IDES Remote Access

Hi there - I am a new member.  I have looked through FAQs and some of the forums but the volume/granularity of information is pretty daunting and I can't seem to find an answer to the simple question I have.
I am looking to become a self-taught Certified Associate in ERP Financials.  I have been told that there are some companies offering remote access to IDES ECC 6.0. However when I look at Google I only see www.erptraininguk.com I get no response from phone calls or emails and a few negative reviews on the web.
Does anyone have any other ideas? - ideally looking to do it for $50 per month or less?
Thanks in advance.
Gerald

Hi Morgan,
http://www.consolut.net/en/s/sap-ides-access/discover-sap-ides.html
Click on the above link, and click on request IDES access.
user id will be created within 24 hours of request and you will receive a new password every night at 12 am CET.

Similar Messages

  • Remote access vpn clients, access to Internet resources

    Hello, we currently have a remote access vpn set up terminating on an ASA 5520.  Remote access users connect into this ASA and are able to access resources inside of the firewall- the public IP of the ASA is 1.1.1.135.  We need these users to be able to access resources natted behind another ASA firewall on the same public IP segment, at IP address 1.1.1.165.
    I have gotten to the point where I believe I have all of my Nat/global statements in place, along with my ACLs on both firewalls, but I am not able to make the connection to the server behind the second ASA.
    running packet tracer on the second ASA (hosting the 1.1.1.165 server) shows that the packet will be allowed.  RUnning packet tracer on the Remote access VPN ASA is showing that the packet is dropped due to :
    Action: drop
    Drop-reason: (ipsec-spoof) IPSEC Spoof detected
    To me, this should be a simple setup, very similar to a company that tunnels all traffic (including Internet traffic) for remote access VPN users.  It just doesn't seem like my traffic is getting to the second ASA wioth the remote host.
    Anyone have any ideas?

    I figured out the answer- I had to add a nat statement form my VPN user subnet to be natted to the outside global IP:
    nat (outside) 1 10.2.2.0 255.255.255.0 (this is my vpn subnet)
    global (outside) 1 interface

  • Problem with Remote Access VPN on ASA 5505

    I am currently having an issue configuring an ASA 5505 to connect via remote access VPN using the Cisco VPN Client 5.0.07.0440 running on Windows 8 Pro x64. The VPN client prompts for the username and password during the connect process, but fails soon after.
    The VPN client logs are as follows:
    Cisco Systems VPN Client Version 5.0.07.0440
    Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.
    Client Type(s): Windows, WinNT
    Running on: 6.2.9200
    2      15:09:21.240  12/11/12  Sev=Info/4    CM/0x63100002
    Begin connection process
    3      15:09:21.287  12/11/12  Sev=Info/4    CM/0x63100004
    Establish secure connection
    4      15:09:21.287  12/11/12  Sev=Info/4    CM/0x63100024
    Attempt connection with server "**.**.***.***"
    5      15:09:21.287  12/11/12  Sev=Info/6    IKE/0x6300003B
    Attempting to establish a connection with **.**.***.***.
    6      15:09:21.287  12/11/12  Sev=Info/4    IKE/0x63000001
    Starting IKE Phase 1 Negotiation
    7      15:09:21.303  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to **.**.***.***
    8      15:09:21.365  12/11/12  Sev=Info/6    GUI/0x63B00012
    Authentication request attributes is 6h.
    9      15:09:21.334  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    10     15:09:21.334  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from **.**.***.***
    11     15:09:21.334  12/11/12  Sev=Info/5    IKE/0x63000001
    Peer is a Cisco-Unity compliant peer
    12     15:09:21.334  12/11/12  Sev=Info/5    IKE/0x63000001
    Peer supports XAUTH
    13     15:09:21.334  12/11/12  Sev=Info/5    IKE/0x63000001
    Peer supports DPD
    14     15:09:21.334  12/11/12  Sev=Info/5    IKE/0x63000001
    Peer supports NAT-T
    15     15:09:21.334  12/11/12  Sev=Info/5    IKE/0x63000001
    Peer supports IKE fragmentation payloads
    16     15:09:21.334  12/11/12  Sev=Info/6    IKE/0x63000001
    IOS Vendor ID Contruction successful
    17     15:09:21.334  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to **.**.***.***
    18     15:09:21.334  12/11/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    19     15:09:21.334  12/11/12  Sev=Info/4    IKE/0x63000083
    IKE Port in use - Local Port =  0xFBCE, Remote Port = 0x1194
    20     15:09:21.334  12/11/12  Sev=Info/5    IKE/0x63000072
    Automatic NAT Detection Status:
       Remote end is NOT behind a NAT device
       This   end IS behind a NAT device
    21     15:09:21.334  12/11/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
    22     15:09:21.365  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    23     15:09:21.365  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from **.**.***.***
    24     15:09:21.365  12/11/12  Sev=Info/4    CM/0x63100015
    Launch xAuth application
    25     15:09:21.474  12/11/12  Sev=Info/4    IPSEC/0x63700008
    IPSec driver successfully started
    26     15:09:21.474  12/11/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    27     15:09:27.319  12/11/12  Sev=Info/4    CM/0x63100017
    xAuth application returned
    28     15:09:27.319  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to **.**.***.***
    29     15:09:27.365  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    30     15:09:27.365  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from **.**.***.***
    31     15:09:27.365  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to **.**.***.***
    32     15:09:27.365  12/11/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system
    33     15:09:27.365  12/11/12  Sev=Info/5    IKE/0x6300005E
    Client sending a firewall request to concentrator
    34     15:09:27.365  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to **.**.***.***
    35     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    36     15:09:27.397  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from **.**.***.***
    37     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 192.168.2.70
    38     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.0
    39     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 192.168.2.1
    40     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 8.8.8.8
    41     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000001
    42     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = NCHCO
    43     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
    44     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5505 Version 8.2(5) built by builders on Fri 20-May-11 16:00
    45     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001
    46     15:09:27.397  12/11/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
    47     15:09:27.397  12/11/12  Sev=Info/4    CM/0x63100019
    Mode Config data received
    48     15:09:27.412  12/11/12  Sev=Info/4    IKE/0x63000056
    Received a key request from Driver: Local IP = 192.168.2.70, GW IP = **.**.***.***, Remote IP = 0.0.0.0
    49     15:09:27.412  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to **.**.***.***
    50     15:09:27.444  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    51     15:09:27.444  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from **.**.***.***
    52     15:09:27.444  12/11/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 86400 seconds
    53     15:09:27.444  12/11/12  Sev=Info/5    IKE/0x63000047
    This SA has already been alive for 6 seconds, setting expiry to 86394 seconds from now
    54     15:09:27.459  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    55     15:09:27.459  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN) from **.**.***.***
    56     15:09:27.459  12/11/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to **.**.***.***
    57     15:09:27.459  12/11/12  Sev=Info/4    IKE/0x63000049
    Discarding IPsec SA negotiation, MsgID=CE99A8A8
    58     15:09:27.459  12/11/12  Sev=Info/4    IKE/0x63000017
    Marking IKE SA for deletion  (I_Cookie=A3A341F1C7606AD5 R_Cookie=F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED
    59     15:09:27.459  12/11/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = **.**.***.***
    60     15:09:27.459  12/11/12  Sev=Info/4    IKE/0x63000058
    Received an ISAKMP message for a non-active SA, I_Cookie=A3A341F1C7606AD5 R_Cookie=F1F403018625E924
    61     15:09:27.459  12/11/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(Dropped) from **.**.***.***
    62     15:09:27.490  12/11/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    63     15:09:30.475  12/11/12  Sev=Info/4    IKE/0x6300004B
    Discarding IKE SA negotiation (I_Cookie=A3A341F1C7606AD5 R_Cookie=F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED
    64     15:09:30.475  12/11/12  Sev=Info/4    CM/0x63100012
    Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_IKE_NEG_FAILED".  0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
    65     15:09:30.475  12/11/12  Sev=Info/5    CM/0x63100025
    Initializing CVPNDrv
    66     15:09:30.475  12/11/12  Sev=Info/6    CM/0x63100046
    Set tunnel established flag in registry to 0.
    67     15:09:30.475  12/11/12  Sev=Info/4    IKE/0x63000001
    IKE received signal to terminate VPN connection
    68     15:09:30.475  12/11/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    69     15:09:30.475  12/11/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    70     15:09:30.475  12/11/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    71     15:09:30.475  12/11/12  Sev=Info/4    IPSEC/0x6370000A
    IPSec driver successfully stopped
    The running configuration is as follows (there is a site-to-site VPN set up as well to another ASA 5505, but that is working flawlessly):
    : Saved
    ASA Version 8.2(5)
    hostname NCHCO
    enable password hTjwXz/V8EuTw9p9 encrypted
    passwd hTjwXz/V8EuTw9p9 encrypted
    names
    name 192.168.2.0 NCHCO description City Offices
    name 192.168.2.80 VPN_End
    name 192.168.2.70 VPN_Start
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address **.**.***.*** 255.255.255.248
    boot system disk0:/asa825-k8.bin
    ftp mode passive
    access-list outside_nat0_outbound extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.2.64 255.255.255.224
    access-list outside_1_cryptomap extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_1_cryptomap_1 extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0
    access-list LAN_Access standard permit NCHCO 255.255.255.0
    access-list LAN_Access standard permit 0.0.0.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPN_Pool VPN_Start-VPN_End mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-645.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (outside) 0 access-list outside_nat0_outbound
    route outside 0.0.0.0 0.0.0.0 74.219.208.49 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    network-acl outside_nat0_outbound
    webvpn
      svc ask enable default svc
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http **.**.***.*** 255.255.255.255 outside
    http 74.218.158.238 255.255.255.255 outside
    http NCHCO 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set l2tp-transform esp-3des esp-sha-hmac
    crypto ipsec transform-set l2tp-transform mode transport
    crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map dyn-map 10 set pfs group1
    crypto dynamic-map dyn-map 10 set transform-set l2tp-transform vpn-transform
    crypto dynamic-map dyn-map 10 set reverse-route
    crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 74.219.208.50
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map vpn-map 1 match address outside_1_cryptomap_1
    crypto map vpn-map 1 set pfs group1
    crypto map vpn-map 1 set peer 74.219.208.50
    crypto map vpn-map 1 set transform-set ESP-3DES-SHA
    crypto map vpn-map 10 ipsec-isakmp dynamic dyn-map
    crypto isakmp identity address
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 15
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 35
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp ipsec-over-tcp port 10000
    client-update enable
    telnet 192.168.1.0 255.255.255.0 inside
    telnet NCHCO 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh NCHCO 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.150-192.168.2.225 inside
    dhcpd dns 216.68.4.10 216.68.5.10 interface inside
    dhcpd lease 64000 interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 192.168.2.1
    vpn-tunnel-protocol IPSec l2tp-ipsec
    default-domain value nchco.local
    group-policy DfltGrpPolicy attributes
    dns-server value 192.168.2.1
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    password-storage enable
    ipsec-udp enable
    intercept-dhcp 255.255.255.0 enable
    address-pools value VPN_Pool
    group-policy NCHVPN internal
    group-policy NCHVPN attributes
    dns-server value 192.168.2.1 8.8.8.8
    vpn-tunnel-protocol IPSec l2tp-ipsec
    default-domain value NCHCO
    username admin password LbMiJuAJjDaFb2uw encrypted privilege 15
    username 8njferg password yB1lHEVmHZGj5C2Z encrypted privilege 15
    username NCHvpn99 password QhZZtJfwbnowceB7 encrypted
    tunnel-group DefaultRAGroup general-attributes
    address-pool (inside) VPN_Pool
    address-pool VPN_Pool
    authentication-server-group (inside) LOCAL
    authentication-server-group (outside) LOCAL
    authorization-server-group LOCAL
    authorization-server-group (inside) LOCAL
    authorization-server-group (outside) LOCAL
    default-group-policy DefaultRAGroup
    strip-realm
    strip-group
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *****
    peer-id-validate nocheck
    tunnel-group DefaultRAGroup ppp-attributes
    no authentication chap
    no authentication ms-chap-v1
    authentication ms-chap-v2
    tunnel-group DefaultWEBVPNGroup ppp-attributes
    authentication pap
    authentication ms-chap-v2
    tunnel-group 74.219.208.50 type ipsec-l2l
    tunnel-group 74.219.208.50 ipsec-attributes
    pre-shared-key *****
    tunnel-group NCHVPN type remote-access
    tunnel-group NCHVPN general-attributes
    address-pool VPN_Pool
    default-group-policy NCHVPN
    tunnel-group NCHVPN ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:15852745977ff159ba808c4a4feb61fa
    : end
    asdm image disk0:/asdm-645.bin
    asdm location VPN_Start 255.255.255.255 inside
    asdm location VPN_End 255.255.255.255 inside
    no asdm history enable
    Anyone have any idea why this is happening?
    Thanks!

