df2f2e e6afcc21 2df6bbd0
    a1f15a01 4ba8960a ec9771bb
quit
crypto isakmp enable outside
crypto isakmp policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd dns 4.2.2.2 8.8.1.1
dhcpd domain hostedatandvoice.local
dhcpd address 192.168.1.12-192.168.1.130 inside
dhcpd dns 4.2.2.2 8.8.1.1 interface inside
dhcpd domain hostedatandvoice.com interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 199.249.224.123 source outside prefer
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
svc image disk0:/anyconnect-win-3.0.11042-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-3.1.02040-k9.pkg 2
svc enable
group-policy DfltGrpPolicy attributes
dns-server value 4.2.2.2
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ECSSLVPN
default-domain value hostedatandvoice.local
split-dns value hostedatandvoice.com
address-pools value VPN-Pool
webvpn
svc ask enable default webvpn
username khayes password <removed> privilege 15
username mharrell password <removed> privilege 15
username bdillard password <removed> privilege 15
username skonti password <removed> privilege 15
tunnel-group ECSSLVPN type remote-access
tunnel-group ECSSLVPN general-attributes
address-pool VPN-Pool
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:977f2a92875a8c744753124c94adbb09
: end

Kenneth,
If that's the case you can use a range of port and create a NAT using your outside interface IP.
object network CUCM_Private
host 10.10.10.10
object service Range_1024_65535
service udp source range 1024 65535
object service SIP_range
service tcp source range 5060 5061
nat (inside,outside) source static CUCM_Private interface service Range_1024_65535 Range_1024_65535
nat (inside,outside) source static CUCM_Private interface service SIP_range SIP_range
access-list outside_access_in permit tcp any object CUCM_Private eq 5060
access-list outside_access_in permit tcp any object CUCM_Private eq 5061
access-list outside_access_in permit tcp any object CUCM_Private range 1024 65535
Take in consideration that I am using different IP address, please use the correponding IP's.
Hope it helps,
Juan Lombana

Similar Messages

I'm trying to use a madcatz controller on the mac but it turns on for 2 seconds and turns off. the system profiler picks it up as a xbox 360 gamepad but says its not been configured. how can i allow my self use this with my games.

i'm trying to use a madcatz controller on the mac but it turns on for 2 seconds and turns off. the system profiler picks it up as a xbox 360 gamepad but says its not been configured. how can i allow my self use this with my games!

I have exactly the same problem.
I'm a little peed-off with Microsoft on this. The original wireless controller I have doesn't work either since the cable I'm using is 'just' the charge and play cable, so a direct connection to my Mac won't work with this cable. It's a cable for god's sake. Why on EARTH put any limitations on this!?!?
Next I learn I need an additional USB wireless receiver from Microsoft to get my original 360 controller to talk to my Mac. As I certainly don't want to fork any more microsoft dollars on this, this is not an option.
Next I think, yes! I have a MadCatz 360 wired USB controller. This should surely do the trick just plugging it in and the way I go. But oh no, for some reason I plug my MadCatz Xbox360 controller in, it flashes a few times then switches off and can't be turned on again.
The System Profiles recognizes it as a MadCatz 360 device controller but that is about it, but the ontroller software I download for the System Prefs (360Controller, USBOverdrive etc) don't even recognize the controller as being plugged in.
What the **** Is The Microsoft Deal with all of this!?!?
PS: Oh, and I forgot to mention, there are No drivers for device 4716 that I can find on the MadCatz website, or am I going blind?
If anyone has a link, it would be appreciated.
Message was edited by: nostrawaggus

Configure static PAT for port range

Hi,
could someone help with this:
we have an ASA 5510 version 8.2 and ASDM 6.4. we want to configure a static PAT for a range of TCP and UDP port. in the nat configuration window we have just to enter one port ( range are note accepted).
Thanks,

Hi,
In software levels 8.2 and below the only option is to generate a separate configurations for each port. This is easiest achieved through the CLI and using some text editor to help generate the possibly large configurations.
On ASA software 8.3 and above (where NAT format was completely redone) you have the option to use a single "nat" command to configure Static PAT for a continuous range of ports.
So your option is to either generate a separate "static" configuration for each port or upgrade the software to a newer one to be able to do Static PAT for a range of ports.
Naturally the update involves rewriting the current NAT configuratins into a new format even though booting to newer software usually converts the configurations automatically but with varying success.
- Jouni

When trying to install itunes on windows 7 i got a configuration data for this product is corrupt?

