PIX 501 VPN users can log in but no remotedesktop

Login accepted by PIX but users cannot see the network nor remote desktop to their PC.
Using PDM 2.0 novice admin.
and ideas?

can they ping the private IP's of their PC?
-brad
www.ccbootcamp.com

Similar Messages

  • Can't Connect to Pix 501 VPN on Network

    Hi All,
    I have a software VPN client that connects just fine to the PIX 501 VPN, but I cannot ping or telnet to any services on the LAN. Below is my config and results of show cry ipsec sa. I would appreciate any suggestions to fix this.
    It's been a while since I have done this. When I check the DHCP address received from the VPN, the default gateway is missing. IIRC, that is normal. What is strange is that when I ping, Windows does not show any sent packets.
    Thanks,
    --Drichards38
    PIX Version 6.3(3)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password bgVy005CZTsaMOwR encrypted
    passwd bgVy005CZTsaMOwR encrypted
    hostname cisco
    domain-name xxxxxx.biz
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol ftp 1024-2048
    fixup protocol ftp 49152-65534
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list acl-out permit tcp any interface outside eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq telnet
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 60990
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq echo
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any interface inside eq www
    access-list acl_out permit tcp any interface inside eq ftp
    access-list acl_out permit tcp any interface inside eq 3389
    access-list acl_out permit tcp any interface inside eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 902
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list outside_cryptomap_dyn_20 permit ip any 10.0.0.0 255.0.0.0
    access-list split_tunnel_acl permit ip 10.0.0.0 255.0.0.0 any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside aa.bb.cc.dd 255.255.255.240
    ip address inside 192.168.93.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool low_vpn_pool 10.0.1.205-10.0.1.210
    pdm location 172.16.0.0 255.255.0.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.93.0 255.255.255.0 0 0
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.67 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.68 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.69 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.70 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.71 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.72 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.73 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.74 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.75 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.76 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.77 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.78 netmask 255.255.255.255 0 0
    access-group acl_out in interface outside
    rip inside default version 1
    route outside 0.0.0.0 0.0.0.0 aa.bb.cc.dd 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa authorization command LOCAL
    http server enable
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map client authentication LOCAL
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp nat-traversal 20
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup MY_VPN address-pool low_vpn_pool
    vpngroup MY_VPN dns-server 4.2.2.1
    vpngroup MY_VPN default-domain xxxxx.biz
    vpngroup MY_VPN split-tunnel split_tunnel_acl
    vpngroup MY_VPN idle-time 1800
    vpngroup MY_VPN password ********
    telnet 0.0.0.0 255.255.255.255 outside
    telnet 192.168.93.0 255.255.255.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 60
    console timeout 0
    dhcpd address 192.168.93.230-192.168.93.240 inside
    dhcpd dns ff.gg.hh.ii ff.gg.hh.ii
    dhcpd lease 65536
    dhcpd ping_timeout 750
    dhcpd domain xxxxxx.biz
    dhcpd auto_config outside
    dhcpd enable inside
    username xxxx password xxxxxxx encrypted privilege 15
    cisco(config)# show cry ipsec sa
    interface: outside
        Crypto map tag: outside_map, local addr. aa.bb.cc.dd
       local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
       remote ident (addr/mask/prot/port): (10.0.1.205/255.255.255.255/0/0)
       current_peer: jj.kk.ll.mm:1265
       dynamic allocated peer ip: 10.0.1.205
         PERMIT, flags={transport_parent,}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
        #pkts decaps: 38, #pkts decrypt: 38, #pkts verify 38
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: aa.bb.cc.dd, remote crypto endpt.: 97.93.95.133
         path mtu 1500, ipsec overhead 64, media mtu 1500
         current outbound spi: 3a898e67
         inbound esp sas:
          spi: 0xeeb64931(4004923697)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            slot: 0, conn id: 1, crypto map: outside_map
            sa timing: remaining key lifetime (k/sec): (4607993/28610)
            IV size: 8 bytes
            replay detection support: Y
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0x3a898e67(982093415)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            slot: 0, conn id: 2, crypto map: outside_map
            sa timing: remaining key lifetime (k/sec): (4608000/28574)
            IV size: 8 bytes
            replay detection support: Y
         outbound ah sas:
         outbound pcp sas:

