No VPN even with a Default Host?
I've tried this with 7.2, 7.2.1 and 7.3.1 all with no luck.
So the only way too get my VPN working is with default hosts, so I enable default hosts. I assign my MAC that IP address and STILL can't connect. My understanding was once I used the default host, everything should be allowed through to that address.
What am I doing wrong? What relevant info am I not considering?
The strangest thing is that the VPN using the Default Host works fine with my older Airport Express.
Hi,
I'll second the opinion above. I'm sure the AEBS is great for something -- remote playback of iTunes and the Draft-N for playing videos? For me it is a nice paperweight. I've never been able to get the network USB port or VPN pass-through on the AEBS to work reliably, if at all.
I've worked with D-Link, Linksys, Netgear, Lucent, SMC, and Cisco wireless routers and had many fewer headaches than the AEBS hassles. Having to use the configuration utility on the AEBS really gets my goat. The SNMP-only management is OK if you're a Fortune 100 company with 1000 routers that have to be identical, but an annoyance for small office and home users. If the AEBS were targeting the Fortune 100, then power-over-ethernet wouldn't be an almost secret special order option.
I'd be willing to cut some slack, but the AEBS is expensive, it isn't Apple's first router product, and there's been over a year that basic serious bugs have persisted.
The best bet if you want to use GRE or PPTP passing through the AEBS is to assign static Internet-routable addresses or have a DHCP server on the LAN side of the AEBS. Set the AEBS to bridge mode to allow the block of addresses your LAN client machines will be using. If you enable NAT/PAT on the AEBS, it won't work. I haven't tried it yet, but it sounds like VPN won't pass through even in bridge mode in 7.3.1
Bill
Similar Messages
-
Critical error with default host
Hi,
I am relatively new to Web Logic and think I have made an error within the Web Logic Console with the default host parameter. As a result, I can no longer start up my WLS.
Is there a way I can edit this parameter outside of the Web Logic Console?
The error from the logs is below:
####<01-May-2012 12:22:30 o'clock BST> <Critical> <WebLogicServer> <AOKEEFF-GB> <AdminServer> <main> <<WLS Kernel>> <> <> <1335871350199> <BEA-000362> <Server failed. Reason:
There are 1 nested errors:
java.net.UnknownHostException: http://127.0.0.1
at java.net.Inet6AddressImpl.lookupAllHostAddr(Native Method)
at java.net.InetAddress$1.lookupAllHostAddr(InetAddress.java:850)
at java.net.InetAddress.getAddressFromNameService(InetAddress.java:1201)
at java.net.InetAddress.getAllByName0(InetAddress.java:1154)
at java.net.InetAddress.getAllByName(InetAddress.java:1084)
at java.net.InetAddress.getAllByName(InetAddress.java:1020)
at java.net.InetAddress.getByName(InetAddress.java:970)
at weblogic.rjvm.JVMID.setLocalID(JVMID.java:238)
at weblogic.rjvm.RJVMService.setJVMID(RJVMService.java:48)
at weblogic.rjvm.RJVMService.start(RJVMService.java:30)
at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
ThanksAlong the lines that Fabian suggested, this is what you can do now.
Create a new domain and compare the config.xml of that new domain with the existing one you have issues with. This should give you the an indication of the changes that need to be reverted from the existing config.xml.
And as already suggested, always take a back of the config.xml before you make any changes. :)
Thanks,
Patrick -
Default Host (DMZ) and Port Mapping together
Hi all,
I have the G5 set as a default host for all my web services through the Airport Extreme.
In the Airport Extreme's Port Mapping tab, a user is not prevented from using the port mapping tab even when the Default host is set. I want to serve video through another port not on the G5.
Does this mean I can set up port mapping for ports I do not want to go to the default host? (my G5 in this case)
I asked this on the airport forum and never got an answer, maybe you G5 folks might know. (Or maybe there is a setting that will redirect from the G5.)
Thanks in advance,
JamyI figured it out. I can't have a DMZ and separately port mapping on the Airport.
-
Dangers of setting a default host? (or help getting on to a remote VPN)
Here is my situation. I have a laptop from work that I need to be able to connect to my company's VPN in order to work. I am not supposed to change the laptop from DHCP so it just gets an IP when I logon to my home network. It appears that I can't connect to my VPN with all the default settings of my AEBS. If I add the IP my laptop gets from my router I can connect. But this requires me to leave a DHCP IP address in this field all the time or constantly having to toggle this feature (which seems to require a router restart to take effect). Is this a major security hole? Also, when it says all internet traffic goes through the default host, does that mean if someone else is surfing the web in my house all the packets go through my laptop first?
Is there a better way to connect to the VPN? Is there someway I can open up the ports easier? Any suggestions?If I add the IP my laptop gets from my router I can connect.
Add it to what?
