Enabling ICMP on cisco acs1120

Hi All ,
            We have downgraded cisco acs appliance 1120 from ACS 5.0 to ACS 4.2.1.15 , when we perform ICMP ping request to acs appliance its not responding , But i can do ping test from acs appliance on console mode not  from GUI mode .
             Is there any option to enable ICMP Ping response on cisco acs 1120 . else any patch to be upgraded to perform this action , my requirement is enable ICMP ping on acs appliance for troubleshooting . instead always check with telnet x.x.x.x 2002 for service responding

Hi Santosh,
The pathc available on cisco.com download page.
The path is as follows:
www.cisco.com > support > download software >Products > Security > Identity Management > Cisco Secure Access Control Server  Solution Engine > Cisco Secure Access Control Server  Solution Engine 4.2 > Secure Access Control Server (ACS)  Solution Engine > 4.2.0.124.
the patches are as follows:
appl_Acs4.x_PingTurnOff_With_CSAgentUpdate_1_Patch.zip
appl_Acs4.x_PingTurnOn_With_CSAgentUpdate_1_Patch.zip
You will need a valid software download contract to download the patches.
Hope this helps.
Regards,
Anisha
P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.

Similar Messages

  • Internet Sloww after enabling IPS on Cisco 5510

    I have recently enabled IPS on Cisco 5510, after we are experiencing slow internet respond. We are sending all traffic to IPS for analysis.

    Based on your needs, configuration and equipment; yes, that can happen with IPS. What's your question?

  • Enabling NPIV in CISCO MDS 9500 Series

                       Hello!!!
    If i could get the response for my query.
    I need to enable NPIV as we have VM's to be created and allocate SAN storage to them so my CISCO MDS needs to have NPIV enabled. Following queries linked with this:
    1. Can i enabled NPIV on single Fibre Channel Port or it gets enabled on the complete SAN Switch
    2. Does enabling NPIV impact any other SAN operation. Also my 2- sites are connected via ISL, so is it important to enable NPIV across all my sites or i can enable it only at 1 site where my VM hosts are located.
    3. Any reference document for NPIV and related zoning concept.
    Thanks in advance.
    Faizul Mufti
    9958766711

    Hi,
    1. Can i enabled NPIV on single Fibre Channel Port or it gets enabled on the complete SAN Switch
    whole switch
    feature npiv
    2. Does enabling NPIV impact any other SAN operation. Also my 2- sites are connected via ISL, so is it important to enable NPIV across all my sites or i can enable it only at 1 site where my VM hosts are located.
    Will not impact any other SAN operation.  Non-disruptive.
    "feature npiv" is local to the switch, not fabric wide.  Use this command on any switch you want multiple flogi's on a single interface.
    3. Any reference document for NPIV and related zoning concept.
    I suggest zoning by pwwn
    Regards,
    David

  • Block / Deny ICMP Traffic cisco asa 5512-x

    hi expert
    I have cisco asa 5512x for configure as firewall and sslvpn.
    my customer want block/Deny icmp traffic from interface outside without block anything.
    i've configure form cli :
    icmp deny any outside
    but from outside can't open sslvpn url and asdm.

    Hi,
    Access for the Anyconnect/ASDM does not depend on the ICMP permit/deny commands on the ASA device.
    If you want to block the Pings to the ASA interface use the command:-
    icmp deny any outside etc.
    What do you mean by "i can ping from outside." Plzz explain.
    Thanks and Regards,
    Vibhor Amrodia

  • How to keep a Fabric port always enable in a Cisco MDS 9000 Switch?

    Dear members:
    I work in Datacenter automation solutions using most part of time Virtualization softwares.
    I'm having an interst problem with a server while it is booting thru SAN using a logical volume stored in a EMC DMX4 array.
    We are trying to boot a VMWare ESX 4.1 OS, but when OS tries to change HBA BIOS driver to ESX device driver during boot process, the Server's HBA logged off from MDS Fabric that it is connected, ESX can't boot and I got a ESX standard prompt.
    I think that problem is becuase ESX 4.1 is taking too long to load Storage Drivers during boot process and the consequences is HBA logged off from Fabric.
    I already tried to change FLOGI parameters in HBA and Topology architecture, but I didn't have success.
    If a try to boot a Microsoft OS like Windows 2008, I don't have this behavior, and OS can boot from SAN without any problem.
    Please, if anyone have any idea about how to keep fabric port always enabled, let me know. Any idea or help is very welcome.
    Best Regards.
    Alexandre Nicolau

    Hi,
    You can take a look at this document:
    http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND_40/QoSCampus_40.html#wp1099352
    Hope this helps, please rate if it does.
    Kind regards,
    - Adrian.

  • Enabling SSH on Cisco 4507

    How do you configure ssh on Cisco 4507 ? I did "show ip ssh" and the log below is displayed as a result.
    Router#show ip ssh
    SSH Disabled - version 1.99
    %Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
    Authentication timeout: 120 secs; Authentication retries: 3
    Minimum expected Diffie Hellman key size : 1024 bits
    IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE
    Thanks.

    Hi,
    Check this link..
    http://www.cisco.com/en/US/tech/tk583/tk617/technologies_tech_note09186a00800949e2.shtml
    aaa related commands are not mandatory. You can even use local authentication. Also, make sure the IOS supports SSH.
    Do 'Shoe version' the IOS name contains 'k9' for crypto.
    hth
    MS

  • Enable "linemode" on Cisco IOS device

    Hi Experts,
    I would like to monitor some telnet traffic with a tcpdump/wireshark. As I know because of the mode between Telnet Client and Telnet Server these "double-characters" appears (when client type something):
    From Cisco device we can connect to another device in line mode with a command like this:
    connect 10.0.0.1 /line
    But is there a way to use this option on all my VTY lines, on my AccessServer (2811 router)?

    Hi,
    There isn't any specific command to activate a tunnel using 3DES and the only thing is, the isakmp and ipsec policies should match on both the sides, which you are already aware of.
    Regards,
    Arul

  • Need assistance in Ciscoworks LMS 3.2 for enable monitoring of cisco switches

    Hello,
    I am new to the ciscoworks LMS 3.2. I have a task to add a devices in ciscoworks and configure the SNMP on the devices and ciscoworks both. My company has bought the ciscoworks LMS3.2 in 2009 december since then one engineer has configured some devices in it but not fully. I tried to look into the guides and documentation but has huge stuff. My infrastructure lead also not familiar of ciscoworks tool. I know there is lot of documentation in it but I have very less time say this weekend I have to activate monitoring of devices in ciscoworks LMS 3.2. Can anyone please provide me the screenshots or step-by-step procedure to how to enable a device for monitoring who has prior experience on ciscoworks LMS 3.2.
    Regards,
    Ahmed

    Regarding SNMP reachabilty, you are the man........ thats true the firewall is blocking, because the subnets for the swithces which i m trying to add into the ciscoworks are not added into the firewall. Those subnets are different than the other 20 switches which are shown as reachable.
    and regarding the swithces which are already seen reachable, based on the document you have provided me for alert and monitoring of a device. I checked the DFM and configured as it is but still i didn't see any of the alert when I turned off one of the 4506E power supply. Is there something I am missing it.
    What do you need from my side to provide information or screenshot so that we can sort out the issue of monitoring of the device. Should I get an alert even if the device goes down?
    regards
    Ahmed

  • Cisco ASA Enable Password

    Hey,
    I am trying to change the enable password on cisco ASA 5510.  I run enable password <password>.  I log off, and log back in with my username/password and type en, it asks for a password and enter the password that I just set but it does not work.
    what am I missing?
    Thanks

    Are you using the local user database or a TACACS or RADIUS server to authenticate?
    If using a TACACS or RADIUS server enter your user password when you type enable.  If that doesn't work disconnect the TACACS or RADIUS server and try to enter the enable password you created.
    If using the local user database, are you sure that you are entering the password correctly?  Perhaps you typed it incorrectly when creating it and accidentally put a space at the begining or end?
    If non of the above work then you will need to perform a password recovery:
    Reboot your ASA
    Press the Esc key to enter ROMON mode when prompted
    Change the configuration register value to 0x41 by using the command confreg 0x41
    To tell the ASA to ignor the startup configuration issue the command confreg
         Current Configuration Register: 0x00000041
         Configuration Summary:
           boot default image from Flash
           ignore system configuration
         Do you wish to change this configuration? y/n [n]: y
        5.  At the prompt enter Y
        6.  Accept all default values when prompted
        7.  Reload the ASA by enter the command boot
        8.  When prompted enter enable and leave the password blank
        9.  Issue the command copy start run
      10.  Enter configuration mode configure terminal
      11.  Enter the command no config-register (the value is returned to its default value of 0x1)
      12.  Save your configuration copy run start
    Please remember to rate and select a correct answer