It is not allowing me to install, it gives me the error: configuration data for this product is corrupt. How do I install itunes on my windows 7?
Trying to update my ipad....but I first need to install itunes!!

(1) Download the Windows Installer CleanUp utility installer file (msicuu2.exe) from the following Major Geeks page (use one of the links under the "DOWNLOAD LOCATIONS" thingy on the Major Geeks page):
http://majorgeeks.com/download.php?det=4459
(2) Doubleclick the msicuu2.exe file and follow the prompts to install the Windows Installer CleanUp utility. (If you're on a Windows Vista or Windows 7 system and you get a Code 800A0046 error message when doubleclicking the msicuu2.exe file, try instead right-clicking on the msicuu2.exe file and selecting "Run as administrator".)
(3) In your Start menu click All Programs and then click Windows Install Clean Up. The Windows Installer CleanUp utility window appears, listing software that is currently installed on your computer.
(4) In the list of programs that appears in CleanUp, select any iTunes entries and click "Remove", as per the following screenshot:
(5) Quit out of CleanUp, restart the PC and try another iTunes install. Does it go through properly this time?

How to configure mwi for GDM (general delivery mailbox)

Hello everyone
I'm trying to configure mwi for GDM and am not having much success. I tried a couple of different ways suggested in a discussion here:
https://supportforums.cisco.com/message/3091135?tstart=0 but don't think I,m doing this the right way.
This is what the thread states:
x511 is a shared line with a corresponding GDM mailbox   (mine is x1007)
x512 is a blast group with members x501 (phone A), x502 (phone B), and x503 (phone C) *****I took 1008
x511 is call forward all to 512
The blast group at 512 forwards on no answer to voicemail
x511 is assigned as a button on each of phones A, B & C
When an incoming call comes in to x511 it is immediately forwarded to the blast group at 512, and as a result, x501, x502, and x503 ring. After 15 seconds (or whatever the no answer timer is set to), the call goes to voicemail. Because the call went to x511 first, it winds up in mailbox 511. After the message is left, an MWI ON message is generated for x511, which results in the envelope icon being displayed next to the x511 button on each of phones A, B and C.
Therefore If I change this to my configurations I think it would go like this:
When an incoming call comes in to x1007(GDM) it is immediately forwarded to the blast group at 1008, and as a result, x1001, x1002, and x1003 and 1004 ring. After 15 seconds (or whatever the no answer timer is set to), the call goes to voicemail. Because the call went to x1007 first, it winds up in mailbox 1007. After the message is left, an MWI ON message is generated for x1007, which results in the envelope icon being displayed next to the x1007 button on each of phones A, B and C.
Here is what I tried:
1: Configured GDM at extension 1007 and shared the extension to phones ext: 1001, 1002, 1003, 1004 (instead of above mentionned x511). This extension works and can retrieve GDM no problem.
dial-peer voice 1007 voip
description [-[ General Delivery Mailbox ]-]
destination-pattern 1007
session protocol sipv2
session target ipv4:10.1.10.1
dtmf-relay sip-notify
codec g711ulaw
no vad
ephone-dn 8 dual-line
number 1007 no-reg both
label GeneralMail- x1007
description General Mail
name General Mailbox
call-forward busy 1999                   *****Should call forward all to 1008 which is the hunt-group
call-forward noan 1999 timeout 3    *****Should call forward all 1008. Therefore remove both commands and add the call-forward all 1008 (Correct???)
hold-alert 30 originator
2: Not sure what a blast group is but I believe it to be a parallel hunt group. Is this correct???
ex: voice hunt-group 2 parallel (This will make all included phones dial at same time correct???)
      list 1001, 1002, 1003, 1004
voice hunt-group 2 parallel
list 1001,1002,1003,1004
pilot ??? (not sure what to put here, i think it should be the pilot number 1008 correct???)
pilot 1008
Therefore this is what i got:
voice hunt-group 2 parallel
list 1001,1002,1003,1004
pilot 1008
Now I believe I need to create the dial-peer 1008 correct???
dial-peer voice 1008 voip
description [-[ Hunt Blast Group ]-]
destination-pattern 1008
session protocol sipv2
session target ipv4:10.1.10.1
dtmf-relay sip-notify
codec g711ulaw
no vad
Next I think I have to create ephone-dn for the hunt blast group correct???
ephone-dn 9 dual-line
number 1008 no-reg both
description General Mail
name General Mailbox
call-forward busy 1999                   *****Should call forward all to 1999 which is my voice mail correct???
call-forward noan 1999 timeout 3    *****Should call forward all 1999 which is my voice mail correct ???
hold-alert 30 originator
Then last I would configure lines on the phones pointing to the ephone-dn 9 on all listed phones correct??? or am I totally lost?...lol
ex: ephone 4
device-security-mode none
mac-address 0018.19B9.35BE
username "operator" password 1234
codec g729r8
type 7961
button 1:3 2:5 3:8 4:9 ***4:9 is the one correct???
Any help will be greatly appreciated. Thanks very much.