Is this a major security hole?
It is hard to know since it isn't clear what you are doing.
Also, when it says all internet traffic goes through the default host, does that mean if someone else is surfing the web in my house all the packets go through my laptop first?
When you are using default host, any requests from the internet are directed to the machine defined as the default host.
If someone on your network is accessing the internet, packets for that machine do not go through the default host. -
I have made a website using iweb, as this will no longer be supported by apple, does that mean the gallery I have created on my website will no longer work even though I am hosting it with a different hosting provider. Will the other widgets no longer work?
There are a few things that won't work on other hosting sites; hit counters and pop-up slide shows for sure.
See http://oldtoadstutorials.net/No.iW11.html for more info, and/or the iWeb forum at https://discussions.apple.com/community/ilife/iweb -
Hi,
I am experiencing Popup ads even with popups blocked in preferences and always on initial opening of FF Browser when clicking anywhere on any website?
Is there a fix, a plugin to disable or is this a Firefox default feature or is this related to something else?
I use FF 11.0 on a Mac OS X 10.6.8
Can you help?
Thank you for your support and understanding.
Kind Regards
- Leslie Banks -Hi Swarnava,
Thanks for the reply and add block link. I have used this before but this is a completely different problem that I am experiencing.
I have a suspicion that I have something on the computer that has control.
The advert popups are always for Mac Cleaner.
Any other suggestions?
Thanks for your help and support.
Best Regards
- Leslie Banks -
http://www.gotrendme.com -
AFP to a default host in AEBS (and other problems with F/W 7.1.x)
Hi all -
I have a AEBS version N connecting a workgroup of several Macbooks and a Mac Mini acting as a app server/file server. This workgroup is connecting to the internet via the AEBS running WPA.
Due to the network configutation, I have 1 publically routable IP address (200.13.99.x), which the Mini needs in order to allow "outsiders" access to a database app. The other laptops can share a NAT address for normal email, web browsing etc.
After several attempts, I found the best solution was to set the AEBS Ethernet WAN manually to the public IP address (200.13.99.x), and set connection sharing to share a public IP address. Then using DHCP and NAT options, I fix and specify the MAC address of the Mini (10.0.1.2), and get the AEBS to enable a default host to be the public IP address (200.13.99.x -> 10.0.1.2).
So far, so good. To recap, the AEBS has the public IP address (everthing else has a DHCP 10.0.1.x address). When outside users need to connect to the database on the Mini, they use the same public IP that the AEBS has. It works perfectly.
NOTE: This ONLY WORKS WITH FIRMWARE 7.0. F/W 7.1 & 7.1.1 FAIL and do not allow any connections in this configuration.
My question is this: How do I enable people to connect to the Mini and mount the filesystem remotely?
If someone goes to Finder, Go, Connect to Server, then input the public IP (200.13.99.x), they attempt to mount the AEBS (which does not have any disks). How do I disable disk sharing on the AEBS and forward all AFP (disk mount) requests to the Mini (acting as Default Host)? I have attempted to Port Map Personal File Sharing, but when attempting to mount 200.13.99.x I still see the AEBS.
The fallback plan is to buy an external disk for the AEBS, but it would be nice not to have that expense.
Any thoughts appreciated!
Regards,
Charles
===
Footnote: I have also seen a lack of stability in F/W 7.1.1. In addition to the above, I was having to restart the AEBS every week or so, and was also getting peridic connection problems to the Internet. F/W 7.0 seems fine. Hopefully these issues will be address in the next F/W release.Hi Robby
I don't know if you solved your 'register now' problem concerning LE7 & LE8. I suspect the error your making is trying to open up each project in it's initial program - i.e. 7 or 8. The computer sees it differently (concerning Library settings etc) and your problem will be solved (hopefully) if you open up things in the right order :
1° Open Logic EX 8.
2° Then open the old project from LE 7. This should then open in your new system of LE8.
Of course if you wish to keep working on LE7 projects in LE7 then you'll have to change between each system as you go. You should remember that in terms of programs (with the same 'name/directory') that a computer works much like a tightly packed garage - if you wish to get out your old bike you'll have to move the new one first and vice versa!!
Normally you won't be asked to register again, BUT ... remember that you have to decide if you're going to save in 8 (and so keep working in that format) or not and I imagine if you've bought an update this is certainly your idea. Of course if you now decide to close LE8 and then start clicking on files in LE7 you'll be back at square one ..... register now etc. Please also remember that LE7 projects can work in LE8 but not the other way round, so once you've opened a LE7 project and made adjustments using LE8 you can't reuse 7 - I suggest you back up all your LE7 first on external/DVD support for later/backwards adjustments or reference.