  • Cisco enable password

    Try this:
    enable secret 0 cisco
    service password encryption.
    The 5 in the command above says the password that follows is an encrypted password. After the service command the passwords should get encrypted in the configuration.
    vel 5 with password ‘password’
    #enable secret level 5 ?
    0 Specifies an UNENCRYPTED password will follow
    4 Specifies an SHA256 ENCRYPTED secret will follow
    5 Specifies a MD5 ENCRYPTED secret will follow
    LINE The UNENCRYPTED (cleartext) ‘enable’ secret

    If I type in: switch# "enable secret 5 cisco"
    and I exit out of global config mode and priv exec mode and then I type in "enable" I get prompted for the password and I type in "cisco" it asks for the password again, until finaly it says "bad secrets". What did I do wrong?
    However if I type in "enable password cisco" and go back into "enable" I type in the password and I can get into priv exec mode no problem.
    whats the problem?
    This topic first appeared in the Spiceworks Community

  • No Audio on either end Cisco Jabber for Windows over Cisco AnyConnect

    Our telephony staff is replacing our aging/unsupported VoIP system with a Cisco system and as the network tech, I'm trying to get Jabber for Windows to work over our AnyConnect VPN client.  Jabber to Cisco phone and Jabber to Jabber calls work fine within our LAN.  
    However, when I take a laptop to a separate internet connection and connect to the network via the VPN, I can't get any audio to pass across the system, in either direction.  If I call a phone on our LAN using the Jabber client (via AnyConnect), the phone rings and when I answer it, it's just dead air on both ends.  If I reverse the process, calling from the phone to the Jabber client, the same thing, Jabber client rings, but dead air both ways once I answer.  
    Things I can do from the laptop over the VPN connection:
    I'm able to get to the phone's web interface using that same laptop.
    I can ping the phone as well.  In fact, the VPN profile I'm using has full access to the entire VoIP Vlan including all IP traffic (all ~65,000 ports).
    Searching the address book also works fine.  I can search for staff and it's pulling directly from our Active Directory environment.
    Is there any special settings on the firewall that I need to setup to allow the voice traffic (which I assume is RTP traffic)?  I tried to add a service policy for RTP traffic, but that didn't seem to work...unless I built it wrong.
    Jabber for Windows - 10.6.0
    Cisco Anyconnect - 3.1.06079
    Cisco 5515-x ASA - 9.2

    I was able to resolve this on my own.  I thought that SIP traffic needed to be inspected via the global inspection policy in order for it to pass through the firewall. I ran into the same issue with ICMP traffic from an Anyconnect client to LAN devices. I had to enable ICMP in that policy for us to be able to ping LAN devices over the VPN tunnel. So when I saw that SIP was already being inspected by this policy, I moved on looking for other solutions. Then I stumbled deep within a Google search (almost hit the end of the Internet doing so) where someone mentioned that SIP shouldn’t be inspected by that policy. So I unchecked it and bam! Voice is now working over the anyconnect client to phones on the LAN. 

  • Cisco ASA 5505 - 2 internal Networks

    Hi new to ASA's,
    Been trying to get the following setup working for ages but can't see what I am missing:
    (Got image from another post but exactly what I want but cannot get working)
    I can get ping between subnets but nothing else and Lan 2 cannot get to internet.
    The reolution for this guy was the following I believe; (from his config he has ASA v8.2)
    same-security-traffic permit intra-interface
    access-list NONAT permit ip 192.168.50.0 255.255.255.0 10.0.50.0255.255.255.0
    access-list NONAT permit ip 10.0.50.0 255.255.255.0 192.168.50.0 255.255.255.0
    nat (inside) 0 access-list NONAT
    I have tried this but I have ASA v8.4 and whilst commands 1 - 3 work command 4 doesn't.
    I get a message about the command being deprecated. I couldn't find a new version I could understand.
    Hope nothing stupid and simple but any help greatly appreciated.
    BTW, I have reset my ASA back to defaults except internet access is working and internet LAN as I made some many changes I feared one my conflict with the other.
    Many thanks for any views or help.

