OS 10.4 clients cannot access Shared Mac folder on W2k Server - URGENT

We have a network of about 25 computers, 10 or so of them are Mac OS 10.4, the rest are Win XP Pro PCs. We have a server dedicated to file sharing. We basically have one main shared folder called "FILES". This is shared for PCs and Macs. Recently after a restart of the server (for regular maintenance), the Macs could not see the shared Mac volume (FILES), PCs could access the share without a problem. After a few minutes (15 or so) the Macs could all of a sudden see the share and
everything was fine.
However, we just restarted the server again and we're having the same issue again. The difference is, this time, after waiting for a few hours, the Macs still cannot see the Mac Share. The macs connect to the server via TCP/IP, the users use their usernames and passwords and can connect to the server, however, the only volume they see is the Micrsoft UAM volume.
When we created a different folder and shared it (through MMC), the Macs could see and access that one.
We get an Event ID 12061 in the System Event Log as the user tries to connect to the share. I found a Microsoft KB article, but no solution to the problem was given. http://support.microsoft.com/kb/q136300/
Here are some things I have tried to remedy the issue, please keep in mind we cannot change the name of the share (FILES) becuase of the thousands of file mappings in quark, etc.:
Again Restarted Server
Stopped Sharing the folder, then reshared it
Stopped sharing the folder
Uninstalled / Reinstalled Appletalk Protocol from network adapter
Uninstalled / Reinstalled File Services for Macintosh [Restarted]
Uninstalled / Reinstalled Appletalk Protocol from network adapter again [Restarted]
Reshared the folder
Created a new mac share called TEST (Macs could see and access)
Moved data from Files to TEST, now Macs could not see TEST
Moved data back to FILES
Created a folder called FILES2, moved data from FILES to FILES2
Stopped sharing FILES (PC and Mac), renamed FILES to FILES1
Renamed FILES2 to FILES (Macs could not see volume)
It seems as though the problem is with an individual file or two, which sort of corresponds the what Microsoft has written regarding the error.
Has anyone had any experience with this issue? Any insight or solution to this issue is greatly appreciated.
Thank you!

It's very important to be as specific as possible when discussion network service access. In your question, it sounds like you want the macs to attach to FILES using SMB/CIFS, but you also call it a Mac share, so it's not obvious if you mean an AFP share or just a share for Macs to use.
You should know that the Macs can connect to either AFP or SMB volumes, and they can browse for SMB over TCP/IP and AFP over both TCP/IP and Appletalk (Appletalk must be turned on and browsing active in Directory Access).
Connecting via SMB to a volume hosted on Windows2K or higher server will fail with the default settings, which require secure connections not supported by Mac OS X (because Samba doesn't support it). To overcome that problem, see this article:
http://www.macosxhints.com/article.php?story=20030922153448490&query=-5000
(scroll down to one of the top-level replies, which explains in detail how to deactivate secure connections)
You might also be able to improve reliability by editing the SMB settings in Directory Access and setting a WINS server, but it depends on your network.

Similar Messages

  • Cannot access shared folders anymore....

    Hi,
    We have a naughty problem at the office for accessing shared folders .
    We use G5 Xserve + Xraid serving home access to 12 macs.
    Our problem started when we updated all machines to 10.5.2 (nor did we have a problem with 10.5.1 or with 10.5.0).
    All machines login correctly, fetch their folders with their home accesses located in the Xserve, as allways did, BUT :
    ·Almost all the machines running Leopard (except two) CANNOT access shared items. They get Error -5002
    ·The old machines running Tiger (G3 Imac's) acess shared items without problem.
    So after many weeks doing multiple tests, we got the following conclusions:
    ·Problem is not server related.
    ·Problem si related to Leopard clients , although not in all
    ·Problem is not related to the machine, but with the account (accounts that can access shared items do it on any machine, and accounts that can't, don't do it on any machine)
    ·It seems that the trouble is related somewhat with Kerberos authentication, but it's not related to tickets (renewing them is no use)
    ·If we create new account with new name, it can access shared items
    ·If we create new account with same name that of the faulty one (renaming the later), it CANNOT access shared items.
    We have got a problem in the office, and no clue of solving it.... Have read all over apple discussions over the internet, and although some people have similar issues, they are not as close as ours....
    And none of the solutions proposed have solved the problem.
    Any ideas would be greatly appreciated, cause we are starting to get desperate
    Thanks everyone.

    new update:
    we are able to connect to remote shared folders with a different remote server (dual G4) from every machine
    machines who can connect to local server are INTELs, the one who can't are PPCs
    makes any sense to anyone?¿

