Differences: PI 7.0, 7.1: Setting up SPROXY

Dear all,
I'd like to know if there are any difference when connecting an ECC with the ESR in PI 7.1 and configuring an ECC as an application system for an PI 7.0 (in order to implement ABAP proxies).
For PI 7.0 i know the blog:
How do you activate ABAP Proxies?
How do you activate ABAP Proxies?
Are these steps also required in PI 7.1? I had a look in a 7.1 system, and in sproxy in the ECC i could see all service interface, although no entries where made in the ECC system in sxmb_adm (e.g. mark it as application system, configure associated integration engine..)
Is it sufficent for proxy development in PI 7.1 just to maintain the entry in the SLD? Or what other steps do i have to do?
Best regards
Florian

Hi Florian,
Am not sure about the 7.0 r 7.1
But kindly follow below steps:
1) Get into Tcode : SXMB_ADM of the Application System (ECC)
2)Select "Integration Engine Configuration"
3) There on page corresponding to "Role of Business System" --> LOC Application System.
4) "Corresponding Integ Server" --> http://host:port/sap/xi/engine?type=entry
Now press "Specific Configuration"
Category    Parameters     SubPara         CurrentValue                      Default vALUE
Runtime     ENGINE_TYPE                         LOC                             UNDEFINED
Runtime    IS_URL                             http://host:port/sap/xi/engine?type=entry
Runtime    IS_URL            "HTTP://SAP/XI/ENGINE?TYPE=ENTRY
Hope this would Help
regards
Srini

Similar Messages

DIFFERENCE BETWEEN SAP ERP 47 EXTENSION SET 110 AND 200.

HELOO TO ALL SAP MASTERS
IS THERE ANY SIGNIFICANCE DIFFERENCE BETWEEN SAP ERP 47 EXTENSION SET 110 AND 200.
IF YES WHAT ARE THE DIFFERENCES.
THANKS IN ADVACE
RAFIQ

Hi
Basic difference between the two:
47x110 first enterprise release.
From a technical point of view, the first SAP R/3 Enterprise release 47x110,
consists of following parts, each containing different software components:
    o The SAP R/3 Enterprise Extension Set 1.10 consists of the
       following software components: EA-HR 110, EA-APPL 110, EA-IPPE
       110, EA-RETAIL 110, EA-GLTRADE 110, EA-PS 110 und EA-FINSERV 110.
From a technical point of view, SAP R/3 Enterprise 47x200 consists of
following sections, which in turn contain various software components:
    o SAP R/3 Enterprise Extension Set 2.00 consists of the following
       software components EA-HR 200, EA-APPL 200, EA-IPPE 200,
       EA-RETAIL 200, EA-GLTRADE 200, EA-PS 200, EA-FINSERV 200, EA-DFPS
       200 and ABA_PLUS 100.
Hope this helps.

WHAT IS THE DIFFERENCE BETWEEN PHRASE GROUP AND PHRASE SET?

WHAT IS DIFFERENCE BETWEEN PHRASE GROUP AND PHRASE SET?

Hi Ramya,
Definition of a Phrase group is a number of phrases contained in a phrase library grouped according to logical criteria. A phrase can be assigned to only one phrase group.
Phrase set is grouping of phrases for a purpose which includes allowed phrases for a value assignment type and Default phrases for a value assignment type. A phrase can be assigned to a number of phrase sets.
Hope this helps you
Best Regards
Srinivas

What is the difference between quarterly patches and patch sets

Hello,
What is the difference between quarterly patches and patch sets?
Should we always apply the latest quarterly pathches?
Is it better to apply to the latest patch set if one can afford?

The quarterly patch sets are generally security fixes, or Critical Patch Updates (CPU). Oracle strongly recommends that the CPU patches are applied. CPU and quarterly patches do not change the release/version of the database.
The patch sets contain bug fixes and do change the release/version of the database.
As with all patches you should test them on a test database before deploying in production. If you have vendor supported applications you should contact your vendor before applying any patchsets.

Difference between SXPG_COMMAND_EXECUTE and Open data set mechanism

Can you please help me to know the difference between moving a file using FM "SXPG_COMMAND_EXECUTE" and moving file using "open data set - transfer file- close data set" mechanism?