Another small point to remember is that your computer will now be saving your project a second time in a LE8 format. So at some point you should remember that you'll be using valuable HD space twice over if you just convert and save in the new format - if you see what I mean?! -
Site to Site VPN Problems With 2801 Router and ASA 5505
Hello,
I am having some issue setting up a site to site ipsec VPN between a Cisco 2801 router and a Cisco ASA 5505. I was told there was a vpn previously setup with an old hosting provider, but those connections have been servered. Right now I am trying to get the sites to talk to the 2801. Here ere are my current configs, please let me know if you need anything else. Im stumped on this one. Thanks.
IP scheme at SIte A:
IP 172.19.3.x
sub 255.255.255.128
GW 172.19.3.129
Site A Ciscso 2801 Router
Current configuration : 11858 bytes
version 12.4
service timestamps debug datetime localtime
service timestamps log datetime localtime show-timezone
service password-encryption
hostname router-2801
boot-start-marker
boot-end-marker
logging message-counter syslog
logging buffered 4096
aaa new-model
aaa authentication login userauthen group radius local
aaa authorization network groupauthor local
aaa session-id common
clock timezone est -5
clock summer-time zone recurring last Sun Mar 2:00 1 Sun Nov 2:00
dot11 syslog
ip source-route
ip dhcp excluded-address 172.19.3.129 172.19.3.149
ip dhcp excluded-address 172.19.10.1 172.19.10.253
ip dhcp excluded-address 172.19.3.140
ip dhcp ping timeout 900
ip dhcp pool DHCP
network 172.19.3.128 255.255.255.128
default-router 172.19.3.129
domain-name domain.local
netbios-name-server 172.19.3.7
option 66 ascii 172.19.3.225
dns-server 172.19.3.140 208.67.220.220 208.67.222.222
ip dhcp pool VoiceDHCP
network 172.19.10.0 255.255.255.0
default-router 172.19.10.1
dns-server 208.67.220.220 8.8.8.8
option 66 ascii 172.19.10.2
lease 2
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW netshow
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
no ip domain lookup
ip domain name domain.local
multilink bundle-name authenticated
key chain key1
key 1
key-string 7 06040033484B1B484557
crypto pki trustpoint TP-self-signed-3448656681
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3448bb6681
revocation-check none
rsakeypair TP-self-signed-344bbb56681
crypto pki certificate chain TP-self-signed-3448656681
certificate self-signed 01
3082024F
quit
username admin privilege 15 password 7 F55
archive
log config
hidekeys
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key XXXXX address 209.118.0.1
crypto isakmp key xxxxx address SITE B Public IP
crypto isakmp keepalive 40 5
crypto isakmp nat keepalive 20
crypto isakmp client configuration group IISVPN
key 1nsur3m3
dns 172.19.3.140
wins 172.19.3.140
domain domain.local
pool VPN_Pool
acl 198
crypto isakmp profile IISVPNClient
description VPN clients profile
match identity group IISVPN
client authentication list userauthen
isakmp authorization list groupauthor
client configuration address respond
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map Dynamic 5
set transform-set myset
set isakmp-profile IISVPNClient
qos pre-classify
crypto map VPN 10 ipsec-isakmp
set peer 209.118.0.1
set peer SITE B Public IP
set transform-set myset
match address 101
qos pre-classify
crypto map VPN 65535 ipsec-isakmp dynamic Dynamic
track 123 ip sla 1 reachability
delay down 15 up 10
class-map match-any VoiceTraffic
match protocol rtp audio
match protocol h323
match protocol rtcp
match access-group name VOIP
match protocol sip
class-map match-any RDP
match access-group 199
policy-map QOS
class VoiceTraffic
bandwidth 512
class RDP
bandwidth 768
policy-map MainQOS
class class-default
shape average 1500000
service-policy QOS
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$$FW_INSIDE$
ip address 172.19.3.129 255.255.255.128
ip access-group 100 in
ip inspect SDM_LOW in
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
interface FastEthernet0/0.10
description $ETH-VoiceVLAN$$
encapsulation dot1Q 10
ip address 172.19.10.1 255.255.255.0
ip inspect SDM_LOW in
ip nat inside
ip virtual-reassembly
interface FastEthernet0/1
description "Comcast"
ip address PUB IP 255.255.255.248
ip access-group 102 in
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map VPN
interface Serial0/1/0
description "Verizon LEC Circuit ID: w0w13908 Site ID: U276420-1"
bandwidth 1536
no ip address
encapsulation frame-relay IETF
frame-relay lmi-type ansi
interface Serial0/1/0.1 point-to-point
bandwidth 1536
ip address 152.000.000.18 255.255.255.252
ip access-group 102 in
ip verify unicast reverse-path
