Having trouble with Dynamic-to-static
Having an issue with traffic passing over a dynamic-to-static VPN. Phase 1 and Phase 2 both complete. sh cry ips sa on the ASA shows 0 #pkts encaps. From the 861 it shows 0 #pkts decaps
I know its a lot to look at but hopefully someone will see something obvious that I messed up.
The second tunnel is working. It is coming from a CradlePoint MBR1400 so I am unable to apply the config from that.
ciscoasa# sh crypto isakmp sa
Active SA: 2
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2
1 IKE Peer: 107.46.57.189
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
2 IKE Peer: xxx.xxx.xxx.xxx
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
ciscoasa# sh crypto ipsec sa
interface: outside
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr:
local ident (addr/mask/prot/port): (10.10.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.101.0/255.255.255.0/0/0)
current_peer: 107.46.57.189
#pkts encaps: 3166, #pkts encrypt: 3166, #pkts digest: 3166
#pkts decaps: 2828, #pkts decrypt: 2828, #pkts verify: 2828
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 3166, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: xxx.xxx.xxx.98, remote crypto endpt.: 107.46.57.189
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 0D67A97D
current inbound spi : B59B6F50
inbound esp sas:
spi: 0xB59B6F50 (3046862672)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 5472256, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 3020
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFF7FFFF
outbound esp sas:
spi: 0x0D67A97D (224897405)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 5472256, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 3020
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: xxx.xxx.xxx.98
local ident (addr/mask/prot/port): (10.10.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)
current_peer: xxx.xxx.xxx.xxx
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 1041, #pkts decrypt: 1044, #pkts verify: 1044
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: xxx.xxx.xxx.xxx/4500, remote crypto endpt.: xxx.xxx.xxx.xxx/2944
path mtu 1500, ipsec overhead 82, media mtu 1500
current outbound spi: 9613FEAC
current inbound spi : 186C9E40
inbound esp sas:
spi: 0x186C9E40 (409771584)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 5476352, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (kB/sec): (3914991/3199)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x9613FEAC (2517892780)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 5476352, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (kB/sec): (3915000/3198)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
REMOTE Config Cisco 861
Current configuration : 3112 bytes
! Last configuration change at 13:07:07 UTC Mon Jan 2 2006 by jwright
! NVRAM config last updated at 12:10:49 UTC Mon Jan 2 2006 by jwright
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
hostname Corvid
boot-start-marker
boot-end-marker
logging buffered 51200 warnings
logging console critical
no aaa new-model
memory-size iomem 10
crypto pki trustpoint TP-self-signed-3769564853
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3769564853
revocation-check none
rsakeypair TP-self-signed-3769564853
crypto pki certificate chain TP-self-signed-3769564853
certificate self-signed 02
ip source-route
ip dhcp excluded-address 10.10.10.1
ip dhcp pool ccp-pool
import all
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
lease 0 2
ip cef
no ip bootp server
no ip domain lookup
ip domain name yourdomain.com
license udi pid CISCO861-K9 sn
username xxxxx privilege 15 secret 5 $1$SI.
