NAC 4.9 CAS inband with ASA 8.6

We are working on a new deployment. The user logs in, the agent pops, and posture assessment happens. The screen for posture assessment closes at the test laptop. It acts like all is working. When we look at the inband user it shows as not having transitioned frm the auth the access VLAN. This is a simple install and the VLAN mapping is definitely there. Ideas?

Steve,
Here is a configuration guide for the ASA to CAS, its not the latest and greatest but this should work:
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a008074d641.shtml
When referrring to L2 and L3 adjacent this is different with respect to VGW and RIP.
L2 and L3 refers to how the clients are positioned with respect to the CAS (not the CAM), are they being routed to the CAS untrusted interface or are they available on a vlan that the CAS can be a part of.
VGW and RIP refers to the operation of the CAS, this is similar to the operation of the ASA, when it comes to transparent vs routed mode (you can use both the on same CAS), VGW bridges the two networks together, and RIP routes the traffic around and requires static routing since the CAS does not support dynamic routing protocols.
You can use VGW by setting the group policy to route all tunneled traffic to an ip that is present on the trusted side of the CAS, also you can use the vlan attribute in the group-policy configuration to assign the remote users to a vlan which forces their traffic to flow through the CAS.
http://cisconac.blogspot.com/2007/07/vpn-deployments-with-asa-80.html
Thanks,
Tarik Admani
*Please rate helpful posts*

Similar Messages

  • How Can i Use two Different Public IP Addresses no my DMZ with ASA Firewall.

    How To Using Two Different Public IP Address on My DMZ with ASA 5520
    Postado por jorge decimo decimo em 28/Jan/2013 5:51:28
    Hi everyone out there.
    can any one please help me regarding this situation that im looking for a solution
    My old range of public ip address are finished, i mean (the 41.x.x.0 range)
    So now i still need to have in my DMZ another two servers that will bring some new services.
    Remember that those two server, will need to be accessable both from inside and from outside users (Internet users) as well.
    So as i said, my old range of public ip address is finished and we asked the ISP to gives some additional public
    ip address to address the need of the two new servers on DMZ. and the ISP gave us the range of 197.216.1.24/29
    So my quation is, on reall time world (on the equipment) how can i Use two different public ip address on the same DMZ
    on Cisco ASA 5520 v8??
    How my configuration should look like?
    I was told about implementing static nat with Sub Interfaces on both Router and ASA interface
    Can someone please do give me a help with a practical config sample please. i can as well be reached at [email protected]
    attached is my network diagram for a better understanding
    I thank every body in advance
    Jorge

    Hi,
    So looking at your picture you have the original public IP address range configured on the OUTSIDE and its used for NAT for different servers behind the ASA firewall.
    Now you have gotten a new public IP address range from the ISP and want to get it into use.
    How do you want to use this IP address range? You want to configure the public IP addresses directly on the servers or NAT them at the ASA and have private IP addresses on the actual servers (like it seems to be for the current server)?
    To get the routing working naturally the only thing needed between your Router and Firewall would be to have a static route for the new public network range pointing towards your ASA OUTSIDE IP address. The routing between your Router and the ISP core could either be handled with Static Routing or Dynamic Routing.
    So you dont really need to change the interface configuration between the Router and ASA at all. You just need a Static route pointing the new public IP address towards the ASA outside IP address.
    Now when the routing is handled between the ISP - ISP/Your Router - Your Firewall, you can then consider how to use those IP addresses.
    Do you want to use the public IP addresses DIRECTLY on the HOSTS behind the firewall?This would require you to either configure a new physical interface with the new public IP address range OR create a new subinterface with the new public IP addresses range AND then configure the LAN devices correspondingly to the chosen method on the firewall
    Do you want to use the public IP addresses DIRECLTY on the ASA OUTSIDE as NAT IP addresses?This would require for you to only start configuring Static NAT for the new servers between the inside/dmz and outside interface of the ASA. The format would be no different from the previous NAT configuration other than for the different IP addresses ofcourse
    Of the above ways
    The first way is good because the actual hosts will have the public IP addresses. Therefore you wont run into problems with DNS when the LAN users are trying to access the server.
    The second way is the one requiring the least amount of configurations/changes on the ASA. In this case though you might run into problem with DNS (to which I refer above) as the server actually has a private IP address but the public DNS might reply to the LAN hosts with a public IP address and therefore connections from LAN could fail. This is because LAN users cant connect to the servers OUTSIDE NAT IP address (unless you NAT the server to public IP address towards LAN also)
    Hopefully the above was helpfull. Naturally ask more specific questions and I'll answer them. Hopefully I didnt miss something. But please ask more
    I'm currently at Cisco Live! 2013 London so in the "worst case" I might be able to answer on the weekend at earliest.
    - Jouni