  • Windows 7 pro client cannot access folders on server 2003 domain server

    I added a windows 7 64 bit client to a server 2003 32 bit domain 3 weeks ago and file sharing was working fine until today, 5/4/12. Now, when trying to access shared folders that reside on the server,
    I get the following "access denied" message:
    […folder…] is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.
    The user name could not be found.
    Strangely enough...
    The windows 7 client
    can open shared folders that reside on the XP clients in the domain
    All the XP clients in the domain can access the server 2003 folders
    All the XP clients and the server 2003 machine can access shared folders and printers on the windows 7 client.
    The windows 7 client can ping the server 2003 machine and vice versa
    I can “see” the server in my network list, but when I click on it, I get the same “access denied” message listed above.
    So... the only problem is that the windows 7 client cannot access folders that reside on the windows server 2003 machine. There must be some sharing setting that got changed
    by a recent windows update.
    Here is what I have done/verified so far on the windows 7 client:
    In advanced sharing settings for Home/Work, Public and Domain profiles:
    network discovery is enabled
    file and print sharing is enabled
    use user accounts and passwords to connect to other computers is selected (I also tried allowing windows to manage homegroup connections instead, but the problem remained.)
    40 -56 bit encryption is enabled
    In “gpedit.msc” Local Policies/Security Settings:
    enabled the following policies:
    Network access: Allow anonymous SID/name translation
    Network access: Let Everyone permissions apply to anonymous users
    disabled the following policies:
    Network access: Restrict anonymous access to Named Pipes and Shares
    Network access: Do not allow anonymous enumeration of SAM accounts
    Network access: Do not allow anonymous enumeration of SAM accounts and shares
    What am I missing? Are there policies on the server that need to be adjusted?
    Please help! My business is crippled if I cannot access server files from this workstation. Thank you in advance.

    As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous
    steps should be helpful for many similar scenarios.  <o:p></o:p>
    If the issue still persists and you want to return to this question, please reply this post directly so we will be notified to follow it up. You
    can also choose to unmark the answer as you wish.  <o:p></o:p>
    In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar
    problems.  <o:p></o:p>
    Thanks!<o:p></o:p>
    Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
    the thread.

  • VPN Client cannot access Internet

    I am currently using PIX 501 and VPN 3000. Everything is running fine except that VPN Client cannot access internet after they logged in via Cisco System VPN CLient. I can't any solution to this problem and is really lost. This is a very important task assign to me.
    Hope someone can help me asap.
    Thanks You

    You need to enable split tunneling. This link is for VPN client to router. The same equivalent config may apply to a PIX as well.
    http://www.cisco.com/application/pdf/en/us/guest/products/ps6659/c1650/cdccont_0900aecd80313bf8.pdf

  • SRS Browser Role Cannot Access Shared Data Sources

    I've created some reports using VS and shared data sources and deployed. I can run reports (I'm a domain admin), but users I've given system administrator roles within SRS cannot access shared data sources. However, if I embed the data source, everything
    is fine. I'm pulling data from three different servers, so the shared data sources are somewhat important.  I'm using SQL Native userid/passwords not windows authentication.  Anybody got any ideas?  I'm new to SRS.  Thanks.

    Hi Janetb,
    I’m confused about the meaning of “cannot access shared data sources”. Are you saying the user cannot see the Shared Data Sources in Report Server, but he can render the report well? Or the user cannot render the report well because he have no permission
    to access shared data sources?
    If in this first scenario, means that the role of the user have no permission to View data sources. To fix this issue, we can add View data sources task to the current role in SQL Server Management Studio.
    If in the second scenario, it is so strange. In my test, I add Browser role of the report to one user which has no permission to access the shared data sources, but he can render the report which retrieve data from the shared data sources very well.
    To troubleshooting this issue more efficiently, could you tell us the scenario you occurred and the error message you received? So that we can make further analysis and help you out.
    Thanks,
    Katherine Xiong
    Katherine Xiong
    TechNet Community Support

  • Cannot display the folder. Microsoft Outlook cannot access the specified folder location.

    Hi, guys
    I cannot view delegate mailbox in Outlook. Following is my configure.
    I have two mailbox A-User and B-User
    Login Outlook as A-User, click File -> Account Settings -> Delegate Access, add B-User and give Editor permission of Inbox.
    Right click A-User's root inbox and select Properties -> Permission, select B-User and check "Folder visible".
    Login Outlook as B-User on other computer, click File -> Account Settings -> Account Settings, select B-User and click Change -> More Settings -> Advanced, add A-User.
    Now I can see a root A-User in Navigation Pane. But when I click it, it shows
    "Cannot display the folder. Microsoft Outlook cannot access the specified folder location."
    or
    "Cannot display the folder. Microsoft Outlook cannot access the specified folder location. The operation failed. An object cannot be found".
    I searched some solutions from internet, but all of them don't work. Could you give some suggestions? 
    Thanks.

    Hi,
    First, please double check if you have given the right permission to B-User on your step 2.
    In addition, we can try to give a higher permission to the B-user to check the result.
    Please feel free to post back and let me know the result.
    Best Regards,
    Steve Fan
    TechNet Community Support

  • Now Mavericks is installed, I cannot access my downloads folder.

    Now Mavericks is installed, I cannot access my downloads folder. How do I click on items in the folder and get them to open? When I attempt to click on the items, nothing happens. Before Mavericks, I could click and get the folders to open.  Yes, I have used three different devices to try to click on them, so it is not my mouse/treackpad/Wacom pen. I am getting very frustrated with this new OS - this is not the only thing bothering me.