username xxxxx privilege 15 secret 5 $1$y1
ip tcp synwait-time 10
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ************ address xxx.xxx.xxx.xxx
crypto ipsec transform-set RTPSET esp-aes esp-sha-hmac
crypto map RTP 1 ipsec-isakmp
set peer xxx.xxx.xxx.xxx
set transform-set RTPSET
match address 100
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map RTP
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.10.10.1 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map nonat interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 dhcp
logging trap debugging
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 24 permit 192.168.0.0 0.0.0.255
access-list 100 permit ip 10.10.10.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 100 deny ip 10.10.10.0 0.0.0.255 any
access-list 120 deny ip 10.10.10.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 120 permit ip 10.10.10.0 0.0.0.255 any
no cdp run
route-map nonat permit 10
match ip address 120
control-plane
line con 0
logging synchronous
login local
no modem enable
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
ASA5510
ciscoasa# sh run
: Saved
ASA Version 8.2(1)11
hostname ciscoasa
domain-name pme.local
enable password xxx encrypted
passwd xxx encrypted
names
interface Ethernet0/0
nameif backup
security-level 1
ip address xxx.xxx.xxx.xxx 255.255.255.248
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.10.1.1 255.255.0.0
interface Ethernet0/2
shutdown
nameif outside2
security-level 0
no ip address
interface Ethernet0/3
nameif outside
security-level 0
ip address xxx.xxx.xxx.xxx 255.255.255.224
interface Management0/0
nameif management
security-level 100
ip address 172.17.0.199 255.255.255.0
management-only
banner motd **************************** NOTICE ******************************
banner motd * Unauthorized access to this network device is FORBIDDEN! *
banner motd * All connection attempts and sessions are logged and AUDITED! *
banner motd ******************************************************************
banner motd **************************** NOTICE ******************************
banner motd * Unauthorized access to this network device is FORBIDDEN! *
banner motd * All connection attempts and sessions are logged and AUDITED! *
banner motd ******************************************************************
boot system disk0:/asa821-11-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside2
dns domain-lookup outside
dns domain-lookup management
dns server-group DefaultDNS
name-server HOMESTEAD-INT
name-server SEBRING-INT
domain-name pme.local
object-group service SQLTEST udp
description SQLTEST for VES
port-object eq 1434
object-group service SQLTEST_TCP tcp
description SQLTEST For VES
port-object eq 1433
object-group service DM_INLINE_TCP_1 tcp
port-object eq ftp
port-object eq ftp-data
access-list nonat extended permit ip any 10.10.11.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.0.0 10.10.11.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.0.0 192.168.101.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.0.0 10.10.10.0 255.255.255.248
access-list outside_access_in extended permit tcp any host DAYTONA-EXT-BAK eq smtp
access-list outside_access_in extended permit tcp any host DAYTONA-EXT-BAK eq https
access-list outside_access_in extended permit tcp any host DAYTONA-EXT-BAK eq www
access-list outside_access_in extended permit tcp any host SonomaBullsEye eq https inactive
access-list outside_access_in extended permit tcp any host AUTHENTICA-EXT-BAK eq www
access-list outside_access_in extended permit tcp any host AUTHENTICA-EXT-BAK eq https
access-list outside_access_in extended permit udp any host xxx.xxx.xxx.xxx eq 1434
access-list outside_access_in extended permit tcp any host xxx.xxx.xxx.xxx eq 1433 inactive
access-list outside_access_in extended permit tcp any host FILETRANSFER-EXT-BAK eq www
access-list outside_access_in extended permit tcp any host FILETRANSFER-EXT-BAK eq https
access-list outside_access_in remark HTTP for TeamWeb
access-list outside_access_in extended permit tcp any host ALEXSYS-EXT-BAK eq www
access-list outside_access_in remark HTTPS for TeamWeb
access-list outside_access_in extended permit tcp any host ALEXSYS-EXT-BAK eq https
access-list outside_access_in extended deny icmp any any
access-list Split_Tunnel_List standard permit 10.10.0.0 255.255.0.0
access-list outside_access_in_1 extended permit tcp any host DAYTONA-EXT-OUT eq smtp