Through 'SXPG_COMMAND_EXECUTE' u can execute a External command (ie.. UNIX /Windows/OS/400) In ABAP programming..
for Conversion Of Aplication server File/Move the file from one directory to Other...
The Command must be present in SM69.
Using this function module'SXPG_COMMAND_EXECUTE' , you can check the authorization of a user to execute a particular external command and run the command:
With the arguments specified in ADDITIONAL_PARAMETERS
On the target host system defined by OPERATINGSYSTEM and TARGETSYSTEM
If an SAP profile parameter is inserted in the portion of the command stored in the database, then the value of this parameter is substituted into the command. If an SAP application server is active on the target system (TARGETSYSTEM), then the profile parameter values are read from the profile that is active on that system. No parameter substitution is made in ADDITIONAL_PARAMETERS.
After substitution, the command is checked for the presence of "dangerous" characters such as the semicolon ( ; ) on UNIX systems.
If an additional "security function module" is specified in the command definition, this function module is also called in the course of processingebenfalls. This function module can prevent execution of the command.
If the authorization checks complete successfully, the command is run on the target host system.
Through Open Data Set u can read and write the file in the same directory...
Thnaks,
SD
Moderator message: copy/paste without credit, points removed, please do not repeat!
http://www.google.de/search?hl=de&q=%22youcanchecktheauthorizationofauserto+execute%22&meta=&aq=f&aqi=&aql=&oq=&gs_rfai=
http://www.google.de/search?hl=de&q=%22Aftersubstitution%2Cthecommandischeckedforthepresence%22&meta=&aq=f&aqi=&aql=&oq=&gs_rfai=
Edited by: Thomas Zloch on Aug 17, 2010 12:47 PM

What's the difference between R/3 Enterprise extension set 1.10 and 2.00 ?

Hi there,
Anyone know how to find the difference between 47x110 and 47x200. I want to install the new IDES R3 which is 47x200 (I found some program/source that I need in this version). But our PRD system is 47x110.
thanks in advance,
Doris

Hi Doris
SAP R/3 Enterprise Core has been assigned the release number
4.70. This signifies its similarity to SAP R/3 4.6C and indicates
that the core can be independently upgraded and maintained.
SAP R/3 Enterprise Extensions are selectively deployable and
have their own release cycles. The name of each SAP R/3 Enterprise Extension reflects its relevant application area.
e.g.
SAP R/3 Enterprise Extension Set 1.10 includes HR,SCM and Fin modules
SAP R/3 Enterprise Extension Set 2.00 includes all above and additionaly PLM module.
Award points if Helpful
Regards
Umesh

L_TO_CONFIRM - differences posted to 99 - how to set this stock as blocked?

I am using fuction module L_TO_CONFIRM for some RF processing and I have been asked that where the differences are posted to 999, can this stock also be blocked so as to remove it from the view of MRP.
I cannot see how I can do this with this function module as there is no flag to set it to blocked.
Does anyone have any ideas?
Regards
Larissa Maryniuk

Larissa,
A useful note on top of Jurgen's.
Potentially you can cause havoc using LI21 (Clear Differences in IM) as it will allow you to enter any Storage Type. There is a table where you can exclude Storage Types from being used with LI21. It makes sense to set this for all Storage Types (except 999 !).
IMG \ LE \ WM \ Activities \ Physical Inventory \ Clear Differences (Interface to IM)
2nd option.
Regards,
Nick

Difference between Gmail and Exchange when setting up email

Hi all,
When adding my Gmail email details in Settings in iOS7 (Via Settings > Mail, Contacts, Calendars > Add Account) I’m presented with the options to use Exchange or Google.
I know back in the early days of the iOS it was always preferable to use Exchange as it synced everything on your phone perfectly (mail, contacts, calendar) but it seems that now the Google option is just as good…?
Other than the capability to push emails to my device (a function that I don't use anyway), is there any other difference between the Exchange and Google options when setting up email?
Thanks,
David

I've tested it out on my iOS7 5s; the calendar and contact syncing seems to work absolutely fine though?
This was in reference to the Google option. It syncs mail, calendar, contacts and notes all absolutely fine as far as I can see - I wanted to check I wasn't missing anything.
Any need to get narky there?

I'm using Acrobat Pro 11. When printing an email to PDF most of the time it cuts off the text on the right margin. Setting look OK and I've moved things around on the email, but that doesn't seem to make any difference. Is there an Adobe setting I'm missi

Like I said above, print to Adobe pdf and it wants to cut off the text on the right margin. I can't see to find a setting that changes this. Any ideas??