    I just set the logging to high on all areas of the Cisco VPN client. Below is the resulting log. Everything looks ok from here:
    Cisco Systems VPN Client Version 5.0.03.0530
    Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved.
    Client Type(s): Windows, WinNT
    Running on: 5.1.2600 Service Pack 3
    29     09:57:02.887  09/03/12  Sev=Info/4    CM/0x63100002
    Begin connection process
    30     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100004
    Establish secure connection
    31     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100024
    Attempt connection with server "a.b.c.d"
    32     09:57:02.907  09/03/12  Sev=Info/6    IKE/0x6300003B
    Attempting to establish a connection with a.b.c.d.
    33     09:57:02.917  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to a.b.c.d
    34     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700008
    IPSec driver successfully started
    35     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    36     09:57:03.228  09/03/12  Sev=Info/6    IPSEC/0x6370002C
    Sent 47 packets, 0 were fragmented.
    37     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    38     09:57:03.979  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK AG (SA, VID(Xauth), VID(dpd), VID(Unity), VID(?), KE, ID, NON, VID(?), VID(Nat-T), NAT-D, NAT-D, HASH) from a.b.c.d
    39     09:57:04.039  09/03/12  Sev=Info/6    GUI/0x63B00012
    Authentication request attributes is 6h.
    40     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports XAUTH
    41     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports DPD
    42     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer is a Cisco-Unity compliant peer
    43     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000082
    Received IOS Vendor ID with unknown capabilities flag 0x000000A5
    44     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports NAT-T
    45     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000001
    IOS Vendor ID Contruction successful
    46     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to a.b.c.d
    47     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    48     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000083
    IKE Port in use - Local Port =  0x0421, Remote Port = 0x1194
    49     09:57:03.999  09/03/12  Sev=Info/5    IKE/0x63000072
    Automatic NAT Detection Status:
       Remote end is NOT behind a NAT device
       This   end IS behind a NAT device
    50     09:57:03.999  09/03/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
    51     09:57:04.029  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    52     09:57:04.029  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) from a.b.c.d
    53     09:57:04.029  09/03/12  Sev=Warning/2    IKE/0xA3000067
    Received Unexpected InitialContact Notify (PLMgrNotify:886)
    54     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    55     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d
    56     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 86400 seconds
    57     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000047
    This SA has already been alive for 2 seconds, setting expiry to 86398 seconds from now
    58     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    59     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    60     09:57:04.039  09/03/12  Sev=Info/4    CM/0x63100015
    Launch xAuth application
    61     09:57:09.327  09/03/12  Sev=Info/4    CM/0x63100017
    xAuth application returned
    62     09:57:09.327  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    63     09:57:09.367  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    64     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    65     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    66     09:57:09.367  09/03/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system
    67     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005E
    Client sending a firewall request to concentrator
    68     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005D
    Firewall Policy: Product=Cisco Systems Integrated Client Firewall, Capability= (Centralized Protection Policy).
    69     09:57:09.387  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    70     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    71     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    72     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.0.1.205
    73     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 4.2.2.1
    74     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = xxxx.biz
    75     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001
    76     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000F
    SPLIT_NET #1
        subnet = 10.0.0.0
        mask = 255.0.0.0
        protocol = 0
        src port = 0
        dest port=0
    77     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
    78     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
    79     09:57:09.427  09/03/12  Sev=Info/4    CM/0x63100019
    Mode Config data received
    80     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000056
    Received a key request from Driver: Local IP = 10.0.1.205, GW IP = a.b.c.d, Remote IP = 0.0.0.0
    81     09:57:09.437  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to a.b.c.d
    82     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    83     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d
    84     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 28800 seconds
    85     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000046
    RESPONDER-LIFETIME notify has value of 4608000 kb
    86     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH) to a.b.c.d
    87     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000059