Thanks very much for the help Rob. This command does indeed take care of having my GDM
light up but now if I try to send a message to the main phone line x1001 and leave a
message it only has the enveloppe now and doesn't light up...lol
It is a great command to know though...thanks a lot
Any chance you know if I can have both the main line and the GDM light up when they receive messages in their respective extensions?
ex:
ephone 4
device-security none
mac-address aaaa.aaaa.aaaa
username "operator"
type 7961
mwi-line 3   ****In my case this lights up the 1007 which is the GDM mailbox
or
mwi-line 1   ***now my main x will light up but not the GDM...lol
button 1:3 2:5 3:8     ***Now for the personal mailbox
ephone-dn 3 dual-line
number 1003 no-reg primary
label Operator-x1003
description Operator
name Sylvie Bombardier
call-forward busy 1999
call-forward noan 1999 timeout 10   ****worst comes to worst i'll get rid of the operator personal mailbox and call-forward all to GDM 1007 on that phone
translation-profile incoming no-prefix
Thanks very much again for your help. If you have any other ideas please feel free to add. I am definitely close to wrapping this issue. Funny cisco didn't configure GDM to also light up the phone extensions included in the GDM like the personal mailboxes when they receive messages.
Thanks very much again for the help. I really appreciate it.

I need help, speach over got accidently turned on in my Iphone 6, now i cant get into my phone it wont take my pass word and when I try to use Siri it says not available what do I do

I need help, speach over got accidently turned on in my Iphone 6, now i cant get into my phone it wont take my pass word and when I try to use Siri it says not available what do I do

Hi, Jennifer.
Thank you for visiting Apple Support Communities.
I understand that VoiceOver has been activated and you are unable to access your device. I have done this myself and here are the steps to disable this feature.
VoiceOver
Press the home button three times quickly (formerly "Triple-click home").
Accessibility Shortcut
Managing Accessibility features using iTunes
Connect your iPhone, iPad, or iPod touch to any computer with iTunes installed.
In iTunes, select your device.
From the Summary pane, click > Configure Universal Access in the Options section at the bottom.
Select the feature you would like to use and click OK.
Use Accessibility features in iOS
-Jason H.

How to configure SMTP for iCloud?