OK, so I have now found that this is apparently normal for iTunes, to only accept mpeg 4 movie files, all the searching I did before I must have worded it wrong because I couldn't find anything about this, incredibly. Had been looking for why iTunes won't take all the files it previously did, like if it had been changed, and it hasn't, it's allegedly always taken only mpeg 4 files. Also I had been searching for why iTunes crashes every time I try and add/import anything but mpeg 4 files, and even sometimes with mpeg 4 files. That isn't normal, it's supposed to just do nothing apparently as I've just found out. So for these reasons I didn't find the answer despite my searching all over the web.
So I guess that answers my own question now, but I'm still perplexed as to why I absolutely, definitely, without any doubt, had several hundred movies of a few different video file types loaded, accessible and playable in my iTunes library that everything here claims iTunes never accepted. It apparently shouldn't have been possible for me to have done this, but for probably 10 years it's been this way.
Perhaps since I don't remember adding these files to iTunes anymore recently than maybe 6 or 7 years ago, the iTunes back then did accept all kinds of file types? Or could I have somehow had some video codecs or software that expanded the capability of my movie players like Quicktime Player that unwittingly also allowed iTunes to take those files as well? All I know is somehow it worked! So now my question is how did I have it working before, so that maybe I can make it work again.

Acrobat 9.5 Pro now FAILS to detect page size differences if the Trim Box is set

Previous versions of Acrobat and even of Acrobat 9.x would flag pages whose "size or orientation is different" if the actual media box size was different from page to page. However, it seems that 9.5 now will not flag a document that has pages without a trim box whose media box matches pages with a trim box that are larger.
This is completely counter-intuitive, as these pages would print at different sizes. Not all devices use the trim box setting in a PDF.
Can someone explain what changed in Acrobat between then and now and if there is a way to change it back?
Thank you.

1) Opened PDF where most of the pages have all page boxes set to zero, with media box (true page size) set to 6" x 9". One subset of pages has a media box of 6.25" x 9.25", but the trim box is set to 0.125" on all sides.
2) Ran a preflight profile with the option "Page size or orientation differs from page to page" set to "Error", as it has been on all previous versions of Acrobat.
3) "Page size or orientation differs from page to page" error does not get triggered.
4) Tried same preflight profile settings on same PDF in Acrobat 7. Error does get triggered.
5) Tried same preflight profile settings on same PDF on a copy of Acrobat 9 not fully updated to 9.5. Error does get triggered.
6) Tried on various machines with 9.5 update. Error does not get triggered on any.
I can only conclude that something has changed in the latest update.

Difference between text size in General setting and large type in Accessibility settings

Difference between text size in General settings and large type in Accessibility settings?

None that I can see.

Differences between Linux and Solaris command set

Hi,
It is complicated to learn Solaris? Is the set of commands the same of Linux?
It is because is more simple for me to find a Linux Admin book than a Solaris book.
Thanks.
Lorenzo

BTW: You might want to start with this peace if information:
http://wwws.sun.com/software/whitepapers/linux/linux_overview.pdf
One remark: this Blue/white paper is written for audience known to Solaris and new to Linux, but usefull the other way around.
Specially table 1 is very usefull !
Good luck, and Welcome as new Solaris Administrator.
Eric.

FrameMaker10: Cause of difference between actual display and element setting

Hello, everyone
In using FM10 in Windows7, I've experienced the problems below.
1) A black square(■) is displayed while an ASTARISK element is set in the structure view. ("*1" is displayed on another computer )
2) Different BODY elements are used but no return is inserted between the sentences.
Acutually, I already know the solution to the problems: import an element definition to the file.
If you know the (possible) "cause" of the problem, please let me know.
[Message moved to FM Structured Forum by moderator]

I'm starting to grasp, where your problem might come from.
You're saying, that when you create a new document and use those elements you mentioned, you are getting those weird results?
And, after you import the element definitions, everything is as it should be again?
Then all you need to do, is to get your system administrator or whoever is responsible for your FM setup to update the standard templates you are using to include the latest element definition file (EDD), as it seems you are using an outdated or incorrect version of it.
The issue, that you are receiving a square bullet instead of "*1" means, that the ASTERISK element is mapped to some other text brick (the square bullet) than in the current version of your EDD (which is embedded in your template file).
The BODY element seems to be mapped to a character style instead of a paragraph style in this outdated version - meaning you will have no line breaks, as it is treated as an inline element.
So, in short terms: get in contact with the guy that did set up your structure definitions/ templates. He should be able to fix your problems in no time.
If the guy isn't in the company anymore or if those structures were created by some 3rd party company, you are going to need to do some more research on how to change templates and their respective element definitions.
It is most important for your work, that at least one person in your company has the knowledge how to fiddle with those things, or you might be facing more serious issues in the future.
On a side note: binary FM files are the ones using *.fm as an extension. Those files include everything the document consists of: your document, the template, the element definitions and everything else.
As a counterpart, XML files only contain your document and the structure markup. Templates, element definitions and almost everything else is applied to those files upon import in Framemaker, or excluded upon export.
-Alex