    Thanks again for your reply, and sorry about the late response, havent gotten back to this issue until just now. I applied the above command as you specified, and unfortunately, it did not resolve the problem. Below are the logs from the VPN Client for the connection + attempted browsing of a network share that is behind the ASA, and the new running configuration.
    VPN Client Log:
    Cisco Systems VPN Client Version 5.0.07.0440
    Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.
    Client Type(s): Windows, WinNT
    Running on: 6.2.9200
    331    13:11:41.362  12/17/12  Sev=Info/4    CM/0x63100002
    Begin connection process
    332    13:11:41.362  12/17/12  Sev=Info/4    CM/0x63100004
    Establish secure connection
    333    13:11:41.362  12/17/12  Sev=Info/4    CM/0x63100024
    Attempt connection with server "69.61.228.178"
    334    13:11:41.362  12/17/12  Sev=Info/6    IKE/0x6300003B
    Attempting to establish a connection with 69.61.228.178.
    335    13:11:41.362  12/17/12  Sev=Info/4    IKE/0x63000001
    Starting IKE Phase 1 Negotiation
    336    13:11:41.424  12/17/12  Sev=Info/6    GUI/0x63B00012
    Authentication request attributes is 6h.
    337    13:11:41.362  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 69.61.228.178
    338    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    339    13:11:41.393  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from 69.61.228.178
    340    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x63000001
    Peer is a Cisco-Unity compliant peer
    341    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x63000001
    Peer supports XAUTH
    342    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x63000001
    Peer supports DPD
    343    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x63000001
    Peer supports NAT-T
    344    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x63000001
    Peer supports IKE fragmentation payloads
    345    13:11:41.393  12/17/12  Sev=Info/6    IKE/0x63000001
    IOS Vendor ID Contruction successful
    346    13:11:41.393  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 69.61.228.178
    347    13:11:41.393  12/17/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    348    13:11:41.393  12/17/12  Sev=Info/4    IKE/0x63000083
    IKE Port in use - Local Port =  0xD271, Remote Port = 0x1194
    349    13:11:41.393  12/17/12  Sev=Info/5    IKE/0x63000072
    Automatic NAT Detection Status:
       Remote end is NOT behind a NAT device
       This   end IS behind a NAT device
    350    13:11:41.393  12/17/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
    351    13:11:41.424  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    352    13:11:41.424  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 69.61.228.178
    353    13:11:41.424  12/17/12  Sev=Info/4    CM/0x63100015
    Launch xAuth application
    354    13:11:41.424  12/17/12  Sev=Info/4    CM/0x63100017
    xAuth application returned
    355    13:11:41.424  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 69.61.228.178
    356    13:11:41.456  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    357    13:11:41.456  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 69.61.228.178
    358    13:11:41.456  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 69.61.228.178
    359    13:11:41.456  12/17/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system
    360    13:11:41.456  12/17/12  Sev=Info/5    IKE/0x6300005E
    Client sending a firewall request to concentrator
    361    13:11:41.456  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 69.61.228.178
    362    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    363    13:11:41.502  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 69.61.228.178
    364    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 192.168.2.70
    365    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.0
    366    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 192.168.2.1
    367    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 8.8.8.8
    368    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000001
    369    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001
    370    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000F
    SPLIT_NET #1
        subnet = 192.168.2.0
        mask = 255.255.255.0
        protocol = 0
        src port = 0
        dest port=0
    371    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = NCHCO.local
    372    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
    373    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5505 Version 8.4(1) built by builders on Mon 31-Jan-11 02:11
    374    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001
    375    13:11:41.502  12/17/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
    376    13:11:41.502  12/17/12  Sev=Info/4    CM/0x63100019
    Mode Config data received
    377    13:11:41.502  12/17/12  Sev=Info/4    IKE/0x63000056
    Received a key request from Driver: Local IP = 192.168.2.70, GW IP = 69.61.228.178, Remote IP = 0.0.0.0
    378    13:11:41.502  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 69.61.228.178
    379    13:11:41.534  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    380    13:11:41.534  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 69.61.228.178
    381    13:11:41.534  12/17/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 86400 seconds
    382    13:11:41.534  12/17/12  Sev=Info/5    IKE/0x63000047
    This SA has already been alive for 0 seconds, setting expiry to 86400 seconds from now
    383    13:11:41.549  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    384    13:11:41.549  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 69.61.228.178
    385    13:11:41.549  12/17/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 28800 seconds
    386    13:11:41.549  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH) to 69.61.228.178
    387    13:11:41.549  12/17/12  Sev=Info/5    IKE/0x63000059
    Loading IPsec SA (MsgID=C4F5B5A6 OUTBOUND SPI = 0xD2DBADEA INBOUND SPI = 0x14762837)
    388    13:11:41.549  12/17/12  Sev=Info/5    IKE/0x63000025
    Loaded OUTBOUND ESP SPI: 0xD2DBADEA
    389    13:11:41.549  12/17/12  Sev=Info/5    IKE/0x63000026
    Loaded INBOUND ESP SPI: 0x14762837
    390    13:11:41.549  12/17/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0       192.168.1.1     192.168.1.162       10
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1      306
          127.0.0.1   255.255.255.255         127.0.0.1         127.0.0.1      306
    127.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
        192.168.1.0     255.255.255.0     192.168.1.162     192.168.1.162      266
      192.168.1.162   255.255.255.255     192.168.1.162     192.168.1.162      266
      192.168.1.255   255.255.255.255     192.168.1.162     192.168.1.162      266
          224.0.0.0         240.0.0.0         127.0.0.1         127.0.0.1      306
          224.0.0.0         240.0.0.0     192.168.1.162     192.168.1.162      266
    255.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
    255.255.255.255   255.255.255.255     192.168.1.162     192.168.1.162      266
    391    13:11:41.877  12/17/12  Sev=Info/6    CVPND/0x63400001
    Launch VAInst64 to control IPSec Virtual Adapter
    392    13:11:43.455  12/17/12  Sev=Info/4    CM/0x63100034
    The Virtual Adapter was enabled:
        IP=192.168.2.70/255.255.255.0
        DNS=192.168.2.1,8.8.8.8
        WINS=0.0.0.0,0.0.0.0
        Domain=NCHCO.local
        Split DNS Names=
    393    13:11:43.455  12/17/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0       192.168.1.1     192.168.1.162       10
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1      306
          127.0.0.1   255.255.255.255         127.0.0.1         127.0.0.1      306
    127.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
        192.168.1.0     255.255.255.0     192.168.1.162     192.168.1.162      266
      192.168.1.162   255.255.255.255     192.168.1.162     192.168.1.162      266
      192.168.1.255   255.255.255.255     192.168.1.162     192.168.1.162      266
          224.0.0.0         240.0.0.0         127.0.0.1         127.0.0.1      306
          224.0.0.0         240.0.0.0     192.168.1.162     192.168.1.162      266
          224.0.0.0         240.0.0.0           0.0.0.0           0.0.0.0      266
    255.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
    255.255.255.255   255.255.255.255     192.168.1.162     192.168.1.162      266
    255.255.255.255   255.255.255.255           0.0.0.0           0.0.0.0      266
    394    13:11:47.517  12/17/12  Sev=Info/4    CM/0x63100038
    Successfully saved route changes to file.
    395    13:11:47.517  12/17/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0       192.168.1.1     192.168.1.162       10
      69.61.228.178   255.255.255.255       192.168.1.1     192.168.1.162      100
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1      306
          127.0.0.1   255.255.255.255         127.0.0.1         127.0.0.1      306
    127.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
        192.168.1.0     255.255.255.0     192.168.1.162     192.168.1.162      266
        192.168.1.2   255.255.255.255     192.168.1.162     192.168.1.162      100
      192.168.1.162   255.255.255.255     192.168.1.162     192.168.1.162      266
      192.168.1.255   255.255.255.255     192.168.1.162     192.168.1.162      266
        192.168.2.0     255.255.255.0      192.168.2.70      192.168.2.70      266
        192.168.2.0     255.255.255.0       192.168.2.1      192.168.2.70      100
       192.168.2.70   255.255.255.255      192.168.2.70      192.168.2.70      266
      192.168.2.255   255.255.255.255      192.168.2.70      192.168.2.70      266
          224.0.0.0         240.0.0.0         127.0.0.1         127.0.0.1      306
          224.0.0.0         240.0.0.0     192.168.1.162     192.168.1.162      266
          224.0.0.0         240.0.0.0      192.168.2.70      192.168.2.70      266
    255.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
    255.255.255.255   255.255.255.255     192.168.1.162     192.168.1.162      266