I have never used the Mail program on my macs. I started using Eudora in 1995 and when Mail came along some years later, i didn't take to it, it didn't have the functionality i needed and enjoyed. Fast forward to a couple days ago, my Snow Leopard MacBook is wearing out and i got a new MacBook Pro running Mountain Lion. When i was setting up the new computer, i thought iCloud would be configured automatically. It wasn't because i have a couple of different Apple IDs but i think that is straightened out now and i'm signed in using the me.com email address and have my calendars and contacts syncing with iphone and my other computer. Mail is working, but only for my me.com email address which i rarely use. I mainly use a gmail address.
I don't want to use Mail and i don't want mail to be downloaded to it. That happened on my other computur, so that i had tens of thousands of messages in a program i never open and don't use. So i somehow turned it off so it no longer gets the mail from my other accounts. i don't want to receive email in Mail. But because i can't use Eudora in Mountain Lion, i need a new email client. Today, i downloaded and installed Mail Mate, i want to try it out. When I tried to use Mail mate to send an email i got a message saying "No SMTP server configured for iCloud." i googled how to configure SMTP for iCloud and what i found said it configures automatically. So i don't know what to do. I went to ICloud in system preferences and i don't see anything i can do there.
Is there anything i can get it to do to configure automatically? All my software is up to date, if that makes a difference.

i was persistently googling search terms for this problem and came across a link that gave information to the effect that for non Apple email clients, SMTP has to be configured manually, and the settings were provided. I entered them into Mail Mate and now it works. So thankfully, this problem is solved.

How to configure N9 for push e-mail?

Does anybody know how to configure N9 for push e-mail? It should be possible because push email is part of Nokia's N9 official specs but I'm unable to find any reference in the manual or online.

I know that I am late to the party but just got my N9. The push email works fine for my Exchange & my Gmail but for my mail.com account (which I believe is really AOL) it only syncs when I manually tell it to. I have it set to "always up to date" ... does anyone have any ideas?
Thanks!
Update: just fixed it myself but in case it helps anyone I turned on the Push Notifications & that did the trick. Which is kind of odd bc I notifications from my Gmail & MS Exchange automatically did it but I guess that feature has to be turned on for this email.
Wish all the features on the N9 had the "I" icon which you could press for more info as I thought that option would just let you know when your email was syncing (like the little arrow on the top right). Oh well - now if I can just get my contacts/calendar off of my PC's OutLook & onto my N9 ...................
Cheers!

NAT issue - (over same link) static-NAT works but PAT (for rest of hosts) does not !

Hello fellow engineers!
I have a puzzling situation implementing an Internet routing pilot project and I need someone with a fresh look at the matter because I cannot make-out what the problem is…
Scenario description:
2901 router with two (one used) DSL intf’s on board and its two GE ports connected to a switch via Port-Channel sub-int’f (router-on-a-stick is implemented).   The router has two other WAN (Internet) connections via a Satelite link and a MetroEthernet link.   These two are terminated on the switch on intf’s at the appropriate VLAN’s.   At attached topology scheme I depict them all collocated on the router for “simplicity” (logical topology) since the router has intf’s at the corresponding networks.   The aDSL and Metro links have an 8-IP public set, each.
Most servers/hosts utilize VLAN 10 (int port-channel 1.10) but they need to forward their internet traffic to corresponding Internet links so PBR is used.    VLAN/subnet (all /24) pairs are:
VLAN 11 -> 10.0.1.x
VLAN 12 -> 10.0.2.x
VLAN 13 -> 10.0.3.x
VLAN 71 -> 192.168.17.x
VLAN 204 -> 172.16.204.x
and – last but not least ! – VLAN 10 -> 10.0.0.x
All servers use static 1-1 NAT while all other hosts/PC’s use the Metro link (PAT).
Situation: All PBR rules and static NAT’s of VLAN 10 behave as expected.   So does the PAT for hosts of all other VLAN’s (11, 12, 13, …).   The rest of the hosts of VLAN 10, i.e. PC’s with IP’s 10.0.0.x (in red), cannot get to the Internet !
What is puzzling is that traffic is matched (by ACL) and NAT does occur but all I see (via “sh ip nat tra”) are the translations of the DNS requests !   Nothing else !   To top that, tracerouting a public IP does lead to the target but when hitting that same public IP (not by name) on the browser can’t load the page !
Could pls someone spot what I’m missing !!
To help you I also attach the router config and some command outputs…
All help is appreciated.
Thanx
Costas