Import error due to character set difference?

hi,
hoping anyone to explain reason for the following import error.
here's the situation,
- export client used WE8MSWIN1252 charset (release v10.02.01)
- import server used WE8ISO8859P1 charset (release v10.1.0.4)
all tables appeared to be imported without error, except that import terminated unsuccesfully due to oracle error 2248
"ALTER SESSION SET PLSQL_OPTIMIZE_LEVEL =1 NLS-LENGTH_SEMANTICS = 'BYTE' PLSQL_CODE_TYPE = 'INTERPRETED' PLSQL_DEBUG = FALSE PLSQL_WARNING = 'DISABLE:ALL' PLSQL_CCFLAGS =''"
ORA-02248: invalid option for ALTER SESSION
was error due to the difference release version? char set conversion to non superset?
appreciate any help pls

It is difficult to say what is the current state of the database, so it is recommended to reexport and reimport the object definitions. You may miss some other stuff like object types, contraints, etc. Table data should be OK, so reexport should not include data.
As far as character sets are concerned, because of the difference between the export client character set and the import server character set, you may have lost some characters in the code range 0x80-0x9f. This includes Euro sign, TM, sign, "smart" quotes, en- and em-dash, etc. Use the Windows charmap.exe to see all the codes. If you have some of these codes in the source database, you have lost them on import (they got converted to the reverse quotation mark code 0xbf).
-- Sergiusz

Setting up site to site vpn with cisco asa 5505

I have a cisco asa 5505 that needs to be set up for site to site vpn to a cisco asa 5500. The 5505 is the remote office and the 5500 is the main office.
IP of remote office router is 71.37.178.142
IP of the main office firewall is 209.117.141.82
Can someone tell me if my config is correct, this is the first time I am setting this up and it can not be tested until I set it up at the remote office. I would rather know its correct before I go.
ciscoasa# show run
: Saved
ASA Version 7.2(4)
hostname ciscoasa
domain-name default.domain.invalid
enable password TMACBloMlcBsq1kp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 host 209.117.141.82
access-list inside_nat0_outbound extended permit ip host 71.37.178.142 host 209.117.141.82
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group5
crypto map outside_map 1 set peer 209.117.141.82
crypto map outside_map 1 set transform-set ESP-AES-256-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn username [email protected] password ********* store-local
dhcpd auto_config outside
dhcpd address 192.168.1.2-192.168.1.129 inside
dhcpd enable inside
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
service-policy global_policy global
prompt hostname context
Cryptochecksum:7e338fb2bf32a9ceb89560b314a5ef6c
: end
ciscoasa#
Thanks!

