Netcfg: Multiple simultaneous vpn-connections
I need to connect to two vpn networks, and I am using netcfg. I can connect to both networks separately, but it does not work to have both networks up at the same time.
This is the configuration:
vpn1: 10.0.0.0/255.0.0.0 vpnc
vpn2: 10.0.0.0/255.0.0.0 pptp
There is of course a collision in the address space. These are my routing requirements:
default gateway should stay at the gw without VPNs.
All traffic to 10.0.0.0/255.0.0.0 should go to vpn1
Traffic to 10.1.2.3 and 10.5.6.7 should go to vpn2
I think I'll figure this routing out by myself, just mentioning it as it might be relevant context.
If vpn1 is up, and I do netcfg vpn2, vpn1 gets disabled before netcfg tries to connect to vpn2. And the other way around. There seems to be some 'exclusive'-flag set, but I have not been able to locate it from scrolling through /usr/bin/netcfg, /usr/lib/network/network and /usr/lib/network/globals. What have I missed? Any pointer would be much appreciated
joepvd wrote:
I need to connect to two vpn networks, and I am using netcfg. I can connect to both networks separately, but it does not work to have both networks up at the same time.
This is the configuration:
vpn1: 10.0.0.0/255.0.0.0 vpnc
vpn2: 10.0.0.0/255.0.0.0 pptp
There is of course a collision in the address space. These are my routing requirements:
default gateway should stay at the gw without VPNs.
All traffic to 10.0.0.0/255.0.0.0 should go to vpn1
Traffic to 10.1.2.3 and 10.5.6.7 should go to vpn2
You need to configure your VPN servers differently. You can not have conflicting subnets.
Also, PPTP is not secure. You should look into OpenVPN if you are in control of the VPN servers and have the authority to chose. OpenVPN is also much easier to configure. You simply add this to the end of the server config for vpn2.
push "route 10.1.2.3 255.255.255.255"
push "route 10.5.6.7 255.255.255.255"
Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2
DEFCON 19: Whitfield Diffie and Moxie Marlinspikeby
https://www.youtube.com/watch?v=sIidzPntdCM
Last edited by hunterthomson (2013-01-28 09:06:24)
Similar Messages
-
Multiple Simultaneous ODBC Connections
Running into a problem when trying to pull data from Oracle via the Merrant drivers. If two databases are building simultaneously and both need to connect to the same Oracle servers at the same time (or, if one database is loading data and a developer is building a data load rule that hits the same server) we get an error stating:SQL driver for [ODBC name] is in use and does not allow multiple connections.This is a problem not only as it slows development (waiting for one load to finish before building another load rule) but can prevent a successful automated build should one app still be loading data prior to the second app starting to load data.Is there a way to allow an Essbase server to connect multiple simultaneous connections to a data source, like Oracle?
joepvd wrote:
I need to connect to two vpn networks, and I am using netcfg. I can connect to both networks separately, but it does not work to have both networks up at the same time.
This is the configuration:
vpn1: 10.0.0.0/255.0.0.0 vpnc
vpn2: 10.0.0.0/255.0.0.0 pptp
There is of course a collision in the address space. These are my routing requirements:
default gateway should stay at the gw without VPNs.
All traffic to 10.0.0.0/255.0.0.0 should go to vpn1
Traffic to 10.1.2.3 and 10.5.6.7 should go to vpn2
You need to configure your VPN servers differently. You can not have conflicting subnets.
Also, PPTP is not secure. You should look into OpenVPN if you are in control of the VPN servers and have the authority to chose. OpenVPN is also much easier to configure. You simply add this to the end of the server config for vpn2.
push "route 10.1.2.3 255.255.255.255"
push "route 10.5.6.7 255.255.255.255"
Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2
DEFCON 19: Whitfield Diffie and Moxie Marlinspikeby
https://www.youtube.com/watch?v=sIidzPntdCM
Last edited by hunterthomson (2013-01-28 09:06:24) -
Cannot establish multiple simultaneous PPTP connections with the CISCO 1841.