    255.255.255.255   255.255.255.255      192.168.2.70      192.168.2.70      266
    396    13:11:47.517  12/17/12  Sev=Info/6    CM/0x63100036
    The routing table was updated for the Virtual Adapter
    397    13:11:47.517  12/17/12  Sev=Info/4    CM/0x6310001A
    One secure connection established
    398    13:11:47.517  12/17/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 192.168.1.162.  Current hostname: MATT-PC, Current address(es): 192.168.2.70, 192.168.1.162.
    399    13:11:47.517  12/17/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 192.168.2.70.  Current hostname: MATT-PC, Current address(es): 192.168.2.70, 192.168.1.162.
    400    13:11:47.517  12/17/12  Sev=Info/5    CM/0x63100001
    Did not find the Smartcard to watch for removal
    401    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x63700008
    IPSec driver successfully started
    402    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    403    13:11:47.517  12/17/12  Sev=Info/6    IPSEC/0x6370002C
    Sent 109 packets, 0 were fragmented.
    404    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    405    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    406    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0xeaaddbd2 into key list
    407    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    408    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0x37287614 into key list
    409    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x6370002F
    Assigned VA private interface addr 192.168.2.70
    410    13:11:47.517  12/17/12  Sev=Info/4    IPSEC/0x63700037
    Configure public interface: 192.168.1.162. SG: 69.61.228.178
    411    13:11:47.517  12/17/12  Sev=Info/6    CM/0x63100046
    Set tunnel established flag in registry to 1.
    412    13:11:52.688  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 69.61.228.178
    413    13:11:52.688  12/17/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to 69.61.228.178, our seq# = 2722476009
    414    13:11:52.704  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    415    13:11:52.704  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 69.61.228.178
    416    13:11:52.704  12/17/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from 69.61.228.178, seq# received = 2722476009, seq# expected = 2722476009
    417    13:12:03.187  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 69.61.228.178
    418    13:12:03.187  12/17/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to 69.61.228.178, our seq# = 2722476010
    419    13:12:03.202  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    420    13:12:03.202  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 69.61.228.178
    421    13:12:03.202  12/17/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from 69.61.228.178, seq# received = 2722476010, seq# expected = 2722476010
    422    13:12:14.185  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 69.61.228.178
    423    13:12:14.185  12/17/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to 69.61.228.178, our seq# = 2722476011
    424    13:12:14.201  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    425    13:12:14.201  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 69.61.228.178
    426    13:12:14.201  12/17/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from 69.61.228.178, seq# received = 2722476011, seq# expected = 2722476011
    427    13:12:24.762  12/17/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 69.61.228.178
    428    13:12:24.762  12/17/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to 69.61.228.178, our seq# = 2722476012
    429    13:12:24.778  12/17/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = 69.61.228.178
    430    13:12:24.778  12/17/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 69.61.228.178
    431    13:12:24.778  12/17/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from 69.61.228.178, seq# received = 2722476012, seq# expected = 2722476012
    New running configuration:
    : Saved
    ASA Version 8.4(1)
    hostname NCHCO
    enable password hTjwXz/V8EuTw9p9 encrypted
    passwd hTjwXz/V8EuTw9p9 encrypted
    names
    name 192.168.2.0 NCHCO description City Offices
    name 192.168.2.80 VPN_End
    name 192.168.2.70 VPN_Start
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 69.61.228.178 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    boot system disk0:/asa841-k8.bin
    ftp mode passive
    object network NCHCO
    subnet 192.168.2.0 255.255.255.0
    object network obj-192.168.1.0
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.64
    subnet 192.168.2.64 255.255.255.224
    object network obj-0.0.0.0
    subnet 0.0.0.0 255.255.255.0
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    access-list outside_nat0_outbound extended permit ip object NCHCO 192.168.1.0 255.255.255.0
    access-list outside_nat0_outbound extended permit ip object NCHCO 192.168.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip object NCHCO 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.2.64 255.255.255.224
    access-list inside_nat0_outbound extended permit ip 0.0.0.0 255.255.255.0 192.168.2.64 255.255.255.224
    access-list outside_1_cryptomap extended permit ip object NCHCO 192.168.1.0 255.255.255.0
    access-list outside_1_cryptomap_1 extended permit ip object NCHCO 192.168.1.0 255.255.255.0
    access-list LAN_Access standard permit 192.168.2.0 255.255.255.0
    access-list LAN_Access standard permit 0.0.0.0 255.255.255.0
    access-list NCHCO_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.255.0
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPN_Pool VPN_Start-VPN_End mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-649.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static NCHCO NCHCO destination static obj-192.168.1.0 obj-192.168.1.0
    nat (inside,any) source static any any destination static obj-192.168.2.64 obj-192.168.2.64
    nat (inside,any) source static obj-0.0.0.0 obj-0.0.0.0 destination static obj-192.168.2.64 obj-192.168.2.64
    object network obj_any
    nat (inside,outside) dynamic interface
    route outside 0.0.0.0 0.0.0.0 69.61.228.177 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    network-acl outside_nat0_outbound
    webvpn
      svc ask enable default svc
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 69.61.228.178 255.255.255.255 outside
    http 74.218.158.238 255.255.255.255 outside
    http NCHCO 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set l2tp-transform esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set l2tp-transform mode transport
    crypto ipsec ikev1 transform-set vpn-transform esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_MD5 mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map dyn-map 10 set pfs group1
    crypto dynamic-map dyn-map 10 set ikev1 transform-set l2tp-transform vpn-transform
    crypto dynamic-map dyn-map 10 set reverse-route
    crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-3DES-SHA
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 74.219.208.50
    crypto map outside_map 1 set ikev1 transform-set ESP-3DES-SHA
    crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map vpn-map 1 match address outside_1_cryptomap_1
    crypto map vpn-map 1 set pfs group1
    crypto map vpn-map 1 set peer 74.219.208.50
    crypto map vpn-map 1 set ikev1 transform-set ESP-3DES-SHA
    crypto map vpn-map 10 ipsec-isakmp dynamic dyn-map
    crypto isakmp identity address
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto ikev1 policy 15
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 35
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet 192.168.1.0 255.255.255.0 inside
    telnet NCHCO 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh NCHCO 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.150-192.168.2.225 inside
    dhcpd dns 216.68.4.10 216.68.5.10 interface inside
    dhcpd lease 64000 interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 192.168.2.1
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    default-domain value nchco.local
    group-policy DfltGrpPolicy attributes
    dns-server value 192.168.2.1
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
    password-storage enable
    ipsec-udp enable
    intercept-dhcp 255.255.255.0 enable
    address-pools value VPN_Pool
    group-policy NCHCO internal
    group-policy NCHCO attributes
    dns-server value 192.168.2.1 8.8.8.8
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value NCHCO_splitTunnelAcl_1
    default-domain value NCHCO.local
    username admin password LbMiJuAJjDaFb2uw encrypted privilege 15
    username 8njferg password yB1lHEVmHZGj5C2Z encrypted privilege 15
    username NCHvpn99 password dhn.JzttvRmMbHsP encrypted
    tunnel-group DefaultRAGroup general-attributes
    address-pool (inside) VPN_Pool
    address-pool VPN_Pool
    authentication-server-group (inside) LOCAL
    authentication-server-group (outside) LOCAL
    authorization-server-group LOCAL
    authorization-server-group (inside) LOCAL
    authorization-server-group (outside) LOCAL
    default-group-policy DefaultRAGroup
    strip-realm
    strip-group
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    peer-id-validate nocheck
    tunnel-group DefaultRAGroup ppp-attributes
    no authentication chap
    no authentication ms-chap-v1
    authentication ms-chap-v2
    tunnel-group DefaultWEBVPNGroup ppp-attributes
    authentication pap
    authentication ms-chap-v2
    tunnel-group 74.219.208.50 type ipsec-l2l
    tunnel-group 74.219.208.50 ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group NCHCO type remote-access
    tunnel-group NCHCO general-attributes
    address-pool VPN_Pool
    default-group-policy NCHCO
    tunnel-group NCHCO ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:b6ce58676b6aaeba48caacbeefea53a5
    : end
    asdm image disk0:/asdm-649.bin
    asdm location VPN_Start 255.255.255.255 inside
    asdm location VPN_End 255.255.255.255 inside
    no asdm history enable
    I'm at a loss myself as to why this isn't working, and i'm sure that you are running out of solutions yourself. Any other ideas? I really need to get this working.
    Thanks so much!
    Matthew

