How to configure a one-way L2L IPSec tunnel

This may be a dumb question, since VPN is for communications between trusted parties and that most people would try to fix a one-way tunnel.
But I am interested in turning a regular tunnel into one-way only, i.e., only traffic on my side can initiate the tunnel.
We recently built this tunnel between our ASA5510 and our biz partner's ASA5510 in order to run critical apps on their non-Internet-facing web servers. I want to tie it down so that they can't initiate the VPN. I have the crypto ACL set to limit to a port address so they can only come to us from that port once the tunnel is established. We also have personal firewall installed on each host.
Any idea on how to make the tunnel one way and also protect us better once the tunnel is up?

Hi,
You can use the following command:
crypto map map-name seq-num set connection-type {answer-only | originate-only | bidirectional}
This command defines whether the tunnel is originate-only or answer-only. If you set the tunnel on your side to originate-only, the asa will never accept the tunnel setup from your business partner. However, you can still initiate the vpn tunnel setup.
Check out:
http://www.cisco.com/en/US/partner/docs/security/asa/asa80/command/reference/c5.html#wp2152576
Although the reference is for ASA8.0 I know it works for 7.2.x as well
Hope this helps
Kind regards
Pieter-Jan

Similar Messages

How do i host one way multiperson video conference?

My friend was able to host a video conference with me and him on video, and another person through audio; this was on his g4. I am on a 2.33 ghz Macbook Pro, and I want to host a video conference with two people on audio. Is that possible? I've tried a slew of combinations, but to no avail. Any suggestions? Is it feasable? Thanks.

I think that it was an extremely lucky strike to realise 2way video in combination with a friend who had a mic (audio only) next to his pict. What might have happened that it actually was a 3way video chat and due to bandwidth drop turned out to effectively be a 2AV one only Audio.
So, if you have a multi layered camera in your list, you can video chat with more than one other camera user, and you audio chat with other multi layered mics up to 10 users. But you can't do mixed invitations between them.
How does iChat determine if you are capable of joining or hosting a multiperson chat?
When iChat is opened, it performs a series of tests to determine if multi-person chats are supported with available bandwidth.
iChat also checks the file "com.apple.ichat.plist" in ~/Library/Preferences/ to detemine if defaut values have been set for bwdup and bwddown. It checks to see if the IP address stored in bwdid is the same as the current IP address of the computer, or if the settings are older than three days.
If any of these conditions are not met, iChat performs a .Mac bandwidth detection test to see if .Mac network bandwidth is fast enough to support a multi-way connection.
If the test succeeds, then multi-way chat is enabled.
JP

How to configure take one get one free offer scenario

Hello Experts
I am quite new to the field of SAP B1
I am stuck at one case scenario, please help
i)     Make sales with take one get one free offer (Eg: With purchase 1 paste same item offered free)
ii)     In Sales document both the item should be displayed, with price of 1 item

Hi Jiss,
           You can also uncheck the "Allow Stock release without item cost" under company details--> basic initialisation and release such items in the marketing documents and also making a bom of such item would be better.
Regards,
Joseph

How to do a one-way synchronize (blast address boo...

I have a 6126 phone that I have sync'd with PC Suite before. I'd like to over-write the address book info currently stored on the phone with the master of that address book stored on my PC (essentially doing a PC-->phone copy, rather than a PC Suite / Synchronize). How would I do that?

If I:
Go to the green/blue yin/yang symbol (the sync icon) near the windows clock
Right Slick, Phone Selector, Select the phone to sync
Right Click, Settings, Go through the wizard
At the end of the wizard, step 5/5 click the Spanner icon
In the DIRECTION tab, you can choose the sync direction
I'm using latest Nokia PC Suite 7.1

HT1386 How do you sync only one way?

I want to know how to sync only one way because there are some photos from our previous apple devices and I don't want those photos to appear onto my new one when I sync to put the photos or videos onto the computer. Does anyone know how to do it without messing up the system?

The photos are now on your computer and you don't want them on your new iPad?
Then move this photos on your computer to another location (folder) first and then sync.

Can Identity Firewall work with L2L IPSec

Hello,
One of my customers has requested a L2L IPSec tunnel between a 3rd party ASA5505 and their central office 5510.
The tunnel works fine but they have asked to enable Identity Firewall against the incoming connections in relation to the IPSec tunnel.
I've read about sysopt and vpn filter. So there are 2 choices.
1. Disable access rule bypass for VPN connections via the sysopt command and configure the access rules accordingly.
2. Use the vpn filter mechanism and define the ACL / ACE w/ the Identity Firewall.
This is an excerpt from the Identity Firewall chapter ASA 9.0/ASDM 7.0.
VPN filter—Although VPN does not support identity firewall ACLs in general, you can use configure the ASA to enforce identity-based access rules on VPN traffic. By default, VPN traffic is not subject to access rules. You can force VPN clients to abide by access rules that use an identity firewall ACL (
no sysopt connection permit-vpn
command). You can also use an identity firewall ACL with the VPN filter feature; VPN filter accomplishes a similar effect as allowing access rules in general.
Has anyone attempted and succeeded with such a configuration? If so, did it support AD authentication or LOCAL only?
Thanks in advance for your input.