    Hi Jumora,
    Thanks for the reply.
    The 192 network behind the ASA can access the internet but the 10 network past the 1841 router can't.
    I have setup tcp bypass already as that got me at least remote access to the PC's on the 10 network from the 192 network.
    I had the 1841 router set to use the interface on the 192 subnet as the route to the 0.0.0.0 0.0.0.0 network but I couldn't get out but have just changed this to go to the inside interface of the ASA and can now ping 8.8.8.8 for example but still not internet access.
    Also I have found that the ASA seems to occasionally when it feels like it block pings from the 10 subnet to devices in the 192 subnet...... annoying for testing! but I can still access shares even though the ping fails.
    e.g. as per above yesterday it stopped when I enabled icmp error inspection but when I switched that off it worked again. Then suddenly again today with no changes it has stopped working again, drives me nuts the inconsistency!
    I couldn't find an attach option for the show tech so it has made this post massive.... apologies for that....
    ASA5505# show tech
    Cisco Adaptive Security Appliance Software Version 8.4(4)1
    Device Manager Version 6.4(9)
    Compiled on Thu 14-Jun-12 11:20 by builders
    System image file is "disk0:/asa844-1-k8.bin"
    Config file at boot was "startup-config"
    ASA5505 up 8 days 23 hours
    Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW016 @ 0xfff00000, 2048KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
                                 Number of accelerators: 1
    0: Int: Internal-Data0/0    : address is 4403.a7a2.e7c7, irq 11
    1: Ext: Ethernet0/0         : address is 4403.a7a2.e7bf, irq 255
    2: Ext: Ethernet0/1         : address is 4403.a7a2.e7c0, irq 255
    3: Ext: Ethernet0/2         : address is 4403.a7a2.e7c1, irq 255
    4: Ext: Ethernet0/3         : address is 4403.a7a2.e7c2, irq 255
    5: Ext: Ethernet0/4         : address is 4403.a7a2.e7c3, irq 255
    6: Ext: Ethernet0/5         : address is 4403.a7a2.e7c4, irq 255
    7: Ext: Ethernet0/6         : address is 4403.a7a2.e7c5, irq 255
    8: Ext: Ethernet0/7         : address is 4403.a7a2.e7c6, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces       : 8              perpetual
    VLANs                             : 3              DMZ Restricted
    Dual ISPs                         : Disabled       perpetual
    VLAN Trunk Ports                  : 0              perpetual
    Inside Hosts                      : 50             perpetual
    Failover                          : Disabled       perpetual
    VPN-DES                           : Enabled        perpetual
    VPN-3DES-AES                      : Enabled        perpetual
    AnyConnect Premium Peers          : 2              perpetual
    AnyConnect Essentials             : Disabled       perpetual
    Other VPN Peers                   : 10             perpetual
    Total VPN Peers                   : 12             perpetual
    Shared License                    : Disabled       perpetual
    AnyConnect for Mobile             : Disabled       perpetual
    AnyConnect for Cisco VPN Phone    : Disabled       perpetual
    Advanced Endpoint Assessment      : Disabled       perpetual
    UC Phone Proxy Sessions           : 2              perpetual
    Total UC Proxy Sessions           : 2              perpetual
    Botnet Traffic Filter             : Disabled       perpetual
    Intercompany Media Engine         : Disabled       perpetual
    This platform has a Base license.
    Serial Number: JMX3434343T
    Running Permanent Activation Key: 0x8509ef7f 0x2cff5895 0xa4675895 0x7989798 0xc1323132
    Configuration register is 0x1
    Configuration last modified by enable_15 at 16:21:28.863 UTC Wed Oct 23 2013
    ------------------ show disk0: controller ------------------
    Flash Model: SMART CF
    ------------------ show clock ------------------
    04:43:59.822 UTC Thu Oct 24 2013
    ------------------ show crashinfo ------------------
    No crash file found.
    ------------------ show module ------------------
    Mod Card Type                                    Model              Serial No.
      0 ASA 5505 Adaptive Security Appliance         ASA5505            JMX3434343T
    Mod MAC Address Range                 Hw Version   Fw Version   Sw Version    
      0 1255.a3a4.e3bf to 1233.a4a4.e4c4  0.1          1.0(12)13    8.4(4)1
    Mod SSC Application Name           Status           SSC Application Version
    Mod Status             Data Plane Status     Compatibility
      0 Up Sys             Not Applicable        
    ------------------ show memory ------------------
    Free memory:         283382600 bytes (53%)
    Used memory:         253488312 bytes (47%)
    Total memory:        536870912 bytes (100%)
    ------------------ show conn count ------------------
    76 in use, 704 most used
    ------------------ show xlate count ------------------
    80 in use, 814 most used
    ------------------ show vpn-sessiondb summary ------------------
    No sessions to display.
    ------------------ show blocks ------------------
      SIZE    MAX    LOW    CNT
         0    400    399    400
    4    100     99     99
        80    347    332    347
       256    200    192    195
      1550   6374   6306   6371
      2048   1200   1199   1200
      2560    264    264    264
      4096    100     99    100
      8192    100     99    100
    16384    100     99    100
    65536     16     15     16
    CORE  LIMIT  ALLOC   HIGH    CNT       FAILED
       0  24576     26     26     25            0
    ------------------ show blocks queue history detail ------------------
    History buffer memory usage: 2832 bytes (default)
    History analysis time limit: 100 msec
    Please see 'show blocks exhaustion snapshot' for more information
    ------------------ show interface ------------------
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7bf, MTU not set
    IP address unassigned
    8257648 packets input, 9051289473 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    6222 switch ingress policy drops
    6399241 packets output, 1011134108 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 3
    Interface config status is active
    Interface state is active
    Interface Ethernet0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c0, MTU not set
    IP address unassigned
    1330699 packets input, 312264395 bytes, 0 no buffer
    Received 63097 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    1738131 packets output, 637935280 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 4
    Interface config status is active
    Interface state is active
    Interface Ethernet0/2 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c1, MTU not set
    IP address unassigned
    5028958 packets input, 693527818 bytes, 0 no buffer
    Received 28835 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    1 switch ingress policy drops
    7782140 packets output, 8316018900 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 5
    Interface config status is active
    Interface state is active
    Interface Ethernet0/3 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c2, MTU not set
    IP address unassigned
    17048409 packets input, 21350059442 bytes, 0 no buffer
    Received 75081 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    18 switch ingress policy drops
    8319277 packets output, 5138543287 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 6
    Interface config status is active
    Interface state is active
    Interface Ethernet0/4 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex, Auto-Speed
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c3, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 7
    Interface config status is not active
    Interface state is active
    Interface Ethernet0/5 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex, Auto-Speed
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c4, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 8
    Interface config status is not active
    Interface state is active
    Interface Ethernet0/6 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex, Auto-Speed
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c5, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 9
    Interface config status is not active
    Interface state is active
    Interface Ethernet0/7 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c6, MTU not set
    IP address unassigned
    7293552 packets input, 4521902362 bytes, 0 no buffer
    Received 6520 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    16232858 packets output, 21234947011 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 10
    Interface config status is active
    Interface state is active
    Interface Internal-Data0/0 "", is up, line protocol is up
      Hardware is y88acs06, BW 1000 Mbps, DLY 10 usec
    (Full-duplex), (1000 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    MAC address 4403.a2a2.e2c2, MTU not set
    IP address unassigned
    15222257 packets input, 10134321711 bytes, 0 no buffer
    Received 173531 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops, 0 demux drops
    15128507 packets output, 10256870512 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 input reset drops, 0 output reset drops, 0 tx hangs
    input queue (blocks free curr/low): hardware (512/487)
    output queue (blocks free curr/low): hardware (512/450)
      Control Point Interface States:
    Interface number is 2
    Interface config status is active
    Interface state is active
    Interface Internal-Data0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 1000 Mbps, DLY 10 usec
    (Full-duplex), (1000 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    MAC address 0000.0003.0002, MTU not set
    IP address unassigned
    15128465 packets input, 10256855882 bytes, 0 no buffer
    Received 1967 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 switch ingress policy drops
    15222217 packets output, 10134318430 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 11
    Interface config status is active
    Interface state is active
    Interface Vlan1 "inside", is up, line protocol is up
      Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
    MAC address 4403.a7a2.e7c7, MTU 1500
    IP address 192.168.1.1, subnet mask 255.255.255.0
      Traffic Statistics for "inside":
    4183727 packets input, 523675346 bytes
    5702790 packets output, 5851485425 bytes
    142576 packets dropped
          1 minute input rate 22 pkts/sec,  2839 bytes/sec
          1 minute output rate 30 pkts/sec,  22751 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 33 pkts/sec,  3746 bytes/sec
          5 minute output rate 46 pkts/sec,  20906 bytes/sec
          5 minute drop rate, 1 pkts/sec
      Control Point Interface States:
    Interface number is 14
    Interface config status is active
    Interface state is active
    Interface Vlan2 "outside", is up, line protocol is up
      Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
    MAC address 4403.a7a2.e7c7, MTU 1492
    IP address 98.22.77.33, subnet mask 255.255.255.255
      Traffic Statistics for "outside":
    10541983 packets input, 11433817622 bytes
    3793777 packets output, 526586888 bytes
    13654 packets dropped
          1 minute input rate 47 pkts/sec,  41657 bytes/sec
          1 minute output rate 18 pkts/sec,  2802 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 80 pkts/sec,  38519 bytes/sec
          5 minute output rate 29 pkts/sec,  3749 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 15
    Interface config status is active
    Interface state is active
    Interface Virtual0 "_internal_loopback", is up, line protocol is up
      Hardware is Virtual          MAC address 0000.0000.0000, MTU 1500
    IP address 127.0.0.1, subnet mask 255.255.255.0
      Traffic Statistics for "_internal_loopback":
    1 packets input, 28 bytes
    1 packets output, 28 bytes
    1 packets dropped
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 12
    Interface config status is active
    Interface state is active
    ------------------ show cpu usage ------------------
    CPU utilization for 5 seconds = 12%; 1 minute: 8%; 5 minutes: 8%
    ------------------ show cpu hogging process ------------------
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 1, MAXHOG: 23, LASTHOG: 23
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853e1f4 (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 23, LASTHOG: 23
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853e1f4 (suspend)
    Call stack:   0x0853e1f4  0x0853ec36  0x0854182c  0x0869cc4b  0x08415ae7  0x0840ae40  0x0806e6cf
                  0x08aade2b  0x0806e6cf  0x084a0a44  0x0849986d  0x08499aac  0x08499dd6  0x084a0909
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 2, MAXHOG: 18, LASTHOG: 18
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853fb48 (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 2, MAXHOG: 18, LASTHOG: 18
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853fb48 (suspend)
    Call stack:   0x0853fb48  0x0853fd1d  0x0853e1bc  0x0853ec36  0x0854182c  0x0869cc4b  0x08415ae7
          0x0840ae40  0x0806e6cf  0x08aade2b  0x0806e6cf  0x084a0a44  0x0849986d  0x08499aac
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 2, MAXHOG: 24, LASTHOG: 24
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x084167d2 (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 2, MAXHOG: 24, LASTHOG: 24
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x084167d2 (suspend)
    Call stack:   0x08538afd  0x0853fa3a  0x0853fd1d  0x0853e1bc  0x0853ec36  0x0854182c  0x0869cc4b
                  0x08415ae7  0x0840ae40  0x0806e6cf  0x08aade2b  0x0806e6cf  0x084a0a44  0x0849986d
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 1, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x08ee9b4e (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x08ee9b4e (suspend)
    Call stack:   0x08ee9e12  0x084a1032  0x0849986d  0x08499aac  0x08499dd6  0x084a0909  0x080689bc