    Now Mavericks is installed, I cannot access my downloads folder. How do I click on items in the folder and get them to open? When I attempt to click on the items, nothing happens. Before Mavericks, I could click and get the folders to open.  Yes, I have used three different devices to try to click on them, so it is not my mouse/treackpad/Wacom pen. I am getting very frustrated with this new OS - this is not the only thing bothering me.

  • Cannot access shared external hard drive with other mac accounts

    I cannot access a shared external hard drive with other mac accounts (all accounts are on the same macbook Pro). The shared external drive is shared via time capsule and is connected (of course) in USB. I see well this external hard drive as a shared disk with my main account. Yes shared option has been activated with the Airport Utility .. but when I open other account these othe accounts can see the external drive but cannot access to its content that is flagged with a no way sign. Strangely enough when I close my main account and start opening a new session with one of the other account then fine I can access the external hard drive and its content .. BUT then it is from my main account than I cannot access its content the no way sign showing ..
    Looks like only one account at a time can access the content of this SHARED external hard drive .. any one as an idea on how to really make it a shared hard drive so that all accounts on the same mac can also access it ? I am at my wit ends on this case. THANKS ..

    Results of my enquiries at Apple Genius Bar .. the guys found the problem interesting. They've been unable to provide a fix neither to give any explanation as to the reason why. To be fair I was not much impressed by the technical level demonstrated ..
    In the mean time I have found that if account no.1 can see the shared external drive content and in such case account no.2 (same Mac computer) cannot see its content (only the external HD with a no way sign) this account no.2 can UNMOUNT (by ejecting) this external HD from account 1 and then remount it (just clicking on the TC shared part in a finder window) and .. see and access its content ; whilst account no.1 cannot see its content anylonger. Unless it unmounts the shared external HD and remount it .. then account no.2 can see its content anylonger. This can goes on an on.
    So eventually YES the TC can allow to share a USB external drive between several accounts and a same Mac .. BUT this require to unmount and remount EACH time the external drive is accessed from a "no.2 account". So OK to share files with seldom access but not practical in case of frequent access needed.
    I just I have now to figure how iTunes can automatically unmount and remount a shared external HD when it needs to access one of this shared HD content from on time account no.1 and then next time from account no.2. May be I am asking too much ..

  • Cannot access shared photo album in iPhoto 9.4.3 on mac

    I cannot access a shared photo album in iPhoto 9.4.3.  The directions in help tell me to go to iPhoto preferences > photo stream, and check the box next to "select the shared photo stream checkbox".  There is no such option in my version.  Can anyone help?  Thanks!

    I cannot access a shared photo album in iPhoto 9.4.3
    Is this a shared photo album from iPhoto on a mobile device or a Shared Photo Stream?
    If a shared Photo Stream you should have this preference pane in iPhoto 9.4.3:
    Check the boxes as shown in this screenshot and then go to the Photo Stream section in iPhoto and see if they appear.
    OT