Hello everyone;
I have recently tested a PPTP connection with a CISCO 1841 router and got success. I have configured a windows 7 client and successfully connected to the router and was able to access the documents in the server PC that I have mentioned in the attached diagram. I have created number of different users in the CISCO 1841 too. While some one is having a connection, another user cannot connect to it, which means multiple simultaneous connections aren't possible. Do I have to create a ACL for the PPTP and if yes, How ?
FastEthernet0/0 is up, line protocol is up
Internet address is 192.168.100.1/25
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is 100
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF Feature Fast switching turbo vector
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Policy routing is disabled
Network address translation is enabled, interface in domain inside
BGP Policy Mapping is disabled
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
Inbound inspection rule is SDM_LOW
--------------------------------------------------------------------------------------------ACL 100-----------------------------
deny icmp any any echo-reply
deny ip host 255.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 66.163.169.186 any
permit ip any any (122467027 matches)As long as you have the inspection engine enabled on the ASA, it shouldn't freak out of the different IP as it will inspect the call signalling and will NAT it accordingly, BUT, for simplicity, I agree with you, it would cause a lot of troubleshooting headache if there is problem as well as reconfiguration of IP on the host ends.
Here is the NAT FYI:
object network obj-10.10.96.0
subnet 10.10.96.0 255.255.255.0
object network obj-192.168.96.0
subnet 192.168.96.0 255.255.255.0
object network obj-10.10.14.0
subnet 10.10.14.0 255.255.255.0
object network obj-10.1.0.0
subnet 10.1.0.0 255.255.255.0
object network obj-192.168.1.0
subnet 192.168.1.0 255.255.255.0
object network obj-10.10.11.0
subnet 10.10.11.0 255.255.255.0
object network obj-192.168.11.0
subnet 192.168.11.0 255.255.255.0
nat (inside,outside) source static obj-10.10.96.0 obj-192.168.96.0 destination static obj-10.10.14.0 obj-10.10.14.0
nat (inside,outside) source static obj-10.1.0.0 obj-192.168.1.0 destination static obj-10.10.14.0 obj-10.10.14.0
nat (inside,outside) source static obj-10.10.11.0 obj-192.168.11.0 destination static obj-10.10.14.0 obj-10.10.14.0 -
I work for a healthcare consulting company, we have 50+ consultants that work remotely from their home. We currently are cloud managed and for various reasons are looking for a solution to streamline our connection to our Clinics' personal VPNs. Our Clinics' VPNs vary greatly in regards to vendor and type of connection.
What we want to do:
Create a Jumpoff where all our consultants (simultaneously as well) can remote VPN into. From there be able to jump out to any of our Clinics' VPNs.
We need this because we have some consultants with foreign IPs and we also want to connect from Google Chromebooks which don't play nice with every type of our Clinics' VPNs. So the our Jump Off Box will have all the needed connections for any type of VPNs our Clinics use.
This solution should connect to our Clinics' side from their default VPN settings - Just a regular VPN connection from us to them.
From what I have been told is that this was attempted in the past:
Consultants VPN'd to our cloud server - RDPd to a machine and then VPNd out to our clinics. However this locked down the VPN and only one consultant could jump out.
What Cisco Product would allow us to do so?
How would this be set up?
Do we set up the Router to handle outbound connections?
Any input would be greatly appreciated.Hi Jay, there are a number of ways you can do this I can help you setup an initial recommendation on what products to get please send me an email at [email protected] hope to hear from you soon!
-
Which units support multiple inbound L2TP VPN connections?
Hello. I have a Mac OS X Server that I want to use as a L2TP VPN server for my remote Mac clients. Are there any Linksys routers that support multiple inbound L2TP connections? (The remote clients are 1 person per one location, so there won't be a problem with multiple outbound VPN clients where they are.)
Thanks
DavidMessage Edited by dmcheng on 09-14-2006 01:38 PM
Solved!
Go to Solution.The WRV200 supports 50 tunnels.The BEFVP41 supports 70 tunnels .Even the RV series is good So you have a lot of choices here.