    Loading IPsec SA (MsgID=D70550E6 OUTBOUND SPI = 0xB335C6DA INBOUND SPI = 0xE99E1A59)
    88     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000025
    Loaded OUTBOUND ESP SPI: 0xB335C6DA
    89     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000026
    Loaded INBOUND ESP SPI: 0xE99E1A59
    90     09:57:09.527  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255       172.16.0.11           0.0.0.0        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    91     09:57:10.448  09/03/12  Sev=Info/4    CM/0x63100034
    The Virtual Adapter was enabled:
        IP=10.0.1.205/255.0.0.0
        DNS=4.2.2.1,0.0.0.0
        WINS=0.0.0.0,0.0.0.0
        Domain=xxxx.biz
        Split DNS Names=
    92     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
           10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205       25
         10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25
    10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1
    255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    93     09:57:10.458  09/03/12  Sev=Info/4    CM/0x63100038
    Successfully saved route changes to file.
    94     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
           10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205        1
         10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25
    10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25
      a.b.c.d   255.255.255.255        172.16.0.1       172.16.0.11        1
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
         172.16.0.1   255.255.255.255       172.16.0.11       172.16.0.11        1
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1
    255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    95     09:57:10.458  09/03/12  Sev=Info/6    CM/0x63100036
    The routing table was updated for the Virtual Adapter
    96     09:57:10.508  09/03/12  Sev=Info/4    CM/0x6310001A
    One secure connection established
    97     09:57:10.618  09/03/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 172.16.0.11.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.
    98     09:57:10.638  09/03/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 10.0.1.205.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.
    99     09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    100    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    101    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0xdac635b3 into key list
    102    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    103    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0x591a9ee9 into key list
    104    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370002F
    Assigned VA private interface addr 10.0.1.205
    105    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700037
    Configure public interface: 172.16.0.11. SG: a.b.c.d
    106    09:57:10.638  09/03/12  Sev=Info/6    CM/0x63100046
    Set tunnel established flag in registry to 1.
    107    09:57:19.741  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    108    09:57:19.741  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445672
    109    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    110    09:57:19.772  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    111    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445672, seq# expected = 3951445672
    112    09:57:30.257  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    113    09:57:30.257  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445673
    114    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    115    09:57:30.297  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    116    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445673, seq# expected = 3951445673
    117    09:57:40.772  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    118    09:57:40.772  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445674
    119    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    120    09:57:40.802  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    121    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445674, seq# expected = 3951445674
    122    09:57:54.291  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    123    09:58:04.306  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    124    09:58:14.320  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    125    09:58:24.334  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    126    09:58:34.349  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    127    09:58:41.359  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    128    09:58:41.359  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445675
    129    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    130    09:58:41.389  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    131    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445675, seq# expected = 3951445675
    132    09:58:54.378  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    133    09:59:04.392  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    134    09:59:14.406  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    135    09:59:24.421  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    136    09:59:34.435  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    137    09:59:41.946  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    138    09:59:41.946  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445676
    139    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    140    09:59:41.976  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    141    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445676, seq# expected = 3951445676
    142    09:59:54.464  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA

  • ICal Server - User can log in from iPhone but not from Desktop Mac

    I've got quite the peculiar problem with iCal Server on OS X 10.6.6 - my users can log in and access the shared calendars using their iPhones. When I set up an the same account on their desktop Macs in iCal, I get an error message "The server did not recognize your user name or password for account <username@servername>".
    I'm positive that username and password are correct. The only thing I found about that in the log files was that the CalDAV server returns a 201 HTTP status code when accessing the account from the iPhone vs. a 407 status code when using iCal on their desktop Mac. The same accounts are used for Email, File Sharing and Address book, all of which run fine.
    Has anyone experienced a similar problem? Maybe even solved it?

    Solved it myself - there was a non-ASCII character in the account password. Strange that the iPhone didn't have a problem with that while iCal did. Now that I've changed the password to contain only ASCII characters, the problem is gone.

  • Only One Mobile User can Log In to Laptop

    I have a network account on my Mac Book Pro. I can log in no problem, access everything on the network, etc. but no one else can log in to this particular laptop. All of the other users can log into each other's identical Mac Book Pros, my account included. I have checked in my MBP's System Preferences > Accounts and the "Allow network users to login to this computer" checkbox is checked. The PDC is Leopard 10.5.6 running Open Directory.
    When one of the other network accounts tries to log in to my computer we get the following error:
    You are unable to login to the user account (username) at this time. Logging in to the account failed because of an error.
    I have googled that error but nothing seems to apply to this situation. Most of the postings found here and on the web are authenticating against Active Directory, and the assumption seems to be no one can log in, not just select accounts.
    I've done plenty of searching here and on Google but the description of the problem is hard to summarize so I'm posting my own question. Thank you in advance for any information you can provide.

    Is this a second hand phone? It sounds like the it is and the previous owner did not disable Activation Lock, the antitheft feature of iOS. If this is the case then the only solution is to get the previous owner to unlock it.

  • User SAP* is active. No other users can log on.  Now What?

    After the last time I restarted the portal, I get the following message when I try to logon:
    User SAP* is active. No other users can log on
    Before the reboot, I was trying to configure LDAP. I changed the Data source from "Database Only" to "Read-Only Microsoft ADS (Deep Hierarchy) + Database". I also, tried to create a Superuser/Password.  You can logon using SAP* and see the users from LDAP.
    Any thoughts?  Also, can anyone clarify the configuration option:
    SAP* User Configuration
    Enable SAP* user (If you disable the SAP* user, enter a superuser ID and password below)
    Superuser Name   
    Superuser Password
    EP6.0

    Bill,
    You have to assign a user the super admin role.  Once the user has this role, go to the UM Configuration (System Admin--> System Config --> UM Configuration) and uncheck the Enable SAP* User option and enter in the superuser name and superuser password.  Restart the portal and users should be able to login.
    FYI.  No users can login to the portal if sap* is active.
    Regards,
    Marty

  • How do I make it so users can log in and sign up on my adobe muse website

    How do I make it so users can log in and sign up on my adobe muse website?

    If you would read through the Muse forum, this subject has come up multiple times.
    Muse does not currently support CMS, passwords, logins or bespoke client areas.

  • I can't login on my Mac I am the administrator. Other users can log in.

    I Can not login to my mac desktop. I am the administrator. Other user can log in

    You might also want to take a look at this article:
    http://applehelpwriter.com/2011/09/21/how-to-uninstall-mackeeper-malware/
    These are instructions on how to remove the app MacKeeper if you have it in your Applications folder; you may or may not also have adware installed - in which case you can run the other app to get rid of it (it will not get rid of the MacKeeper application itself though if you have it) and/or it's adware simply advertising MacKeeper. If you do not wish to download that app, here are manual instructions from Apple on how to get rid of adware:
    Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support

  • Cannot access hot mail. can log in but not view email. Works fine with Exployer.

    This is a recent issuse. Worked fine 4 days ago. for last 3 days I can go to Windows live (my email account), I can log in, but that's all. When I click on my email tab, or any tab, nothing happens. I can go on line with Windows Exployer and it works fine.