  • VPN Clients cannot access remote site

    Hey there,
    I am pretty new in configuring Cisco devices and now I need some help.
    I have 2 site here:
    site A
    Cisco 891
    external IP: 195.xxx.yyy.zzz
    VPN Gateway for Remote users
    local IP: VLAN10 10.133.10.0 /23
    site B
    Cisco 891
    external IP: 62.xxx.yyy.zzz
    local IP VLAN10 10.133.34.0 /23
    Those two sites are linked together with a Site-to-Site VPN. Accessing files or ressources from one site to the other is working fine while connected to the local LAN.
    I configured VPN connection with Radius auth. VPN clients can connect to Site A, get an IP adress from VPN Pool (172.16.100.2-100) and can access files and servers on site A. But for some reason they cannot access ressources on site B. I already added the site B network to the ACL and when connecting with VPN it shows secured routes to 10.133.10.0 and 10.133.34.0 in the statistics. Same thing for other VPN Tunnels to ERP system.
    What is missing here to make it possible to reach remote sites when connected through VPN? I had a look at the logs but could not find anything important.
    Here is the config of site A
    Building configuration...
    Current configuration : 24257 bytes
    version 15.2
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname Englerstrasse
    boot-start-marker
    boot config usbflash0:CVO-BOOT.CFG
    boot-end-marker
    aaa new-model
    aaa group server radius Radius-AD
    server 10.133.10.5 auth-port 1812 acct-port 1813
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_2 group Radius-AD local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    clock timezone Berlin 1 0
    clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
    crypto pki trustpoint TP-self-signed-27361994
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-27361994
    revocation-check none
    rsakeypair TP-self-signed-27361994
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki certificate chain TP-self-signed-27361994
    certificate self-signed 01
      30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 32373336 31393934 301E170D 31323038 32373038 30343238
      5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
      2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D323733 36313939
      3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B709
      64CE1874 BF812A9F 0B761522 892373B9 10F0BB52 6263DCDB F9877AA3 7BD34E53
      BCFDA45C 2A991777 4DDC7E6B 1FCEE36C B6E35679 C4A18771 9C0F871F 38310234
      2D89A4FF 37B616D8 362B3103 A8A319F2 10A72DC7 490A04AC 7955DF68 32EF9615
      9E1A3B31 2A1AB243 B3ED3E35 F4AAD029 CDB1F941 5E794300 5C5EF8AE 5C890203
      010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
      18301680 14D0F5E7 D3A9311D 1675AA8F 38F064FC 4D04465E F5301D06 03551D0E
      04160414 D0F5E7D3 A9311D16 75AA8F38 F064FC4D 04465EF5 300D0609 2A864886
      F70D0101 05050003 818100AB 2CD4363A E5ADBFB0 943A38CB AC820801 117B52CC
      20216093 79D1F777 2B3C0062 4301CF73 094B9CA5 805F585E 04CF3301 9B839DEB
      14A334A2 F5A5316F C65EEF21 0B0DF3B5 F4322440 F28B984B E769876D 6EF94895
      C3D5048A A4E2A180 12DF6652 176942F8 58187D7B D37B1F1A 4DDD7AE9 5189F9AF
      AF3EF676 26AD3F31 D368F5
          quit
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    no ip source-route
    ip auth-proxy max-login-attempts 5
    ip admission max-login-attempts 5
    no ip bootp server
    no ip domain lookup
    ip domain name yourdomain.com
    ip inspect log drop-pkt
    ip inspect name CCP_MEDIUM appfw CCP_MEDIUM
    ip inspect name CCP_MEDIUM ftp
    ip inspect name CCP_MEDIUM h323
    ip inspect name CCP_MEDIUM sip
    ip inspect name CCP_MEDIUM https
    ip inspect name CCP_MEDIUM icmp
    ip inspect name CCP_MEDIUM netshow
    ip inspect name CCP_MEDIUM rcmd
    ip inspect name CCP_MEDIUM realaudio
    ip inspect name CCP_MEDIUM rtsp
    ip inspect name CCP_MEDIUM sqlnet
    ip inspect name CCP_MEDIUM streamworks
    ip inspect name CCP_MEDIUM tftp
    ip inspect name CCP_MEDIUM udp
    ip inspect name CCP_MEDIUM vdolive
    ip inspect name CCP_MEDIUM imap reset
    ip inspect name CCP_MEDIUM smtp
    ip cef
    no ipv6 cef
    appfw policy-name CCP_MEDIUM
      application im aol
        service default action allow alarm
        service text-chat action allow alarm
        server permit name login.oscar.aol.com
        server permit name toc.oscar.aol.com
        server permit name oam-d09a.blue.aol.com
        audit-trail on
      application im msn
        service default action allow alarm
        service text-chat action allow alarm
        server permit name messenger.hotmail.com
        server permit name gateway.messenger.hotmail.com
        server permit name webmessenger.msn.com
        audit-trail on
      application http
        strict-http action allow alarm
        port-misuse im action reset alarm
        port-misuse p2p action reset alarm
        port-misuse tunneling action allow alarm
      application im yahoo
        service default action allow alarm
        service text-chat action allow alarm
        server permit name scs.msg.yahoo.com
        server permit name scsa.msg.yahoo.com
        server permit name scsb.msg.yahoo.com
        server permit name scsc.msg.yahoo.com
        server permit name scsd.msg.yahoo.com
        server permit name cs16.msg.dcn.yahoo.com
        server permit name cs19.msg.dcn.yahoo.com
        server permit name cs42.msg.dcn.yahoo.com
        server permit name cs53.msg.dcn.yahoo.com
        server permit name cs54.msg.dcn.yahoo.com
        server permit name ads1.vip.scd.yahoo.com
        server permit name radio1.launch.vip.dal.yahoo.com
        server permit name in1.msg.vip.re2.yahoo.com
        server permit name data1.my.vip.sc5.yahoo.com
        server permit name address1.pim.vip.mud.yahoo.com
        server permit name edit.messenger.yahoo.com
        server permit name messenger.yahoo.com
        server permit name http.pager.yahoo.com
        server permit name privacy.yahoo.com
        server permit name csa.yahoo.com
        server permit name csb.yahoo.com
        server permit name csc.yahoo.com
        audit-trail on
    parameter-map type inspect global
    log dropped-packets enable
    multilink bundle-name authenticated
    redundancy
    ip tcp synwait-time 10
    class-map match-any CCP-Transactional-1
    match dscp af21
    match dscp af22
    match dscp af23
    class-map match-any CCP-Voice-1
    match dscp ef
    class-map match-any sdm_p2p_kazaa
    match protocol fasttrack
    match protocol kazaa2
    class-map match-any CCP-Routing-1
    match dscp cs6
    class-map match-any sdm_p2p_edonkey
    match protocol edonkey