  • NAC Server and Manager Failure with out failover

    Hi, I'm working on a NAC L2 OOB wired design with 1 CAM and 1 CAS. I've not included failover to the design for the obvious financial reasons, and want to figure out the affect that the network would have in the case of a failure.
    1.)What would the users experience in the event of a CAS failure? both currently online users and new users
    2.)What would the users experience in the event of a CAM failure? both currently online users and new users
    3.) Are there any ideas on how to minimize the effect on the users in the event of a failure, w/o adding failover bundle ?
    Many thanks for your valuable input in advance.
    Din

    If you are out OOB, then a CAS failure would not affect logged in, remediated users, anyone not logged in would be stuck because when the CAS fails, the connectivity to the CAM would be lost.
    If the CAM fails, you will not be able to log in, do remediation or anything. VLAN settings on switches will be frozen where they are at the moment of CAM faiure. Not that you could easily connect to switches, change vlans to allow users onto the LAN and the CAM would accept that passively when restarted but if you use the Agent it will probably want to log in again, which is not a huge issue if you use AD SSO.
    Dan Sichel
    Dan S.

  • Problem with ASA 5505 VPN config

    Hi to all,
    I have a problem with ASA 5505 remote access vpn. I have site-to-site VPN and I need that my VPN clients can access IP subnets that I have behind site-to-site VPN. All that I have tried I get and error to my log “Flow is a loopback”.
    So what I need : for example I need that vpn client with ip 10.0.0.1 can go to 192.168.1.2
    My config:
    access-list Test_splitTunnelAcl standard permit host 10.0.2.3
    access-list Test_splitTunnelAcl standard permit host 10.0.2.4
    access-list Test_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list nonat_outside extended permit ip 10.0.0.0 255.255.255.0 192.168.1.0 255.255.255.0
    ip local pool VPN_Client_Pool2 10.0.0.1-10.0.0.200 mask 255.255.255.0
    nat (outside) 0 access-list nonat_outside
    nat (outside) 1 10.0.0.0 255.255.255.0
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Test_splitTunnelAcl
    Site-to-Site:
    crypto map outside_map 3 set peer 195.233.x.x
    access-list outside_3_cryptomap extended permit ip object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_4
    object-group network DM_INLINE_NETWORK_2
    network-object 10.0.2.0 255.255.255.0
    network-object 10.0.3.0 255.255.255.0
    object-group network DM_INLINE_NETWORK_4
    network-object host 192.168.2.70
    network-object host 192.168.3.55
    network-object 192.168.1.0 255.255.255.0
    I hope that someone can post an answer and solve my problem

    A few things are required:
    1) You don't need the following 2 lines, so it can be removed:
    nat (outside) 0 access-list nonat_outside
    nat (outside) 1 10.0.0.0 255.255.255.0
    2) On the ASA, you need to configure:
    same-security-traffic permit intra-interface
    3) Object group: DM_INLINE_NETWORK_2 needs to include 10.0.0.0/24
    4) On the remote lan-to-lan end, the crypto ACL also needs to include 10.0.0.0/24 as the destination subnet.
    5) The NAT exemption (NONAT) on the remote lan-to-lan end also needs to include 10.0.0.0/24 as the destination subnet.
    Hope that will resolve your problem.

