IPsec for remote telephones

I want to activate IPsec for remote telephones, I have 2 Cisco 2651 and I'm trying to configure a IPsec tunnel between them, but when I try to use the command crypto in the configure terminal doesn´t exists, Is not possible by default the configuration of IPsec in all the routers? Do I need a license or something like that? How can I know if my router support IPsec? I have Cisco IOS 12.4
regards

And how I can add this feature?
Which solution do you suggest?

Similar Messages

VRF-Aware IPSec for Remote Access

Dear All,
Has anyone successfully implemented VRF-Aware IPSec for Remote Access ?
I am trying to implement this feature on a PE which has MPLS enabled
on the Internet facing interface.
With the config below, I am being able to establish an IPSEc tunnel but not being able to PING the VRF interface configured on the same PE.
I will be really grateful for any comment or any pointers for what could
be possibly wrong with the configuration below:
aaa new-model
aaa authentication login USER-AUTHENTICATION local
aaa authorization network GROUP-AUTHORISATION local
crypto keyring test-1
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration group test-1
key test-1
domain test.com
pool cpe-1
acl 101
crypto isakmp profile test-1
vrf test-1
keyring test-1
match identity group test-1
client authentication list USER-AUTHENTICATION
isakmp authorization list GROUP-AUTHORISATION
client configuration address initiate
client configuration address respond
client configuration group test-1
crypto map IPSEC-AWARE-VRF 2 ipsec-isakmp dynamic test-1
ip local pool cpe-1 192.168.81.1 192.168.81.254 group test-1
crypto dynamic-map test-1 1
set transform-set test-1
set isakmp-profile test-1
reverse-route remote-peer
Internet facing interface
interface GigabitEthernet4/0/0
ip address x.x.x.x 255.255.255.240
ip router isis
mpls ip
crypto map IPSEC-AWARE-VRF
Customer facing interface
interface GigabitEthernet1/0/0.1
encapsulation dot1Q 100
ip vrf forwarding test-1
ip address 110.110.110.1 255.255.255.0
Kind regards,
ZH

Million thanks for this.
This now works after disabling CEF on the public facing interface.
Regards,
Zahid

Rejecting IPSec tunnel: no matching crypto map entry for remote proxy

Hi!
I have already search for this but didn't get an exact answer I'm looking for so I try asking it again (if there is the same question).
I'm in process of migrating some VPN tunnels with from a Cisco router to an ASA, everything will keep the same but just the peering IP address. However, some of the tunnel was being torn down since it request for a proxy doesn't match the one configured on our side. And the remote peer said there is no such issue on the previous platform, but now they need to reset the tunnel from time to time.
Apr 18 2013 07:29:10 asa002 : %ASA-3-713061: Group = 192.168.1.226, IP = 192.168.1.226, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 192.168.1.226/255.255.255.255/0/0 local proxy 10.10.9.81/255.255.255.255/0/0 on interface outside
Apr 18 2013 07:29:10 asa002 : %ASA-3-713902: Group = 192.168.1.226, IP = 192.168.1.226, QM FSM error (P2 struct &0x745e9150, mess id 0x8d7ad777)!
Apr 18 2013 07:29:10 asa002 : %ASA-3-713902: Group = 192.168.1.226, IP = 192.168.1.226, Removing peer from correlator table failed, no match!
The remote peer said they did not change the proxy id on their side so it is possibly the old platform will just not setting up the SA without torn down the tunnel while the ASA on the new platform will torn down if there is any mismatch.
Anyway I have requested the remote side to remove those unmatched entried to avoid the tunnel being torn down, but if there any configuration that is related to this issue? i.e. Just bring up the SA with matched addresses and ignore others, instead of torn down the tunnel.
Thanks!!
//Cody

Are you trying to send traffic destined towards the internet from 172.16.0.0/20 via this ASA as well? why? are you inspecting those traffic before being sent out to the internet?
If so, this end also needs to be configured with "any" as well --> crypto ACL needs to mirror image.
access-list outside_1_cryptomap extended permit ip any 172.16.0.0 255.255.240.0
Then you also need NAT on the outside interface, otherwise, traffic from 172.16.0.0/20 is not PATed to a public IP, and won't be able to reach the internet:
nat (outside) 1 172.16.0.0 255.255.240.0

Rejecting IPSec tunnel: no matching crypto map entry for remote proxy on interface outside.