    class-map match-any CCP-Signaling-1
    match dscp cs3
    match dscp af31
    class-map match-any sdm_p2p_gnutella
    match protocol gnutella
    class-map match-any CCP-Management-1
    match dscp cs2
    class-map match-any sdm_p2p_bittorrent
    match protocol bittorrent
    policy-map sdm-qos-test-123
    class class-default
    policy-map sdmappfwp2p_CCP_MEDIUM
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    policy-map CCP-QoS-Policy-1
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    class CCP-Voice-1
      priority percent 33
    class CCP-Signaling-1
      bandwidth percent 5
    class CCP-Routing-1
      bandwidth percent 5
    class CCP-Management-1
      bandwidth percent 5
    class CCP-Transactional-1
      bandwidth percent 5
    class class-default
      fair-queue
      random-detect
    crypto ctcp port 10000
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key REMOVED address 62.20.xxx.yyy 
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 83.140.xxx.yyy  
    crypto isakmp client configuration group VPN_local
    key REMOVED
    dns 10.133.10.5 10.133.10.7
    wins 10.133.10.7
    domain domain.de
    pool SDM_POOL_2
    acl 115
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group VPN_local
       client authentication list ciscocp_vpn_xauth_ml_2
       isakmp authorization list ciscocp_vpn_group_ml_2
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA11 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA5 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA1 esp-des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA11
    set isakmp-profile ciscocp-ike-profile-1
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to62.20.xxx.xxx
    set peer 62.20.xxx.xxx
    set transform-set ESP-3DES-SHA
    match address 105
    crypto map SDM_CMAP_1 2 ipsec-isakmp
    description Tunnel to195.243.xxx.xxx
    set peer 195.243.xxx.xxx
    set transform-set ESP-3DES-SHA4
    match address 107
    crypto map SDM_CMAP_1 3 ipsec-isakmp
    description Tunnel to83.140.xxx.xxx
    set peer 83.140.xxx.xxx
    set transform-set ESP-DES-SHA1
    match address 118
    interface Loopback2
    ip address 192.168.10.1 255.255.254.0
    interface Null0
    no ip unreachables
    interface FastEthernet0
    switchport mode trunk
    no ip address
    spanning-tree portfast
    interface FastEthernet1
    no ip address
    spanning-tree portfast
    interface FastEthernet2
    no ip address
    spanning-tree portfast
    interface FastEthernet3
    no ip address
    spanning-tree portfast
    interface FastEthernet4
    description Internal LAN
    switchport access vlan 10
    switchport trunk native vlan 10
    no ip address
    spanning-tree portfast
    interface FastEthernet5
    no ip address
    spanning-tree portfast
    interface FastEthernet6
    no ip address
    spanning-tree portfast
    interface FastEthernet7
    no ip address
    spanning-tree portfast
    interface FastEthernet8
    description $FW_OUTSIDE$$ETH-WAN$
    ip address 62.153.xxx.xxx 255.255.255.248
    ip access-group 113 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip inspect CCP_MEDIUM out
    no ip virtual-reassembly in
    ip verify unicast reverse-path
    duplex auto
    speed auto
    crypto map SDM_CMAP_1
    service-policy input sdmappfwp2p_CCP_MEDIUM
    service-policy output CCP-QoS-Policy-1
    interface Virtual-Template1 type tunnel
    ip unnumbered FastEthernet8
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface GigabitEthernet0
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    no ip address
    interface Vlan10
    description $FW_INSIDE$
    ip address 10.133.10.1 255.255.254.0
    ip access-group 112 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat inside
    ip virtual-reassembly in
    interface Async1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    encapsulation slip
    ip local pool SDM_POOL_1 192.168.10.101 192.168.10.200
    ip local pool VPN_Pool 192.168.20.2 192.168.20.100
    ip local pool SDM_POOL_2 172.16.100.2 172.16.100.100
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip forward-protocol nd
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet8 overload
    ip route 0.0.0.0 0.0.0.0 62.153.xxx.xxx
    ip access-list extended VPN1
    remark VPN_Haberstrasse
    remark CCP_ACL Category=4
    permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    ip radius source-interface Vlan10
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 10.10.10.0 0.0.0.7
    access-list 23 remark CCP_ACL Category=17
    access-list 23 permit 195.243.xxx.xxx
    access-list 23 permit 10.133.10.0 0.0.1.255
    access-list 23 permit 10.10.10.0 0.0.0.7
    access-list 100 remark CCP_ACL Category=4
    access-list 100 permit ip 10.133.10.0 0.0.1.255 any
    access-list 101 remark CCP_ACL Category=16
    access-list 101 permit udp any eq bootps any eq bootpc
    access-list 101 deny   ip 10.10.10.0 0.0.0.255 any
    access-list 101 permit icmp any any echo-reply
    access-list 101 permit icmp any any time-exceeded
    access-list 101 permit icmp any any unreachable
    access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 101 deny   ip host 255.255.255.255 any
    access-list 101 deny   ip any any
    access-list 102 remark auto generated by CCP firewall configuration
    access-list 102 remark CCP_ACL Category=1
    access-list 102 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 102 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 102 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 102 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 102 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 102 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 102 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 102 deny   ip host 255.255.255.255 any
    access-list 102 deny   ip host 0.0.0.0 any
    access-list 102 deny   ip any any log
    access-list 103 remark auto generated by CCP firewall configuration
    access-list 103 remark CCP_ACL Category=1
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp any host 62.153.xxx.xxx
    access-list 103 permit ahp any host 62.153.xxx.xxx
    access-list 103 permit udp host 194.25.0.60 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 103 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 103 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 103 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 103 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 103 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 103 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 103 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 103 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 103 deny   ip host 255.255.255.255 any