Anyone??

One way SMS + OTP in Azure MFA server

Hi, how can i enable one way SMS in Azure MFA on premise?
I have Azure MFA server and local active diretcory. I want users to receive a OTP and enter it to the logon page instead of replying to it? how can this be done? and if it is via the SDK, any one can explain more
ammarhasayen

MFA Server v6.2.2 and older doesn't have one-way SMS capability. It is being added to v6.3 which is expected to release in Jan 2015. The one-way SMS will work with the ADFS Adapter, RADIUS and the User Portal. In order to work successfully with RADIUS,
the system sending the ACCESS request will need to be able to handle an ACCESS CHALLENGE response so that the user can be prompted for the OTP.

IChat for just one way purposes?

Do you have to have a video conference while you want to webcam in iChat? I want to webcam with my friend but she doesn't have a webcam or iChat (she's on AIM), and she's not on an Apple computer, she's on Windows. Is there a way I can still connect with her so she can hear and see me from my iSight without her having to have a webcam or anything like that? I hope this makes sense :\ Any help would be nice.

Hello st3phani3
Look in your Mac's iChat > Help for If your buddy doesn’t have a camera to see how to do a
one-way video chat.
PC related one-way video help in Ralph Johns' How do I get Video and Audio Chats with PCs user tip.
EZ Jim
PowerBook 1.67 GHz w/Mac OS X (10.4.11) G5 DP 1.8 w/Mac OS X (10.5.2) External iSight

One Way Sync - OCS to PDA only

Was wondering how I can accomplish one way sync to "PDA only" so that users cannot overwrite calendar on server.

(1) Setting the replace all existing will wipe out my entire calendar of the phone and replace it with what is in Outlook.
Correct.
(2) By selecting "syncing" calendar events, will sync the events between Outlook and the iPhone.
Correct.
What happens about the events I have placed onto the phone (after that initial sync)? Won't they get synced to Outlook?
Yes, which is the definition of syncing.
I want the sync to always be one-way...only from Outlook to the iPhone.
Not possible. If this is what you want, then don't sync calendar events or only enter calendar events with Outlook.
Contact information, calendar events, and bookmarks (if selected to be synced with the supported applications on your computer) is a bidirectional or true sync process with the supported applications on your computer. There is no setting to transfer calendar events from the iPhone to the supported application on your computer only or vice-versa or to not be synchronized.

One-Way sync from Palm to iBook?

Wiped my address book with a crashed sync, but the data remains on my Palm device (Treo 650). Anyone know how to setup a one-way sync from the Treo back into the iBook? Thanks, M

Welcome to Apple Discussions.
You should first try to correct the problem by dragging the AddressBook.data file out of your Address Book folder at the end of this path:
Macintosh HD:Users:<username>:Library:Application Support:Address Book
Duplicate the AddressBook.data.previous file, and rename it simple AddressBook.data and launch the application to see if it can recover your files.
If not, you should understand that there is no easy, quick, painless way to achieve what you want - moving a copy of your handheld data to your Macintosh.
You can restore synchronization to the Palm Desktop, by moving the Apple conduit out of the active Conduits folder, and by moving the following disabled Palm conduits out of the Disabled Conduits folder and back into the active one:
• Address Conduit
• Calendar Conduit
• Contacts Conduit
• Datebook Conduit
• Tasks Conduit
• ToDo Conduit
(Only one of each conduit pair is used by your Treo 650, but these instructions would also apply to users of the older conduits.)
By setting each conduit to Handheld overwrites Macintosh, you will transfer the data on your smartphone to the Palm Desktop, overwriting any existing records by doing so.
You can then export contact data as a vCard file and calendaring data as a vCal file but, here's a problem: you cannot export task or to do data, so in this process, you will lose all of the to do items in iCal. Once you have exported the Palm Desktop data in vCard and vCal format, you can import the contents of each file into the Address Book and iCal, remembering that your vCal file contains only event—and not to do—data.
You can then return the Palm conduits to the Disabled Conduits folder and the iSync Palm Conduit to the active one, and synchronize once again with iSync, choosing to overwrite the contents of your handheld with the data from the Address Book and iCal. Once again, say goodbye to your to do records. You do this by removing your device from iSync and adding it back prior to the next synchronization, causing the framework to act as if you have never synchronized before. Choose Replace (and not Merge) to avoid data duplication errors.
Do you see why periodically backing up Address Book and iCal data is so important? To do so, just select the Back up Address Book in the Address Book or the Back up Database option in iCal.