access-list outside_access_in_1 extended permit tcp any host DAYTONA-EXT-OUT eq https
access-list outside_access_in_1 extended permit tcp any host DAYTONA-EXT-OUT eq www
access-list outside_access_in_1 extended permit tcp any host Sonoma eq https inactive
access-list outside_access_in_1 extended permit tcp any host PMEUPDATE-EXT-OUT eq www
access-list outside_access_in_1 extended permit tcp any host FILETRANSFER-EXT-OUT eq www
access-list outside_access_in_1 extended permit tcp any host FILETRANSFER-EXT-OUT eq ssh inactive
access-list outside_access_in_1 extended permit tcp any host FILETRANSFER-EXT-OUT eq https
access-list outside_access_in_1 remark FTPS
access-list outside_access_in_1 extended permit tcp any host FTP-EXT-OUT object-group DM_INLINE_TCP_1
access-list outside_access_in_1 extended permit tcp any host FTP-EXT-OUT range 60200 60400
access-list outside_access_in_1 extended permit tcp any host AUTHENTICA-EXT-OUT eq www
access-list outside_access_in_1 extended permit tcp any host AUTHENTICA-EXT-OUT eq https
access-list outside_access_in_1 extended permit tcp any host OSCODA-EXT-OUT object-group SQLTEST_TCP inactive
access-list outside_access_in_1 extended permit udp any host OSCODA-EXT-OUT object-group SQLTEST inactive
access-list outside_access_in_1 extended permit tcp any host ALEXSYS123-EXT-OUT eq www
access-list outside_access_in_1 extended permit tcp any host ALEXSYS123-EXT-OUT eq https
access-list outside_access_in_1 extended deny icmp any any
access-list inside_access_out extended permit ip any any log
pager lines 24
logging enable
logging timestamp
logging trap notifications
logging asdm notifications
logging from-address [email protected]
logging recipient-address [email protected] level errors
logging host inside 10.10.2.12
logging permit-hostdown
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302012
no logging message 302017
no logging message 302016
mtu backup 1500
mtu inside 1500
mtu outside2 1500
mtu outside 1500
mtu management 1500
ip local pool IPSECVPN2 10.10.11.76-10.10.11.100
ip local pool SSLVPN 10.10.11.101-10.10.11.200 mask 255.255.0.0
ip local pool IPSECVPN 10.10.11.25-10.10.11.75
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-623.bin
no asdm history enable
arp timeout 14400
global (backup) 1 xxx.xxx.xxx.xxx
global (outside) 1 xxx.xxx.xxx.xxx netmask 255.255.255.224
nat (inside) 0 access-list nonat
nat (inside) 1 10.10.0.0 255.255.0.0
static (inside,outside) DAYTONA-EXT-OUT DAYTONA-INT netmask 255.255.255.255
static (inside,outside) AUTHENTICA-EXT-OUT AUTHENTICA-INT netmask 255.255.255.255
static (inside,outside) ALEXSYS123-EXT-OUT MIDOHIO-INT netmask 255.255.255.255
static (inside,outside) PMEUPDATE-EXT-OUT PMEUPDATE-INT netmask 255.255.255.255
static (inside,outside) FILETRANSFER-EXT-OUT FILETRANSFER-INT netmask 255.255.255.255
static (inside,outside) FTP-EXT-OUT FTP-INT netmask 255.255.255.255
static (inside,backup) FILETRANSFER-EXT-BAK FILETRANSFER-INT netmask 255.255.255.255
static (inside,backup) DAYTONA-EXT-BAK DAYTONA-INT netmask 255.255.255.255
static (inside,backup) AUTHENTICA-EXT-BAK AUTHENTICA-INT netmask 255.255.255.255
static (inside,backup) ALEXSYS-EXT-BAK MIDOHIO-INT netmask 255.255.255.255
access-group outside_access_in in interface backup
access-group inside_access_out in interface inside
access-group outside_access_in_1 in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1 track 1
route backup 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 254
route backup 62.109.192.0 255.255.240.0 xxx.xxx.xxx.xxx 1
route backup 64.68.96.0 255.255.224.0 xxx.xxx.xxx.xxx 1
route backup 66.114.160.0 255.255.240.0 xxx.xxx.xxx.xxx 1
route backup 66.163.32.0 255.255.240.0 xxx.xxx.xxx.xxx 1
route backup 209.197.192.0 255.255.224.0 xxx.xxx.xxx.xxx 1
route backup 210.4.192.0 255.255.240.0 xxx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 24:00:00 half-closed 0:05:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
webvpn
http-proxy enable
aaa-server PMERADIUS protocol radius
aaa-server PMERADIUS (inside) host HOMESTEAD-INT
key ******
radius-common-pw ******
aaa authentication ssh console LOCAL
http server enable
http 10.10.0.0 255.255.0.0 inside
http 172.17.0.0 255.255.255.0 management
http redirect backup 80
http redirect outside 80
snmp-server location Server Room
snmp-server contact Jay
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 100