That last PBR statement
(route-map 10.0.0.X_hosts_PBR permit 70
description *** rest of 10.0.0.x net --> Oxygen ***
match ip address rest_of_10.0.0.x
set ip next-hop 212.251.64.153)
was not there in the first place - I got it there assuming it would help but it didn't.   Actually - as mentioned - it does not get any hits !
(route-map 10.0.0.X_hosts_PBR, permit, sequence 255
Match clauses:
    ip address (access-lists): rest_of_10.0.0.x
Set clauses:
    ip next-hop 212.251.64.153
Policy routing matches: 0 packets, 0 bytes)

Configure SSO for ITS to R/3 using SNC/Kerberos

Our R/3 systems had been configured for SSO using SNC and Kerberos for awhile now. We now have a requirement to configure SSO between ITS and R/3. Since our R/3 env. has been using kerberos library, we won't be able to use SAP Cryptographic library. I had modified the registry, environment and services in itsadmin to point to the kerberos library and principal names for agate and r/3 servers as described in SNC User Guide; also, I updated table SNCSYSACL with the Agate SNC name. That seems to work fine. From the trace file, it recognized GSS-API library for Kerberos and the SNC name for Agate. However, when I tried to logon to R/3 from ITS, I still am being prompted with the logon screen to enter my SAP account/password.
I found several whitepapers and documentations stating that ITS does support Kerberos for SSO but I couldn't find any procedure on how to implement it. Following is the error I'm getting from the sapbasis.trc file but I can't find any document on this error:
=====================================================
[Thr 5284] SncInit(): Initializing Secure Network Communication (SNC)
[Thr 5284]       PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 8/32/32)
[Thr 5284] SncInit(): Trying environment variable SNC_LIB as a
      gssapi library name: "C:\WINNT\system32\gsskrb5.dll".
[Thr 5284]   File "C:\WINNT\system32\gsskrb5.dll" dynamically loaded as GSS-API v2 library.
[Thr 5284]   The internal Adapter for the loaded GSS-API mechanism identifies as:
Internal SNC-Adapter (Rev 1.0) to Kerberos 5/GSS-API v2
[Thr 2888] Sun Jan 15 22:44:59 2006
[Thr 2888] <<- ERROR: SncSetParam()==SNCERR_PARAM_DENIED
[Thr 2888] *** WARNING => NO Domain! domain==NULL means: No domain at all within the cookie. [sapss1_loctr 333]
[Thr 2888] Sun Jan 15 22:45:29 2006
[Thr 2888] *** WARNING => NO Domain! domain==NULL means: No domain at all within the cookie. [sapss1_loctr 333]
=====================================================
Does anyone know what am I missing? Any help is greatly appreciated.
Thank you!
Diem