Hi Mandy,
By using following access list define Peer IP as source and destination
access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
you are not defining the interesting traffic / subnets from both ends.
Make some number ACL 101 as you do not have to write the extended keyword then if you like as follows, or else NAME aCL will also work:
access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 101 remark CCP_ACL Category=4 access-list 101 remark IPSEC Rule
!.1..source subnet(called local encryption domain) at your end 192.168.200.0
!..2.and destination subnet(called remote encryption domain)at other end 192.168.100.0 !.3..I mean you have to define what subnets you need to communicate between which are behind these firewalls
!..4...Local Subnets behind IP of the main office firewall is 209.117.141.82 say
!...at your end 192.168.200.0
!..5.Remote Subnets behind IP of remote office router is 71.37.178.142 say
!...at other end 192.168.100.0
Please use Baisc Steps as follows:
A. Configuration in your MAIN office having IP = 209.117.141.82 (follow step 1 to 6)
Step 1.
Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
Step 2.
Config ISAKMP Policy with minimum 4 parameters are to be config for
crypto isakmp policy 10
authentication pre-share ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
hash sha   ---> 3rd parameter of ISAKMP Policy is OK
group 5 ---> 4th parameter of ISAKMP Policy is OK
lifetime 86400 ------ > this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
Step 3.
Define Preshared key or PKI which you will use with other side Peer address 71.37.178.142, either key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
Here in your case in step 2 Authentication is using PSK, looks you have not defines Password
Use following command:
crypto isakmp key 0 CISCO123 address 71.37.178.142
or , but not both
crypto isakmp key 6 CISCO123 address71.37.178.142
step 4.
Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
Here is yours one:
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
or
crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
ah-sha-hmac or ah-md5-hmac
crypto ipsec transform-set TSET1 ah-sha-hmac
or
crypto ipsec transform-set TSET1 ah-md5-hmac
Step 5.
Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
crypto map ipsec-isakmp
1. Define peer -- called WHO to set tunnel with
2. Define or call WHICH - Transform Set
3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
Like in your case it is but ipsec-isakmp keyword missing in the ;ast
crypto map outside_map 10 ipsec-isakmp
1. set peer 209.117.141.82 -----> is correct as this is your other side peer called WHO in my step
2. set transform-set TSET1 -----> is correct as this is WHICH, and only one transform set can be called
!..In you case it is correct
!...set transform-set ESP-AES-256-SHA (also correct)
3. match address outside_1_cryptomap ---->Name of the extended ACL define as WHAT to pass through this tunnel
4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
Step 6.
Now apply this one crypto MAP to your OUTSIDE interface always
interface outside
crypto map outside_map
Configure the same but just change ACL on other end in step one by reversing source and destination
and also set the peer IP of this router in other end.
So other side config should look as follows:
B. Configuration in oyur Remote PEER IP having IP = 71.37.178.142 (follow step 7 to 12)
Step 7.
Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
access-list outside_1_cryptomap extended ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
Step 8.
Config ISAKMP Policy with minimum 4 parameters are to be config for
crypto isakmp policy 10
authentication pre-share ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
hash sha   ---> 3rd parameter of ISAKMP Policy is OK
group 5 ---> 4th parameter of ISAKMP Policy is OK
lifetime 86400 ------ > this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
Step 9.
Define Preshared key or PKI which you will use with other side Peer address key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
Here in your case in step 8 Authentication is using PSK, looks you have not defines Password
Use following command:
crypto isakmp key 0 CISCO123 address 209.117.141.82
or , but not both
crypto isakmp key 6 CISCO123 address 209.117.141.82
step 10.
Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
Here is yours one:
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
or
crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
ah-sha-hmac or ah-md5-hmac
crypto ipsec transform-set TSET1 ah-sha-hmac
or
crypto ipsec transform-set TSET1 ah-md5-hmac
Step 11.
Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
crypto map    ipsec-isakmp
1. Define peer -- called WHO to set tunnel with