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
frame-relay interface-dlci 500 IETF
crypto map VPN
service-policy output MainQOS
interface Serial0/2/0
description "PAETEC 46.HCGS.788446.CV (Verizon ID) / 46.HCGS.3 (PAETEC ID)"
ip address 123.252.123.102 255.255.255.252
ip access-group 102 in
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
encapsulation ppp
crypto map VPN
service-policy output MainQOS
ip local pool VPN_Pool 172.20.3.130 172.20.3.254
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 50.00.000.110 track 123
ip route 0.0.0.0 0.0.0.0 111.252.237.000 254
ip route 122.112.197.20 255.255.255.255 209.252.237.101
ip route 208.67.220.220 255.255.255.255 50.78.233.110
no ip http server
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-top-talkers
top 20
sort-by bytes
ip nat inside source route-map COMCAST interface FastEthernet0/1 overload
ip nat inside source route-map PAETEC interface Serial0/2/0 overload
ip nat inside source route-map VERIZON interface Serial0/1/0.1 overload
ip nat inside source static tcp 172.19.3.140 21 PUB IP 21 extendable
ip access-list extended VOIP
permit ip 172.20.3.0 0.0.0.127 host 172.19.3.190
permit ip host 172.19.3.190 172.20.3.0 0.0.0.127
ip radius source-interface FastEthernet0/0
ip sla 1
icmp-echo 000.67.220.220 source-interface FastEthernet0/1
timeout 10000
frequency 15
ip sla schedule 1 life forever start-time now
access-list 23 permit 172.19.3.0 0.0.0.127
access-list 23 permit 172.19.3.128 0.0.0.127
access-list 23 permit 173.189.251.192 0.0.0.63
access-list 23 permit 107.0.197.0 0.0.0.63
access-list 23 permit 173.163.157.32 0.0.0.15
access-list 23 permit 72.55.33.0 0.0.0.255
access-list 23 permit 172.19.5.0 0.0.0.63
access-list 100 remark "Outgoing Traffic"
access-list 100 deny ip 67.128.87.156 0.0.0.3 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit tcp host 172.19.3.190 any eq smtp
access-list 100 permit tcp host 172.19.3.137 any eq smtp
access-list 100 permit tcp any host 66.251.35.131 eq smtp
access-list 100 permit tcp any host 173.201.193.101 eq smtp
access-list 100 permit ip any any
access-list 100 permit tcp any any eq ftp
access-list 101 remark "Interesting VPN Traffic"
access-list 101 permit ip 172.19.3.128 0.0.0.127 172.19.3.0 0.0.0.127
access-list 101 permit ip 172.20.3.128 0.0.0.127 172.19.3.0 0.0.0.127
access-list 101 permit ip 172.19.3.128 0.0.0.127 host 172.19.250.10
access-list 101 permit ip 172.19.3.128 0.0.0.127 host 172.19.250.11
access-list 101 permit tcp any any eq ftp
access-list 101 permit tcp any any eq ftp-data
access-list 102 remark "Inbound Access"
access-list 102 permit udp any host 152.179.53.18 eq non500-isakmp
access-list 102 permit udp any host 152.179.53.18 eq isakmp
access-list 102 permit esp any host 152.179.53.18
access-list 102 permit ahp any host 152.179.53.18
access-list 102 permit udp any host 209.000.000.102 eq non500-isakmp
access-list 102 permit udp any host 209.000.000.102 eq isakmp
access-list 102 permit esp any host 209.000.000.102
access-list 102 permit ahp any host 209.000.000.102
access-list 102 permit udp any host PUB IP eq non500-isakmp
access-list 102 permit udp any host PUB IP eq isakmp
access-list 102 permit esp any host PUB IP
access-list 102 permit ahp any host PUB IP
access-list 102 permit ip 72.55.33.0 0.0.0.255 any
access-list 102 permit ip 107.0.197.0 0.0.0.63 any
access-list 102 deny ip 172.19.3.128 0.0.0.127 any
access-list 102 permit icmp any any echo-reply
access-list 102 permit icmp any any time-exceeded
access-list 102 permit icmp any any unreachable
access-list 102 permit icmp any any
access-list 102 deny ip any any log
access-list 102 permit tcp any host 172.19.3.140 eq ftp
access-list 102 permit tcp any host 172.19.3.140 eq ftp-data established
access-list 102 permit udp any host SITE B Public IP eq non500-isakmp
access-list 102 permit udp any host SITE B Public IP eq isakmp
access-list 102 permit esp any host SITE B Public IP
access-list 102 permit ahp any host SITE B Public IP
access-list 110 remark "Outbound NAT Rule"
access-list 110 remark "Deny VPN Traffic NAT"
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.19.3.0 0.0.0.127
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.19.10.0 0.0.0.255
access-list 110 deny ip 172.19.10.0 0.0.0.255 172.19.3.128 0.0.0.127
access-list 110 deny ip 172.20.3.128 0.0.0.127 172.19.3.0 0.0.0.127
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
access-list 110 deny ip 172.19.3.128 0.0.0.127 host 172.19.250.11
access-list 110 deny ip 172.19.3.128 0.0.0.127 host 172.19.250.10
access-list 110 permit ip 172.19.3.128 0.0.0.127 any