-
Multiple VPN connection question
I want to connect two on-premise locations to azure. The hardware in these locations only support static routing so per the documentation I can only connect on site to site tunnel to the vpn connection in azure.
Im curious what my options are, can I add two vpn's in azure and make it all work that way? Also if I wanted could I simply run a VM (windows rras, linux, etc) inside my VNET and make it a VPN server that can accept two tunnels?
thanksHi Chris,
Please be advised that for a Multi-Site VPN, you need to have a VPN Device that is compatible with Dynamic Routing.
You could refer the following link for details about Multi-Site VPN:
http://msdn.microsoft.com/en-us/library/azure/dn690124.aspx
And the following link for the list of Azure Compatible VPN Devices and the Routing Configurations they support:
http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx#bkmk_VPN_Devics
Also, please be advised Microsoft Azure Virtual Machines do not support Remote Access and Routing Roles.
You could refer the following link for details:
http://support.microsoft.com/kb/2721672
Regards,Malar. -
Dual Simultaneous Site to Site VPN connections
My goal is to have an 891 router at a branch office with two, always active VPN tunnels where the routing would switch to the secondary tunnel within the 891. On the Hub side there would be two ISPs connected into the same MPLS cloud which has internet access. Is this possible? Which device should I terminate the VPNs on. Typically used ASAs in the past.
Remote Site
I
891
I
Cable/DSL
I
MPLS
I
ISP1 ISP2
I I
R1 R2
I |
ASA ASA
I I
Core SW1 SW2 Core
Server
To take it even further I would like to configure the branch office with two ISPs but have a VPN connection over both.HI ,
As far I know, you cant create two IPSec VPN tunnel from same source to same destination in single router. For this you may can consider DMVPN but ASA doesnt support this yet. You would typically need a ISR router to do this. -
Is there a limit to the number of concurrent L2TP/IPSec VPN connections in Snow Leopard
Hi,
I'm currently running an L2TP/IPSec service from a Snow Leopard server VM running on the latest version of Lion Server ( Had loads of issues with Lion VPN connectivity from outside our network when I first upgraded the physical server to Lion. quickest way to get the service back was to run an S/L VM. I know that there have been some changes to Lion in the VPN area, but this works... sort of;;;)
I've got an IP address pool of 20 addresses confgured as this is only for ICT staff members. Each user has a local userid/password on the S/L server. For me, things just work.
iPhone, iPad, OS X lion client they all work and I've had about 3 simultaneous connections up and running.However, the majority of staff users use Windows 7 client machines and they're been reporting sporadic connection failures where one moment they can get connected and the next they can't. I'm currently wondring if there is some concurrent limit setting they are hitting and are getting slung off because I've got other users using the service. It would be a bit strange if S/L can only support 2 or 3 connections out of the box.
Then again it might be VMWare Fusion (Vsn 4.1.1) thats the problem.
Any help apppreciated
Rgds
AlexYou have to count to have about 30GB at least free on the startup disk, after you have the library loaded.
On the external you have space enough.
As far as I know there is no limit for iPhoto, but I suggest to not let it grow too much, because everything will become sluggish, also making backups. It should be possible to split up in more libraries, one that is really actual and one that is the past. Physical splitting up I mean, not smart collections. You can switch libraries by holding the Alt(option) at startup of iPhoto. -
I have an issue with the Cisco 4.01 VPN client connecting more then one connection.
I have it set to connect to the remote sight using the following parameters
Group Authentication
Transparent Tunneling with IPSec over UDP (Nat / Pat)
I have also selected allow local LAN access
I am connecting to the remote network through a Sonicwall firewall to the remote Cisco device.
I have no problem getting connected to the remote network. All connection attempts work.
If I have a VPN connection connected and active the next connection that is made disconnects the first one. This is repeatable and constant. So each connection is successful but it always disconnects any session that is active from that location.
Multiple sessions are possible as long as they dont originate from the one site. In other words workers working from home do not affect workers working from the main office.