2. Define or call WHICH - Transform Set, only one is permissible
3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
Like in your case it is but ipsec-isakmp keyword missing in the ;ast
crypto map outside_map 10 ipsec-isakmp
1. set peer 209.117.141.82 -----> is correct as this is your other side peer called WHO in my step
2. set transform-set TSET1 -----> is correct as this is WHICH, and only one transform set can be called
!..In you case it is correct
!...set transform-set ESP-AES-256-SHA (also correct)
3. match address outside_1_cryptomap ---->Name of the extended ACL define as WHAT to pass through this tunnel
4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
Step 12.
Now apply this one crypto MAP to your OUTSIDE interface always
interface outside
crypto map outside_map
Now initite a ping
Here is for your summary:
IPSec: Site to Site - Routers
Configuration Steps
Phase 1
Step 1: Configure Mirrored ACL/Crypto ACL       for Interesting Traffic
Step 2: Configure ISAKMP Policy
Step 3: Configure ISAKMP Key
Phase 2
Step 4: Configure Transform Set
Step 5: Configure Crypto Map
Step 6: Apply Crypto Map to an Interface
To debug for Phase 1 and Phase 2. Store it in buffer without displaying logs on terminal.
Router#debug crpyto isakmp
Router#debug crpyto ipsec
Router(config)# logging buffer 7
Router(config)# logging buffer 99999
Router(config)# logging console 6
Router# clear logging
Configuration
In R1:
(config)# access-list 101 permit ipo host 10.1.1.1 host      10.1.2.1
(config)# crypto isakmp policy 10
(config-policy)# encryption 3des
(config-policy)# authentication pre-share
(config-policy)# group 2
(config-policy)# hash sha1
(config)# crypto isakmp key 0 cisco address 2.2.2.1
(config)# crypto ipsec transform-set TSET esp-3des      sha-aes-hmac
(config)# crypto map CMAP 10 ipsec-isakmp
(config-crypto-map)# set peer 2.2.2.1
(config-crypto-map)# match address 101
(config-crypto-map)# set transform-set TSET
(config)# int f0/0
(config-if)# crypto map CMAP
Similarly in R2
Verification Commands
#show crypto isakmp SA
#show crypto ipsec SA
Change to Transport Mode, add the following command in Step 4:
(config-tranform-set)# mode transport
Even after doing this change, the ipsec negotiation will still be done through tunnel mode if pinged from Loopback to Loopback. To overcome this we make changes to ACL.
Change to Aggressive Mode, replace the Step 3 command with these commands in R1:
(config)# crypto isakmp peer address 2.2.2.1
(config-peer)# set aggressive-mode password cisco
(config-peer)# set aggressive-mode clien-endpoint       ipv4-address 2.2.2.1
Similarly on R2.
The below process is for the negotiation using RSA-SIG (PKI) as authentication type
Debug Process:
After we debug, we can see the negotiation between the two peers. The first packet of the interesting traffic triggers the ISAKMP (Phase1) negotiation. Important messages are marked in BOLD and explanation in RED
R2(config)#do ping 10.1.1.1 so lo0 // Interesting Traffic
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
Mar 2 16:18:42.939: ISAKMP:(0): SA request profile is (NULL) // Router tried to find any IPSec SA matching the outgoing connection but no valid SA has been found in Security Association Database (SADB)
Mar 2 16:18:42.939: ISAKMP: Created a peer struct for 20.1.1.10, peer port 500
Mar 2 16:18:42.939: ISAKMP: New peer created peer = 0x46519678 peer_handle = 0x8000000D
Mar 2 16:18:42.939: ISAKMP: Locking peer struct 0x46519678, refcount 1 for isakmp_initiator
Mar 2 16:18:42.939: ISAKMP: local port 500, remote port 500
Mar 2 16:18:42.939: ISAKMP: set new node 0 to QM_IDLE
Mar 2 16:18:42.939: ISAKMP:(0):insert sa successfully sa = 4542B818
Mar 2 16:18:42.939: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. // Not an error. By default it is configured for Main Mode
Mar 2 16:18:42.939: ISAKMP:(0):No pre-shared key with 20.1.1.10! // Since we are using RSA Signature, this message. If we use pre-share, this is where it would indicate so!
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-07 ID
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-03 ID
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-02 ID
Mar 2 16:18:42.939: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
Mar 2 16:18:42.939: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
Mar 2 16:18:42.943: ISAKMP:(0): beginning Main Mode exchange
Mar 2 16:18:42.943: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_NO_STATE // Sending ISAKMP Policy to peer
Mar 2 16:18:42.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
Mar 2 16:18:42.943: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_NO_STATE // Sending ISAKMP Policy to peer
Mar 2 16:18:42.947: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 2 16:18:42.947: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2