  • Remote Access VPN to Router

    Hi Guys
    I configured a remote access vpn to our secondary office router (no failover or anything on configured)
    I can login but i cannot access the internal lan.
    I've attachted the config, if anyone has an idea please let me know.
    Regards

    No, currently VPN is not supported on any of the Blackberry devices.

  • Remote Access VPN with existing site-to-site tunnel

    Hi there!
    I have successfully configured my Cisco router to create a VPN tunnel to Azure. This is working fine. Now I am trying to add a remote access VPN for clients. I want to use IPsec and not PPTP.
    I'm not a networking guy, but from what I've read, you basically need to add a dynamic crypto map for the remote access VPN to the crypto map on the external interface (AzureCryptoMap in this case). I've read that the dynamic crypto map should be applied after the non-dynamic maps.
    The problem is that the VPN clients do not successfully negotiate phase 1. It's almost like the router does not try the dynamic map. I have tried specifying it to come ahead of the static crypto map policy, but this doesn't change anything. Here is some output from the debugging ipsec and isakmp:
    murasaki#
    *Oct 6 08:06:43: ISAKMP (0): received packet from 1.158.149.255 dport 500 sport 500 Global (N) NEW SA
    *Oct 6 08:06:43: ISAKMP: Created a peer struct for 1.158.149.255, peer port 500
    *Oct 6 08:06:43: ISAKMP: New peer created peer = 0x87B97490 peer_handle = 0x80000082
    *Oct 6 08:06:43: ISAKMP: Locking peer struct 0x87B97490, refcount 1 for crypto_isakmp_process_block
    *Oct 6 08:06:43: ISAKMP: local port 500, remote port 500
    *Oct 6 08:06:43: ISAKMP:(0):insert sa successfully sa = 886954D0
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1
    *Oct 6 08:06:43: ISAKMP:(0): processing SA payload. message ID = 0
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    *Oct 6 08:06:43: ISAKMP (0): vendor ID is NAT-T RFC 3947
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 198 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 29 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    *Oct 6 08:06:43: ISAKMP (0): vendor ID is NAT-T v7
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 114 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 227 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 250 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is NAT-T v3
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 164 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is NAT-T v2
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 242 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is XAUTH
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is Unity
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): processing IKE frag vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0):Support for IKE Fragmentation not enabled
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is DPD
    *Oct 6 08:06:43: ISAKMP:(0):No pre-shared key with 1.158.149.255!
    *Oct 6 08:06:43: ISAKMP : Scanning profiles for xauth ... Client-VPN
    *Oct 6 08:06:43: ISAKMP:(0): Authentication by xauth preshared
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 2 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 3 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 4 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 5 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 6 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 7 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 8 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 1 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 2 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 3 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 4 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 5 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 6 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 7 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 8 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 2 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Proposed key length does not match policy
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 3 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 4 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 5 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 6 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 7 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 8 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct 6 08:06:43: ISAKMP:(0):no offers accepted!
    *Oct 6 08:06:43: ISAKMP:(0): phase 1 SA policy not acceptable! (local x.x.x.x remote 1.158.149.255)
    *Oct 6 08:06:43: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init
    *Oct 6 08:06:43: ISAKMP:(0): Failed to construct AG informational message.
    *Oct 6 08:06:43: ISAKMP:(0): sending packet to 1.158.149.255 my_port 500 peer_port 500 (R) MM_NO_STATE
    *Oct 6 08:06:43: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Oct 6 08:06:43: ISAKMP:(0):peer does not do paranoid keepalives.
    *Oct 6 08:06:43: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 1.158.149.255)
    *Oct 6 08:06:43: ISAKMP (0): FSM action returned error: 2
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM1
    *Oct 6 08:06:43: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 1.158.149.255)
    *Oct 6 08:06:43: ISAKMP: Unlocking peer struct 0x87B97490 for isadb_mark_sa_deleted(), count 0
    *Oct 6 08:06:43: ISAKMP: Deleting peer node by peer_reap for 1.158.149.255: 87B97490
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_DEST_SA
    *Oct 6 08:06:43: IPSEC(key_engine): got a queue event with 1 KMI message(s)
    *Oct 6 08:06:47: ISAKMP (0): received packet from 1.158.149.255 dport 500 sport 500 Global (R) MM_NO_STATEmurasaki#
    *Oct 6 08:06:43: ISAKMP (0): received packet from 1.158.149.255 dport 500 sport 500 Global (N) NEW SA
    *Oct 6 08:06:43: ISAKMP: Created a peer struct for 1.158.149.255, peer port 500
    *Oct 6 08:06:43: ISAKMP: New peer created peer = 0x87B97490 peer_handle = 0x80000082
    *Oct 6 08:06:43: ISAKMP: Locking peer struct 0x87B97490, refcount 1 for crypto_isakmp_process_block
    *Oct 6 08:06:43: ISAKMP: local port 500, remote port 500
    *Oct 6 08:06:43: ISAKMP:(0):insert sa successfully sa = 886954D0
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1
    If I specify my key like a site-to-site VPN key like this:
    crypto isakmp key xxx address 0.0.0.0
    Then it does complete phase 1 (and then fails to find the client configuration). This suggests to me that the dynamic map is not being tried.
    Configuration:
    ! Last configuration change at 07:55:02 AEDT Mon Oct 6 2014 by timothy
    version 15.2
    no service pad
    service timestamps debug datetime localtime
    service timestamps log datetime localtime
    service password-encryption
    no service dhcp
    hostname murasaki
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    aaa new-model
    aaa authentication login client_vpn_authentication local
    aaa authorization network default local
    aaa authorization network client_vpn_authorization local
    aaa session-id common
    wan mode dsl
    clock timezone AEST 10 0
    clock summer-time AEDT recurring 1 Sun Oct 2:00 1 Sun Apr 3:00
    ip inspect name normal_traffic tcp
    ip inspect name normal_traffic udp
    ip domain name router.xxx
    ip name-server xxx
    ip name-server xxx
    ip cef
    ipv6 unicast-routing
    ipv6 cef
    crypto pki trustpoint TP-self-signed-591984024
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-591984024
    revocation-check none
    rsakeypair TP-self-signed-591984024
    crypto pki trustpoint TP-self-signed-4045734018
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4045734018
    revocation-check none
    rsakeypair TP-self-signed-4045734018
    crypto pki certificate chain TP-self-signed-591984024
    crypto pki certificate chain TP-self-signed-4045734018
    object-group network CLOUD_SUBNETS
    description Azure subnet
    172.16.0.0 255.252.0.0
    object-group network INTERNAL_LAN
    description All Internal subnets which should be allowed out to the Internet
    192.168.1.0 255.255.255.0
    192.168.20.0 255.255.255.0
    username timothy privilege 15 secret 5 xxx
    controller VDSL 0
    ip ssh version 2
    no crypto isakmp default policy
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    lifetime 3600
    crypto isakmp policy 2
    encr 3des
    hash md5
    authentication pre-share
    group 2
    lifetime 3600
    crypto isakmp policy 10
    encr aes 256
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp key xxx address xxxx no-xauth
    crypto isakmp client configuration group VPN_CLIENTS
    key xxx
    dns 192.168.1.24 192.168.1.20
    domain xxx
    pool Client-VPN-Pool
    acl CLIENT_VPN
    crypto isakmp profile Client-VPN
    description Remote Client IPSec VPN
    match identity group VPN_CLIENTS
    client authentication list client_vpn_authentication
    isakmp authorization list client_vpn_authorization
    client configuration address respond
    crypto ipsec transform-set AzureIPSec esp-aes 256 esp-sha-hmac
    mode tunnel
    crypto ipsec transform-set TRANS_3DES_SHA esp-3des esp-sha-hmac
    mode tunnel
    crypto dynamic-map ClientVPNCryptoMap 1
    set transform-set TRANS_3DES_SHA
    set isakmp-profile Client-VPN
    reverse-route
    qos pre-classify
    crypto map AzureCryptoMap 12 ipsec-isakmp
    set peer xxxx
    set security-association lifetime kilobytes 102400000
    set transform-set AzureIPSec
    match address AzureEastUS
    crypto map AzureCryptoMap 65535 ipsec-isakmp dynamic ClientVPNCryptoMap
    bridge irb
    interface ATM0
    mtu 1492
    no ip address
    no atm ilmi-keepalive
    pvc 8/35
    encapsulation aal5mux ppp dialer
    dialer pool-member 1