    ''Adblock Plus may be blocking too much''
    Please update your filter subscriptions in "Adblock Plus".
    see "What to do when Adblock Plus blocks too much" within the following:
    * https://support.mozilla.com/en-US/questions/893525

  • Federated user can log into mailbox, but cannot send email

    Hello. Of several dozen federated users with mailboxes in Exchange Online, I have one user who suddenly cannot send mail from his own mailbox, always receiving a, "you do not have the required permission to send from this mailbox." He used to be
    able to send, and I've reviewed and compared his mailbox properties and mailbox permissions with other federated users, and I can find nothing to explain these errors. The "NT Authority\Self" identity is listed in the Send-As permission, just as
    it is on every other user's mailbox. I even tried explicitly adding the user's account to the Send-As permissions, which made no difference, so I removed it again.
    As I said, the user can successfully log into his mailbox and can read his mail, but all attempts to send anything out fail with the same error. Any ideas?
    Thanks,
    Mike

    Turns out the problem was caused by two things:
    1) the user has a K2 (kiosk) license
    2) in Settings, the user checked the box to "always show the From field"
    Apparently, despite the fact that this user had access to no mailboxes other than his own, when you turn on the From field, Exchange apparently does some sort of check for Send on Behalf of rights whenever the user hits Send, even on his own mailbox, and
    the Kiosk license excludes the ability to Send on Behalf Of any mailbox.
    The bottom line is that, unchecking the "always show From field" checkbox resolved the issue and allowed the user to again send mail.
    I'm a bit annoyed by this. If the Kiosk licenses limits a feature like this, then it should remove or deactivate the GUI element, to prevent it from causing this sort of error from occurring.

  • Vpn client can access internet but cannot access internal network

    I am using PIX 501 to setup a VPN. At first the VPN client cannot access the internet once they logged in via the Cisco system vpn client, so i enable split tunneling. Now the VPN client can access the internet but they can't access the internal network.Due to the limited characters can be posted here, only necessary IOS coding is posted on the next message. Who knows how to solve this problem? Pls Help.....

    enable password ********** encrypted
    passwd ********** encrypted
    hostname Firewall
    domain-name aqswdefrgt.com.sg
    access-list 100 permit ip 192.168.1.0 255.255.255.0 192.168.50.0 255.255.255.0
    access-list nat permit tcp any host 65.165.123.142 eq smtp
    access-list nat permit tcp any host 65.165.123.142 eq pop3
    access-list nat permit tcp any host 65.165.123.143 eq smtp
    access-list nat permit tcp any host 65.165.123.143 eq pop3
    access-list nat permit tcp any host 65.165.123.143 eq www
    access-list nat permit tcp any host 65.165.123.152 eq smtp
    access-list nat permit tcp any host 65.165.123.152 eq pop3
    access-list nat permit tcp any host 65.165.123.152 eq www
    access-list nat permit tcp any host 65.165.123.143 eq https
    access-list nat permit icmp any any
    ip address outside 65.165.123.4 255.255.255.240
    ip address inside 192.168.1.2 255.255.255.0
    ip verify reverse-path interface outside
    ip local pool clientpool 192.168.50.1-192.168.50.50
    global (outside) 1 interface
    nat (inside) 0 access-list 100
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) tcp 65.165.123.142 smtp 192.168.1.56 smtp netmask 255.255.2
    55.255 0 0
    static (inside,outside) tcp 65.165.123.142 pop3 192.168.1.56 pop3 netmask 255.255.2
    55.255 0 0
    static (inside,outside) tcp 65.165.123.143 smtp 192.168.1.55 smtp netmask 255.255.2
    55.255 0 0
    static (inside,outside) tcp 65.165.123.143 pop3 192.168.1.55 pop3 netmask 255.255.2
    55.255 0 0
    static (inside,outside) tcp 65.165.123.143 www 192.168.1.55 www netmask 255.255.255
    .255 0 0
    static (inside,outside) tcp 65.165.123.152 smtp 192.168.1.76 smtp netmask 255.255.
    255.255 0 0
    static (inside,outside) tcp 65.165.123.152 pop3 192.168.1.76 pop3 netmask 255.255.
    255.255 0 0
    static (inside,outside) tcp 65.165.123.152 www 192.168.1.76 www netmask 255.255.25
    5.255 0 0
    static (inside,outside) tcp 65.165.123.143 https 192.168.1.55 https netmask 255.255
    .255.255 0 0
    access-group nat in interface outside
    route outside 0.0.0.0 0.0.0.0 65.165.123.1 1
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa-server plexus protocol radius
    aaa-server plexus (inside) host 192.168.1.55 ******** timeout 5
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set myset esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto dynamic-map cisco 1 set transform-set myset
    crypto map dyn-map 20 ipsec-isakmp dynamic cisco
    crypto map dyn-map client authentication plexus
    crypto map dyn-map interface outside
    isakmp enable outside
    isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    isakmp policy 40 authentication pre-share
    isakmp policy 40 encryption 3des
    isakmp policy 40 hash md5
    isakmp policy 40 group 2
    isakmp policy 40 lifetime 86400
    vpngroup vpn3000 address-pool clientpool
    vpngroup vpn3000 dns-server 192.168.1.55
    vpngroup vpn3000 wins-server 192.168.1.55
    vpngroup vpn3000 default-domain aqswdefrgt.com.sg
    vpngroup vpn3000 idle-time 1800
    vpngroup vpn3000 password ********
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80