    Process:      Dispatch Unit, PROC_PC_TOTAL: 2, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x081e208a (suspend)
    Process:      Dispatch Unit, NUMHOG: 2, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x081e208a (suspend)
    Call stack:   0x081e208a  0x080689bc
    Process:      Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 180, LASTHOG: 180
    LASTHOG At:   07:24:33 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x08a8ebd7  0x08a8f7c8  0x08a914fa  0x080ddd6f  0x080df9db  0x080f4132
                  0x080f5b16  0x080dd956  0x080de0ef  0x080de876  0x080dea37  0xdd6e6c1c  0xdd6e71b5
    Process:      rtcli async executor process, NUMHOG: 14, MAXHOG: 94, LASTHOG: 82
    LASTHOG At:   07:28:06 UTC Oct 19 2013
    PC:           0x08f262e3 (suspend)
    Call stack:   0x0806a881  0x08f262e3  0x08f432a2  0x09064ba8  0x0903dfa9  0x0904f88d  0x0903ed70
                  0x09036221  0x0903d29b  0x0903d49f  0x09035ffa  0x09055321  0x0903dfa9  0x0904f88d
    Process:      rtcli async executor process, PROC_PC_TOTAL: 27, MAXHOG: 319, LASTHOG: 88
    LASTHOG At:   07:28:06 UTC Oct 19 2013
    PC:           0x08f4212d (suspend)
    Process:      rtcli async executor process, NUMHOG: 27, MAXHOG: 319, LASTHOG: 88
    LASTHOG At:   07:28:06 UTC Oct 19 2013
    PC:           0x08f4212d (suspend)
    Call stack:   0x08069faa  0x08f4212d  0x08f260b6  0x08f27b85  0x08f27c35  0xcb147b98
    Process:      rtcli async executor process, PROC_PC_TOTAL: 12, MAXHOG: 45, LASTHOG: 10
    LASTHOG At:   07:28:14 UTC Oct 19 2013
    PC:           0x08f2594b (suspend)
    Process:      rtcli async executor process, NUMHOG: 12, MAXHOG: 45, LASTHOG: 10
    LASTHOG At:   07:28:14 UTC Oct 19 2013
    PC:           0x08f2594b (suspend)
    Call stack:   0x0806a881  0x08f2594b  0x08f27b85  0x08f27c35  0xcb147b98
    Process:      Unicorn Admin Handler, NUMHOG: 4, MAXHOG: 11, LASTHOG: 11
    LASTHOG At:   07:28:14 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x08a8ebd7  0x08b9aa46  0x08b9ad0e  0x080dc76f  0xdd6e6961  0xdd6e71b5
                  0xdd6e7b07  0xdd6e8d5c  0xdd6e138d  0xdd6e247a  0x080dcb22  0x0849f899  0x084981c7
    Process:      rtcli async executor process, PROC_PC_TOTAL: 83, MAXHOG: 298, LASTHOG: 119
    LASTHOG At:   07:28:16 UTC Oct 19 2013
    PC:           0x08f262e3 (suspend)
    Process:      rtcli async executor process, NUMHOG: 47, MAXHOG: 298, LASTHOG: 119
    LASTHOG At:   07:28:16 UTC Oct 19 2013
    PC:           0x08f262e3 (suspend)
    Call stack:   0x0806a881  0x08f262e3  0x08f38fad  0x08f3acc0  0x0905a29e  0x0905b2ba  0x0903dfa9
                  0x0903ecb5  0x0904f6f5  0x0903ed70  0x09036221  0x0903d29b  0x0903d49f  0x09035ffa
    Process:      Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 180, LASTHOG: 180
    LASTHOG At:   07:28:16 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a881  0x0806a8c2  0x0816261b  0x095302a7  0x0954abef  0x0954acc3  0x0815aabe
                  0x08134da6  0x08c64632  0x08ea8079  0x08ea8481  0x08ea85f7  0x08f41adc  0x0806e6cf
    Process:      Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 15, LASTHOG: 15
    LASTHOG At:   07:28:20 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a881  0x0806a8c2  0x0947a399  0x0946d24d  0x0946d364  0x08c2b0e6  0x08c38f65
                  0x08ea810b  0x08ea8481  0x08ea85f7  0x08f41adc  0x0806e6cf  0x08f3cc48  0x092afca6
    Process:      Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 64, LASTHOG: 64
    LASTHOG At:   07:28:20 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a881  0x0806a8c2  0x0947a3e4  0x09479cf9  0x094750eb  0x08c3f645  0x08c3fcab
                  0x08c2b235  0x08c38f65  0x08ea810b  0x08ea8481  0x08ea85f7  0x08f41adc  0x0806e6cf
    Process:      IP Thread, NUMHOG: 4, MAXHOG: 14, LASTHOG: 14
    LASTHOG At:   07:28:24 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x0947a399  0x0946d24d  0x0946d364  0x08c2b0e6  0x08c38f65  0x08ea810b
                  0x08ea8481  0x08ea85f7  0x08ea5f86  0x090e086e  0x090e0b6e  0x090b9a99  0x090b6b00
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 22, MAXHOG: 180, LASTHOG: 64
    LASTHOG At:   07:28:24 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Process:      IP Thread, NUMHOG: 4, MAXHOG: 64, LASTHOG: 64
    LASTHOG At:   07:28:24 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x0947a3e4  0x09479cf9  0x094750eb  0x08c3f645  0x08c3fcab  0x08c2b235
                  0x08c38f65  0x08ea810b  0x08ea8481  0x08ea85f7  0x08ea5f86  0x090e086e  0x090e0b6e
    CPU hog threshold (msec): 10.240
    Last cleared: None
    ------------------ show process ------------------
        PC       SP       STATE       Runtime    SBASE     Stack Process
    Lwe 0x08058ba4 0xc82baf84 0x0a345788          0 0xc82b7078 15760/16384 block_diag
    Mrd 0x081e1e11 0xc82ed54c 0x0a346144     430188 0xc82cd6e0 120548/131072 Dispatch Unit
    Msi 0x087509a4 0xc82fdcb4 0x0a3458b0        713 0xc82f9da8 15688/16384 WebVPN KCD Process
    Msi 0x09200c7b 0xc839b3d4 0x0a3458b0       3466 0xc83974c8 15688/16384 y88acs06 OneSec Thread
    Mwe 0x080718dd 0xc83a3804 0x0a3458b0          0 0xc839f948 15808/16384 Reload Control Thread
    Mwe 0x080849b9 0xc83ae79c 0x0a346e2c          0 0xc83aabe0 15256/16384 aaa
    Mwe 0x08f4212d 0xc8d3d1e4 0x0a3458b0          9 0xc83aed78 15056/16384 UserFromCert Thread
    Mwe 0x08f4212d 0xc9003fe4 0x0a3458b0         14 0xc83b2f50 14528/16384 aaa_shim_thread
    Mwe 0x080b477c 0xc83bfa1c 0x0a347eb4          0 0xc83bbb20 15760/16384 CMGR Server Process
    Mwe 0x080b6ded 0xc83c3b64 0x0a3458b0          0 0xc83bfcb8 15832/16384 CMGR Timer Process
    Lwe 0x081e0474 0xc83d83bc 0x0a3568e0          0 0xc83d44b0 15488/16384 dbgtrace
    Mwe 0x084de0ed 0xc83ef574 0x0a3458b0          0 0xc83e76d8 31680/32768 idfw_proc
    Mwe 0x084ea35b 0xc83f75b4 0x0a3458b0          0 0xc83ef708 32216/32768 idfw_service
    Mwe 0x084f5fc5 0xc83fb70c 0x0a3458b0          0 0xc83f78a0 15524/16384 idfw_adagent
    Mwe 0x085351b5 0xc84038dc 0x0a3458b0         89 0xc83ffbd0 11568/16384 eswilp_svi_init
    Mwe 0x08f4212d 0xc8770564 0x0a3458b0          0 0xc8433aa0 15280/16384 netfs_thread_init
    Mwe 0x09576795 0xc844c10c 0x0a3458b0          0 0xc8448290 15848/16384 Chunk Manager
    Msi 0x08ae10be 0xc84508ac 0x0a3458b0       3523 0xc844c9c0 15656/16384 PIX Garbage Collector
    Mwe 0x08ac328a 0xc8461a0c 0x0a1d5d24          0 0xc845db00 16104/16384 IP Address Assign
    Mwe 0x08d0477a 0xc85f7534 0x0a251838          0 0xc85f3628 16104/16384 QoS Support Module
    Mwe 0x08b5c32a 0xc85fb70c 0x0a1d6c88          0 0xc85f7800 16104/16384 Client Update Task
    Lwe 0x095d54f5 0xc860009c 0x0a3458b0     109750 0xc85fc1f0 14448/16384 Checkheaps
    Mwe 0x08d093ed 0xc861080c 0x0a3458b0        454 0xc86089a0 19328/32768 Quack process
    Mwe 0x08d8569d 0xc86189c4 0x0a3458b0        533 0xc8610b38 31952/32768 Session Manager
    Mwe 0x08ed964d 0xc8620cd4 0xcadf5b08          8 0xc861ce68 15464/16384 uauth
    Mwe 0x08e66621 0xc8624f0c 0x0a264a10          0 0xc8621000 15632/16384 Uauth_Proxy
    Msp 0x08ea87de 0xc86313d4 0x0a3458b0        561 0xc862d4c8 15688/16384 SSL
    Mwe 0x08ed72d4 0xc863554c 0x0a26bc14          0 0xc8631660 15708/16384 SMTP
    Mwe 0x08ed170c 0xc86396a4 0x0a26af38      23255 0xc86357f8 13608/16384 Logger
    Mwe 0x08ecfd1d 0xc863d80c 0x0a3458b0          0 0xc8639990 15784/16384  Syslog Retry Thread
    Mwe 0x08ecadf5 0xc86419d4 0x0a3458b0          0 0xc863db28 15600/16384 Thread Logger
    Mwe 0x08ed50b4 0xc866457c 0x0a26b5e0          0 0xc8660680 15464/16384 syslogd
    Mwe 0x09132032 0xc8681094 0x0a2a5688          0 0xc867d1a8 15328/16384 vpnlb_thread
    Mwe 0x092037ec 0xc86916c4 0x0a2aa9e8          0 0xc868d808 16024/16384 pci_nt_bridge
    Mwe 0x082beb95 0xc8756e44 0x0a3458b0          0 0xc8752fb8 15864/16384 TLS Proxy Inspector
    Msi 0x08da221c 0xc87d44a4 0x0a3458b0       2749 0xc87d0598 15688/16384 emweb/cifs_timer
    Mwe 0x08852cc4 0xc88291f4 0x0a1c4c44          0 0xc88252f8 15712/16384 netfs_mount_handler
    Msi 0x086b4248 0xc8316454 0x0a3458b0      27304 0xc8312568 15312/16384 arp_timer
    Mwe 0x086bc58e 0xc8447fb4 0x0a371110          0 0xc84440f8 16024/16384 arp_forward_thread
    Mwe 0x08eddb77 0xc8f2e27c 0x0a26c680          0 0xc8f2a380 15672/16384 tcp_fast
    Mwe 0x08ee69a8 0xc8f3229c 0x0a26c680          0 0xc8f2e3b0 15656/16384 tcp_slow
    Mwe 0x08f1df34 0xc8f42fac 0x0a2745d0          0 0xc8f3f0b0 16000/16384 udp_timer
    Mwe 0x0814110d 0xc8fb133c 0xc83ca8d0          4 0xc8fad4a0 15664/16384 IPsec message handler
    Mwe 0x087515c6 0xc8fdc834 0x0a376060          1 0xc8fd8958 16056/16384 Lic TMR
    Mwe 0x087513bc 0xc8fe0884 0x0a1c0ea0        242 0xc8fdc988 16088/16384 Lic HA
    Msi 0x08153267 0xc84270dc 0x0a3458b0      54986 0xc8423440 13872/16384 CTM message handler
    Mwe 0x0811bd2d 0xc843bb8c 0x0a3458b0          0 0xc8437ce0 15832/16384 CTCP Timer process
    Mwe 0x090d3d95 0xc843fbac 0x0a3458b0          0 0xc843bd10 15816/16384 L2TP data daemon
    Mwe 0x090d6605 0xc9b5b24c 0x0a3458b0          0 0xc9b573b0 15816/16384 L2TP mgmt daemon
    Mwe 0x090c2b27 0xc9b9339c 0x0a29a3ec       2228 0xc9b8f4e0 15480/16384 ppp_timer_thread
    Msi 0x0913239d 0xc9b973ec 0x0a3458b0       4093 0xc9b93510 15640/16384 vpnlb_timer_thread
    Mwe 0x081c7708 0xc9c67c84 0x0a13ef88       2899 0xc9c47f18 118548/131072 tmatch compile thread
    Mwe 0x08d38b2d 0xcac940cc 0x0a3458b0          0 0xcac90210 15848/16384 ICMP event handler
    Mwe 0x0908081d 0xcac98254 0x0a3458b0          0 0xcac943a8 15832/16384 Dynamic Filter VC Housekeeper
    Mwe 0x08a1b612 0xcacc47f4 0x0a3458b0        819 0xcacc0938 13860/16384 IP Background
    Mwe 0x08c26e63 0xcaed904c 0x0a3458b0          0 0xcaed51a0 15832/16384 Crypto CA
    Mwe 0x08c60c18 0xcaedd1e4 0x0a3458b0          0 0xcaed9338 15896/16384 CERT API
    Mwe 0x08c257d5 0xcaee6e24 0x0a3458b0          0 0xcaee2f58 15928/16384 Crypto PKI RECV
    Mwe 0x0878dd85 0xc862d1cc 0x0a3458b0        187 0xc8629330 15272/16384 ESW_MRVL switch interrupt service
    Mwe 0x08cae62c 0xc866c89c 0x0a1ea7e0          0 0xc86689b0 15832/16384 lina_int
    Mrd 0x0959948b 0xc8684f1c 0x0a346144   28493079 0xc8681340 13824/16384 esw_stats
    Lsi 0x08af3199 0xc86958bc 0x0a3458b0        152 0xc86919a0 15704/16384 uauth_urlb clean
    Lwe 0x08acbd76 0xc83ff8b4 0x0a3458b0       4432 0xc83fba38 14308/16384 pm_timer_thread
    Mwe 0x08555f8d 0xc8418b0c 0x0a3458b0          0 0xc8414c60 15832/16384 IKE Common thread
    Mwe 0x0858cecd 0xcaf8688c 0x0a3458b0          0 0xcaf82a60 15704/16384 IKE Timekeeper
    Mwe 0x0857bad1 0xcaf8ccc4 0x0a1bc678          1 0xcaf890e8 12116/16384 IKE Daemon
    Mwe 0x08629eb3 0xcaf90c64 0x0a3458b0        964 0xcaf8d118 14744/16384 IKEv2 Daemon
    Mwe 0x08628e7c 0xcaf94ff4 0x0a3458b0       1095 0xcaf91148 15640/16384 IKEv2 DPD Client Process
    Mwe 0x08e7d2e4 0xcafafd7c 0x0a2690f4          0 0xcafabe90 16072/16384 RADIUS Proxy Event Daemon
    Mwe 0x08e41f35 0xcafb3d74 0xcb07e358          7 0xcafb0028 14912/16384 RADIUS Proxy Listener
    Mwe 0x08e7ca0d 0xcafb806c 0x0a3458b0          0 0xcafb41c0 15832/16384 RADIUS Proxy Time Keeper
    Mwe 0x086a1e44 0xcafbc184 0x0a3710c8          0 0xcafb8358 15264/16384 Integrity FW Task
    Mrd 0x082c923a 0xcaffce54 0x0a346144          0 0xcaff8f98 14552/16384 CP Threat-Detection Processing
    Mwe 0x081fb74e 0xcb0cc4bc 0x09c4a8bc       2497 0xcb0acd60 122448/131072 ci/console
    Msi 0x08b0ea8c 0xcb0d0e14 0x0a3458b0     217583 0xcb0ccef8 14004/16384 update_cpu_usage
    Mwe 0x08ef5ff5 0xcb0d4ecc 0x0a3458b0         77 0xcb0d1090 15360/16384 npshim_thread
    Msi 0x08b0eb14 0xcb0e1224 0x0a3458b0          0 0xcb0dd428 13104/16384 NIC status poll
    Mwe 0x08dd5f2c 0xcb0e54bc 0x0a259ec8        228 0xcb0e15c0 15540/16384 SNMP Notify Thread
    Mwe 0x086aba0e 0xcb12ebe4 0x0a37170c     235813 0xcb126d08 25428/32768 IP Thread
    Mwe 0x086b31fe 0xcb132d9c 0x0a371100       9150 0xcb12eea0 9700/16384 ARP Thread
    Mwe 0x084be3ae 0xcb136f8c 0x0a3716c8       1743 0xcb1331b0 12696/16384 icmp_thread
    Mwe 0x08f1f443 0xcb13b1e4 0x0a3458b0        158 0xcb137348 15728/16384 udp_thread
    Mwe 0x08ee0f44 0xcb13f0bc 0x0a37178c          0 0xcb13b4e0 15288/16384 tcp_thread
    Mwe 0x08f4212d 0xcb1bccd4 0x0a3458b0      12848 0xcb13fd70 26600/32768 rtcli async executor process
    Mwe 0x090e408d 0xcb4dff64 0x0a3458b0          0 0xcb4dc0a8 14608/16384 PPPOE background daemon
    Mwe 0x090e53c4 0xcb4e3fb4 0x0a29aa4c          1 0xcb4e00d8 14656/16384 PPPOE CLI daemon
    Mwe 0x0824ff45 0xcb501e4c 0x0a3458b0        258 0xcb4fdf90 15624/16384 Timekeeper
    Mwe 0x08e41f35 0xcb89a6d4 0xcb89eb10          7 0xcb896998 15392/16384 EAPoUDP-sock
    Mwe 0x0822323d 0xcb89e544 0x0a3458b0          0 0xcb89a9c8 15016/16384 EAPoUDP
    Mwe 0x08204371 0xcb3df9dc 0x0a3458b0        149 0xcb3dbb20 15168/16384 DHCPD Timer
    Mwe 0x082066a1 0xcb3e6404 0x0a3458b0       1286 0xcb3e25a8 7172/16384 dhcp_daemon
    Mwe 0x0910dfd4 0xcbc3b4e4 0x0a2a5380          0 0xcbc335e8 32472/32768 vpnfol_thread_msg
    Msi 0x09116252 0xcbc3fac4 0x0a3458b0       2657 0xcbc3bbd8 15656/16384 vpnfol_thread_timer
    Mwe 0x09114882 0xcbc44074 0x0a2a53c0          0 0xcbc401c8 16008/16384 vpnfol_thread_sync
    Msi 0x09115fdc 0xcbc486b4 0x0a3458b0      11061 0xcbc447b8 15672/16384 vpnfol_thread_unsent
    Mwe 0x0869e365 0xc8689384 0x0a3458b0          0 0xc86854d8 15832/16384 Integrity Fw Timer Thread
    Msi 0x08852fd6 0xc868d55c 0x0a3458b0        206 0xc8689670 15656/16384 netfs_vnode_reclaim
    Mwe 0x08f4212d 0xcb2a1914 0x0a3458b0       1277 0xcbd38510 15008/16384 Unicorn Proxy Thread
    Mwe 0x0825afcb 0xcbc61254 0x0a3458b0        335 0xcbc5d788 14272/16384 emweb/https
    Mwe 0x08eef828 0xcbd4dd0c 0xcbd4fd7c          0 0xcbd49fd0 14888/16384 listen/telnet
    Mwe 0x08aac530 0xcbdbd754 0xcbd6c9fc        102 0xcbd9def8 127432/131072 Unicorn Admin Handler
    Mwe 0x08aab345 0xcbddd644 0x0a3458b0        105 0xcbdbdf28 123712/131072 Unicorn Admin Handler
    Mwe 0x08cd7c6f 0xcaf358cc 0x0a49edc8          0 0xcaf31bb0 15384/16384 qos_metric_daemon
    Mwe 0x08218c82 0xcb2693fc 0x0a3458b0          3 0xcb265560 13248/16384 DHCP Client
    Mwe 0x08f1d929 0xcb4bb0fc 0xc8f3ece4          0 0xcb4b3300 31552/32768 DHCPC Receiver