  • Remote access VPN with ASA 5510 using DHCP server

    Hi,
    Can someone please share your knowledge to help me find why I am not able to receive an IP address on remote access VPN connection while I can get an IP address on local DHCP pool?
    I am trying to setup remote access VPN with ASA 5510. It works with local dhcp pool but doesn't seem to work when I tried using an existing DHCP server. It is being tested in an internal network as follows:
    ASA Version 8.2(5)
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.6.0.12 255.255.254.0
    ip local pool testpool 10.6.240.150-10.6.240.159 mask 255.255.248.0 !(worked with this)
    route inside 0.0.0.0 0.0.0.0 10.6.0.1 1
    crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map dyn1 1 set transform-set FirstSet
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto map mymap interface inside
    crypto isakmp enable inside
    crypto isakmp policy 1
      authentication pre-share
      encryption 3des
      hash sha
      group 2
      lifetime 43200
    vpn-addr-assign aaa
    vpn-addr-assign dhcp
    group-policy testgroup internal
    group-policy testgroup attributes
    dhcp-network-scope 10.6.192.1
    ipsec-udp enable
    ipsec-udp-port 10000
    username testlay password *********** encrypted
    tunnel-group testgroup type remote-access
    tunnel-group testgroup general-attributes
    default-group-policy testgroup
    dhcp-server 10.6.20.3
    tunnel-group testgroup ipsec-attributes
    pre-shared-key *****
    I got following output when I test connect to ASA with Cisco VPN client 5.0
    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + VENDO
    4024 bytesR copied in 3.41 0 secs (1341 by(tes/sec)13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 853
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing SA payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ISA_KE payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing nonce payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, Received xauth V6 VID
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, Received DPD VID
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, Received Fragmentation VID
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  False
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, Received NAT-Traversal ver 02 VID
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, Received Cisco Unity client VID
    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, Connection landed on tunnel_group testgroup
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing IKE SA payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA Proposal # 1, Transform # 9 acceptable  Matches global IKE entry # 1
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing ISAKMP SA payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing ke payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing nonce payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for Responder...
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing ID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing hash payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Computing hash for ISAKMP
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing Cisco Unity VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing xauth V6 VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing dpd vid payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing NAT-Traversal VID ver 02 payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing NAT-Discovery payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, computing NAT Discovery hash
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing NAT-Discovery payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, computing NAT Discovery hash
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing Fragmentation VID + extended capabilities payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + HASH (8) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 440
    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + HASH (8) + NOTIFY (11) + NAT-D (130) + NAT-D (130) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 168
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Computing hash for ISAKMP
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing NAT-Discovery payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, computing NAT Discovery hash
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing NAT-Discovery payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, computing NAT Discovery hash
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Processing IOS/PIX Vendor ID payload (version: 1.0.0, capabilities: 00000408)
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing VID payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Received Cisco Unity client VID
    Jan 16 15:39:21 [IKEv1]: Group = testgroup, I
    [OK]
    kens-mgmt-012# P = 10.15.200.108, Automatic NAT Detection Status:     Remote end is NOT behind a NAT device     This   end is NOT behind a NAT device
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing blank hash payload
    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing qm hash payload
    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SENDING Message (msgid=d4ca48e4) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 72
    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIVED Message (msgid=d4ca48e4) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 87
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): Enter!
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Processing MODE_CFG Reply attributes.
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = cleared
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = cleared
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary WINS = cleared
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary WINS = cleared
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: IP Compression = disabled
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling Policy = Disabled
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Browser Proxy Setting = no-modify
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Browser Proxy Bypass Local = disable
    Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, User (testlay) authenticated.
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing blank hash payload
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing qm hash payload
    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SENDING Message (msgid=6b1b471) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 64
    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIVED Message (msgid=6b1b471) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 60
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): Enter!
    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Processing cfg ACK attributes
    Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIVED Message (msgid=49ae1bb8) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 182
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): Enter!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Processing cfg Request attributes
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for IPV4 address!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for IPV4 net mask!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for DNS server address!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for WINS server address!
    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Received unsupported transaction mode attribute: 5
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Banner!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Save PW setting!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Default Domain Name!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Split Tunnel List!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Split DNS!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for PFS setting!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Client Browser Proxy Setting!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for backup ip-sec peer list!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Client Smartcard Removal Disconnect Setting!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for Application Version!
    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Client Type: WinNT  Client Application Version: 5.0.07.0440
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for FWTYPE!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for DHCP hostname for DDNS is: DEC20128!
    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: Received request for UDP Port!
    Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Duplicate Phase 2 packet detected.  No last packet to retransmit.
    Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIVED Message (msgid=b04e830f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload
    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload
    Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Duplicate Phase 2 packet detected.  No last packet to retransmit.
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE received response of type [] to a request from the IP address utility
    Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Cannot obtain an IP address for remote peer
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE TM V6 FSM error history (struct &0xd8030048)  <state>, <event>:  TM_DONE, EV_ERROR-->TM_BLD_REPLY, EV_IP_FAIL-->TM_BLD_REPLY, NullEvent-->TM_BLD_REPLY, EV_GET_IP-->TM_BLD_REPLY, EV_NEED_IP-->TM_WAIT_REQ, EV_PROC_MSG-->TM_WAIT_REQ, EV_HASH_OK-->TM_WAIT_REQ, NullEvent
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE AM Responder FSM error history (struct &0xd82b6740)  <state>, <event>:  AM_DONE, EV_ERROR-->AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL-->AM_TM_INIT_MODECFG_V6H, NullEvent-->AM_TM_INIT_MODECFG, EV_WAIT-->AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG-->AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK-->AM_TM_INIT_XAUTH_V6H, NullEvent-->AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b terminating:  flags 0x0945c001, refcnt 0, tuncnt 0
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending delete/delete with reason message
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing blank hash payload
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing IKE delete payload
    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing qm hash payload
    Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SENDING Message (msgid=9de30522) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
    Regards,
    Lay