Hi,
I have read a problem where the VPN between an ISP and ourselves started dropping sessions. I have rebuilt the crypto map and tried to dig deeper into my config and some basic troubleshooting while I await the ISP to respond.
Any ideas?
Thanks Steve
https://supportforums.cisco.com/thread/255085
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#solution10
5 Jun 13 15:46:25 713904 IP = 209.183.xxx.xxx, Received encrypted packet with no matching SA, dropping
4 Jun 13 15:46:25 113019 Group = 209.183.xxx.xxx, Username = 209.183.xxx.xxx, IP = 209.183.xxx.xxx, Session disconnected. Session Type: IKE, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: crypto map policy not found
3 Jun 13 15:46:25 713902 Group = 209.183.xxx.xxx, IP = 209.183.xxx.xxx, Removing peer from correlator table failed, no match!
3 Jun 13 15:46:25 713902 Group = 209.183.xxx.xxx, IP = 209.183.xxx.xxx, QM FSM error (P2 struct &0xda90f540, mess id 0x76c09eb7)!
3 Jun 13 15:46:25 713061 Group = 209.183.xxx.xxx, IP = 209.183.xxx.xxx, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 172.16.0.0/255.255.240.0/0/0 local proxy 0.0.0.0/0.0.0.0/0/0 on interface outside
5 Jun 13 15:46:25 713119 Group = 209.183.xxx.xxx, IP = 209.183.xxx.xxx, PHASE 1 COMPLETED
6 Jun 13 15:46:25 113009 AAA retrieved default group policy (DfltGrpPolicy) for user = 209.183.xxx.xxx
6 Jun 13 15:46:25 713172 Group = 209.183.xxx.xxx, IP = 209.183.xxx.xxx, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device

Are you trying to send traffic destined towards the internet from 172.16.0.0/20 via this ASA as well? why? are you inspecting those traffic before being sent out to the internet?
If so, this end also needs to be configured with "any" as well --> crypto ACL needs to mirror image.
access-list outside_1_cryptomap extended permit ip any 172.16.0.0 255.255.240.0
Then you also need NAT on the outside interface, otherwise, traffic from 172.16.0.0/20 is not PATed to a public IP, and won't be able to reach the internet:
nat (outside) 1 172.16.0.0 255.255.240.0

How to create accounts for remote users in 1841

Hi,
I was wondering how can i create accounts for remote users to be able to vpn please ? I have setup the vpn server successfully.
Regard,

Hello.
I believe that you can try this:
Router# configure terminal
Router (config)# password encryption aes
Router (config)# crypto ipsec client ezvpn ezvpn1
Router (config-crypto-ezvpn)# username server_1 password 0 blue
if you are using easy vpn.
from: http://cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455b7d.html

Updates for Remote Desktop via App Store Software Update

Hello, and Happy Thanksgiving. On a computer running Mavericks, I installed Apple Remote Desktop 3.5 from the disk (not from the App Store.) On it's first startup, I was greeted with the message "The Remote Desktop Administrator software must be upgraded on this computer." I downloaded and installed the 3.7 update manually from http://support.apple.com/kb/dl1565. However, I view this as a "Band-Aid", and not a fix. How would I recieve future updates for Remote Desktop from Software Update within the Mac App Store?

Hi ya.. just to let everyone know Apple UK Senior Tech support are aware of this error message that we are all getting as from today and are on the case....

I have a time capsule connected directly to fiber connection. I have connected a windows server directly to TC and configured it for remote desktop connection. From my interanet I can access srvr but not from my home. What config I need on TC?