    M*  0x08a86f55 0xdcc1df2c 0x0a346144        274 0xcb34deb8 19696/32768 telnet/ci
    -           -          -          -          0          -      -      DATAPATH-0-455
    -           -          -          -  744377118          -      -      scheduler
    -           -          -          -  774156778          -      -      total elapsed
    ------------------ show kernel process ------------------
    PID PPID PRI NI      VSIZE      RSS      WCHAN STAT  RUNTIME COMMAND
      1    0  20  0    2080768      616 3725686580    S      630 init
      2    0  15 -5          0        0 3725738556    S        0 kthreadd
      3    2  15 -5          0        0 3725692956    S        0 ksoftirqd/0
      4    2  15 -5          0        0 3725728656    S        0 events/0
      5    2  15 -5          0        0 3725728656    S        0 khelper
    50    2  15 -5          0        0 3725728656    S        0 kblockd/0
    53    2  15 -5          0        0 3726777703    S        0 kseriod
    99    2  20  0          0        0 3725848262    S        0 pdflush
    100    2  20  0          0        0 3725848262    S        0 pdflush
    101    2  15 -5          0        0 3725861131    S        0 kswapd0
    102    2  15 -5          0        0 3725728656    S        0 aio/0
    103    2  15 -5          0        0 3725728656    S        0 nfsiod
    214    2  15 -5          0        0 3725728656    S        0 hid_compat
    215    2  15 -5          0        0 3725728656    S        0 rpciod/0
    240    1  16 -4    1789952      600 3725997327    S        4 udevd
    272  240  18 -2    1785856      564 3725997327    S        0 udevd
    277  240  18 -2    1785856      552 3725997327    S        0 udevd
    421    1  20  0    5201920     1600 4294967295    S       11 lwsmd
    423  421  20  0   16736256     3600 4294967295    S      102 lwregd
    448    1  20  0    2084864      512 3725686580    S        1 sh
    449  448  20  0   10186752      528 4294967295    S        2 lina_monitor
    451  449   0 -20  440270848    53000 4294967295    S 77713055 lina
    ------------------ show kernel cgroup-controller detail ------------------
    memory controller:
    memory.limit_in_bytes: unlimited
    memory.usage_in_bytes: 61665280   (11%)
    memory.max_usage_in_bytes: 64245760   (12%)
    memory.failcnt: 0
    tasks:
    group "normal"
      memory.limit_in_bytes: unlimited
      memory.usage_in_bytes: 77824   (0%)
      memory.max_usage_in_bytes: 544768   (0%)
      memory.failcnt: 0
      tasks:
           PID         RSS COMMAND                      
             1      630784 init                         
             2           0 kthreadd                     
             3           0 ksoftirqd/0                  
             4           0 events/0                     
             5           0 khelper                      
            50           0 kblockd/0                    
            53           0 kseriod                      
            99           0 pdflush                      
           100           0 pdflush                      
           101           0 kswapd0                      
           102           0 aio/0                        
           103           0 nfsiod                       
           214           0 hid_compat                   
           215           0 rpciod/0                     
           240      614400 udevd                        
           272      577536 udevd                        
           277      565248 udevd                        
           448      524288 sh                           
    group "privileged"
      memory.limit_in_bytes: unlimited
      memory.usage_in_bytes: 22327296   (4%)
      memory.max_usage_in_bytes: 22515712   (4%)
      memory.failcnt: 0
      tasks:
           PID         RSS COMMAND                      
           449      540672 lina_monitor                 
           450           0 lina_monitor                 
           451    54280192 lina                         
           452           0 lina                         
           453           0 lina                         
           454           0 lina                         
           455           0 lina                         
    group "restricted"
      memory.limit_in_bytes: 23068672   (4%)
      memory.usage_in_bytes: 1724416   (0%)
      memory.max_usage_in_bytes: 1900544   (0%)
      memory.failcnt: 0
      tasks:
           PID         RSS COMMAND                      
           421     1638400 lwsmd                        
           422           0 lwsmd                        
           423     3686400 lwregd                       
           425           0 lwregd                       
           426           0 lwregd                       
           427           0 lwregd                       
           428           0 lwregd                       
           429           0 lwregd                       
           430           0 lwsmd                        
           431           0 lwsmd                        
           432           0 lwsmd                        
           433           0 lwsmd                        
           434           0 lwsmd                        
    cpu controller:
    cpu.shares: 1024
    cpuacct.usage: 777015353084076
    tasks:
    group "normal"
      cpu.shares: 1024
      cpuacct.usage: 53525955783   (0%)
    tasks:
           PID         RSS COMMAND                      
             1      630784 init                         
             2           0 kthreadd                     
             3           0 ksoftirqd/0                  
             4           0 events/0                     
             5           0 khelper                      
            50           0 kblockd/0                    
            53           0 kseriod                      
            99           0 pdflush                      
           100           0 pdflush                      
           101           0 kswapd0                      
           102           0 aio/0                        
           103           0 nfsiod                       
           214           0 hid_compat                   
           215           0 rpciod/0                     
           240      614400 udevd                        
           272      577536 udevd                        
           277      565248 udevd                        
           448      524288 sh                           
           449      540672 lina_monitor                 
           450           0 lina_monitor                 
           451    54280192 lina                         
           452           0 lina                         
           453           0 lina                         
           454           0 lina                         
    group "privileged"
      cpu.shares: 16384
      cpuacct.usage: 776952528547140   (100%)
      tasks:
           PID         RSS COMMAND                      
           455           0 lina                         
    group "restricted"
      cpu.shares: 1024
      cpuacct.usage: 1291957168   (0%)
      tasks:
           PID         RSS COMMAND                      
           421     1638400 lwsmd                        
           422           0 lwsmd                        
           423     3686400 lwregd                       
           425           0 lwregd                       
           426           0 lwregd                       
           427           0 lwregd                       
           428           0 lwregd                       
           429           0 lwregd                       
           430           0 lwsmd                        
           431           0 lwsmd                        
           432           0 lwsmd                        
           433           0 lwsmd                        
           434           0 lwsmd                        
    ------------------ show traffic ------------------
    inside:
    received (in 422169.300 secs):
    4183910 packets          523687951 bytes
    9 pkts/sec          1006 bytes/sec
    transmitted (in 422169.300 secs):
    5702974 packets          5851550584 bytes
    3 pkts/sec          13006 bytes/sec
          1 minute input rate 22 pkts/sec,  2839 bytes/sec
          1 minute output rate 30 pkts/sec,  22751 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 33 pkts/sec,  3746 bytes/sec
          5 minute output rate 46 pkts/sec,  20906 bytes/sec
          5 minute drop rate, 1 pkts/sec
    outside:
    received (in 422169.300 secs):
    10542135 packets          11433861540 bytes
    4 pkts/sec          27002 bytes/sec
    transmitted (in 422169.300 secs):
    3793870 packets          526596330 bytes
    8 pkts/sec          1003 bytes/sec
          1 minute input rate 47 pkts/sec,  41657 bytes/sec
          1 minute output rate 18 pkts/sec,  2802 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 80 pkts/sec,  38519 bytes/sec
          5 minute output rate 29 pkts/sec,  3749 bytes/sec
          5 minute drop rate, 0 pkts/sec
    _internal_loopback:
    received (in 422168.950 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 422168.950 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Aggregated Traffic on Physical Interface
    Ethernet0/0:
    received (in 776992.730 secs):
    8257731 packets          9051312645 bytes
    5 pkts/sec          11002 bytes/sec
    transmitted (in 776992.730 secs):
    6399342 packets          1011145708 bytes
    2 pkts/sec          1002 bytes/sec
          1 minute input rate 26 pkts/sec,  24481 bytes/sec
          1 minute output rate 20 pkts/sec,  3472 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 40 pkts/sec,  20147 bytes/sec
          5 minute output rate 29 pkts/sec,  4280 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/1:
    received (in 776992.730 secs):
    1330771 packets          312271947 bytes
    1 pkts/sec          3 bytes/sec
    transmitted (in 776992.730 secs):
    1738316 packets          638003030 bytes
    2 pkts/sec          3 bytes/sec
          1 minute input rate 4 pkts/sec,  405 bytes/sec
          1 minute output rate 11 pkts/sec,  3333 bytes/sec
    <--- More --->
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 7 pkts/sec,  735 bytes/sec
          5 minute output rate 13 pkts/sec,  4410 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/2:
    received (in 776993.220 secs):
    5028958 packets          693527818 bytes
    0 pkts/sec          2 bytes/sec
    transmitted (in 776993.220 secs):
    7782202 packets          8316039741 bytes
    4 pkts/sec          10000 bytes/sec
          1 minute input rate 1 pkts/sec,  153 bytes/sec
          1 minute output rate 2 pkts/sec,  391 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 1 pkts/sec,  187 bytes/sec
          5 minute output rate 3 pkts/sec,  1011 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/3:
    received (in 776993.220 secs):
    17219822 packets          21609826615 bytes
    0 pkts/sec          27005 bytes/sec
    transmitted (in 776993.220 secs):
    8373382 packets          5142266559 bytes
    5 pkts/sec          6004 bytes/sec
    <--- More --->
          1 minute input rate 8384 pkts/sec,  12695156 bytes/sec
          1 minute output rate 2657 pkts/sec,  203156 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 8010 pkts/sec,  12112337 bytes/sec
          5 minute output rate 2525 pkts/sec,  188122 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/4:
    received (in 776993.680 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 776993.680 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/5:
    received (in 776993.690 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 776993.690 secs):
    <--- More --->
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/6:
    received (in 776994.140 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 776994.140 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/7:
    received (in 776994.140 secs):
    7328915 packets          4524298170 bytes
    <--- More --->
    3 pkts/sec          5004 bytes/sec
    transmitted (in 776994.140 secs):
    16345245 packets          21405489647 bytes
    4 pkts/sec          27001 bytes/sec
          1 minute input rate 2330 pkts/sec,  158045 bytes/sec
          1 minute output rate 7422 pkts/sec,  11264540 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 2481 pkts/sec,  168427 bytes/sec
          5 minute output rate 7977 pkts/sec,  12105867 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/0:
    received (in 776994.640 secs):
    15222548 packets          10134365294 bytes
    3 pkts/sec          13004 bytes/sec
    transmitted (in 776994.640 secs):
    15128813 packets          10256961010 bytes
    2 pkts/sec          13001 bytes/sec
          1 minute input rate 45 pkts/sec,  24860 bytes/sec
          1 minute output rate 49 pkts/sec,  26647 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 73 pkts/sec,  24918 bytes/sec
          5 minute output rate 75 pkts/sec,  26334 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/1:
    <--- More --->
    received (in 776994.640 secs):
    15128721 packets          10256943282 bytes
    2 pkts/sec          13001 bytes/sec
    transmitted (in 776994.640 secs):
    15222455 packets          10134357062 bytes
    3 pkts/sec          13004 bytes/sec
          1 minute input rate 48 pkts/sec,  26530 bytes/sec
          1 minute output rate 45 pkts/sec,  24826 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 75 pkts/sec,  26323 bytes/sec
          5 minute output rate 73 pkts/sec,  24908 bytes/sec
          5 minute drop rate, 0 pkts/sec
    ------------------ show perfmon ------------------
    PERFMON STATS:                     Current      Average
    Xlates                                0/s          0/s
    Connections                           0/s          0/s
    TCP Conns                             0/s          0/s
    UDP Conns                             0/s          0/s
    URL Access                            0/s          0/s
    URL Server Req       