type echo protocol ipIcmpEcho xxx.xxx.xxx.xxx interface outside
timeout 3000
frequency 10
sla monitor schedule 100 life forever start-time now
crypto ipsec transform-set PM1 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set pfs group1
crypto dynamic-map dyn1 1 set transform-set PM1
crypto dynamic-map dyn1 1 set security-association lifetime seconds 28800
crypto dynamic-map dyn1 1 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set reverse-route
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map cryptomap1 1 ipsec-isakmp dynamic dyn1
crypto map cryptomap1 interface backup
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint xxx.xxx.xxx.xxx
enrollment terminal
fqdn xxx.xxx.xxx.xxx
subject-name CN= xxx.xxx.xxx.xxx, O=xxxx, C=US, St=MI, L=xxxx
keypair xxx.xxx.xxx.xxx
crl configure
crypto ca certificate chain xxx.xxx.xxx.xxx
certificate 041200616c79f4
30820577 3082045f a0030201 02020704 1200616c 79f4300d 06092a86 4886f70d
quit
crypto isakmp identity address
crypto isakmp enable backup
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto isakmp policy 50
authentication pre-share
encryption aes-256
hash md5
group 5
lifetime 86400
crypto isakmp nat-traversal 33
track 1 rtr 100 reachability
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
ssh version 2
console timeout 0
management-access inside
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 64.22.86.210 source backup prefer
ssl trust-point vpn.prattmiller.com outside
ssl trust-point vpn.prattmiller.com backup
ssl trust-point vpn.prattmiller.com outside2
webvpn
enable backup
enable outside2
enable outside
svc image disk0:/anyconnect-win-2.5.3055-k9.pkg 2
svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 3
svc profiles AllowRemoteUsers disk0:/AnyConnectProfile.xml
svc enable
internal-password enable
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 10.10.2.1
vpn-tunnel-protocol IPSec l2tp-ipsec
default-domain none
group-policy DfltGrpPolicy attributes
dns-server value 10.10.2.1 10.10.2.62
vpn-idle-timeout 600
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split_Tunnel_List
default-domain value pme.local
webvpn
url-list value Book1
svc profiles value AllowRemoteUsers
svc ask enable default webvpn timeout 10
group-policy AnyConnect internal
group-policy AnyConnect attributes
vpn-tunnel-protocol webvpn
webvpn
svc ask enable default webvpn timeout 15
username xxxx password RrjDgdg5BBLrGPnn encrypted privilege 15
username xxxx password qDxllXruMJHEVZji encrypted privilege 15
username xxxx password dGOqWbOOjP0FVxtl encrypted privilege 15
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup general-attributes
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool (backup) IPSECVPN2
address-pool (outside2) IPSECVPN2
address-pool (outside) SSLVPN
address-pool SSLVPN
authentication-server-group PMERADIUS
tunnel-group pm_ipsec type remote-access
tunnel-group pm_ipsec general-attributes
address-pool IPSECVPN2
tunnel-group pm_ipsec ipsec-attributes
pre-shared-key *
tunnel-group prattmiller type remote-access
tunnel-group prattmiller general-attributes
address-pool IPSECVPN
tunnel-group prattmiller ipsec-attributes
pre-shared-key *
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 1024
policy-map global_policy
class inspection_default
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
class class-default
service-policy global_policy global
smtp-server 10.10.2.6
prompt hostname context
Cryptochecksum:8316029502f6698d4015f5e1b3d40a08
: end
[code] TEST [/code]
My question about this is the other Dynamic VPN that is working has no static route.
I added:
route outside 10.10.10.0 255.255.255.248 xxx.xxx.xxx.xxx (where xxx.xxx.xxx.xxx is the IP of the non working remote IKE Peer)
This had no effect.
Looking at the two tunnels. The working tunnel is using IKE IPSEC and the nonworking tunnel is using IKE IPsecOverNatT. What have I entered that tells the VPN to use IPsecOverNatT?
Similar Messages
-
Having trouble with the most simple of things: Static IP
I am having trouble with the most simple of things: Static IP.
I am working in Windows Server 2008 R2 SP1.
"Control Panel\Network and Internet\Network and Sharing Center\Local Area Connections>Properties>Internet Protocol Version 4 (TCP/IPv4) and Internet Protocol Version 6 (TCP/IPv6)"
IPv4: I have went to "ipconfig /all" and found the "preferred" IP Address and the Default Gateway.
Assign DNS Servers?