    For RADIUS you need a aaa-server-definition:
    aaa-server NPS-RADIUS protocol radius
    aaa-server NPS-RADIUS (inside) host 10.10.18.12
      key *****   
      authentication-port 1812
      accounting-port 1813
    and tell your tunnel-group to ask that server:
    tunnel-group VPN general-attributes
      authentication-server-group NPS-RADIUS LOCAL
    Don't stop after you've improved your network! Improve the world by lending money to the working poor:
    http://www.kiva.org/invitedby/karsteni

  • Case structure with more than 200 cases, slower lab view app

    Problem Description :
    i am currently making a vi which compose of a simple case structures, a case structure with more than 200 cases, what i noticed is that the more i added cases the slower the labview reacts, it takes time for me to route wire on each of the cases.
    i dont know if there are any setting in the labview environment that i can increase the buffer size? i dont know... but its getting slow (only on the
    vi with more cases in a case structure)
    mytestautomation.com
    ...unleashed the power, explore and share ideas on power supply testing
    nissanskyline.org
    ...your alternative nissan skyline information site

    Can you clarify what you mean by "slow". Does it run more slowly or does it feel sluggish during editing?
    Could you attach the actual VI?
     Overall, I agree with the notion of local variable overuse. For example, you read the same local variable twice in the same case. Is there a need for this? Is there a chance that it varies between the two reads? Typically, you would place the terminal in front of the case structure and wire to all the locations where you need the value. This ensures that the data is consistent. Still, this should not cause any slowdown problem.
    (On a sidenote, the code in the upper left corner is inefficient. You convert the same data to lower case with each iteration, so you might want to place this before the loop and do it only once (well, if you are lucky, LabVIEW will fold the operation, but still....). Also your "index array" operation can be replaced by autoidenxing of the 2D array on the outer loop boundary.)
    LabVIEW Champion . Do more with less code and in less time .

  • Tacacs+ access issue with ASA firewall after integrating with RSA SecureID

    Hi,
    In my earlier post,  I raised the same question but let me rephrased it again. I have configured TACACS+ in cisco ASA firewall and able to access . But when I integrated it with RSA secure ID , I am not able to enter in enable mode. It is not accepting enable password nor RSA passcode. I have created enable_15 in ASA , ACS and RSA server but no luck.
    Did any one face similar issue with ASA access ?
    Rgds
    Siddhesh

    Hi Siddesh,
    In order to help you here, I need to know few things:
    1.] Show run | in aaa
    2.] When you enter enable password on ASA CLI, what error do you see on ACS > Monitoring and reports > AAA protocols > tacacs authentication > "look for the error message"
    3.] Turn on the debugs on ASA "debug tacacs" and "debug aaa authentication" before you duplicate the problem.
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • Lightning docks and what cases works with them!