  • VPN stops forwarding traffic on subsequent connections (Cisco 861)

    Hello everyone,
    I have a very strange problem on 2 (independent) Cisco 861 routers in different places.
    They are both configured as easyVPN servers. One uses UDP, the other TCP. VPN clients connect by using Cisco VPN client software. This cannot be changed because the customer expects it this way. Both routers have the same problem:
    * the first VPN connection after a reset works fine. Traffic passes through and it is perfectly usable. I can ping the internal network interface on the router side from the client without problems.
    * the second connection (and all subsequent ones from different client machines etc.) connects fine, no errors on the client whatsoever (not sure I evaluated all possible debug output on the "server" side). However,  no traffic passes through. Pings do not come back from the 861 anymore through the VPN tunnel.
    I already enabled ICMP debugging and saw that pings are actually answered by the 861, but do not reach the client.The same seems to happen to any and all other packets as well.
    * If I restart the 861 the very same thing happens: first VPN connection works fine. You disconnect, try another connection from the very same client computer, and it does not work anymore until the next router reset.
    I append the configuration for sake of completeness. confidential parts are represented by XXX. Some ACLs are not in use right now; I used them for testing.
    Quite frankly, I am out of ideas (and desperate).
    Any ideas?
    Best Regards
    Mike
    version 15.0
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname XXX
    boot-start-marker
    boot-end-marker
    logging buffered 51200
    logging console critical
    enable secret 5 XXX
    enable password 7 XXX
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa session-id common
    memory-size iomem 10
    clock timezone Berlin 1
    crypto pki trustpoint TP-self-signed-2638506017
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-2638506017
    revocation-check none
    rsakeypair TP-self-signed-2638506017
    no ip source-route
    ip cef
    no ip bootp server
    ip domain name local
    license udi pid CISCO861-K9 sn XXX
    archive
    log config
      hidekeys
    no spanning-tree vlan 1
    username root privilege 15 secret 5 XXX
    username remote secret 5 XXX
    crypto ctcp port 10000
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp nat keepalive 20
    crypto isakmp client configuration group vpn
    key XXX
    pool SDM_POOL_1
    acl 104
    netmask 255.255.255.0
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group vpn
       client authentication list ciscocp_vpn_xauth_ml_1
       isakmp authorization list ciscocp_vpn_group_ml_1
       client configuration address respond
       client configuration group vpn
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA
    set isakmp-profile ciscocp-ike-profile-1
    interface Loopback0
    ip address 192.168.234.1 255.255.255.0
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface FastEthernet4
    ip address dhcp
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    duplex auto
    speed auto
    interface Virtual-Template1 type tunnel
    ip unnumbered Loopback0
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
    ip address 192.168.233.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip virtual-reassembly
    ip tcp adjust-mss 1452
    ip local pool SDM_POOL_1 192.168.234.2 192.168.234.127
    ip forward-protocol nd
    no ip http server
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip route 10.179.232.0 255.255.255.0 192.168.233.2
    ip route 172.16.0.0 255.255.0.0 192.168.233.2
    ip access-list log-update threshold 10
    logging trap debugging
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 192.168.233.0 0.0.0.255
    access-list 100 remark XXX
    access-list 100 permit ip 192.168.233.0 0.0.0.255 any
    access-list 100 permit ip 192.168.234.0 0.0.0.255 any
    access-list 101 remark CCP_ACL Category=4
    access-list 101 permit ip 192.168.233.0 0.0.0.255 any
    access-list 101 permit ip 192.168.234.0 0.0.0.255 any
    access-list 102 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255
    access-list 103 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255 log
    access-list 103 permit ip 192.168.234.0 0.0.0.255 192.168.233.0 0.0.0.255 log
    access-list 104 permit ip 192.168.233.0 0.0.0.255 any log-input
    access-list 104 permit ip 192.168.234.0 0.0.0.255 any log-input
    no cdp run
    control-plane
    banner exec ^CCC
    XXX
    ^C
    banner login ^CCC
    XXX
    ^C
    line con 0
    no modem enable
    transport output telnet
    line aux 0
    transport output telnet
    line vty 0 4
    privilege level 15
    transport input ssh
    scheduler max-task-time 5000
    scheduler allocate 4000 1000
    scheduler interval 500
    end