access-list 110 permit ip 172.19.10.0 0.0.0.255 any
access-list 198 remark "Networks for IISVPN Client"
access-list 198 permit ip 172.19.3.0 0.0.0.127 172.20.3.128 0.0.0.127
access-list 198 permit ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
access-list 199 permit tcp any any eq 3389
route-map PAETEC permit 10
match ip address 110
match interface Serial0/2/0
route-map COMCAST permit 10
match ip address 110
match interface FastEthernet0/1
route-map VERIZON permit 10
match ip address 110
match interface Serial0/1/0.1
snmp-server community 123 RO
radius-server host 172.19.3.7 auth-port 1645 acct-port 1646 key 7 000000000000000
control-plane
line con 0
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
transport input telnet ssh
scheduler allocate 20000 1000
ntp server 128.118.25.3
ntp server 217.150.242.8
end
IP scheme at site B:
ip 172.19.5.x
sub 255.255.255.292
gw 172.19.5.65
Cisco ASA 5505 at Site B
ASA Version 8.2(5)
hostname ASA5505
domain-name domain.com
enable password b04DSH2HQqXwS8wi encrypted
passwd b04DSH2HQqXwS8wi encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 172.19.5.65 255.255.255.192
interface Vlan2
nameif outside
security-level 0
ip address SITE B public IP 255.255.255.224
boot system disk0:/asa825-k8.bin
ftp mode passive
clock timezone est -5
clock summer-time zone recurring last Sun Mar 2:00 last Sun Oct 2:00
dns server-group DefaultDNS
domain-name iis-usa.com
same-security-traffic permit intra-interface
object-group network old hosting provider
network-object 72.55.34.64 255.255.255.192
network-object 72.55.33.0 255.255.255.0
network-object 173.189.251.192 255.255.255.192
network-object 173.163.157.32 255.255.255.240
network-object 66.11.1.64 255.255.255.192
network-object 107.0.197.0 255.255.255.192
object-group network old hosting provider
network-object host 172.19.250.10
network-object host 172.19.250.11
access-list 100 extended permit ip 172.19.5.64 255.255.255.192 object-group old hosting provider
access-list 100 extended permit ip 172.19.5.64 255.255.255.192 172.19.3.128 255.255.255.128
access-list 10 extended deny ip 0.0.0.0 255.0.0.0 any
access-list 10 extended deny ip 127.0.0.0 255.0.0.0 any
access-list 10 extended deny ip 169.254.0.0 255.255.0.0 any
access-list 10 extended deny ip 172.16.0.0 255.255.0.0 any
access-list 10 extended deny ip 224.0.0.0 224.0.0.0 any
access-list 10 extended permit icmp any any echo-reply
access-list 10 extended permit icmp any any time-exceeded
access-list 10 extended permit icmp any any unreachable
access-list 10 extended permit icmp any any traceroute
access-list 10 extended permit icmp any any source-quench
access-list 10 extended permit icmp any any
access-list 10 extended permit tcp object-group old hosting provider any eq 3389
access-list 10 extended permit tcp any any eq https
access-list 10 extended permit tcp any any eq www
access-list 110 extended permit ip 172.19.5.64 255.255.255.192 172.19.3.0 255.255.255.128
access-list 110 extended permit ip 172.19.5.64 255.255.255.192 object-group old hosting provider
pager lines 24
logging enable
logging timestamp
logging console emergencies
logging monitor emergencies
logging buffered warnings
logging trap debugging
logging history debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface inside
ip verify reverse-path interface outside
ip audit name jab attack action alarm drop reset
ip audit name probe info action alarm drop reset
ip audit interface outside probe
ip audit interface outside jab
ip audit info action alarm drop reset
ip audit attack action alarm drop reset
ip audit signature 2000 disable
ip audit signature 2001 disable
ip audit signature 2004 disable
ip audit signature 2005 disable
icmp unreachable rate-limit 1 burst-size 1
icmp permit 75.150.169.48 255.255.255.240 outside
icmp permit 72.44.134.16 255.255.255.240 outside
icmp permit 72.55.33.0 255.255.255.0 outside
icmp permit any outside
icmp permit 173.163.157.32 255.255.255.240 outside
icmp permit 107.0.197.0 255.255.255.192 outside
icmp permit 66.11.1.64 255.255.255.192 outside
icmp deny any outside
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 100
nat (inside) 1 0.0.0.0 0.0.0.0
access-group 10 in interface outside
route outside 0.0.0.0 0.0.0.0 174.78.151.225 1
timeout xlate 3:00:00
timeout conn 24:00:00 half-closed 0:10:00 udp 0:10:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 24:00:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http 107.0.197.0 255.255.255.192 outside
http 66.11.1.64 255.255.255.192 outside
snmp-server host outside 107.0.197.29 community *****
snmp-server host outside 107.0.197.30 community *****
snmp-server host inside 172.19.250.10 community *****