    access-list 103 deny   ip host 0.0.0.0 any
    access-list 103 deny   ip any any log
    access-list 104 remark CCP_ACL Category=4
    access-list 104 permit ip 10.133.10.0 0.0.1.255 any
    access-list 105 remark CCP_ACL Category=4
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 remark CCP_ACL Category=2
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 permit ip 10.10.10.0 0.0.0.7 any
    access-list 106 permit ip 10.133.10.0 0.0.1.255 any
    access-list 107 remark CCP_ACL Category=4
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 108 remark Auto generated by SDM Management Access feature
    access-list 108 remark CCP_ACL Category=1
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq telnet
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 22
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq www
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 443
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq cmd
    access-list 108 deny   tcp any host 10.133.10.1 eq telnet
    access-list 108 deny   tcp any host 10.133.10.1 eq 22
    access-list 108 deny   tcp any host 10.133.10.1 eq www
    access-list 108 deny   tcp any host 10.133.10.1 eq 443
    access-list 108 deny   tcp any host 10.133.10.1 eq cmd
    access-list 108 deny   udp any host 10.133.10.1 eq snmp
    access-list 108 permit ip any any
    access-list 109 remark CCP_ACL Category=1
    access-list 109 permit ip 10.133.10.0 0.0.1.255 any
    access-list 109 permit ip 10.10.10.0 0.0.0.7 any
    access-list 109 permit ip 192.168.10.0 0.0.1.255 any
    access-list 110 remark CCP_ACL Category=1
    access-list 110 permit ip host 195.243.xxx.xxx any
    access-list 110 permit ip host 84.44.xxx.xxx any
    access-list 110 permit ip 10.133.10.0 0.0.1.255 any
    access-list 110 permit ip 10.10.10.0 0.0.0.7 any
    access-list 110 permit ip 192.168.10.0 0.0.1.255 any
    access-list 111 remark CCP_ACL Category=4
    access-list 111 permit ip 10.133.10.0 0.0.1.255 any
    access-list 112 remark CCP_ACL Category=1
    access-list 112 permit udp host 10.133.10.5 eq 1812 any
    access-list 112 permit udp host 10.133.10.5 eq 1813 any
    access-list 112 permit udp any host 10.133.10.1 eq non500-isakmp
    access-list 112 permit udp any host 10.133.10.1 eq isakmp
    access-list 112 permit esp any host 10.133.10.1
    access-list 112 permit ahp any host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1645 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1646 host 10.133.10.1
    access-list 112 remark auto generated by CCP firewall configuration
    access-list 112 permit udp host 10.133.10.5 eq 1812 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1813 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.7 eq domain any
    access-list 112 permit udp host 10.133.10.5 eq domain any
    access-list 112 deny   ip 62.153.xxx.xxx 0.0.0.7 any
    access-list 112 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 112 deny   ip host 255.255.255.255 any
    access-list 112 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 112 permit ip any any
    access-list 113 remark CCP_ACL Category=1
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ahp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ip host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit ip host 84.44.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark auto generated by CCP firewall configuration
    access-list 113 permit udp host 194.25.0.60 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp host 194.25.0.60 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp any host 62.153.xxx.xxx
    access-list 113 permit ahp any host 62.153.xxx.xxx
    access-list 113 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 remark Pop3
    access-list 113 permit tcp host 82.127.xxx.xxx eq 8080 host 62.153.xxx.xxx
    access-list 113 remark Pop3
    access-list 113 permit tcp any eq pop3 host 62.153.xxx.xxx
    access-list 113 remark SMTP
    access-list 113 permit tcp any eq 465 host 62.153.xxx.xxx
    access-list 113 remark IMAP
    access-list 113 permit tcp any eq 587 host 62.153.xxx.xxx
    access-list 113 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 113 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 113 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 113 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 113 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 113 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 113 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 113 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 113 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 113 deny   ip host 255.255.255.255 any
    access-list 113 deny   ip host 0.0.0.0 any
    access-list 113 deny   ip any any log
    access-list 114 remark auto generated by CCP firewall configuration
    access-list 114 remark CCP_ACL Category=1
    access-list 114 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 114 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 114 permit icmp any any echo-reply
    access-list 114 permit icmp any any time-exceeded
    access-list 114 permit icmp any any unreachable
    access-list 114 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 114 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 114 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 114 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 114 deny   ip host 255.255.255.255 any
    access-list 114 deny   ip host 0.0.0.0 any
    access-list 114 deny   ip any any log
    access-list 115 remark VPN_Sub
    access-list 115 remark CCP_ACL Category=5
    access-list 115 permit ip 10.133.10.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.34.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.20.0 0.0.0.255 any
    access-list 116 remark CCP_ACL Category=4
    access-list 116 remark IPSec Rule
    access-list 116 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 117 remark CCP_ACL Category=4
    access-list 117 remark IPSec Rule
    access-list 117 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark CCP_ACL Category=4
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    no cdp run
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    control-plane
    mgcp profile default
    line con 0
    transport output telnet
    line 1
    modem InOut
    speed 115200
    flowcontrol hardware
    line aux 0
    transport output telnet
    line vty 0 4
    session-timeout 45
    access-class 110 in
    transport input telnet ssh
    line vty 5 15
    access-class 109 in
    transport input telnet ssh
    scheduler interval 500
    end