I have a time capsule directly connected to fibre optic point out. All pcs and macs are connected wirelessly to the internet. I have connected a windows server pc to TC. When configured for Remote desktop connection, I can access windows server from within interanet but don't know how to access it from internet. I guess I need to change some settings in TC to get some ip adress for the remote desktop connection from my home. Anyone who can help me out? Appreciate it.
Narmin

I am a little lost now.. I have read again your title and your first post.. and they seem inconsistent.
In the title you state.
From my interanet I can access srvr but not from my home.
Interanet is not a word I know.. I assumed intranet...are you talking about internet or intranet? And just to be clear say WAN or LAN.. !! Is your home part of the interanet??
In the first post you state,
I can access windows server from within interanet but don't know how to access it from internet.
Now this is more normal.. the issue is not in the home at all, it is accessible from there but fails from internet. If this is correct, then you can do a few obvious things to determine where the problem is.
But first I need to know are you actually testing from a different internet connection to your home lan.. you are not just trying the public IP from inside the LAN as that will fail due to the TC not doing NAT Loopback.
I am also assuming the TC is the only router in the network, and has the public IP on the WAN interface.
And I am also assuming you have turned on the ping responder and you can actually ping your public ip from the internet and get a response. This helps no end in figuring out where there are issues. Strange but I have no idea if there is a ping responder in the TC WAN so you might need to forward that as well. Also if you have a dynamic public ip address are you using dyndns or no-ip or some other service to connect.
1. Test bypassing the TC.. plug the internet connection straight into the windows server,, and test if you have access. If yes, the TC is the problem.. if not, your setup on the windows server is wrong.. look at firewall in particular.
2. Assuming from test 1 the TC is the problem, Post the screen shots of the port forwarding setup for us to look at.. that is by far the easiest way to check it out.
There are lots of references to port forwarding in the TC.. eg
http://must-know-mac.blogspot.com/2008/07/how-to-port-forward-time-capsule.html
The things that generally go wrong are firewall on the computer that is accepting the port.
The ISP doesn't allow connections on a particular port. (not likely in your case)
The router is behind another router.. double NAT will kill any port forward.
Upnp has already allocated a port.. not an issue as TC doesn't use upnp although a reboot of everything after you set port forwards is well worth it.. amazing how things don't stick properly without a reboot.
IP on the receiving device is not static and so changes.
Not enough or right type of ports are opened. This is always messier than it looks as one port is often not enough for two way communications.

Key genaration for remote system

Hi,
I want to genarate number ranges for remote system like
a100 to z999.
But in Console its allowing me to enter only numaric values only.
could you please suggest me to achive this functionality.
Thanks in Advance.
Kiran.G

Hi Kiran,
I want to genarate number ranges for remote system like
a100 to z999.
But in Console its allowing me to enter only numaric values only.
could you please suggest me to achive this functionality.
If in Console, you are not able to put in Alpha numeric Numbers, then I can suggest you a workaround.
If you want to get the range a100 to z999,
then only take the numeric part in the range.
Try using an Assigment in the Data Manager. And Concatenate the Alplanumeric part to the numeric part.
I am not sure, whether it will work. But still try out.
Hope it helps.
Thanks and Regards
Nitin jain

Remote Desktop Service Manager - configure permissions for Remote Desktop Users to Send Message, Disconnect, Logoff

Hello, dear colleagues.
We are using Windows Server 2012 R2 as Remote Desktop Server. Also use Windows Server 2008 R2 with Remote Desktop Service Manager to control RDS user sessions (Send Message, Disconnect, Logoff, Query Info).
Send Message, Disconnect, Logoff options works only for users in Administrators group.
I can't to configure permissions for Remote Desktop Users, specific user or AD group.
To set permissions I'm running RDS Host Configuration on Windows Server 2008 R2 and connect to Windows Server 2012 R2. Then double-click
RDP-Tcp, Security tab, add specific user account , AD group or configure
advanced permissions
for Remote Desktop Users.
But, as I sad above, these options works only for users in Administrators group. How to make it work for Remote Desktop Users or specific user, AD group?
Thanks.
P.S. If move specific user from Remote Desktop Users group to Administrators group on
Windows Server 2012 R2 - it works.