  • PIX 501 VPN HELP NO NETWORK ACCESS!

    I need some help please..
    I am trying to connect Windows 7 VPN to L2TP access on the PIX 501. I know that PIX 501 doesn't allow MSCHAP v2. The VPN connects fine but when trying to access the local network and shared drives remote desktop I am not able to connect. I already I have the IPV4 / IPV6 IP Settings on the VPN for use default gateway on remote network unchecked.  Can you please help me configure this correctly if I am configuring incorrectly.
    PIX Version 6.3(4)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd ANRIhDDsTteQmCkO encrypted
    hostname pixfirewall
    domain-name controller.hopto.org
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list out2in permit tcp any interface outside eq www
    access-list out2in permit tcp any interface outside eq https
    access-list out2in permit tcp any interface outside eq 3074
    access-list out2in permit udp any interface outside eq 88
    access-list out2in permit udp any interface outside eq 3074
    access-list out2in permit udp any interface outside eq domain
    access-list out2in permit tcp any interface outside eq domain
    access-list out2in permit udp any interface outside eq 1701
    access-list nonat permit ip 192.168.1.0 255.255.255.0 172.17.130.0 255.255.255.192
    access-list vpn-cryptomap permit ip any 172.17.130.0 255.255.255.0
    pager lines 24
    logging on
    logging timestamp
    logging standby
    logging buffered informational
    logging trap informational
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside 192.168.1.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool l2tp-pool 172.17.130.1-172.17.130.254
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 192.168.1.0 255.255.255.0 0 0
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) tcp interface www 192.168.1.33 www netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface https 192.168.1.2 https netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface domain 192.168.1.30 domain netmask 255.255.255.255 0 0
    static (inside,outside) udp interface domain 192.168.1.30 domain netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface 3074 192.168.1.30 3074 netmask 255.255.255.255 0 0
    static (inside,outside) udp interface 3074 192.168.1.30 3074 netmask 255.255.255.255 0 0
    static (inside,outside) udp interface 88 192.168.1.30 88 netmask 255.255.255.255 0 0
    access-group out2in in interface outside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt connection permit-l2tp
    crypto ipsec transform-set cisco-l2tp esp-3des esp-sha-hmac
    crypto ipsec transform-set cisco-l2tp mode transport
    crypto dynamic-map l2tp 30 set transform-set cisco-l2tp
    crypto map dmu 30 ipsec-isakmp dynamic l2tp
    crypto map dmu interface outside
    isakmp enable outside
    isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
    isakmp identity address
    isakmp nat-traversal 20
    isakmp policy 5 authentication pre-share
    isakmp policy 5 encryption 3des
    isakmp policy 5 hash sha
    isakmp policy 5 group 2
    isakmp policy 5 lifetime 28800
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 15
    console timeout 0
    vpdn group 2 accept dialin l2tp
    vpdn group 2 ppp authentication pap
    vpdn group 2 client configuration address local l2tp-pool
    vpdn group 2 client authentication local
    vpdn group 2 l2tp tunnel hello 60
    vpdn username Brandon password *********
    vpdn enable outside
    dhcpd address 192.168.1.2-192.168.1.33 inside
    dhcpd dns 4.2.2.1 4.2.2.2
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    username Brandon password PX78ZeD.LCbQntqy encrypted privilege 15
    terminal width 80
    Cryptochecksum:6e43dff6ef4837997276c092f9204707
    : end
    Thanks,
    Brandon