Hi Markus,
I also just installed/configured PAS for LDAP authentication using the "PAS for External Authentication Mechanisms" documentation. I think the domain problem probably due to not having the external authentication mechanism install (in this case - PAS). Does that sound right to you?
I tried both options for ~extid_type parameter = "LD" and "UN". I added the DN information to table USREXTID when ~extid_type="LD" but both options gave me error of "LDAP authentication failed". I increased the trace level for sapextaut.trc but I don't see enough detail information. Following are the errors/data from the trace file. Can you please let me know how I can tell what string is being passed for authentication?
I'm quite sure the LDAP host and port data is correct since we've been using the same information for the SAP LDAP connector and we've been using our LDAP connector between MS AD and R/3 for a long time without any problem.
To logon to R/3 through ITS, I entered the AD account (CN attribute in AD) when I got the errors.
Thank you very much for all your help.
Diem Tran
Trace:
=====================================================
2006-01-18T01:39:30.734 p001688 t4992 s0158B4E8 [sapextauth, 437]: W sapextauth: PAS session begins...
2006-01-18T01:39:30.734 p001688 t4992 s0158B4E8 [sapextauth, 456]:     sapextauth: SncNameR3 is:    "p:na1adm/[email protected]"
2006-01-18T01:39:30.734 p001688 t4992 s0158B4E8 [sapextauth, 462]:     sapextauth: SncNameAGate is: "p:[email protected]"
2006-01-18T01:39:30.750 p001688 t4992 s0158B4E8 [sapextauth, 468]:     sapextauth: SNC_LIB is:      "C:\WINNT\system32\gsskrb5.dll"
2006-01-18T01:39:30.750 p001688 t4992 s0158B4E8 [sapextauth, 568]:     sapextauth: XGatConnectSession leaving....
2006-01-18T01:39:30.750 p001688 t4992 s0158B4E8 [sapextauth, 616]:     sapextauth: XGatHandleLogin called....
2006-01-18T01:39:30.750 p001688 t4992 s0158B4E8 [sapextauth, 976]:     sapextauth: Entering XGatHandleLogin with LDAP...
2006-01-18T01:39:30.750 p001688 t4992 s0158B4E8 [sapextauth, 993]: W Either ~login or ~password missing, returning XGDKRCloginrequired.
2006-01-18T01:39:50.281 p001688 t4992 s00000000 [sapextauth, 398]:     sapextauth: XGatEventOpenSession called...
2006-01-18T01:39:50.281 p001688 t4992 s0158B4E8 [sapextauth, 616]:     sapextauth: XGatHandleLogin called....
2006-01-18T01:39:50.281 p001688 t4992 s0158B4E8 [sapextauth, 976]:     sapextauth: Entering XGatHandleLogin with LDAP...
2006-01-18T01:39:50.296 p001688 t4992 s0158B4E8 [sapextauth, 1059]:     sapextauth: LDAP port ist 389
2006-01-18T01:39:50.296 p001688 t4992 s0158B4E8 [sapextauth, 1261]: E sapextauth: LDAP authentication failed.
2006-01-18T01:39:50.296 p001688 t4992 s0158B4E8 [sapextauth, 1277]: E sapextauth: Wrong try for user Tran_Diem
2006-01-18T01:39:59.140 p001688 t4992 s00000000 [sapextauth, 398]:     sapextauth: XGatEventOpenSession called...
2006-01-18T01:39:59.156 p001688 t4992 s0158B4E8 [sapextauth, 616]:     sapextauth: XGatHandleLogin called....
2006-01-18T01:39:59.156 p001688 t4992 s0158B4E8 [sapextauth, 976]:     sapextauth: Entering XGatHandleLogin with LDAP...
2006-01-18T01:39:59.156 p001688 t4992 s0158B4E8 [sapextauth, 1059]:     sapextauth: LDAP port ist 389
2006-01-18T01:39:59.156 p001688 t4992 s0158B4E8 [sapextauth, 1261]: E sapextauth: LDAP authentication failed.
2006-01-18T01:39:59.156 p001688 t4992 s0158B4E8 [sapextauth, 1277]: E sapextauth: Wrong try for user Tran_Diem
=======================================================

In an attempt to configure Linksys PAP2 VOIP adapter, I a...

In an attempt to configure Linksys PAP2 VOIP adapter, I am constantly receiving this message, "Your phone may be plugged into incorrect phone port. Please try the other port." Manual reboot did not solve the problem. Can anyone help?

Hello,I am partheeban.Have you got to fix the problem.Me al so have same problem.If you sole that let me know.How you did.this is the massage i have got on my phone
This is the voice massage i have got it from my phone.
Connected in the incorrect phone port. Please try other port. If you believe
your correct port. Please log on to your web account to check your states of
your service O108.
This is the voice massage i have got it when you pickup the phone
immediately the voice massage will comes.
Thanks

Give me the Configuration steps for intercompany billing and third party s

Hi Gurus,
Give me the Configuration steps for intercompany billing and third party sales and give me a brief description with examples.
Regards,
YSR