IPSEC tunnel Phase 1 and 2

Guys was checking ASA config and we have many IPSEC tunnels
one of the IPSEC tunnel has follwoing
crypto map clientmap 40 set transform-set ESP-3DES-MD5 ESP-3DES-SHA
whats does the second means normally oter IPSEC has
crypto map clientmap 14 set transform-set ESP-3DES-MD5
what is a clientmap anyway will appriciate if someone plz explain

Hi,
The "crypto map" settings belong to the Phase II portion of your VPN tunnel (with some exceptions).
Here you usually define the following paratemers (most common):
1- Protected traffic, "match address" command.
2- Transform-set, integrity and authentication.
3- VPN peer.
So the transform-set "ESP-3DES-SHA" probably is "esp-3des esp-sha-hmac" which means:
ESP with the 3DES encryption algorithm.
ESP with the SHA (HMAC variant) authentication algorithm,
Now, you can have many valid combinations like "ESP-3DES-SHA" and "ESP-3DES-MD5", this would be useful in case you do not know which transform-set the other side of the tunnel has configured (there must be at least one perfect match).
Here is good link to set up L2L tunnels on ASAs:
Configuring LAN-to-LAN VPNs
Hope to help.
Portu.
Please rate any helpful posts

Multiple IPSEC tunnels on ASA 5505

Configuring Multiple IPSEC tunnels on ASA 5505
Hi,
I need to configure 2 diffrent type of IPSEC tunnels on my ASA 5505. 1st one is static ipsec tunnel already configured between HO to site A and 2nd one is dynamic to be configure between HO to site B since site B does not have static IP so I have to configure dynamic ipsec vpn.
I have following clarification
1. After configuring dynamic ipsec Is my existing static ipsec tunnel will work simultenously?
2. can I apply different crypmap on the same outside interface? if not then what setting i need to do to make this work?
3. Do i need to create 1 more Nat0 or can i add in existing ACL which i have already created for previous.
kindly help me on this
Thanks in advance
Subhan Shaikh
France Telecom

Configuring Multiple IPSEC tunnels on ASA 5505
Hi,
I need to configure 2 diffrent type of IPSEC tunnels on my ASA 5505. 1st one is static ipsec tunnel already configured between HO to site A and 2nd one is dynamic to be configure between HO to site B since site B does not have static IP so I have to configure dynamic ipsec vpn.
I have following clarification
1. After configuring dynamic ipsec Is my existing static ipsec tunnel will work simultenously?
2. can I apply different crypmap on the same outside interface? if not then what setting i need to do to make this work?
3. Do i need to create 1 more Nat0 or can i add in existing ACL which i have already created for previous.
kindly help me on this
Thanks in advance
Subhan Shaikh
France Telecom

How to configure one TREX host with multiple index servers ?

Hi All,
Does anyone know how to configure TREX on the one host,
with multiple index servers ?
Reason for this is to make better use of resources available on the host server(4 Gig, 4 Processor, Windows2003), to improve the search performance of
our KM content for portal users.
I am using TREX 7 and have not been able to do this,
despite reading the Single and Distributed install
documentation.
Any help would be appreciated.
Regards,
Andres

Hi Andres,
To make use of the RAM a Server provides you have to run two indexserver processes (each can then consume 2 GB);
Proceed like this:
1. Go to TREXdeamon.ini; check if section [indexserver2] is there (it is already provided, but not active in standard installation)
2. In TREXdeamon.ini go to
[daemon]
references sections below
programs=nameserver,preprocessor1,indexserver1,queueserver,alertserver
and add indexserver2 here. Restart TREX; second porcess is then started; can be checked in TREX monitor in Portal as well
3. To distribute existing indexes to the new process, start TREXadmintool and go to Index: Landscape
Go to the last two columns and move the indexes (move master here/secondary mouse click)
If you don't distribute the indexes the new index server process will be regarded when an new index is created.
Hope this helps!
cheers
Bettina

How to configure multiple IP addresses on one NIC?

Hi,
I just installed a OVM Server in version 3.2.1 and the according VMManager. Now i wanted to try to configure the Server/Server Pool. Now i come across a problem, which was already a big problem in OVM 2 while configuring the Networks.
All our OVM Servers have three NICs in them. One is for VMs and Management, the others are for connection to our SAN (Dell PowerVault MD 3220i). My problem is, that due to the network setup, the two NICs for storage need two IP addresses in two different networks each. This shouldn't be a problem, because usually in linux all you have to do is configure something like eth1:1. I remember having huge trouble configuring it in our OVM 2 cluster up to the point where I had to write a shell script to configure the second IP.
Anyways, I have configured two of the storage networks on eth1 and eth2 of the VM Server. Now i cannot configure any more IP addresses, because eth1 and eth2 are not available anymore for configuration in a third network. I really hoped that it would be possible in OVM 3 to configure multiple IP addresses. And probably it is only my lack of knowledge of how to configure it.
So any advice is well appreciated.
Thanks!
Regards,
Marek Hubatka

You should be able to do this by using "VLAN Groups".
http://docs.oracle.com/cd/E35328_01/E35332/E35332.pdf
Check out the VLAN groups section. You must great the VLAN groups before you can assign them to interfaces.

I`d like to know how can i insert documents, xls/doc/pdf into iCloud and have them in my iPhone and my iPad. I just found one way, through ibooks, but i think it isn't a practical option.

I`d like to know how can i insert documents, xls/doc/pdf into iCloud and have them in my iPhone and my iPad. I just found one way, through ibooks, but i think it isn't a practical option.

Just use Drop Box instead.

How to configure a one-way L2L IPSec tunnel

Similar Messages

Maybe you are looking for