    Hi,
    I addded a dynamic crypto map to the configuration according to the document you sent. However, it does not work yet.
    There must be some stupid mistake or mixup with the old config.
    The router logs:
    000038: *Mar  1 01:19:24.047 Berlin: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at XXX
    000039: *Mar  1 01:19:29.403 Berlin: CTCP: cTCP connection entry not found. Dropping the packet
    Correspondingly, the client retransmits a few times during a connection attempt and then fails.
    The current configuration is:
    version 15.0
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname XXX
    boot-start-marker
    boot-end-marker
    logging buffered 51200
    logging console critical
    enable secret XXX
    enable password XXX
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa session-id common
    memory-size iomem 10
    clock timezone Berlin 1
    crypto pki trustpoint TP-self-signed-2638506017
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-2638506017
    revocation-check none
    rsakeypair TP-self-signed-2638506017
    no ip source-route
    no ip cef
    no ip bootp server
    ip domain name local
    license udi pid CISCO861-K9 sn XXX
    archive
    log config
      hidekeys
    no spanning-tree vlan 1
    username root privilege 15 secret 5 XXX
    username remote secret 5 XXX
    crypto ctcp keepalive 10
    crypto ctcp port 10000
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp nat keepalive 20
    crypto isakmp client configuration group vpn
    key XXX
    pool SDM_POOL_1
    acl 105
    netmask 255.255.255.0
    crypto isakmp client configuration group testgroup
    key XXX
    pool SDM_POOL_1
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group vpn
       client authentication list ciscocp_vpn_xauth_ml_1
       isakmp authorization list ciscocp_vpn_group_ml_1
       client configuration address respond
       client configuration group vpn
    crypto isakmp profile VPNclient
       description VPN clients profile
       match identity group testgroup
       client authentication list clientauth
       isakmp authorization list groupauthor
       client configuration address respond
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA
    set isakmp-profile ciscocp-ike-profile-1
    crypto dynamic-map dynmap 5
    set transform-set ESP-3DES-SHA
    set isakmp-profile VPNclient
    crypto map mymap 10 ipsec-isakmp dynamic dynmap
    interface Loopback0
    ip address 192.168.234.1 255.255.255.0
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface FastEthernet4
    mtu 1300
    ip address dhcp
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    duplex auto
    speed auto
    interface Virtual-Template1 type tunnel
    ip unnumbered Loopback0
    tunnel mode ipsec ipv4
    crypto map mymap
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
    ip address 192.168.233.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip virtual-reassembly
    ip tcp adjust-mss 1452
    ip local pool SDM_POOL_1 192.168.234.2 192.168.234.127
    ip forward-protocol nd
    no ip http server
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip route 10.179.232.0 255.255.255.0 192.168.233.2
    ip route 172.16.0.0 255.255.0.0 192.168.233.2
    ip access-list log-update threshold 10
    logging trap debugging
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 192.168.233.0 0.0.0.255
    access-list 100 remark XXX
    access-list 100 permit ip 192.168.233.0 0.0.0.255 any
    access-list 100 permit ip 192.168.234.0 0.0.0.255 any
    access-list 101 remark CCP_ACL Category=4
    access-list 101 permit ip 192.168.233.0 0.0.0.255 any
    access-list 101 permit ip 192.168.234.0 0.0.0.255 any
    access-list 102 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255
    access-list 103 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255 log
    access-list 103 permit ip 192.168.234.0 0.0.0.255 192.168.233.0 0.0.0.255 log
    access-list 104 permit ip 192.168.233.0 0.0.0.255 any log-input
    access-list 104 permit ip 192.168.234.0 0.0.0.255 any log-input
    access-list 105 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255
    no cdp run
    control-plane
    banner exec ^CCC
    XXX
    ^C
    banner login ^CCC
    XXX
    ^C
    line con 0
    no modem enable
    transport output telnet
    line aux 0
    transport output telnet
    line vty 0 4
    privilege level 15
    transport input ssh
    scheduler max-task-time 5000
    scheduler allocate 4000 1000
    scheduler interval 500
    end