Mar 2 16:18:42.947: ISAKMP:(0): processing SA payload. message ID = 0
Mar 2 16:18:42.947: ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch // Do not worry about this! Not an ERROR!
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
Mar 2 16:18:42.947:.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
R2(config)# ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0): processing IKE frag vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0):Support for IKE Fragmentation not enabled
Mar 2 16:18:42.947: ISAKMP : Scanning profiles for xauth ...
Mar 2 16:18:42.947: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
Mar 2 16:18:42.947: ISAKMP:      encryption 3DES-CBC
Mar 2 16:18:42.947: ISAKMP:      hash SHA
Mar 2 16:18:42.947: ISAKMP:      default group 2
Mar 2 16:18:42.947: ISAKMP:      auth RSA sig
Mar 2 16:18:42.947: ISAKMP:      life type in seconds
Mar 2 16:18:42.947: ISAKMP:      life duration (VPI) of 0x0 0x1 0x51 0x80
Mar 2 16:18:42.947: ISAKMP:(0):atts are acceptable. Next payload is 0
Mar 2 16:18:42.947: ISAKMP:(0):Acceptable atts:actual life: 0
Mar 2 16:18:42.947: ISAKMP:(0):Acceptable atts:life: 0
Mar 2 16:18:42.947: ISAKMP:(0):Fill atts in sa vpi_length:4
Mar 2 16:18:42.947: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
Mar 2 16:18:42.947: ISAKMP:(0):Returning Actual lifetime: 86400
Mar 2 16:18:42.947: ISAKMP:(0)::Started lifetime timer: 86400.
Mar 2 16:18:42.947: ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
Mar 2 16:18:42.947: ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.951: ISAKMP:(0): processing IKE frag vendor id payload
Mar 2 16:18:42.951: ISAKMP:(0):Support for IKE Fragmentation not enabled
Mar 2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM2
Mar 2 16:18:42.951: ISAKMP (0): constructing CERT_REQ for issuer cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
Mar 2 16:18:42.951: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_SA_SETUP // Sending Key Exchange Information to peer
Mar 2 16:18:42.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
Mar 2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3
Mar 2 16:18:42.955: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_SA_SETUP // Receive key exchange information from peer
Mar 2 16:18:42.955: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 2 16:18:42.955: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_I_MM4
Mar 2 16:18:42.959: ISAKMP:(0): processing KE payload. message ID = 0
Mar 2 16:18:43.003: ISAKMP:(0): processing NONCE payload. message ID = 0
Mar 2 16:18:43.007: ISAKMP:(1008): processing CERT_REQ payload. message ID = 0
Mar 2 16:18:43.007: ISAKMP:(1008): peer wants a CT_X509_SIGNATURE cert
Mar 2 16:18:43.007: ISAKMP:(1008): peer wants cert issued by cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
Mar 2 16:18:43.007: Choosing trustpoint CA_Server as issuer
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008): vendor ID is Unity
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008): vendor ID seems Unity/DPD but major 180 mismatch
Mar 2 16:18:43.007: ISAKMP:(1008): vendor ID is XAUTH
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008): speaking to another IOS box!
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008):vendor ID seems Unity/DPD but hash mismatch
Mar 2 16:18:43.007: ISAKMP:received payload type 20
Mar 2 16:18:43.007: ISAKMP (1008): His hash no match - this node outside NAT
Mar 2 16:18:43.007: ISAKMP:received payload type 20
Mar 2 16:18:43.007: ISAKMP (1008): No NAT Found for self or peer
Mar 2 16:18:43.007: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 2 16:18:43.007: ISAKMP:(1008):Old State = IKE_I_MM4 New State = IKE_I_MM4
Mar 2 16:18:43.011: ISAKMP:(1008):Send initial contact
Mar 2 16:18:43.011: ISAKMP:(1008):My ID configured as IPv4 Addr, but Addr not in Cert!
Mar 2 16:18:43.011: ISAKMP:(1008):Using FQDN as My ID
Mar 2 16:18:43.011: ISAKMP:(1008):SA is doing RSA signature authentication using id type ID_FQDN
Mar 2 16:18:43.011: ISAKMP (1008): ID payload
          next-payload : 6
          type         : 2
          FQDN name    : R2
          protocol     : 17
          port         : 500
          length       : 10
Mar 2 16:18:43.011: ISAKMP:(1008):Total payload length: 10
Mar 2 16:18:43.019: ISAKMP (1008): constructing CERT payload for hostname=R2+serialNumber=FHK1502F2H8
Mar 2 16:18:43.019: ISAKMP:(1008): using the CA_Server trustpoint's keypair to sign
Mar 2 16:18:43.035: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_KEY_EXCH
Mar 2 16:18:43.035: ISAKMP:(1008):Sending an IKE IPv4 Packet.
Mar 2 16:18:43.035: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 2 16:18:43.035: ISAKMP:(1008):Old State = IKE_I_MM4 New State = IKE_I_MM5