Any Ideas as to what may be causing this?just wondering what sort of cisco device we are discussing here.
the issue maybe related to the vpn client pool.
e.g. the pool should start with x.x.x.1, not an entire subnet. -
Branch Office DC Demand Dial VPN connection keeps failing
here is me issue
Our Branch Office DC is connected to Main Office DC with a Demand Dial Connection in RRAS Everything is connected fine for a little bit then its like the connection just gives out, it stays connected but i cannot ping the branch office DC with the local
IP from the Main Office or access any network shares on it. When this happens i have to disconnect the server at the remote office and wait for it to reconnect im currently baffled as there are no Error LOGS to help me along and there doesnt seem to be anything
that would be causing the issue for now until i get some answers as to what is going on i opened a command prompt on the DC here at the main office and i typed "ping 10.141.70.25 -t100" to monitor the connection more or less and when i see it timeout
i reconnect it, i also have the networking tab open in task manager to monitor the LAN and RAS (Dial-In) Interface the LAN doesnt seem too active but the RAS Interface does its got a constant network utilization of 0.28% and the Demand Dial interface
on the remote office DC has a Utilization of 0.38% (Server Just disconnected as i was typing this and the utilization on the VPN connections on both servers went through the roof) heres the troubleshooting i have tried so far
1. Rebooted both office DC`s at the same time
2. Rebooted the branch office DC alone (this helped a little because the connection is staying active longer without fail)
3. looked through all RRAS configuration on both servers to see if theres any mistakes by any other administrators (None Were Found)
4. Used wireshark to see if there was anything interfering or that would cause this to happen (Nothing found)
5. manually connected to the server in multiple ways like accessing network shares and remote management via MMC and manually making the servers replicate to see if any of that was causing issues and it wasnt
My thoughts: im starting to think it may be a switch or something causing the connection issue at the branch office because the main office has all new routers and switches and just recently got a 100.00MBPS connection but nothing was affected for a good
month so im not thinking it is the new connection or anything at the main office if theres something im overlooking here please let me know if some ipconfig /all results are needed i can provide them
Viper Technologies Computer Repair Putting The Venomus Bite Back In Your Computer We Are Located In Antigonish ,NS Canada Check Us Out HTTP://WWW.VIPERTECHNOLOGIES.TKHi,
Are there any error messages on the event log ?
Meanwhile, it is more network issue, i think you may ask in network forums:
http://social.technet.microsoft.com/Forums/en-US/home?forum=winserverNIS
Regards.
Vivian Wang -
IPad2, Verizon 3G, VPN Connectivity Issues
Greetings all. I am the systems administrator for my corporation and have seen an issue that I wish to present to the community for discussion.
For those enterprise users that have an iPad2 with Verizons 3G, are you experiencing connectivity issues while trying to connect to your VPNs from the 3G network? If so, have you found any work around to allow connectivity or does it work fine for you?
Here's a summary of my issues:
We have a VPN server built on Debian Linux that has been in operation for over four years. It handles remote VPN connections from Windows, Linux, Android, OS X, iOS, and from many different devices including multiple flavors of Apple products (iMacs, Minis, MacBooks, iPads, etc.). To date, it has performed flawlessly with assorted devices connecting to it through broadband and assorted 3G networks.
Recently I purchased an iPad2 with Verizon 3G. I was able to set up the VPN connection using PPTP and connect using a Wi-Fi connection. When I turned off the Wi-Fi and attempted the same connection via Verizon 3G, it fails. I then took an associates iPad1 using AT&T 3G, set up the same connection, and was able to connect. I don't have access to an iPad2 on AT&T 3G so, I can't speak for that.