Hi,
You can prevent administrators from changing the permissions for a connection by applying the
Do not allow local administrators to customize permissions Group Policy setting.
This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
Apart there is one command with which you can set the permission for that check the related
article. Additionally checkthis
thread for more detail.
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Error when uninstalling App-V RDS client: Product: Microsoft Application Virtualization (App-V) Client for Remote Desktop Services 5.0 Service Pack 2 x64 -- Error 1324. The folder path 'C:' contains an invalid character

Issue: experienced when attempting to uninstall the App-V 5.0 SP2 RDS client.
Event Log: Product: Microsoft Application Virtualization (App-V) Client for Remote Desktop Services 5.0 Service Pack 2 x64 -- Error 1324. The folder
path 'C:' contains an invalid character
Symptoms (when in this current state):
Unable to uninstall the SP2 client
You can upgrade the client (via hotfix) and uninstall the hotfix, but you will not be able to remove the SP2 client
AppvVfs filter driver will not create an instance, therefore applications will not be able to read into existing streamed VFS content, or trigger sparse files to stream content. (you can still stream the content via other means, like the UI or powershell)
Because of the AppvVfs filter driver not instantiating, applications that depend on licences that exist in VFS will not be able to be read causing certain applications to react as if the license does not exist or is an incorrect format

Resolution:
Check for the existence of a hidden folder named %appdata% in the C:\Program Files\Microsoft Application Virtualization\Client folder. (You will need to un-check the folder options box in windows explorer for "Hide
protected operating system files" to see it)
If the hidden %appdata% folder exists, delete it.
Proceed to uninstall the App-V client
After a clean uninstall and removal of remnants of the client, reinstall the client again and apply the latest hotfix available (Hotfix 2 for SP2 at a minimum).

Does Av digital adapter works with the universal dock for remote control?

if I only connect the Lightning to 30 pin adapter to the universal dock for remote control it works so good with music, spotify, Netflix, YouTube etc.
but if I add the av digital lightning adapter to watch on Tv, the dock and remote control don't work anymore what can I do? I want to watch stuff on tv and use the IR dock for remote control please help me what's going wrong?

Thanks for your advice.
I recently purchased a universal dock for my iphone 3g. It works great. I just had one question. When my iphone is sitting on it for lets say 20 - 30 minutes. Then if i press the buttons on the remote. nothing happens! If I then press the home button while it is on the cradle then, the remote, it plays music. There after lets say if I stop stop the music through the remote and again press the remote button after a few minutes it starts playing. So what happens after a long time. Why do i have to press the home button on the iphone for the remote to work. Is that how it is supposed to work???
Thanks

I have a mac mini server which I want to set up for remote access from windows and mac pcs. How do I do this. I can access it form my home network OK

I have a mac mini server which I want to set up for remote access from windows and mac pcs. How do I do this. I can access it form my home network OK

Posted in error.

Desperate help needed to configure WVC210 for remote access?

Hi, I'm new and desperately need some help on setting up my WVC210 for remote access.
I manage to setup and see images from my WVC210 using my home LAN via both wired and also wireless.
I have 2 questions:
(a) for wireless connection, i only manage to get connection to my WVC210 if i disable the wireless security from my router. But that means i'm opening my wireless LAN to everyone. How can i still get connection to the camera if i enable the wireless security from my router. (FYI: my router is 2Wire ADSL from Singnet Mio)
(b) how can i get connection to my WVC210 from outside or in my office? I type in the camera Fixed IP address (displayed on the front screen) on the web browser, by it shows a error page. Is there some setting that i might need to adjust ?
Pls kindly help me
Thank you.