    Being racking my brain for couple weeks now and trying to find info and get hope from people on various mac forums but to no avail, so thought I would ask on here
    I currently have an old 30 pin connector dock with the lightning adaptor on it so I can play my iphone 5 on it, now as you probably know, when the iphone 5 is docked , if it had no case on it whatsoever it will not reach because it seems the connector is too small which IMO is a massive oversight
    So to solve it I bought the speck flip case which if you haven't seen it flips up at the bottom so it docks easily.
    Is there anything anyone  recommend? I really fancy one of the new iPhone 5s cases to fit my iPhone 5 but as I have seen if I want to dock it I have to remove the case which is a real pain!
    I'm also looking at a new lightning dock, is there one anyone recommend? Can you get one where the lightning adaptor on the dock itself is a bit longer so it docks with a case on? Or am I going to have to resign that no case, mostly notably the 5s case docks with the case on?
    iMac (21.5-inch Mid 2011), Mac OS X (10.7.3), 2.5 Ghz Intel Core i5, 4GB DDR RAM

    You should be able to 'see' the BlackBerry memory in the Meida Manager, and you can transfer small files to the Content Store on the BlackBerry using the Media Manager. Just remember that you are using the base memory on the BlackBerry for media files and you shouldn't get too crazy with files transferred to it. 
    Try installing v4.2 Service Pack 2 and using the Media Manager and seeing if the BlackBerry device memory option shows up at the bottom of the screen. When you open the memory you should see some file folders and you should store the files directly into the file folder appropriate to the media, and not use folders inside the original folder so the BB will 'see' the files when you use your Profile options to select ringtones or background photos.   

  • Case statement with Subquery

    Case statement with Subquery
    select case when condition then
    i want to execute qr1
    else qr2
    How to implement this ?

    Hi,
    Welcoem to the forum!
    972471 wrote:
    Case statement with SubqueryHow does a sub-query, or a query, figure in this question?
    Be more specific. Post a complete script that you tried, and what output you expected from it. If you got an error, post the complete error message, including line numbers.
    See the forum FAQ {message:id=9360002}
    select case when condition then
    i want to execute qr1
    else qr2
    How to implement this ?Here's one way:
    BEGIN
        CASE
            WHEN  1 = 1
            THEN
                dbms_output.put_line ('Condition was TRUE');
            ELSE
                dbms_output.put_line ('Condition was FALSE or UNKNOWN');
        END CASE;
    END;
    /If the condition involves a query, then you may have to select the results into a variable first, and then use the variable in the CASE statement.

  • Case function with group by

    Hi,
      I am having a scenario like :
    Column 1:  BrokerList(dimension1)
    Column 2 : Broker(dimension2)
    Column 3 : Metric value(measure)
    so i am having a case when (dimension 3) Custodian = 'ss' then sum(metirc) group by dimension1,dimension2 but the result value is not matching
    BrokerList
    Broker
    Metric
    a1
    a
    10
    b
    20
    c
    30
    a1 :total
    60
    a2
    a
    50
    c
    60
    d
    10
    a2:total
    120
    Grand total
    180
    Here the metric is based on other case condition.. so the total value is not matching.. Is there any other way to do a case function with group by funtions. Please advise.
    regards,
    Guru

    Use filter on metric by ss value and then go for group by from Criteria
    something like
    sum(FILTER(metric USING (Custodian = 'ss')) by dimension1,dimension2)
    mark if helps
    ~ http://cool-bi.com

  • How to create a case in case management with QM02 link?