Dear YSR
Check the links
[Cross Company Configuration|http://help.sap.com/bp_bblibrary/500/Documentation/J62_BB_ConfigGuide_EN_DE.doc]
[Third Party Without Shipping Notification|http://help.sap.com/bestpractices/BBLibrary/html/J55_ThirdPartyWOSN_EN_US.htm]
Third party order processing is as follows:
Assume three companies X, Y and Z
X - The company,
y - The customer
Z - Vendor
When ever X gets a PO from Y to supply some goods, X has an option of either manufacturing those goods or procuring those goods.
If he is procuring the goods, there are two methods that are generally followed:
Method 1)
After receiving the PO from Y, X creates a sales order against Y.
Now at the same time he also creates a PO to a vendor Z to produce the goods
Z produces the goods and supplies to X
X receives the goods from Z
Then X delivers the same goods to Y.
After that X invoices Y and Z invoices X.
Note : Here there is no direct/ Indirect relation between Z and Y.
This process is known as Trading Process. and the Material here is created with Material type HAWA.
The other method is a Third party order processing method:
Here the glaring difference is that instead of Z supplying the material to X and X in turn supplying the same material to Y.
X authorizes Z to supply the material to Y on his behalf and notify him once the delivery is complete.
Now Z supplies the material to Y and acknowledges the same to X.
Z will send a copy of delivery acknowledgement and invoice to X.
After receiving the delivery confirmation and invoice from Z, X has to verify the invoice and this process is known as invoice verification and is done in SAP through Tcode MIRO.
The next step for X is to create an invoice and submit to Y
Only after the invoice verification document is posted then only X can create an invoice for Y.
This is the business flow that is followed for third party order configuration.
There are few steps that have to be configured to enable the system to function as mentioned above.
Step1)
If you are always followwing a third party process for a material then you have to create the material using item category group BANS.
The procument type should be marked as External procurement (F) in MRP 2 view of the material master record.
if you are not always allowing third party order processing then u can create a material master record with item category group as NORM and the procurement type should be marked as ( X) meaning both types of procurment ( in house manufacturing and external procurement).
Step 2)
the item category in the order should be manually changed as TAS.
For that you need to confugure the item category determination
ord type + item cat grp + usge + Hiv level = Item cat + Manual item cat
OR + NORM + + = TAN . + TAS
OR + BANS + + = TAS
Step 3)
make sure that during the item category configuration for TAS you need to mark relevnat for billing indicator as F
Step 4)
The schedule line cateogry for this type should be CS.
make sure that you mark subsequent type as NB - purchase requisition in this schedule line category as this will trigger the purchase requision order immediately after the creation of the sales order and the PO to vendor is created against this purchase requiesion.
thanks
G. Lakshmipathi

How to configure EOIO for async RFC ----- SOAP scenario

Hello Experts,
I have Async. RFC----->SAOP secnario. Problem is that when the target system is down the PI system do not recoginze it and send the message successfully to target system, where the target system is down and do not show those transaction in it.
I got the impression that , I have to make the QoS as EOIO and set up the queues in the PI.
So, I checked both the comm channel RFC Sender and SOAP recevier but i was not able to find the option where we can make the QoS to EOIO.
Do we need to mention the QoS in the SOAP URL in SOAP recevier comm channel . if yes please anyone can give me an example of that.
Or do we have other option in PI to identify that target system is down and we can queue up the msgs in PI.
I would appreciate your responses.
Thanks.

Problem is that when the target system is down the PI system do not recoginze it and send the message successfully to
target system, where the target system is down and do not show those transaction in it
No need to change the Qos in order to know the status of the target system.
Just configure alert for Adapter Engine...when the SOAP channel tries to send the message and if the target system is down and alert will be generated (Connection Exception: Connection refused).
This will indicate that the Target system is down....now it dpends on your business on what to do in such a case....to cancel the message or to restart it (from XI/ PI)
Making QoS as EOIO will cause the entire queue to get blocked...and hence the following messages will also get blocked and wont be delivered even if the target system is up and running.
Regards,
Abhishek.

Kerberos Configuration Manager for SQL Server: Access of system information failed!