Mar 2 16:18:43.047: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_KEY_EXCH
// "MM_KEY_EXCH" indicates that the peers have exchanged DH Public keys and generated a shared secret!
Mar 2 16:18:43.047: ISAKMP:(1008): processing ID payload. message ID = 0
Mar 2 16:18:43.047: ISAKMP (1008): ID payload
          next-payload : 6
          type         : 2
          FQDN name    : ASA1
          protocol     : 0
          port         : 0
          length       : 12
Mar 2 16:18:43.047: ISAKMP:(0):: peer matches *none* of the profiles // Normal Message! Not an error!
Mar 2 16:18:43.047: ISAKMP:(1008): processing CERT payload. message ID = 0
Mar 2 16:18:43.047: ISAKMP:(1008): processing a CT_X509_SIGNATURE cert
Mar 2 16:18:43.051: ISAKMP:(1008): peer's pubkey isn't cached
Mar 2 16:18:43.059: ISAKMP:(1008): Unable to get DN from certificate!
Mar 2 16:18:43.059: ISAKMP:(1008): Cert presented by peer contains no OU field.
Mar 2 16:18:43.059: ISAKMP:(0):: peer matches *none* of the profiles
Mar 2 16:18:43.063: ISAKMP:(1008): processing SIG payload. message ID = 0
Mar 2 16:18:43.067: ISAKMP:received payload type 17
Mar 2 16:18:43.067: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.067: ISAKMP:(1008): vendor ID is DPD
Mar 2 16:18:43.067: ISAKMP:(1008):SA authentication status:
          authenticated
Mar 2 16:18:43.067: ISAKMP:(1008):SA has been authenticated with 20.1.1.10
Mar 2 16:18:43.067: ISAKMP: Trying to insert a peer 40.1.1.1/20.1.1.10/500/, and inserted successfully 46519678. // SA inserted into SADB
Mar 2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM5 New State = IKE_I_MM6
Mar 2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM6 New State = IKE_I_MM6
Mar 2 16:18:43.071: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 2 16:18:43.071: ISAKMP:(1008):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE
Mar 2 16:18:43.071: ISAKMP:(1008):beginning Quick Mode exchange, M-ID of -1523793378
Mar 2 16:18:43.071: ISAKMP:(1008):QM Initiator gets spi
Mar 2 16:18:43.075: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE
Mar 2 16:18:43.075: ISAKMP:(1008):Sending an IKE IPv4 Packet.
Mar 2 16:18:43.075: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
Mar 2 16:18:43.075: ISAKMP:(1008):Old State = IKE_QM_READY New State = IKE_QM_I_QM1
Mar 2 16:18:43.075: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Mar 2 16:18:43.075: ISAKMP:(1008):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Mar 2 16:18:43.079: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) QM_IDLE // IPSec Policies
Mar 2 16:18:43.079: ISAKMP:(1008): processing HASH payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008): processing SA payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008):Checking IPSec proposal 1
Mar 2 16:18:43.079: ISAKMP: transform 1, ESP_3DES
Mar 2 16:18:43.079: ISAKMP:   attributes in transform:
Mar 2 16:18:43.079: ISAKMP:      SA life type in seconds
Mar 2 16:18:43.079: ISAKMP:      SA life duration (basic) of 3600
Mar 2 16:18:43.079: ISAKMP:      SA life type in kilobytes
Mar 2 16:18:43.079: ISAKMP:      SA life duration (VPI) of 0x0 0x46 0x50 0x0
Mar 2 16:18:43.079: ISAKMP:      encaps is 1 (Tunnel)
Mar 2 16:18:43.079: ISAKMP:      authenticator is HMAC-SHA
Mar 2 16:18:43.079: ISAKMP:(1008):atts are acceptable. // IPSec attributes are acceptable!
Mar 2 16:18:43.079: ISAKMP:(1008): processing NONCE payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
Mar 2 16:18:43.083: ISAKMP:(1008): Creating IPSec SAs
Mar 2 16:18:43.083:         inbound SA from 20.1.1.10 to 40.1.1.1 (f/i) 0/ 0
          (proxy 1.1.1.1 to 2.2.2.2)
Mar 2 16:18:43.083:         has spi 0xA9A66D46 and conn_id 0
Mar 2 16:18:43.083:         lifetime of 3600 seconds
Mar 2 16:18:43.083:         lifetime of 4608000 kilobytes
Mar 2 16:18:43.083:         outbound SA from 40.1.1.1 to 20.1.1.10 (f/i) 0/0
        (proxy 2.2.2.2 to 1.1.1.1)
Mar 2 16:18:43.083:         has spi 0x2B367FB4 and conn_id 0
Mar 2 16:18:43.083:         lifetime of 3600 seconds
Mar 2 16:18:43.083:         lifetime of 4608000 kilobytes
Mar 2 16:18:43.083: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE
Mar 2 16:18:43.083: ISAKMP:(1008):Sending an IKE IPv4 Packet.
Mar 2 16:18:43.083: ISAKMP:(1008):deleting node -1523793378 error FALSE reason "No Error"
Mar 2 16:18:43.083: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
Mar 2 16:18:43.083: ISAKMP:(1008):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE // At this point tunnels are up and ready to pass traffic!
Verification Commands
#show crypto isakmp SA
#show crypto ipsec SA
Kindly rate if you find the explanation useful !!
Best Regards
Sachin Garg

Differences: PI 7.0, 7.1: Setting up SPROXY

Similar Messages

Maybe you are looking for