IPv6: I used "netsh interface ipv6 show address level=verbose" and found 3 usable IPv6 IPs.
Assign IP Address, Default Gateway and DNS Servers?What is the question?
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. -
I am currently having trouble with an attached PDF fill-able form...Help Please
Hello, I was wondering if you would be able to help me out?
I am having trouble with my attached PDF fill-able form, I am creating a form that has a limit of one page so in order for more room in a certain field I have added a Hyperlink to an additional fill-able(secondary) form within the Parent document (primary fill-able form. The secondary form is inserted as an attachment into the Primary form. My problem is when I open this document up in Adobe Reader, the Primary fill-able form is savable but the attached Secondary form for which the hyperlink leads to is non-savable and is a must print only. Is there a way to make the Secondary form savable as well within the same document? or is there another way I could execute what it is I am trying to achieve?
Help would be greatly appreciated please and thank you!Here is the code, thought I had put it in the first time, guess not heh. Anyway, I converted the arrayList(accountList) to a String so that I could see the that element I am trying to index is in there, which it is. I also checked the file that i'm populating the arrayList from and it also has the element in it.
public static void getAccountNumbers() {
accountList = LoadStoreAccounts.readCollectionObject();
accountInfo = accountList.toString();
JOptionPane.showMessageDialog(null, accountInfo);
acctNumIndex = accountList.indexOf(accountNumber);
acctIndex = String.valueOf(acctNumIndex);
JOptionPane.showMessageDialog(null, "Index of accountNumber is: " + acctIndex); -
Hi I am having trouble with iTunes! Randomly when I click on a song in iTunes it changes the song title to time after time and the artist is pink.
I could click on 4 songs and they will be normal but then the 5th one will change the info to time after time.
I haven't done anything different or new, it started doing it all of a sudden, well that I have noticed anyway. Please help.Hello Schimi. The Time Capsule is a kind of product that offer you two possibility:
- To use the TC as a router or as an external HD.
The difference between WPA and WPA 2 are:
- They are two kinds of internet connection.
WPA uses dynamic key encryption , which means that the key is constantly changing and makes the invasion of a wireless network more difficult than WEP . WPA is considered one of the highest levels of wireless security for your network and is recommended if your devices support this kind of encryption . Newer routers offer WPA2 security . WPA2 is compatible with WPA , but offers higher security level . In fact, it meets the high standards of many government agencies . If the router and computer support WPA2 , this should be your choice.
If you need any help or if you find some difficult setting up it you can contact Apple Support.
I am sure that they can help you with that.
I am sory for the delay. I holpe that you solve your issue. -
Having trouble with fm transmitter
i have a 2gb 1st gen nano and use an extrememac airplay2 transmitter in my car
i've been having trouble with the connection - it will sometimes only transmit through the right speaker, or it will be working fine and it will suddenly kick off and i get a blast of static (i.e. what would be coming through the radio if the ipod wasn't playing at all). gives me a coronary, every time.
picking up the entire assembly and jiggling things a bit clears it up, though, which makes me think that i've got a dirty or damaged connection between the ipod and the transmitter...so, first things first - if i wanted to clean the 'dock' part of the nano, how would i do that? safely?
has anyone else had this problem?how much did you spend on this fm transmitter? my experence is that if you pay less than $80 its junk.. if i were to clean out the "dock" portion of an ipod i would use an air gun/bottle.. I dont know if its safe or not but its what i would try. i have been through an itrip and one other cheap fm transmitter and i had the same issues as you had..
good luck. -
Hey there.
I'm fairly new to java so bear with me here.
I'm having trouble with a program that, in short, reads from a file.
Let me shorten a show the code to you...
//main opens up and in a bit we get to...
if (loginVerify())
//and the if continues.
fileIn.close();
//main ends
public boolean loginVerify() throws IOException
openIn(); //Checks for validity - It's a long story why I //didn't just put the code in loginVerify(). I //don't think it should matter.