snmp-server host outside 172.19.250.10 community *****
snmp-server host inside 172.19.250.11 community *****
snmp-server host outside 172.19.250.11 community *****
snmp-server host outside 68.82.122.239 community *****
snmp-server host outside 72.55.33.37 community *****
snmp-server host outside 72.55.33.38 community *****
snmp-server host outside 75.150.169.50 community *****
snmp-server host outside 75.150.169.51 community *****
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map VPNMAP 10 match address 110
crypto map VPNMAP 10 set peer 72.00.00.7 old vpn public ip Site B Public IP
crypto map VPNMAP 10 set transform-set ESP-3DES-MD5
crypto map VPNMAP 10 set security-association lifetime seconds 86400
crypto map VPNMAP 10 set security-association lifetime kilobytes 4608000
crypto map VPNMAP interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
telnet 172.19.5.64 255.255.255.192 inside
telnet 172.19.3.0 255.255.255.128 outside
telnet timeout 60
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
console timeout 0
management-access inside
dhcpd dns 172.19.3.140
dhcpd wins 172.19.3.140
dhcpd ping_timeout 750
dhcpd domain iis-usa.com
dhcpd address 172.19.5.80-172.19.5.111 inside
dhcpd enable inside
threat-detection basic-threat
threat-detection scanning-threat shun except object-group old hosting provider
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 128.118.25.3 source outside
ntp server 217.150.242.8 source outside
tunnel-group 72.00.00.7 type ipsec-l2l
tunnel-group 72.00.00.7 ipsec-attributes
pre-shared-key *****
tunnel-group old vpn public ip type ipsec-l2l
tunnel-group old vpn public ip ipsec-attributes
pre-shared-key *****
tunnel-group SITE A Public IP type ipsec-l2l
tunnel-group SITE A Public IP ipsec-attributes
pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect netbios
inspect tftp
inspect pptp
inspect sip
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:
: endI have removed the old "set peer" and have added:
IOS router:
access-list 101 permit ip 172.19.3.128 0.0.0.127 172.19.5.64 0.0.0.65
ASA fw:
access-list 110 extended permit ip 172.19.5.64 255.255.255.192 172.19.3.128 255.255.255.128
on the router I have also added;
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.19.5.64 0.0.0.63
Here is my acl :
access-list 110 remark "Outbound NAT Rule"
access-list 110 remark "Deny VPN Traffic NAT"
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.19.3.0 0.0.0.127
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.19.10.0 0.0.0.255
access-list 110 deny ip 172.19.10.0 0.0.0.255 172.19.3.128 0.0.0.127
access-list 110 deny ip 172.20.3.128 0.0.0.127 172.19.3.0 0.0.0.127
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
access-list 110 deny ip 172.19.3.128 0.0.0.127 host 172.19.250.11
access-list 110 deny ip 172.19.3.128 0.0.0.127 host 172.19.250.10
access-list 110 permit ip 172.19.3.128 0.0.0.127 any
access-list 110 permit ip 172.19.10.0 0.0.0.255 any
access-list 110 deny ip 172.19.3.128 0.0.0.127 172.19.5.64 0.0.0.63
access-list 198 remark "Networks for IISVPN Client"
access-list 198 permit ip 172.19.3.0 0.0.0.127 172.20.3.128 0.0.0.127
access-list 198 permit ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
Still no ping tothe other site. -
I get a pop-up message saying "A server with the specified host name could not be found", whenever I try to access any streaming websites/apps or even WhatApp over Wi-Fi and I cannot access the specific THING for that moment, and I've tried switching Wi-Fi On and Off both in my Phone and also in the Router. I got an internet connection and a Wi-Fi router just before two days, and it's happening since. I got the internet speed around 80kbps and i can easily stream YouTube videos except sometimes, I receive that annoying message. I can't even browse the internet in Safari, which says "No Internet Connection"(Even though the Wi-Fi is connected), and I can access it after somewhile (say 10 minutes, it'll be perfectly alright). I use iPhone 4s. And everything about the internet connection is totally fine in my Computer, but not in my iPhone, as I've explained the issues, above. If there are any technical settings that I should change/modify, either on my computer(Windows 7 OS) or in my iPhone(iOS 7.0.4), PLEASE let me know
I hope I've provided enough information for the reader to understand my point. (I apologize for my verbal mistakes, if there are )
THANKSHello Paneesh,
Thank you for the details of the issue you are experiencing with Wi-Fi on your iPhone 4s. I recommend the following steps:
Be sure you're in range of your Wi-Fi router (access point).