Here's the logs from the VPN server while connecting from my iPad2:
Wi-Fi
Jul 27 05:20:43 localhost pppd[31694]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Jul 27 05:20:43 localhost pppd[31694]: pptpd-logwtmp: $Version$
Jul 27 05:20:43 localhost pppd[31694]: pppd 2.4.4 started by root, uid 0
Jul 27 05:20:43 localhost pppd[31694]: Using interface ppp2
Jul 27 05:20:43 localhost pppd[31694]: Connect: ppp2 <--> /dev/pts/4
Jul 27 05:20:46 localhost pppd[31694]: Unsupported protocol 'IPv6 Control Protocol' (0x8057) received
Jul 27 05:20:46 localhost pppd[31694]: found interface eth1 for proxy arp
Jul 27 05:20:46 localhost pppd[31694]: local IP address 192.168.1.69
Jul 27 05:20:46 localhost pppd[31694]: remote IP address 192.168.1.82
Jul 27 05:20:46 localhost pppd[31694]: pptpd-logwtmp.so ip-up ppp2 scott XXX.XXX.XXX.XXX (removed external IP for security reasons)
Quick connect, able to utilize VPN connection normally. No issues.
Verizon 3G
Jul 27 05:20:29 localhost pppd[31682]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Jul 27 05:20:29 localhost pppd[31682]: pptpd-logwtmp: $Version$
Jul 27 05:20:29 localhost pppd[31682]: pppd 2.4.4 started by root, uid 0
Jul 27 05:20:29 localhost pppd[31682]: Using interface ppp2
Jul 27 05:20:29 localhost pppd[31682]: Connect: ppp2 <--> /dev/pts/4
Jul 27 05:20:32 localhost pppd[31682]: peer refused to authenticate: terminating link
Jul 27 05:20:33 localhost pppd[31682]: Connection terminated.
Jul 27 05:20:33 localhost pppd[31682]: Exit.
As you can see, the peer refuses to authenticate causing the link to be terminated while attempting to connect using Verizons network. This is with the same VPN connection settings on the iPad2 that just worked with WiFi connection from the same device.
Here's what I can verify with regards to 3G networks:
Older (<4) iPhones and iPad1 using AT&T can connect
Windows and OS X based laptops using Sprint 3G can connect
Android based smart phones using Sprint 3G can connect
I have not called Verizon or Apple Support yet but, that's next when I have the time. My initial conclusion is that there is something with Verizons 3G services that is causing the issue. It may be that Verizon is using some sort of data compression process that is problematic with VPN transmission. While the log shows an unsupported IPv6 protocol when connecting via Wi-Fi, it still negotiates a successful connection and I don't think that's the root cause for the disconnect. Thoughts?Hi Alexander,
I am running in to the exact same issue (although not with Linux). Did you ever find a fix for this? I have some support tickets open with my VAR's, but found your post and thought I would check. If I find anything I will post.
Thanks
Stu -
how to handle multiple site to site IPsec vpn on ASA, any best practice to to manage multiple ipsec vpn configurations
before ver 8.3 and after version 8.3 ...8.4.. 9 versions..Hi,
To my understanding you should be able to attach the same cryptomap to the other "outside" interface or perhaps alternatively create a new crypto map that you attach only to your new "outside" interface.
Also I think you will probably need to route the remote peer ip of the VPN connection towards the gateway IP address of that new "outside" and also the remote network found behind the VPN connection.
If you attempt to use VPN Client connection instead of L2L VPN connection with the new "outside" interface then you will run into routing problems as naturally you can have 2 default routes active at the sametime (default route would be required on the new "outside" interface if VPN Client was used since you DONT KNOW where the VPN Clients are connecting to your ASA)
Hope this helps
- Jouni -
Two active active ISPs with load balancing, publishing and VPN connection
Hi,
I wonder how to enable a scenario where i have to use two ISP's to share 30/70 load on our internet traffic, have to configure almost 60 internal websites already published using microsoft TMG firewall and connect client VPN connections and site-to-site vpn connections. I know that ASA firewall has limitation when using security contexts. Is good idea that how to achieve this gool?
I previously tried connecting four sites running ASA devices with this fifth site running Microsoft TMG firewall but i was able to connect only two ASA firewalls using site-to-site VPN, though I was able to connect remaining two as well but last two were not able to access ASA-TMG resources. furthermore behavious of two ASA-TMG connected sites was strange: sometime i was not able to access cross site resources from one machine but was able to do so from another machine.