String str = verifyLog(); //Does the actual reading
str = str.substring(1);
if (str == placeHold) //Don't worry about not making placeHold,
//I made it global for testing reasons.
return true;
else
return false;
private String verifyLog() throws IOException
String str;
while (true)
str = fileIn.readLine();
if (str == null)
break;
else if (str.charAt(0) == 1)
return str;
//ADDITION OF OTHER NUMBERS
else
return str = "invalid";
private void readIn() throws IOException
BufferedReader console =
new BufferedReader(new InputStreamReader(System.in));
openInputFile(fileName);
if (fileIn == null)
System.out.println("*** Can't open " + fileName + " ***");
return;
private static void openInputFile(String fileName)
try
fileIn = new BufferedReader(new FileReader(fileName));
catch (FileNotFoundException e)
So it's fairly simple. It checks for validity and then reads lines until it finds one with the first char as '1' when it finds it, it reads the rest of the line off.
The error I'm getting is as follows: Exception java.io.IOException must be caught, or it must be declared in the throws clause of this method.
I've added throws IOException to them in attempts to fix the error but to no avail. I've tryed putting the catch in different spots... again, doesn't work.
I'm using codewarrior IDE version 5. I'm fairly sure it's the newest. I installed Java SDK 1.3 with codewarrior originally but I installed 1.4.1 recently.
If you need to see anything else about it, please tell me. I'd be more than happy to post a little more if it'll help.
ThanksOk. I worked through a bunch of throws and now I've found one I can't seem to conquer.
private String verifyLog()
String str = "";
while (true)
try {
str = fileIn.readLine();
catch (FileNotFoundException g) {
if (str == null)
break;
else if (str.charAt(0) == 1)
return str;
//ADDITION OF OTHER PEOPLE
else
return str = "invalid";
return str = "invalid";
}This time the error is at the reference to readLine() and it tells me the same error as before. I have a catch set up there, don't I?
readLine() is something I didn't create so I don't know how I'd tell it to throw an exception if I had to...
Thanks -
Hi, i am having trouble with my mac mail account, i cannot send or receive any emails because of the server connection problems. Message says it could not be connected to SMTP server. Thanks in advance for your help.
Hello Sue,
I have an iPad 3, iPad Mini and iPhone 5S and they are all sluggish on capitalisation using shift keys. I hope that Apple will solve the problem because it is driving me crazy.
I find using a Microsoft Surface and Windows 8 phone, which I also have, work as well as all the ios devices before the ios 7 upgrade.
It has something to do with the length of time that you need to hold the shift key down. The shift key needs to be held longer than the letter key for the capitalisation to work. For some reason, this is a major change in the way we have learnt to touch type on computers. I am having to relearn how to type!
Michael -
I'm having trouble with a virus or something which affects Google search results when I use Firefox on my PC ...
When I search a topic gives me pages of links as normal, but when I click on a link, the page is hijacked to a site called 'www.goingonearth.com' ...
I've done a separate search and found that other users are affected, but there doesn't seem to be a clear-cut solution ... (Norton, McAfee and Kaspersky don't seem to be able to detect/fix it).
I'd like to continue using the Firefox/Google combination (nb: the hijack virus also affects IE but not Safari) - do you have a patch/fix that could rectify the vulnerability in your software?
thanks''' "... vulnerability in your software?" ''' <br />
And it affects IE, too? Ya probably picked up some malware and you blame it on Firefox.
Install, update, and run these programs in this order. They are listed in order of efficacy.<br />'''''(Not all programs detect the same Malware, so you may need to run them all to solve your problem.)''''' <br />These programs are all free for personal use, but some have limited functionality in the "free mode" - but those are features you really don't need to find and remove the problem that you have.<br />
''Note: If your Malware infection is bad enough and you are mis-directed to URL's other than what is posted, you may have to use a different PC to download these programs and use a USB stick to transfer them to the afflicted PC.''