Tap Settings > Wi-Fi and turn Wi-Fi off and on. If your W-Fi setting is dimmed, follow these steps.
Confirm that your Wi-Fi router and cable or DSL modem are connected to power, turned on, and connected to the Internet. If not, refer to your network administrator or Internet service provider (ISP) for assistance.
Restart your iOS device.
Tap Settings > Wi-Fi and locate the Wi-Fi network to which you're connected.
Tap and Forget this Network.
Try to connect to your desired Wi-Fi network.
Note: You may need to enter your Wi-Fi password again if your network requires one.
Turn your Wi-Fi router off and on2. If your ISP also provides cable or phone service, check with them before attempting this step to avoid interruption of service.
Update your device to the latest version of software.
Update your Wi-Fi router to the latest firmware2. For AirPort Base Stations, install updates using the AirPort Utility.
If the issue is still unresolved Wi-Fi disconnects or signal strength is less than expected
Move closer to the Wi-Fi router (access point).
Check for sources of potential interference.
Remove any case, stand, or other accessories from your iOS device and see if signal strength improves.
Reset network settings by tapping Settings > General > Reset > Reset Network Settings. Note: This will reset all network settings including
previously connected Wi-Fi networks and passwords
recently used Bluetooth accessories
VPN and APN settings
You can find the full article here:
iOS: Troubleshooting Wi-Fi networks and connections
http://support.apple.com/kb/ts1398
Thank you for using Apple Support Communities.
Best,
Sheila M. -
Enable Default Host not forwarding to host
Hello all,
Thank you in advance for any insight you can provide to this frustrating problem!
Here's the set-up:
ISP Modem with Static IP on Internet - no ports blocked - confirmed with ISP
BaseStation connected to the above modem with external IP configured to the static IP of the ISP
BaseStation internally giving out private IPs in the 192.168.x.x range via wireless and wired connections (section of range 50-100 only within range)
BaseStation internally providing a guest network in the 172.16 rage (limted to 50 max)
Targeted client set to static IP in the 192.168 range (not over-lapping with the range being handed out dynamically)
BaseStation set to use Default Host at the above IP (the one statically assigned to my "target" system that I want to reach from the internet)
Traffic to and from the internet for browsing and remote Server access works fine. Including Servers that are using the same ports that I wish this one to answer on.
Traffic INBOUND destined for the static host at the 192.168.x.x is NOT reaching the host on the ports I need it to. Even though that host is set as the Default Host. It is using two specific ports, but there is no port blocking on the ISP and the default host should be..... well.. the default. This is where traffic should go shouldnt' it?
The host can browse the internet, so it is a source and destination for that traffic, it just won't "answer the phone" when external traffic comes calling on the ports I want to direct to it.1) If it's going to forward all internet traffic to this one specific machine, why bother configuring Port Mappings?
You wouldn't. If you want only select ports opened, use Port Mapping; for all ports to be open, use Default Host, which is just another name for a DMZ.
2) If I would like my server (10.5.7 Leopard Server) to handle internet requests and then send the traffic to the appropriate internal computer based on the port request, what service on the Server do I use to do this?
Sorry, I'm not familiar with Leopard Server features, but I would think this would be something similar to the Proxy Server service provided by Windows Servers. -
Airport extreme default host won't stick
Hi all, I am using the newest version of the airport extreme and newest version of airport utility. I have a mac mini server running on my LAN with a manually set IP address of 10.0.1.15. I have my DHCP range on my airport set to start at 10.0.1.16-200.
I have tried to set the default host to 15 multiple times but it keeps resetting to 253. I don't get what is happening here but it's a really big PITA. I'd like to be able to access my server for things like VPN and screen sharing without having to manually set every individual service as well as dealing with the newest icloud port conflicts that the airport utilities report.
Can anyone offer any suggestions as to why this might be happening?I am having the same issue on my airport extreme. I am using software version 6.2 , I have slightly different IPs but the same scenario.
Very frustrating!!
Add to it the fact that I can no longer see the clients that are on my router from the router itself.... -
Can't Get Anywhere in Windows 2003 VPN System with AE 2009
Hi,
This is driving me nuts, and I'm wondering if anyone can help.
Since purchasing a new 2009 Airport Extreme, I can't see any servers when logged into my company's Windows 2003 VPN system. I log on and authenticate fine, it looks like I see the VPN system's DNS servers, and I'm assigned an IP address, but I can't get to any volumes, nor can Safari get to the company intranet. When I switch back to my old Linksys router, VPN works normally, so I know the issue is the AE.
My sysadmin doesn't have much info on port mapping, just a 1723 public TCP port.