Bernard,
For Item (2) is there any difference between the camera built-in dyndns updater versus the software updater? I am under the impression that the software updater is easier to manage.
The biggest difference for you is that the camera always stays at the same location, and the laptop goes with you. Every time you access the internet from a different location with the laptop the software updater is sending the new IP address to dyndns.com. This causes you to lose access to your camera because the FQDN doesn't point to your home IP address anymore. Once the dyndns credentials are in the camera (or router) there is no management needed. The device will automatically update dyndns.com with your new IP address as it changes, and you do not need to do anything.
For Item (3), are you saying port forward 1025 is it for the 2nd camera only or for both? Or is it 2nd camera use 1025 and first camera use 8080?
Here's an example of what I mean:
Camera 1: 192.168.1.210 port 1024. In router, forward port 1024 to 192.168.1.210
Local Access: http://192.168.1.210:1024
Remote Access: http://bernards210.dyndns.org:1024 (Example)
Camera 2: 192.168.1.211 port 1025. In router, forward port 1025 to 192.168.1.211
Local Access: http://192.168.1.211:1025
Remote Access: http://bernards210.dyndns.org:1025 (Example)
Camera 3: 192.168.1.212 port 1026. In router, forward port 1026 to 192.168.1.212
Local Access: http://192.168.1.212:1026
Remote Access: http://bernards210.dyndns.org:1026 (Example)
to access the 2 camera outside, do i have to have another dyndns host name or can i use the current one for both camera?
As you can see in the above example, the dyndns name remains the same for remote access to all three cameras. The only change is the port number at the end. Your router will translate the port number to the IP address that the port is forwarded to, allowing you to select the camera that you wish to view by changing the port number in the address.
I was actually thinking that the camera web browser can show 2 camera at the same time. Is it possible?
No. Each browser window will display a single camera. You can however opens multiple instances of your browser to allow viewing of more than one camera simultaneously. A better solution is to install the Video Monitoring Software that is included with the camera which allows you to view multiple cameras in the same window.

LDAP vs local login for remote access

Hi Team,
I am evaluating the best means for single factor authentication for remote access (client to site or SSL VPN). The options I see are creating local usernames and password or integration with Active Directory via LDAP. What are the pros and cons of these solutions.
I feel local logins are more secure comparitavely because the user first login using local login and password and then has to use the domain credentials for accessing corporate resources. Of course, this comes at an admistrator overload and local management of user names and passwords. Do you have any opinion on this? Any acknowledgement will be highly appreciated.

Hello Manoj,
IMO, I would never consider the LOCAL DB as an option for a corporate deployment. It does not scale and it is not easy to manage.
Local DB is used in case you need to manage a number of 15 users for instance, so in this case it is managable, but when it comes to a higher number it is not an option.
Active Directory is a better solution since it is meant to handle hundred of users and allows password-management for instance. Also you can have many ASA devices, performing DB bindings and queries to check the users credentials to the AD servers, so you don't need to deal with tons of user accounts on each ASA, for instance.
If you are looking for a more secure way to authenticate your users you can consider two-factor authentication using certificates for instance:
AnyConnect Certificate Based Authentication.
Why to use AD:
Pros
Scalable.
Easy to manage.
Allows password-management.
Cons:
Expensive (not open AD solution).
HTH.
Please rate helpful posts.

I deleted Bonjour, since I don't need it for remote printing. Now I get the message " Airport Base Station has stopped working: and also a message saying APAgent.exe can't be found. What to do??? Thanks.

I deleted Bonjour since I don't need it for remote printing. Now on start-up I get the message: "Airport Base Station Agent has stopped working" and also message: "can't find APAgent.exe.: Do I need AP Agent?? What to do?? Thanks.

The APAgent monitors your AirPort base station and informs you if there are things like firmware updates available. This utility relies on Bonjour, but is not required for base station operation. However, Bonjour makes it easier for your PC to "find" the base station via the AirPort Utility and I would recommend that you keep it installed. If you don't want the APAgent, you can just use the Apple Updater utility (that was also installed when the AirPort Utility was installed) to remove it.

IPsec for remote telephones

Similar Messages

Maybe you are looking for