Malwarebytes' Anti-Malware - [http://www.malwarebytes.org/mbam.php] <br />
SuperAntispyware - [http://www.superantispyware.com/] <br />
AdAware - [http://www.lavasoftusa.com/software/adaware/] <br />
Spybot Search & Destroy - [http://www.safer-networking.org/en/index.html] <br />
Windows Defender: Home Page - [http://www.microsoft.com/windows/products/winfamily/defender/default.mspx]<br />
Also, if you have a search engine re-direct problem, see this:<br />
http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html
If these don't find it or can't clear it, post in one of these forums for specialized malware removal help: <br />
[http://www.spywarewarrior.com/index.php] <br />
[http://forum.aumha.org/] <br />
[http://www.spywareinfoforum.com/] <br />
[http://bleepingcomputer.com] -
my ipad is having trouble with my music... i had recently gotten a new one when i signed into my icloud the music that i had on the orignal one was not there.... some songs were in fact there but not clickable ( it was there only gray)... i was looking for help on how to get the music on the ipad
my ipad is having trouble with my music... i had recently gotten a new one when i signed into my icloud the music that i had on the orignal one was not there.... some songs were in fact there but not clickable ( it was there only gray)... i was looking for help on how to get the music on the ipad
-
I am having trouble with my mac mini ethernet. It had been working for weeks after an update to SL 10.6.8.
Once it went out and i repaired it by defining a new connection from System Preferences ->Network->(left panel service, +).
But yesterday, after a power up. my ethernet was not working again. I tried this old trick to repair it, but the interface choices
listed for '+' a new service did not include Ethernet any more. And the Utilities->System Profiler->Ethernet Cards shows
no ethernet available.
As a last ditch effort i reloaded my original SL from DVD. (I think it was version 10.6.4 but i could be mistaken on the version).
The ethernet worked! But KeyNote wasn't going to work because apparently the version i purchased depends on 10.6.8.
So I upgraded again to SL 10.6.8 (Plus some other updates like AirPort which i don't use).
Now the Ethernet is not working again. I see the same symptoms as before with the Ethernet seeming not installed.
Is this a problem seen by others?
Would going to Lion fix the problem?
Could AirPort actually be the culprit and not SL?
If i stay with my original SL, would i need to repurchase a version of KeyNote for the older version of SL?Have you reset the SMC?
Shut down the computer.
Unplug the computer's power cord.
Wait fifteen seconds.
Attach the computer's power cord.
Wait five seconds, then press the power button to turn on the computer.
While you're at it, resetting the PRAM won't hurt anything and 'might' help is SMC reset didn't work (PRAM does some port control):
Shut down the computer.
Locate the following keys on the keyboard: Command, Option, P, and R. You will need to hold these keys down simultaneously in step 4.
Turn on the computer.
Press and hold the Command-Option-P-R keys. You must press this key combination before the gray screen appears.
Hold the keys down until the computer restarts and you hear the startup sound for the second time.
Release the keys.
Something else you might try .... you don't say how you're updating to 10.6.8, however, if you're using Software Update, you might try downloading the 10.6.8 combo update, which contains all updates to 10.6. Sometimes, Software Update doesn't work quite right, and installing the combo update fixes that. Download the update from Apple's download site at http://support.apple.com/downloads/ , using Disk Utility repair permissions, apply the combo update, then repair permissions again. -
I am having trouble with my links/websites having images attached to them. The place where the image should be is blank. For example, AARP has an A for its image. My storage website has a blank broken box where the image should be. I forgot I had trouble and had to reset Foxfire, this problem occurred after that reset.
cor-el,
Mixed content normally gives the world globe image, unless you are using a theme that uses a broken padlock instead. Maybe the gray triangle means invalid? I came across that in a few themes (what is invalid was not made clear), but those were not using triangle shapes to indicate that.
I came across that mention in one of the pages you posted:
* https://support.mozilla.org/kb/Site+Identity+Button
I cannot attach a screenshot because I have not seen a triangle of any kind in my address bar. -
I have been having troubles with this for months and am extremly tired of not being able to download my songs. I bought these songs off of Itunes as well, so I really hope i can retrieve them. I do not know where to find a personal apple support person yet, does anyone know where to find one on the website?
See these previous discussions:
Waiting applications: Apple Support Communities
Downloading apps stuck on waiting...: Apple Support Communities -
I am having trouble with iMessage being activated. It has worked up until yesterday and now won't activate and is saying no address in the send and receive section. My number is there but not ticked. Any suggestions on how to fix this? I have shut down my phone, but still no luck!
iMessage and FaceTime went down yesterday for some people. Mine is still down. My iMessage is saying the same thing about being activated. Sounds like you are still down too. Ignore the status page that says everything is fine - it lies.