  • ASA /Router -SNMP Trap when IP SLA monitored (ICMP timeout)

    Hi,
    I am looking for some solution for my below requirment
    Requirment is :
    How do I configure ASA or Router to send SNMP Trap when IP SLA monitored  features enabled (ICMP request or 900 millisecond delay from destination IP)
    Thanks in advance..

    Hi,
    Maybe this thread might help you?
    https://supportforums.cisco.com/thread/2039293
    I have not personally configured these type of SLA configurations on an ASA other than for testing purposes. We handle Dual ISP setups outside the ASA firewalls.
    - Jouni

  • ICMP Inspection and Extended Access-List

    I need a little help clarifying the need for an Extended Access-list when ICMP Inspect is enabled on an ASA.  From reading various documents such as the following (http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html), I CAN allow ICMP through my ASA using an extended access-list or enabling ICMP Inspection in the Modular Policy Framework.  Is that true?  I only NEED an Extended Access-list or enable ICMP Inspection? I do not need both?  Or is it best practice to do both?
    What does the ASA do to a PING from a host on the inside interface (Security 100) to host on the outside interface (Security 0) when ICMP Inspection is enabled with the following commands:
    policy-map global_policy
    class inspection_default
    inspect_icmp
    However, the following commands are NOT placed on the inbound Extended Access-list of the outside interface:
    access-list inbound permit icmp any any echo-reply
    access-list inbound permit icmp any any source-quench
    access-list inbound permit icmp any any unreachable 
    access-list inbound permit icmp any any time-exceeded
    access-group inbound in interface outside
    Will the PING complete?
    Thank you,
    T.J.

    Hi, T.J.
    If problem is still actual, I can answer you this question.
    Let's see situation without ICMP inspection enabled:
    The Cisco ASA will allow ICMP packets only in case if ACL entry exist on interface, where packet goes in. If we're speaking about ping, then ACL rules must allow packets in both directions.
    In case with ICMP inspection, with ACL entry you should allow only request packets, replies will be allowed based on ICMP inspection created connection.
    Speaking about your particular example with different security levels - with default ACL rule, that allow traffic from higher interface to lower - NO, you can do not enter that rules you described, and as you'll have successful ping.
    If you deleted this rule and administrate allowed traffic manually, then YES, you must allow ICMP requests to have successful ping.
    P.S. It's not a good practice to leave that default rule, which allow traffic from higher sec.lvl. to lower.

Maybe you are looking for

  • I am thinking of buying a MacBook Air and am wondering how to get the content of my iPad into iTunes.

    I have iTunes on an old pc and am thinking of buying a MacBook Air. I am wondering how to get the content of my iPad on to the Mac as I know that sync only happens in one direction, from pc to device. I assume therefore that when I attach my pad to t

  • SOAP Certificate issue...High priority...please check

    We are getting the below error in SOAP receiver side and 2 day ago certificates got expired and we imported new certificates when we trigger an idoc in receiver side SOAP is showing the below error.in receiver communication channel monitoring. SOAP:

  • COOIS Capacity report for Collective Order

    Hello Expert, Need your help & assistance. I have an issue related to collective order, COOIS report display for list Capacity. For one collective order, when I check this COOIS>Capacity report it display only header order detail, not for dependent o

  • Why do document icons change

    During login, document icons display as the familiar icon we've become accustomed to, but when login completes, the icons change to a rather drab, generic-looking thing. For example Word documents, which used to show as the familiar blue Word documen

  • Reset Time Machine "Do Not Use"?

    Hello, I have a new MacBook Pro retina, and wanted to take some files from my existing Time Machine backup disk. When I plugged the disc in for the first time, I got the dialog box asking me if I wanted to use this disc for Time Machine. The options