    Dear Gurus,
    I have to create a case in case management with link to t-code QM02. Any help would be appreciated.
    Thanks,
    GSM

    Hi..
    Easy transaction to Case Management customizing is SCASE_CUSTOMIZING. There you have an overview of the customizing of case management.
    Also carryon these steps one by one...
    Case Management Basic Settings :
    Define Number Range Intervals for Case
    Define Case Types
    Determine Permitted values for attribute
    Create values for "Category" attribute
    Create values for "Cause" attributes
    Create values for "Priority" attribute
    Create values for "Reason" for escalation attribute
    Assign escalation reasons to an attribute profile
    Create values for "Authorization level" attribute
    System Modifications
    Create status profile
    Create Text profile
    Create Text Ids
    Create Text Profile
    Define Logical system for external objects
    Enhanced System modifications
    Note About Enhanced System Modifications
    Define Processes
    Set up registry
    Create/Change Case Record Model
    Create Profiles
    Create attribute profile
    Create function profile
    Create terminology profile
    Create Activities for authorization check
    Activate application log
    Define processes
    Create/Change Case Record Model
    When u open the Transaction SCASE_CUSTOMIZING , there will be Registry Steps...
    Follow them step by step.
    Regards,
    Eswari.

  • IPod on iPhone is case sensitive with bandnames, iTunes is not

    Hi,
    The iPod application on the iPhone (software version 3.1) is case sensitive with bandnames, iTunes (9.0.1) is not.
    iPod on iPhone shows the bands
    "Guns n' Roses"
    and
    "Guns N' Roses"
    as separate bands.
    iTunes manages them as one band.
    Cheers,
    Philipp

    Both the root file-system and the /var file-system on the iPhone are case sensitive.
    I have no idea why. Curious thing for Apple to do.
    Must be a unix hacker there. They love case sensitive filesystems
    This is likely a cause of the problem.
    Best just to rename the offending artist and album fields.
    You can sort & filter them in iTunes and change a whole whack of them at once.

  • WLC With ASA as gateway

    Hi ALL,
    Has any one configured a WLC with ASA as the gateway, I have 3 interface 70, 80 and 90 ( 70 is the management vlan ) in the WLC, with all the gateway in the ASA. But I can ping only the gateway for vlan 70 from my wlc, none of the other gateway's are reachable.
    Let me know if any one have faced this issue before
    Thanks
    NikhiL

    Probably the other ASA interfaces are configured to be non pingable ? that's quite common.

  • Waas with asa

    we will deploy waas in branch with asa so we will make wccp redirect on asa as asa will terminate vpn with headoffice so we must use wccp on asa is there is any document of sample of configuration to configure wccp with asa

    hi,
    here is the link:
    http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/dhcp.html#wp1094445
    hope it will help

  • What is the rationale for naming a DVD in upper case letters with no space?

    I went "brain-dead" and named a DVD disk project (the name that appears on the computer desktop when the disk is inserted) using "regular" text, i.e., upper and lower case letters, with spaces between words. Could this result in any repercussions?
    Everything works; the DVD plays fine on my mac & pc + DVD players. If something could go wrong, I'll change the name to all caps and use underscores instead of spaces.
    Thanks for any input & advice.

    Because the Sonic authorcore in Encore has some problems with spaces, I have developed a habit of using the underscore. Now, when it comes ot all Caps, I have not observed an issue.
    Most recent Project had Caps and lowercase characters, and it played on all player that ai tested it on.
    Even my Assets lack spaces, but again, this is out of habit from doing hundreds of En Projects, so maybe I am being overly cautious?
    Good luck,
    Hunt

Maybe you are looking for

  • Sharing Libraries between users.

    Hey All Is it possible to share one iTunes library between multiple users on one computer? Spencer

  • Messages Mac default to sending by iMessage instead of SMS/MMS

    Is there a way to set Messages on my iMac (10.10.3) to send messages to a recipient using iMassage rather than SMS/MMS? I know my recipients have iPhones, but when I open messages and want to send them a message, Messages uses their "green" text mess

  • Messages disappearing in whole or part.

    Win 7, IE 11;   Many times when I am writing a message or leaving a note on a petition or just writing, the use of the back space or movement of the cursor or the simple deletion of a letter will cause  missing letters, portions of the message, or th

  • Replacing a picture turns the background black

    I am working on a project and when i replace a picture in the project the preview screen turns black but the time line has the changed picture. When exported the background is black and not the picture.

  • *Really confused* on how to install Vista 64 using BC

    OK, so I'm now proud owner of a "Harpertown" model Mac Pro Quad Core 2.8, and I want to install Windows Vista Ultimate x64 on it. I have read that you can definitiely install this Windows OS on this model of Mac. I have three components here – I've i