-
I am having trouble with app updates on my iOS 5 iPhone never getting beyond the "waiting" state.
I am having trouble with app updates on my iOS 5 iPhone never getting beyond the "waiting" state. I have tried signing out/in of my account, rebooting and removing/re-installing the apps. This started shortly after going to iOS 5 but I am not certain if that is related. All updates that I try now are stuck in "waiting". I also tried removing the apps and then installing via iTunes desktop sync with no improvement. The only thing that I have not tried so far is a restore to a prior iPhone backup. I have not been able to find anything to indciate what the updates on waiting on. There is plenty of space on the iPhone (16gb available). Any suggestions on what to try next?
Hello there, Missy.
First thing I would recommend is to check your downloads queue to make sure there is not an interrupted download per the following Knowledge Base article:
iTunes: How to resume interrupted iTunes Store downloads
http://support.apple.com/kb/HT1725
If your download was interrupted using your iPhone, iPad, or iPod touch
1. From the Home screen, tap the iTunes app.
2. For iPhone or iPod touch, tap More > Downloads. For iPad, tap Downloads.
3. Enter your account name and password if prompted.
4. Tap the blue download arrow to resume.
If you can't complete the download on your iOS device, you can download it in iTunes on your Mac or PC and then sync it to your iOS device. You can also transfer purchases from your iPhone, iPad, or iPod to a computer.
For Apps, you can also try tapping on the application icon to resume the download, as outline in this featured discussion:
App updates won't download on my...: Apple Support Communities
https://discussions.apple.com/thread/4111336
Try tapping the App, so that it changes to Paused instead of Waiting, then tap it again to resume the install.
Make sure you don't have any paused downloads in other apps either, like the App Store or iTunes Store.
If that doesn't do it, try resetting or restoring the iPhone.
via whatheck
Thanks for reaching out to Apple Support Communities.
Cheers,
Pedro. -
In Mail, I am having trouble with my cursor. When making revisions to what I have already typed, the cursor doesn't "land" where I "click" it to be. It seems to land somewhere below the spot I click on. It seems to have a mind of its own.
Cool handyandy42!
I'm happy I could be helpful, with solving your problem!
Also, I notice that you have marked your question as answered, but have not utilized the Helpful or Solved options. That may be intentional, but, if you are not aware of the benefits, of using that function, here is some information.
When you mark the appropriate posts as Helpful (5 pts) 2 available, or Solved (10 pts) 1 available, you are Thanking the contributors, by awarding them points.
In threads with multiple replies, it also alerts other readers, to which answers may have been helpful, or solved the issue.
This info, and more, can be viewed by clicking on
? Help & Terms of Use, located under your login name, on all "Discussions" pages.
Specifically What are question answers?.
ali b
Maybe you are looking for
-
Creative Cloud doesn't include everything?
Hi, I thought Creative Cloud was supposed to include all adobe services. So why doesn't it include SendNow, and Export/Create PDF when it includes Story Plus.. This confuses me, and kind of upset me as I thought it was supposed to be everything, and
-
I need to download CS2 - but the system is not recognizing my Serial Number
I have an older version of Adobe Photoshop CS2 - The computer I had the program on crashed. I am wanting to download the program on my new laptop, but unfortunately my new laptop does not have a disc portal. The Adobe site is not recognizing my Seria
-
Unable to boot from bootcamp to macosx snow leopard in bootcamp ctrl panel
update to bootcamp 3.2 for win 32 winxp home sp2 bootcamp, open bootcamp ctrl pnl> select macosx to reboot> press enter> dialogue to restart now?> yes desktop freezes, i press ctrl alt del, .. nothing get the busy/working cursor this happened on the
-
I just installed Tiger (10.4.3) this afternoon and have not been able to lauch Safari successfully since. the contents of the crash log are: Date/Time: 2005-11-22 16:03:39.214 -0500 OS Version: 10.4.3 (Build 8F46) Report Version: 3 Command: Safari Pa
-
Cursor won't highlight text in word
All of a sudden the cursor will not select text in ms word. I can double click to select groups of words but I can't click and drag the cursor over words to select them. There was no change in software- just out of the blue. thanks for any advice