I'm trying to use the new Kerberos Configuration Manager for SQL Server tool that was released recently to verify SPN on several SQL Servers, but any time I attempt to connect to a server I get the following error in the log:
6/24/2013 3:48:22 PM Info: Connect to WMI, \\<HOSTNAME>\root\cimv2
6/24/2013 3:48:25 PM Error: Access of system information failed System.DirectoryServices.AccountManagement.PrincipalOperationException: An error (1332) occurred while enumerating the group membership. The member's SID could not be resolved.
at System.DirectoryServices.AccountManagement.SAMMembersSet.IsLocalMember(Byte[] sid)
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNextLocal()
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNext()
at System.DirectoryServices.AccountManagement.FindResultEnumerator`1.MoveNext()
at System.Linq.Enumerable.Contains[TSource](IEnumerable`1 source, TSource value, IEqualityComparer`1 comparer)
at KerberosCM.WMIHelper.isUserLocalAdmin(SystemInfo si, UserPrincipal user)
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
6/24/2013 3:48:25 PM Error: Error System.Exception: Access of system information failed!
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
at KerberosCM.SystemInfo.GetInfo()
at KerberosConfigMgr.Utility.Login(String serverName, String login, String password, Boolean isCmdLine, Form uiForm)
Things I have tried to resolve this:
1. Verified that my account is a Domain Admin.
2. Attempt to connect locally without inputting any information for server/user/pw
3. Attempt to connect remotely using server/user/pw
I always receive the same error message and log: Access of system information failed!
Has anyone else run into this issue?

Update to this:
There were some invalid user accounts added to the Local Administrators group only showing up as a GUID. This caused the enumeration of the group to fail and generate the error in my original post. Removing those user accounts from the Administrators group
got past the enumeration error.
However, now when attempting to connect to the servers (locally or remotely) I get this error:
6/27/2013 10:24:24 AM Info: Connect to WMI, \root\cimv2
6/27/2013 10:24:38 AM Error: Access of system information failed System.Runtime.InteropServices.COMException (0x80070035): The network path was not found.
at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.PropertyValueCollection.PopulateList()
at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
at System.DirectoryServices.AccountManagement.SAMStoreCtx.ResolveCrossStoreRefToPrincipal(Object o)
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNextForeign()
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNext()
at System.DirectoryServices.AccountManagement.FindResultEnumerator`1.MoveNext()
at System.Linq.Enumerable.Contains[TSource](IEnumerable`1 source, TSource value, IEqualityComparer`1 comparer)
at KerberosCM.WMIHelper.isUserLocalAdmin(SystemInfo si, UserPrincipal user)
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
6/27/2013 10:24:38 AM Error: Error System.Exception: Access of system information failed!
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
at KerberosCM.SystemInfo.GetInfo()
at KerberosConfigMgr.Utility.Login(String serverName, String login, String password, Boolean isCmdLine, Form uiForm)

How do I get the configuration settings for GPRS mms ect for EE

Hiya :)
My son-in-law got a new iphone4s as an upgrade from EE/orange on Tuesday 18th feb 2014
It was an upgrade for his sim only contract changed to a phone and sim
The first phone he had was a samsung galaxy s3 mini but he couldn't get used to it as had used his old iphone4 for over 4 years before it died
The samsung galaxy s3 mini was sent back and a nice shiny iphone4s was sent out instead and he got it on the date up top
The sim that came with the iPhone keeps saying invalid for some reason?
But the sim he got with the sg3 mini works but has no configuration settings for the iphone4s in it only for the sg3 mini
We have tried online looking for the settings for wap/GPRS/mms/edge ect to send via SMS but can't seem to find anywhere that works?
Can anybody help please?
His partner (my daughter) is expecting there 2nd baby and he wants these set up ASAP
He can recieve calls and make calls and do the same with SMS but no Internet/mms ect

Check out FEBE. <br />
https://addons.mozilla.org/en-US/firefox/addon/2109/

Configuring PAT for VoIP got a Turn Up today!!!

Similar Messages

Maybe you are looking for