    The crypto ACL for the site to site vpn should also include the vpn client pool, otherwise, traffic from the vpn client does not match the interesting traffic for the site to site vpn.
    On Site A:
    should include "access-list 107 permit ip 172.16.100.0 0.0.0.255 10.133.34.0 0.0.1.255"
    You should also remove the following line as the pool is incorrect:
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    On Site B:
    should include: permit ip 10.133.34.0 0.0.1.255 172.16.100.0 0.0.0.255"
    NAT exemption on site B should also be configured with deny on the above ACL.

  • VPN clients cannot access inside LAN

    I have a vpn setup.  I can vpn in from either the outside (internet) or from inside my network.  Once I do that I can no longer ping or remote into the server I have setup on the 192.168.1.0/24 subnet.  I can ping from the 192.168.1.0 subnet to any other subnet but I cannot ping from the vpn subnet to any other subnet.  I know that I have some permits on Outside-IN and Inside-IN, this is only to make it easier to troubleshoot.  Thank you in advance.
    The VPN subnet is 192.168.2.0
    The Server subnet is 192.168.1.0
    the Internal client subnet is 10.0.0.0 /24
    Here is the config and the packet-tracer output
    RUNNING-CONFIG
    =====================
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 2KFQnbNIdI.2KYOU encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network Axon
    network-object host 192.168.1.6
    object-group network VPN-Clients
    network-object 192.168.2.0 255.255.255.0
    object-group service HTTP-HTTPS tcp
    port-object eq www
    port-object eq https
    object-group service RDP tcp
    port-object eq 3389
    access-list Outside-IN extended permit ip any any
    access-list Inside-IN extended permit ip any any
    access-list Axon-NAT extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNPool 192.168.2.2-192.168.2.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) 192.168.2.0 192.168.2.0 netmask 255.255.255.0
    access-group Inside-IN in interface inside
    access-group Outside-IN in interface outside
    route outside 192.168.2.0 255.255.255.0 192.168.1.0 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    no sysopt connection permit-vpn
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.5-192.168.1.36 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc enable
    group-policy VPNPolicy internal
    group-policy VPNPolicy attributes
    vpn-tunnel-protocol svc webvpn
    address-pools value VPNPool
    webvpn
      url-list none
      svc ask enable
    username test2 password sLyNkwX4lP/BSsCW encrypted privilege 0
    username test2 attributes
    vpn-group-policy VPNPolicy
    username fwaarmac password 5rABwjFzDBYcp0nJ encrypted privilege 15
    username fwaarmac attributes
    vpn-group-policy VPNPolicy
    username test1 password sLyNkwX4lP/BSsCW encrypted privilege 0
    username test1 attributes
    vpn-group-policy VPNPolicy
    username dan password vFpifCksRBgKm.0Q encrypted privilege 15
    username dan attributes
    vpn-group-policy VPNPolicy
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy VPNPolicy
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    address-pool VPNPool
    default-group-policy VPNPolicy
    tunnel-group VPN webvpn-attributes
    group-alias vpn enable
    group-url https://10.0.0.10/vpn enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:b8d7144e7d51265fa9a5f38e29f40269
    : end
    NAT / PACKET-TRACER
    ========================
    packet-tracer input outside tcp 192.168.2.1 3389 192.168.1.6 3389 detailed
    Phase: 1
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.1.0     255.255.255.0   inside
    Phase: 2
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group Outside-IN in interface outside
    access-list Outside-IN extended permit ip any any
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc95ea0e0, priority=12, domain=permit, deny=false
            hits=5247, user_data=0xc793c350, cs_id=0x0, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 3
    Type: IP-OPTIONS
    Subtype:     
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc95e6d48, priority=0, domain=inspect-ip-options, deny=true
            hits=10050, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 4
    Type: HOST-LIMIT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc959fab8, priority=0, domain=host-limit, deny=false
            hits=5248, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 5
    Type: NAT
    Subtype: rpf-check
    Result: DROP
    Config:
    nat (inside) 1 0.0.0.0 0.0.0.0
      match ip inside any outside any
        dynamic translation to pool 1 (10.0.0.10 [Interface PAT])
        translate_hits = 88, untranslate_hits = 7
    Additional Information:
    Forward Flow based lookup yields rule:
    out id=0xc962a5f8, priority=1, domain=nat-reverse, deny=false
            hits=415, user_data=0xc962a388, cs_id=0x0, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Result:
    input-interface: outside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule

    You would need to configure NAT exemption for the VPN client to access internal host:
    access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list nonat permit ip 10.0.0.0 255.255.255.0 192.168.2.0 255.255.255.0
    nat (inside) 0 access-list nonat
    route inside 10.0.0.0 255.255.255.0 192.168.1.x
    access-list splitacl permit 192.168.1.0 255.255.255.0
    access-list splitacl permit 10.0.0.0 255.255.255.0
    group-policy VPNPolicy attributes
       split-tunnel-policy tunnelspecified
       split-tunnel-network-list value splitacl