    interface Ethernet0
    no ip address
    shutdown
    interface FastEthernet0
    switchport mode trunk
    no ip address
    interface FastEthernet1
    no ip address
    spanning-tree portfast
    interface FastEthernet2
    switchport mode trunk
    no ip address
    spanning-tree portfast
    interface FastEthernet3
    no ip address
    interface GigabitEthernet0
    switchport mode trunk
    no ip address
    interface GigabitEthernet1
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    description Main LAN
    ip address 192.168.1.97 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1452
    interface Dialer1
    mtu 1492
    ip address negotiated
    ip access-group PORTS_ALLOWED_IN in
    ip flow ingress
    ip inspect normal_traffic out
    ip nat outside
    ip virtual-reassembly in
    encapsulation ppp
    ip tcp adjust-mss 1350
    dialer pool 1
    dialer-group 1
    ipv6 address autoconfig
    ipv6 enable
    ppp chap hostname xxx
    ppp chap password 7 xxx
    ppp ipcp route default
    no cdp enable
    crypto map AzureCryptoMap
    ip local pool Client-VPN-Pool 192.168.20.10 192.168.20.15
    no ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat translation timeout 360
    ip nat inside source list SUBNETS_AND_PROTOCOLS_ALLOWED_OUT interface Dialer1 overload
    ip nat inside source static tcp 192.168.1.43 55663 interface Dialer1 55663
    ip nat inside source static tcp 192.168.1.43 22 interface Dialer1 22
    ip nat inside source static udp 192.168.1.43 55663 interface Dialer1 55663
    ip access-list extended AzureEastUS
    permit ip 192.168.20.0 0.0.0.255 172.16.0.0 0.15.255.255
    permit ip 192.168.1.0 0.0.0.255 172.16.0.0 0.15.255.255
    ip access-list extended CLIENT_VPN
    permit ip 172.16.0.0 0.0.0.255 192.168.20.0 0.0.0.255
    permit ip 192.168.1.0 0.0.0.255 192.168.20.0 0.0.0.255
    ip access-list extended PORTS_ALLOWED_IN
    remark List of ports which are allowed IN
    permit gre any any
    permit esp any any
    permit udp any any eq non500-isakmp
    permit udp any any eq isakmp
    permit tcp any any eq 55663
    permit udp any any eq 55663
    permit tcp any any eq 22
    permit tcp any any eq 5723
    permit tcp any any eq 1723
    permit tcp any any eq 443
    permit icmp any any echo-reply
    permit icmp any any traceroute
    permit icmp any any port-unreachable
    permit icmp any any time-exceeded
    deny ip any any
    ip access-list extended SUBNETS_AND_PROTOCOLS_ALLOWED_OUT
    deny tcp object-group INTERNAL_LAN any eq smtp
    deny ip object-group INTERNAL_LAN object-group CLOUD_SUBNETS
    permit tcp object-group INTERNAL_LAN any
    permit udp object-group INTERNAL_LAN any
    permit icmp object-group INTERNAL_LAN any
    deny ip any any
    mac-address-table aging-time 16
    no cdp run
    ipv6 route ::/0 Dialer1
    route-map NoNAT permit 10
    match ip address AzureEastUS CLIENT_VPN
    route-map NoNAT permit 15
    banner motd Welcome to Murasaki
    line con 0
    privilege level 15
    no modem enable
    line aux 0
    line vty 0
    privilege level 15
    no activation-character
    transport preferred none
    transport input ssh
    line vty 1 4
    privilege level 15
    transport input ssh
    scheduler max-task-time 5000
    scheduler allocate 60000 1000
    ntp update-calendar
    ntp server au.pool.ntp.org
    end
    Any ideas on what I'm doing wrong?

    Hi Marius,
    I finally managed to try with the official Cisco VPN client on Windows. It still fails at phase 1, but now talks about 'aggressive mode', which didn't seem to be mentioned in the previous logs. Any ideas?
    *Oct  9 20:43:16: ISAKMP (0): received packet from 192.168.1.201 dport 500 sport 49727 Global (N) NEW SA
    *Oct  9 20:43:16: ISAKMP: Created a peer struct for 192.168.1.201, peer port 49727
    *Oct  9 20:43:16: ISAKMP: New peer created peer = 0x878329F0 peer_handle = 0x80000087
    *Oct  9 20:43:16: ISAKMP: Locking peer struct 0x878329F0, refcount 1 for crypto_isakmp_process_block
    *Oct  9 20:43:16: ISAKMP: local port 500, remote port 49727
    *Oct  9 20:43:16: ISAKMP:(0):insert sa successfully sa = 886697E0
    *Oct  9 20:43:16: ISAKMP:(0): processing SA payload. message ID = 0
    *Oct  9 20:43:16: ISAKMP:(0): processing ID payload. message ID = 0
    *Oct  9 20:43:16: ISAKMP (0): ID payload
        next-payload : 13
        type         : 11
        group id     : timothy
        protocol     : 17
        port         : 500
        length       : 15
    *Oct  9 20:43:16: ISAKMP:(0):: peer matches *none* of the profiles
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID seems Unity/DPD but major 215 mismatch
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is XAUTH
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is DPD
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): processing IKE frag vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0):Support for IKE Fragmentation not enabled
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is NAT-T v2
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is Unity
    *Oct  9 20:43:16: ISAKMP : Scanning profiles for xauth ... Client-VPN
    *Oct  9 20:43:16: ISAKMP:(0): Authentication by xauth preshared
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 2 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 3 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 4 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 5 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 6 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 7 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 8 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 9 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 10 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 11 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Preshared authentication offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 12 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 13 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 14 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 1 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 2 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 3 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 4 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 5 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 6 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 7 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 8 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 9 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 10 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 11 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 12 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Preshared authentication offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 13 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 14 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 2 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 3 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Preshared authentication offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 4 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 5 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Proposed key length does not match policy
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 6 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 7 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Proposed key length does not match policy
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 8 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 9 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 10 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 11 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 12 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 13 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 14 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct  9 20:43:16: ISAKMP:(0):no offers accepted!
    *Oct  9 20:43:16: ISAKMP:(0): phase 1 SA policy not acceptable! (local xxxx remote 192.168.1.201)
    *Oct  9 20:43:16: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init
    *Oct  9 20:43:16: ISAKMP:(0): Failed to construct AG informational message.
    *Oct  9 20:43:16: ISAKMP:(0): sending packet to 192.168.1.201 my_port 500 peer_port 49727 (R) AG_NO_STATE
    *Oct  9 20:43:16: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Oct  9 20:43:16: ISAKMP:(0):peer does not do paranoid keepalives.
    *Oct  9 20:43:16: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer 192.168.1.201)
    *Oct  9 20:43:16: ISAKMP:(0): processing KE payload. message ID = 0
    *Oct  9 20:43:16: ISAKMP:(0): group size changed! Should be 0, is 128
    *Oct  9 20:43:16: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: reset_retransmission
    *Oct  9 20:43:16: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_AM_EXCH:  state = IKE_READY
    *Oct  9 20:43:16: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
    *Oct  9 20:43:16: ISAKMP:(0):Old State = IKE_READY  New State = IKE_READY
    *Oct  9 20:43:16: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 192.168.1.201
    *Oct  9 20:43:16: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer 192.168.1.201)
    *Oct  9 20:43:16: ISAKMP: Unlocking peer struct 0x878329F0 for isadb_mark_sa_deleted(), count 0
    *Oct  9 20:43:16: ISAKMP: Deleting peer node by peer_reap for 192.168.1.201: 878329F0
    *Oct  9 20:43:16: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    *Oct  9 20:43:16: ISAKMP:(0):Old State = IKE_READY  New State = IKE_DEST_SA
    *Oct  9 20:43:16: IPSEC(key_engine): got a queue event with 1 KMI message(s)
    *Oct  9 20:43:21: ISAKMP (0): received packet from 192.168.1.201 dport 500 sport 49727 Global (R) MM_NO_STATE
    *Oct  9 20:43:26: ISAKMP (0): received packet from 192.168.1.201 dport 500 sport 49727 Global (R) MM_NO_STATE