I noticed that two of ASA sites connected with TMG site has different internal IP class (e.g site one 192.168.0.* and site two using 172.16.*.*) while remaining two have same class like the first site e.g 192.168.128.* and 192.168.100.*
Did anyone has experiance connecting TMG-ASA with multiple sites within same IP class scenario?
OR
How to enable same features using Cisco devices as they are on a single Microsoft TMG?
Best,
Saulat (Contact# 0092-321-4025587)Sulat,
You can load balance between the two ISPs. That is not possible. But, we do have some options that I have discussed here:
Hope the above link gives you some ideas to utilize both your ISP links.
-Kureli -
Certificate error when Lync client login through VPN connection
Hello,
I am using the certificates from internal cert authority on Lync 2013 frontend servers and on edge server internal network. Edge external is using a third part certificate.
The users always use MS VPN connection when work remotely. We have multiple subnets in the company so "use default gateway on remote network" is enabled for routing.
When the users try to log in Lync client from non-domain joined computers while on VPN, they can't log in and get certificate error. It is hard to import the internal certificate on the computers.
What change do I need to do to the Lync certificates? ThanksYou have a few options:
1) You could attempt to hardcode the client so that it always connects through the edge. This can be done through tools->options->personal->advanced->manual configuration (but you may have to hardcode the FQDN in your hosts file so it doesn't
attempt to resolve via internal DNS). This may not work since your firewall may not be too happy with "internal" traffic leaving and coming back through the edge.
2) Write a script that helps automate the certificate installation and try to walk users through it.
3) Bite the bullet and use a third party certificate on the internal servers.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications -
Windows 2008 R2 TS VPN connection closed when another user logs in
Hi.
I have a W 2008 R2 Ent. server with TS
I have VPN on the TS configured with a L2TP/Ipsec connection to connect to a customer site
Users will remote into the server, and make a VPN connection (click on shortcut to start VPN) and access the customer's site. This has worked OK for 2 years often with several users logged into the TS via RDP.
Recently users are encountering this problem: User A logs into the TS, makes VPN connection, accesses customer site. User B logs into the TS, user A's VPN connection is broken immediately. It seems to happen every time - not sporadic.
Can I get some suggestions on how to troubleshoot this?
Thanks!Hi,
The error which you are facing is because of Event Id 20226 (RAS connection termination).
Error 831 (ERROR_FAST_USER_SWITCH)
The connection was terminated because user switch happened.
There are multiple login sessions on the user's computer. The user switched from a login session with an active RAS connection to another session. This resulted in the termination of the connection.
For this you can check that you can limit the connection and tried to switch back the original session and make all new connection again. Please refer “Event ID
20226 — RAS Connection Termination” for more details.
Hope it helps!
Thanks.
Maybe you are looking for
-
IMovie 5.0 doesn't save project folder
I installed iLife 5.0 and it worked fine. Then I installed Tiger. Now iMovie no longer saves a folder containing audio and media folders but only saves the project title icon with a star. When I work with the project all the stills end up in the tras
-
Hi there, After i have installed the mavericks update for my macbook pro, i had started having a problem in closing my apps or browser or files with the red X button, When i click on the button to close my apps it doesnt work at all unless i drag the
-
Just downloaded Photoshop and there was a pop up box that mentioned my RAM and something about not enough RAM left for certain 3D features, filters, and image/color graphics(?). I continued. Everything was working fine the first time I went to use it
-
Cropping doesn't work in iOS 8 Photos
Whenever I try to crop a picture in Photos and tap done, it zooms in to one area and crops out the rest, totally unlike the one previewed. How to fix it?
-
LOAD_PROGRAM_NOT_FOUND when calling transaction in ECC6 from CRM3.0
Hi Very new to CRM so would appreciate any assistance here. We have a CRM 3.0 system and have recently replaced the old 4.7 R3 system with ECC6 The ECC6 system has a different logical system name to the old 4.7 system. We have created a new RFC des