  • Cannot access shared external drive on iMac from Windows 7

    Used to be able to access this drive with no problem from any of my PC's. Sent iMac in for repair and system drive was wiped so I'm starting from clean install of Leopard. Did all the updates first including 10.6.4 which wasn't on before the system drive died.
    Firewall is off
    SMB is on
    Everyone as well as main user has read write access to external drive
    iMac is in the same workgroup as machine, although it wasn't before and it worked fine.
    PC can ping the IP of the iMac and get a response, can see the iMac in list of networked computers
    but cannot access anything on it.
    Windows 7 network diagnostics says "file and print sharing resource (JMGIMAC) is online but isn't responding to connection attempts" "The remote computer isn't responding to connections on port 445
    I've tried everything, any ideas
    Josh

    I am familiar with the instructions for sharing files and have followed them (several times I might add).
    My problem is that the information that I place in the WINS tab ( in the Network Preference Pane) disappears when the iMac is re-started. This information (especially the Workgroup name) must appear when the computer re-boots. It doesn't and I have to re-enter the information in the iMac before I can access its files from a Windows PC.
    I have searched the internet for days trying to find an answer to this question. Although the problem seems to be fairly common, no solutions have been found.

  • Outlook 2007 Clients Cannot Access Free/Busy Calendar info. for Exchange 2010 Mailbox

    Hi:
    I have Outlook 2007 clients that cannot access Free/Busy Calendar info. for Exchange 2010 mailboxes.  They receive error like "...you do not have appropriate permissions..."
    If those same users logon to a machine running Outlook 2010 then they can view the free/busy info. of the other user's mailbox, so I believe the permissions are set correctly on the mailbox to allow the viewing.
    Any insights are greatly appreciated!
    Thank you!
    Bob Herman IT Tropolis

    Hi Herman,
    As you said, it seems users have proper permissions on mailbox.
    Please make sure users has Reviewer permission on Outlook 2007.
    Please try to run Outlook 2007 under safe mode or re-create profile.
    Also try to turn Outlook 2007 to Exchange Online mode from Cached mode.
    Thanks
    Mavis Huang
    TechNet Community Support

  • Windows 8.1 client cannot delete shared server files.

    We have one office that has a Windows 8.1 client on the network that cannot delete files in a shared folder on their server.
      The folder is a catch all folder for the copier to scan to and contains all the PDF files it creates.  When the one user tries to delete any of the PDF files they get an error saying the file is in use.  We have tested by deleting files from
    the server and also from other workstations.
      We have rebooted the computer and also tried to resolve it by specifically giving the user full rights to the folder, but the problem remains persistent.

    Hi,
    There are several possible reasons for your situation, you might don’t have a permission of this folder, the folder is in use, a corrupted file is in current folder.
    http://windows.microsoft.com/en-hk/windows/cant-delete-file-folder#1TC=windows-7  (Also applies for Windows 8.1)
    First, I suggest to log on the computer with an administrator account to delete the folder and disconnect the network connection if possible, second, Run your computer in safe mode to delete the folder or files, to run computer in safe mode:
    Restart your computer, meanwhile press F8 until you see the safe mode screen.
    Hit enter at safe mode, log on the system as an administrator.
    Find the folder or file you want delete.
    Regards
    Wade Liu
    TechNet Community Support

  • After installing windows 7 on my macbook pro, i cannot access my mac

    After installing windows 7 on my macbook pro late 2011, when I try to access the mac side of the computer it just stays in "thinking" mode and will not open up the mac. Windows side opens and works ok.
    I only know enough to try to uninstall windows 7 then hopefully open the mac and possibly reinstall the windows 7.
    PROBLEM: I only know how to uninstall windows 7 from the mac side (in the bootcamp) BUT cannot access it??
    Any help. Thank you
    <Edited By Host>

    Hi craig1045,
    It is possible that the file system for the volume containing the Mac operating system, or the OS itself has become damaged. I suggest that you follow the steps in this article to try to repair them -
    A flashing question mark or globe appears when you start your Mac
    http://support.apple.com/kb/TS1440
    Specifically -
    If your installation of OS X needs repair
    If you don't see your startup disk displayed in Startup Manager, or if you see a prohibitory symbol (⊘) appear, your startup drive may need directory repair, or OS X may need to be reinstalled.
    If you only see a disk named "Recovery HD" in Startup Manager, select it instead. You can also start from OS X Recovery by holding down Command and R on the keyboard at startup.
    From the Utilities menu, choose Disk Utility.
    In the Disk Utility window that appears, select your startup disk (usually named "Macintosh HD") from the left side of the Disk Utility window.
    Click the First Aid tab.
    Click Repair Disk to verify and repair any issues with your OS X startup disk.
    After repairing the disk, try to start up normally. 
    If none of these steps resolve the issue, start from OS X Recovery and reinstall OS X.
    Thanks for using Apple Support Communities.
    Best,
    Brett L

Maybe you are looking for