  • Remote access VPN on PIX525 issues.

    Hi I was wondering if anybody had any ideas about my remote access VPN. Its configured on a Cisco PIX525 running ver 6.3(5) (old I know!) and I am running Cisco VPN client ver 5.06.0160 on the client end. Ok so here's the thing. The client connects ok, and it gets an IP address no problem. But I cannot ping anything on the remote LAN. So the client is coming across the internet, the VPN adapter has a 192.168.1.1 address assigned by the PIX and I am trying to ping the 192.168.0.4 address assigned to a switch on the inside of the firewall but with no joy. I've attached the config, any help is gratefully appreciated!
    Many thanks
    Richard.
    show run
    : Saved
    PIX Version 6.3(5)
    interface ethernet0 auto
    interface ethernet1 100full
    interface ethernet2 auto shutdown
    interface ethernet3 auto shutdown
    interface ethernet4 auto shutdown
    interface ethernet5 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 intf2 security4
    nameif ethernet3 intf3 security6
    nameif ethernet4 intf4 security8
    nameif ethernet5 intf5 security10
    enable password 2KFQnbNIdI.2KYOU encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    hostname Coeliac-firewall
    domain-name sungard.com
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol icmp error
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu intf2 1500
    mtu intf3 1500
    mtu intf4 1500
    mtu intf5 1500
    ip address outside 213.212.66.36 255.255.255.248
    ip address inside 192.168.0.1 255.255.255.0
    no ip address intf2
    no ip address intf3
    no ip address intf4
    no ip address intf5
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool MYPOOL 192.168.1.1-192.168.1.254
    no failover
    failover timeout 0:00:00
    failover poll 15
    no failover ip address outside
    no failover ip address inside
    no failover ip address intf2
    no failover ip address intf3
    no failover ip address intf4
    no failover ip address intf5
    pdm history enable
    arp timeout 14400
    nat (inside) 0 access-list 101
    router ospf 1
      network 192.168.0.0 255.255.255.0 area 0
      network 192.168.1.0 255.255.255.0 area 0
      log-adj-changes
    route outside 0.0.0.0 0.0.0.0 213.212.66.33 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt connection permit-pptp
    crypto ipsec transform-set myset esp-des esp-md5-hmac
    crypto dynamic-map dynmap 10 set transform-set myset
    crypto map mymap 10 ipsec-isakmp dynamic dynmap
    crypto map mymap client configuration address initiate
    crypto map mymap client configuration address respond
    crypto map mymap interface outside
    isakmp enable outside
    isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
    isakmp identity address
    isakmp client configuration address-pool local MYPOOL outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption des
    isakmp policy 10 hash md5
    isakmp policy 10 group 1
    isakmp policy 10 lifetime 86400
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup coeliacvpn address-pool MYPOOL
    vpngroup coeliacvpn dns-server 62.73.136.246
    vpngroup coeliacvpn wins-server 62.73.136.246
    vpngroup coeliacvpn default-domain password
    vpngroup coeliacvpn split-tunnel 101
    vpngroup coeliacvpn idle-time 1800
    vpngroup coeliacvpn password ********
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group 1 accept dialin pptp
    vpdn group 1 ppp authentication pap
    vpdn group 1 ppp authentication chap
    vpdn group 1 ppp authentication mschap
    vpdn group 1 ppp encryption mppe auto
    vpdn group 1 client configuration address local MYPOOL
    vpdn group 1 pptp echo 60
    vpdn group 1 client authentication local
    vpdn username user password *********
    vpdn enable outside
    terminal width 80
    Cryptochecksum:b18e9c6df0917108ff35f720f0230073
    : end

    Managed to solve the issue. Needed a isakmp nat-traversal 20 to get it to work.

  • Remote Access VPN Setup

    Hello Support,
    I have a question regarding a remote access VPN setup with the following. I have a Cisco 6500 with multiple VLANs, and an FWSM setup in mutliple context mode. Each of our clients sits behind their own context, and has their own associated VLANs. Each context has a shared interface, so that one network (our management network) can see all of the networks. We are using a Cisco ASA to terminate P2P VPNs as the FWSms cannot do so, but I would like to setup a remote access VPN from the ASA, but I will need to connect in and have access to all networks. Currently the ASA has an outside interface for internet, two client inside interfaces, and one interface on the shared network.
    If I setup a remote access VPN from the ASA with a separate scope will I be able to see all the networks that I setup routes and nonats for or is there more to it?
    I provided a brief diagram showing all the vlans, I will need to be able to access all of the 6500s vlans when connected using the VPN.
    Thanks in advance for all ideas, suggestions, and assistance.

    Hello John,
    You will need to configure the respective IP Address pool for the Anyconnect users,
    Then create the no_nat rules from all of the internal subnets to the Anyconnect Pool.
    That should do it bud . I mean just make sure the internal network (core) knows that in order to reach the anyconnect pool must send the traffic to the ASA.
    Rate all of the helpful posts!!!
    Regards,
    Jcarvaja
    Follow me on http://laguiadelnetworking.com

  • Remote access VPN with Softphone

    Dear all,
    I have configured a Remote Access VPN on a 5520 ASA and the users from out side are able to connect to this VPN successfuly using VPN client version 5.3.
    The clients have a softphone (IP Phone) installed on thier laptops, and when they make a call over the RA-VPN, the call is successfuly made to the LAN but when i dial a number outside the LAN (over the PSTN using Voice gateway) the call is initiated successfuly (Ring), but when the other side asnwers my call, i cannot hear him and also he cannot hear me as well, this situation lasts for 2 to 3 minutes, then we can hear each other.
    i have tried to sniff from the laptop side and found that the IP-Phone sends RTP packets to the VG but it doesnt recieve any until the 2 to 3 minutes pass.
    i also red that the stateful firewall from the VPN client could be the reason so i have tried to disable it from the laptop side, but a message appeared that the firewall service is disabled.
    any idea about this?
    many thanx in advance.
    Mamoun