I've spent hours on the Web looking for info, and don't want to return the AE, but I'm I'll have to if I can't get this resolved.I found this in another thread, and it worked:
SOLUTION:
It turns out that a co-worker of mine had the same problem in the past...and the solution couldn't be simpler. It turns out that:
1. the AP Ext DHCP defaults to assigning IPs based using 10.0.x.x addressing
2. my work network tries to use the same addressing scheme.
Therefore, I had to change the AP Ext base addressing to 192.168.x.x
STEP BY STEP SOLUTION:
1. Open Airport Utility
2. Click on the "Internet" tab at the top
3. Click on the "DHCP" tab within that window
4. Change the value of "DHCP Beginning Address" from "10.0" to "192.168"
5. Click Update. You AP Extreme will reboot and once back up, should work fine with your VPN (if you're lucky enough to have similar configuration as mine on your work end of things)
THIS SOLUTION DOES NOT REQUIRE
Assigning a DHCP IP Reservation
Enabling a default host on the NAT
Port Mapping -
AEBS/AE/AE/AE DMZ ("Default Host") issue?
Hi! Just a little background on my problem, I have an AEBS(n) talking to an AE (bridge), which then talks to two other AEs (remote 1, remote 2). This is configured using WDS because I found if I used the standard "Extend a network" / "Join a network" configuration, remote 1 would connect to remote 2 which in turn connected to the bridge, which was sub-optimal.
My problem is that on remote 2, I have my PS3 plugged in, and I've given the PS3 a static IP and set it as a default host. I can connect to the Playstation Network fine, get NAT type 2 status, but for some reason can't connect to LittleBigPlanet (which I understand is a new game, and I may be facing other problems besides network configuration...)
My question is actually: can you set a device that's two hops away from the router as a DMZ? Or does a DMZ need to be connected to the router/gateway?I'd like to add one bit of information.
Using Transmit, if I am logged on to our LAN "in house," then I MUST use PASV mode for Transmit to connect. This is true whether whether I connect by using our domain name or our static IP address.
However, if I am "out in the world" and connecting like a regular user, I must DESELECT PASV mode in order to connect with Transmit. This was never the case until we put our server "behind" the AE as a "default host."
It really seems like there's something fishy about the way ftp messages are sent through the AE, even when the target server is made the default host. -
ASA , Cisco VPN client with RADIUS authentication
Hi,
I have configured ASA for Cisco VPN client with RADIUS authentication using Windows 2003 IAS.
All seems to be working I get connected and authenticated. However even I use user name and password from Active Directory when connecting with Cisco VPN client I still have to provide these credentials once again when accessing domain resources.
Should it work like this? Would it be possible to configure ASA/IAS/VPN client in such a way so I enter user name/password just once when connecting and getting access to domain resources straight away?
Thank you.
Kind regards,
AlexHi Alex,
It is working as it should.
You can enable the vpn client to start vpn before logon. That way you login to vpn and then logon to the domain. However, you are still entering credentials twice ( vpn and domain) but you have access to domain resources and profiles.
thanks
John -
All items are not visible even with no filter
I have a custom list and am not able to run a search the list, through the "all items" view, even with no filter set. The list is also set to only view 50 items at a time, but I am not able to view the next batch of items. The search
will give no results even when the list contains the item with that specific information.Hi,
1) I understand you are not able to view the 'All Items' in the list.
Can you check the total number of items that list contains.
Go to Site Actions-->View All site content see the number of items beside the list name( right side)
I suspect the list might be reached the threshold value.
2) If the number of Items are less than the threshold value then I would suggest you do a test by creating another view by providing only the view name (Don't use any sort, Filter, Groupby ...etc) and just keep the default settings and let me
know if you are able to see the items using the newly created view.
****************************************************************************************** Please remember to mark your question as answered &Vote helpful, if this solves/helps your problem.
s p kumar
Maybe you are looking for
-
Unable to close the cursors in the database
While executing a stored program unit(containing three cursors and sub programs or functions containing another two cursors) through forms the client running the form stops responding. While checking the database the open_cursor view reports that the
-
some import operations were not performed , could not copy the file to requested location , has anyone seen this or have a fix?
-
Hi Alex, My script always fails due to a timeout issue when invoking a CAS comman in Siebel functional test. How can I use error recovery methods to ignore this particular error and prevent my test from failing? Thanks in advance. Here is the code wh
-
After loading my photos from my iphone to my mac iphoto it gives me the option to delete photos on my phone. When I click to delete the photos do not delete from my phone. I am out of storage due to I can not delete photos from my iphone.
-
Hi As RSEOUT00 is a report used for the edi outbound process, can some 1 help me and tell me which report to run for startinmg the inbound process? I know the Function module EDI_DATA_INCOMING is used for the process,but its supposed to be aut