    Another firewall in between our lan and the wan was the problem,

  • Remote access VPN client gets connected no access to LAN

    : Saved
    ASA Version 8.6(1)2
    hostname COL-ASA-01
    domain-name dr.test.net
    enable password i/RAo1iZPOnp/BK7 encrypted
    passwd i/RAo1iZPOnp/BK7 encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 172.32.0.11 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.9.200.126 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    nameif failover
    security-level 0
    ip address 192.168.168.1 255.255.255.0 standby 192.168.168.2
    interface Management0/0
    nameif management
    security-level 0
    ip address 192.168.2.11 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dr.test.net
    object network RAVPN
    subnet 192.168.0.0 255.255.255.0
    object network NETWORK_OBJ_192.168.200.0_24
    subnet 192.168.200.0 255.255.255.0
    object network NETWORK_OBJ_192.9.200.0_24
    subnet 192.9.200.0 255.255.255.0
    object-group network inside_network
    network-object 192.9.200.0 255.255.255.0
    object-group network Outside
    network-object host 172.32.0.25
    access-list RAVPN_splitTunnelAcl standard permit 192.9.200.0 255.255.255.0
    access-list test123 extended permit ip host 192.168.200.1 host 192.9.200.190
    access-list test123 extended permit ip host 192.9.200.190 host 192.168.200.1
    access-list test123 extended permit ip object NETWORK_OBJ_192.168.200.0_24 192.9.200.0 255.255.255.0
    access-list test123 extended permit ip 192.9.200.0 255.255.255.0 object NETWORK_OBJ_192.9.200.0_24
    pager lines 24
    mtu management 1500
    mtu outside 1500
    mtu inside 1500
    mtu failover 1500
    ip local pool RAVPN 192.168.200.1-192.168.200.254 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-66114.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (any,inside) source static NETWORK_OBJ_192.168.200.0_24 NETWORK_OBJ_192.168.200.0_24 destination static NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24
    route outside 0.0.0.0 0.0.0.0 172.32.0.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    subject-name CN=KWI-COL-ASA-01.dr.test.net,O=KWI,C=US
    crl configure
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.9.200.0 255.255.255.0 inside
    telnet timeout 30
    ssh 0.0.0.0 0.0.0.0 management
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 66.35.45.128 255.255.255.192 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 30
    ssh version 2
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    group-policy RAVPN internal
    group-policy RAVPN attributes
    wins-server value 192.9.200.164
    dns-server value 66.35.46.84 66.35.47.12
    vpn-filter value test123
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value test123
    default-domain value dr.kligerweiss.net
    username test password xxxxxxx encrypted
    username admin password aaaaaaaaaaaa encrypted privilege 15
    username vpntest password ddddddddddd encrypted
    tunnel-group RAVPN type remote-access
    tunnel-group RAVPN general-attributes
    address-pool RAVPN
    default-group-policy RAVPN
    tunnel-group RAVPN ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 2
      subscribe-to-alert-group configuration periodic monthly 2
      subscribe-to-alert-group telemetry periodic daily
    password encryption aes
    Cryptochecksum:b001e526a239af2c73fa56f3ca7667ea
    : end
    COL-ASA-01#
    Here is some capture done on the inside interface which may help too, I tried pointing the gateway to inside interface on the target device but I think this was a switch without ip route available on it I believe that is still sending packet back to Cisco inside interface
    COL-ASA-01# sho cap test | in 192.168.200
    25: 23:45:55.570618 192.168.200.1 > 192.9.200.190: icmp: echo request
      29: 23:45:56.582794 192.168.200.1.137 > 192.9.200.164.137:  udp 68
      38: 23:45:58.081050 192.168.200.1.137 > 192.9.200.164.137:  udp 68
      56: 23:45:59.583176 192.168.200.1.137 > 192.9.200.164.137:  udp 68
      69: 23:46:00.573517 192.168.200.1 > 192.9.200.190: icmp: echo request
      98: 23:46:05.578110 192.168.200.1 > 192.9.200.190: icmp: echo request
      99: 23:46:05.590057 192.168.200.1.137 > 192.9.200.164.137:  udp 68
    108: 23:46:07.092310 192.168.200.1.137 > 192.9.200.164.137:  udp 68
    115: 23:46:08.592468 192.168.200.1.137 > 192.9.200.164.137:  udp 68
    116: 23:46:10.580795 192.168.200.1 > 192.9.200.190: icmp: echo request
    COL-ASA-01#
    Any help or pointers greatly appreciated, I am doing this config after a long gap on Cisco last time I was working it was all PIX so just need some expert eyes to let me know if I am missing something.
    And Yes I do not have a Host in Inside network to test against, all I have is a switch which cannot route and ip default gateway is not helping too...

    Hi,
    The first thing you should do to avoid problems is to change the VPN Pool to something else than the current LAN network as they are not really directly connected in the same network segment.
    You could try the following changes
    tunnel-group RAVPN general-attributes
      no address-pool RAVPN
    no ip local pool RAVPN 192.168.200.1-192.168.200.254 mask 255.255.255.0
    ip local pool RAVPN 192.168.201.1-192.168.201.254 mask 255.255.255.0
    tunnel-group RAVPN general-attributes
      address-pool RAVPN
    no nat  (any,inside) source static NETWORK_OBJ_192.168.200.0_24  NETWORK_OBJ_192.168.200.0_24 destination static  NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24
    In the above you first remove the VPN Pool from the "tunnel-group" and then remove and recreate the VPN Pool with another network and then insert it back to the same "tunnel-group". Nex you remove the current NAT configuration.
    object network LAN
    subnet 192.168.200.0 255.255.255.0
    object network VPN-POOL
    subnet 192.168.201.0 255.255.255.0
    nat (inside,outside) 1 source static LAN LAN destination static VPN-POOL VPN-POOL
    The above NAT configurations adds the correct NAT0 configuration for the changed VPN Pool. It also inserts the NAT rule to the very top before the Dynamic PAT rule you currently have. It is also one of the problems with the configurations as it will override your current NAT configurations.
    You have your Dynamic PAT rule at the very top of your NAT rules currently which is not a good idea. If you wish to change it to something else that wont override the other NAT configurations in the future you can do the following change.
    no nat (inside,outside) source dynamic any interface
    nat (inside,outside) after-auto source dynamic any interface
    NOTICE! Changing the above Dynamic PAT configuration will temporarily terminate all connections for users from the LAN as you reconfigure the Dynamic PAT rule. So if you do this change make sure that its ok to cause still small cut in the current connections of internal users
    Hope this helps
    Let me know if it works for you
    - Jouni

  • Desktop management and Remote access on OES 2 SP1?

    I am preparing a migration of several servers from NW 65. SP6 to OES 2 SP1 Linux. One of those servers has ZENworks 7 Desktop Management/Middle tier server installed.
    I am seeing statements in the documentation which make me wonder.... We use Desktop Management mostly for remote access, only now and then for inventory. I can live with the idea of doing a fresh install of ZENworks 7 desktop management following migration, and then importing the workstations anew.
    I am planning on upgrading to ZENworks 10 later in the year. However, under the circumstances I am wondering if the migration might be a good time to jump to ZENworks 10 Configuration Management? I understand that Console1 goes away(?) but I do not understand what is to take the place of Console1.
    Do any of you have experience with making that leap? What are the major considerations I should be looking at?

    tkindig,
    It appears that in the past few days you have not received a response to your
    posting. That concerns us, and has triggered this automated reply.
    Has your problem been resolved? If not, you might try one of the following options:
    - Visit http://support.novell.com and search the knowledgebase and/or check all
    the other self support options and support programs available.
    - You could also try posting your message again. Make sure it is posted in the
    correct newsgroup. (http://forums.novell.com)
    Be sure to read the forum FAQ about what to expect in the way of responses:
    http://forums.novell.com/faq.php
    If this is a reply to a duplicate posting, please ignore and accept our apologies
    and rest assured we will issue a stern reprimand to our posting bot.
    Good luck!
    Your Novell Product Support Forums Team
    http://support.novell.com/forums/

  • Lync Application and Desktop Sharing - Restrict remote access/Telnet

    I have a customer and they are paranoid about using Lync application/desktop sharing which could potentially enable remote users from getting into their internal IT systems.  They are asking if we could restrict application/desktop sharing specifically
    for appls with remote access capabilities (e.g. Telnet, etc.)? Anyone could share any information relating to this? Thanks!

    We can’t do this with Lync Server natively. Maybe you want to vote idea at
    http://lync.ideascale.com/a/dtd/Limit-AppSharing-for-specific-applications/467874-16285
    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found
    there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
    Lisa Zheng
    TechNet Community Support

  • Help with remote access to blog/wiki/webcalendar

    Greetings, righteous Mac community.
    I write to you as a brand-newbie in the Leopard server world, and I have found many posts here invaluable in helping me get setup and running. I have been unable to figure out getting the blog/wiki/webcalendar working completely, though, and any aid would be most welcome. Please keep in mind that 1 week ago I knew exactly nothing about running/configuring a server, so the simplest/dumbest/plainest answers would probably work best.
    First, my setup. We are a small (4-client + server) network. Server is successfully configured with: shares all network clients can access; iChat & iCal servers; and Retrospect backing up everything.
    We have an Airport Extreme routing our dynamic-IP DSL connection from Verizon. Static IPs on the LAN for all the clients along with port-mapping on the AEBS & DynDns service has enabled successful afp and vnc connections to the clients & server from outside the network as well as internal and external use of the iCal server through iCal. Also added a CNAME record at my domain host (MediaTemple) to point server.mydomain.com to the DynDns URL - so to do those afp and vnc connections I can type, for example, afp://server.mydomain.com:port in the Finder's Connect to Server window.
    The sole remaining service I'd like to setup for now would be the wiki/blog/webcalendar. This seems to work fine now on the LAN when you type server.mydomain.com into Safari.
    But no dice from outside the network. Verizon blocks port 80, so I've got to type server.mydomain.com:8080 into Safari, and I've mapped the 8080 port on the router to point at the webserver. So far so good - the browser displays the default home page, and shows a link in the right sidebar to the single group blog/wiki/calendar. But when I click on this, I am directed to server.mydomain.com:8080/groups/mygroup, but instead of the blog, I get a page with an error: Not Found, 404: No group with that name (mygroup) hosted on this server.
    Any ideas about how to fix this? I've tried running the webserver on port 8080 and pointing the router to that to no avail. The fellow who's been helping me set this up wonders if the problem is that the URL still has that pesky :8080 in it, gumming up the works somehow. If so, is there a way to do some sort of Apache URL rewrite or DNS alias or something to fix it? By the way, that previous sentence demonstrates the entirety of my Apache/DNS knowledge (I know some terms, but not how to do anything), so please be super simple with any explanations!
    Or is there something else I can try?
    As a secondary concern, I'd like to make it possible to type server.mydomain.com from outside the network rather than server.mydomain.com:8080. I think you can do this too through DynDns, but I have not been able to figure that out. Priority, though, is on getting the wiki running well first...
    Thanks so much in advance, wise friends. I'm excited to hear what you think.
    Sincerely,
    Willhaus

    Hi MrHoffman,
    Thanks again for the reply.
    I hear you about Verizon. I checked in with them and they are indeed blocking port 80 and gave no indication that that would change without a considerably bigger package - not realistic or reasonable for our small studio. But the DynDns strategy seems to work well - I can successfully access the network remotely in many ways: vnc, afp, web, etc...
    I got you about web clients needing to add the port to the URL. That's how I've been remotely browsing to the server to get the error I'm encountering.
    VPN: Originally I wanted to set this up, but read some things about VPN not working through an AEBS. Maybe I'll return to it, but for now I want to focus on a non-VPN strategy. Partly b/c of the hassle (one thing at a time...) and partly b/c we'll probably be accessing this stuff from a variety of computers and wouldn't want VPN hassles to get in the way of simple web access.
    As for the redirect, I tried your suggestions. What seems to happen, though, is that the browser just gets redirected to a new URL without the port reference, thereby resending the user to the Verizon-blocked port 80. That's why I was messing around with the proxy method before - I thought it might reroute the traffic to the correct port on the server machine without running into trouble with Verizon. I believe I was getting the Gateway error both in the browser and the logs (can't find it in the logs now, though). Anything else I could try with the RewriteRule method? It seems like once a user gets past Verizon and has access to the server, it ought to be possible to redirect that traffic to the correct Apache port to get the wiki to work. But I can't for the life of me figure it out.
    I have new suspicion too: that this might have to do with the DNS setup on the server. I wonder because: when I go on the server machine itself and try to browse to server.mydomain.com or even www.mydomain.com (which should take you outside the LAN to the internet to deliver our website running on our host), I get a "Safari can't find the server server.mydomain.com" error. But if I input one of 2 IPs (10.0.1.201 and 127.0.0.1) I'll get taken to the proper server homepage. But it breaks on the group page just like remote access does.
    So it seems to me that there must be something wrong with the DNS settings if browsing from the server itself doesn't find our externally hosted domain nor point itself to the wiki site that it hosts that works fine for clients on LAN. Maybe patching that up will fix my problem? Does it make sense that a DNS error might break the wiki but not break the personal blogs? Could anyone walk me through a simple DNS setup for the small network situation I mentioned in my original post? Please keep in mind that I know nothing about Primary/secondary zones, reverse lookup, reverse mapping, etc. Is there a simple way to describe everything I should see in the DNS section of Server Admin?
    Thanks a million,
    W

  • Screen Size and Resolution on Remote Access Mavericks

    Hi Forum,
    Accessing my Mac Mini remotely and it has a new install of Mavericks. The Screen size and shape and resolution isn't right, but Screen options in System doesn't give me any options. Is this because, physically, no screen is attached? Do only screen sizes and options come up when a screen is attached?
    it currently shows 1280x960 [i think - just turned off the mac to get back to work] or 'scaled to fit'. Neither is right for the MBP remote access,. It was fine before i upgraded.
    any ideas?

    Hi xerhino, and a warm welcome to the forums!
    Good work on your part!
    Hope your doing OK with the Snow, Ice, and Winds!

  • Remote access via pppoe - mac add limitation

    Hi,
    We have a requirement to provide remote access for a number of individual customers.  I plan on using pppoe for each of these customers as it will give us the ability to control each session individually and apply shaping etc if required.
    There will be about 250 customers at the one location and we are using a thrid party supplier to run the connectivity into the site.  I plan on dragging the pppoe sessions back to our network rather than terminating them onsite.
    The main issue I have is that the supplier who is running the connectivity into the site for us has a mac address limit of 50.
    My question is  - is there any way in which I can still bring the pppoe session back to our network while still remaining under the 50 mac address limit?
    I thought perhaps mpls might be the way to go here, but, I'm not too sure.  We're running mosly Cisco 7200's so we might be limited in the options available...
    Can any please advise on what might be a suitable option?
    Thanks,
    Jonathan

    I don't think PPPoE is a good idea. It introduces a lot of additional requirements, devices, additional client configuration, all complications that are easily avoided with a normal technology, eg. IP routing, GRE (only if necessary), etc.

  • NMH 410 "Remote Access" - Videos Do Not Play

    When accessing my Media Hub from a "remote" location the videos do not play (I only have videos on my Media Hub). 
    Instead, I get the following error message:
    Error: Could not play the selected title
    Windows Media: this media player was detected but is not responding. 
    The version, plug-in, or codec may be incorrect.
    These same videos play without any problem on my home network using the same PC(Windows Vista), IE browser (8), and Media Player (11.0.5x).
    Does anyone have any keys to success that they can offer?
    My Network:
    DSL with "bridged" modem
    E4200 Linksys router
    Ports forwarded 80, 443, 9000
    Media Hub 410
    Windows XP desktop (wired)
    Windows Vista laptop (wireless)
    MAC 10 laptop (wireless)
    IE 8
    Windows Media Player 11.0.5x
    Video Files (all) .wmv format
    Files imported to Hub through Media Importer
    Files manually moved from Import Folder to Video Folder on Hub File Browser
    All Video Thumbnails shown on Hub Homepage
    As mentioned there is no problem playing these video files at home, nor is there a problem accessing the Media Hub "remotely".  I just cannot get the files to play from a remote location.
    Any ideas or recommendations?
    dutch184

    Hi Fhizoo8:
    Thanks for that knowledge base listing.  The items there only served to re-enforce those things that have already been attempted. 
    I have not tried your suggestion to uninstall and reinstall Windows Media Player.  I'll do this on the laptop that I use while at remote locations, and on the desktop that I have wired to my home network.  At this point I'll reach for any straw that might allow these videos to play (remotely).
    To answer your question, yes I have all 3 ports forwarded on my router (80, 443, 9000) and married to the IP of the Media Hub.  I also access the Media Hub through the HTTPS format, and through the DYNDNS format without any problem.  I do not use the www.cicomediahub.com method of remote access.  That route is never reliable, nor is it ever working and when it does work the videos are buffering every 3-5 seconds.  
    I will try the unistall and reinstall of the Windows Media Player.  I will get back to let you know if it had any positive affect.
    Thanks
    dutch184    

Maybe you are looking for

  • Problem loading window component more than once

    I have a swf with a button that opens a window component (from my library). it loads fine and also closes fine when I click the close button in the window. but when I try to open the window again, it actually loads again, but it stalls and locks up i

  • Getting error while connecting to AS400 DB through Jdeveloper

    I am using Jdeveloper 11.1.2.4.0 and Connecting AS400 DB using the Driver com.ibm.as400.access.AS400JDBCDriver and I put the jt400.jar in classpath : :\JDeveloper\system11.1.2.4.39.64.36.1\DefaultDomain\lib\jt400.jar. Now I am able to test the connec

  • Footer problem

    I am using dreamweaver cs4 this is my CSS style sheet                                                            body {         margin:  0px;         padding: 0px;         background: some picture  repeat x; #header {         margin: 0 auto;        

  • FTP an iBot

    Hi, Can you please let me know whether we can FTP an iBot in OBI EE. Thanks In Advance Siva

  • Some of the items in your iTunes library were not copied to your ipod

    It's a gen.5 ipod with video and works fine with almost everything. Sometimes I get the above message. I've recently tried a brand new set of CDs to rip to the ipod, and I get this again. I've de/re-authorised the mac, but no joy. Ideas?