    Yes, you can modify it.
    By the way, here is a good link about MS:
    Troubleshooting Microsoft Network Neighborhood After Establishing a VPN Tunnel With the Cisco VPN Client
    HTH.
    Portu.

  • Pix 501 VPN Passthrough

    I am a novice/new cisco user. I have been struggling trying to configure a Cisco Pix 501 to allow passthrough of VPN traffic. I have reviewed many articles and posts but have not had success in putting the proper configuration together. I am running a Symantec VPN client to a Symantec Security Gateway. The VPN works fine when the PIX is out of the configuration.
    The Pix is version 6.3 and I also have PDM 3.0 working. I am new to the routing world. I understand most concepts but I seem to be missing a vital piece of information. The error on the symantec VPN client is as follows. Error connecting tunnel to xxx.xxx.xxx.xxx. The server rejected the ISAKMP Security association. Make sure the Phase1 ID's, shared key and IKE policy are correct.
    Thank you for your assistance.

    Hello Tom,
    I dont know if it works in 6x IOS but here is another inspection
    fixup protocol ipsec-pass-thru
    Also make sure that you did a one-to-one static mapping (conduits used in legacy IOS) for an unused public IP of yours because you can not PAT gre or esp to an internal host. And you may also need an outside acl
    access-list outside_access_in permit gre xxx
    access-list outside_access_in permit ipsec xx
    access-list outside_access_in permit esp xxx
    access-list outside_access_in permit ah xxx
    Regards

  • Cisco pix 501 VPN question

    Hi,
    We have a customer with a Pix 501(v6.3.4)(PDM v3.02) Firewall.
    We can succesfully setup a VPN connection, but the client loses the Internet connection when the VPN connection is up. I found some articles on the Internet about split tunneling, but I cant figure out how to do this.
    Can someone please help me out?

    I suppose 501 is Easy VPN server
    Split tunnel says what traffic goes to VPN tunnel if you dont have split tunnel enabled all traffic iis encrypted you need specify with ACL what traffic should be encrypted
    check following example whe is ACL 80 used for split tunnel
    http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172787.html#wp1062497
    M.
    Hope that helps rate if it does

  • PIX 501 VPN setup

    Can any one please advise me I am trying to set up a VPN on my PIX 501 and for some reason it is not working. I have posted the scrips below. If someone can advise me what I need to change that would be great.
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password P@55w0rd! encrypted
    passwd P@55w0rd! encrypted
    hostname CFSLXAKALAZ
    domain-name akademic.com
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    no fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    name 192.168.2.0 VPN
    object-group service RemoteDesktop tcp
    port-object range 3389 3389
    access-list inside_access_in remark Allow all outbound UDP port 53 for DNS
    access-list inside_access_in permit udp any any eq domain
    access-list inside_access_in remark Allow ping to any external IP
    access-list inside_access_in permit icmp any any
    access-list inside_access_in remark Allow all outbound TCP connections
    access-list inside_access_in permit tcp any any
    access-list outside_access_in remark Allow external DNS via UDP
    access-list outside_access_in permit udp any eq domain any
    access-list outside_access_in remark Allow ping from outside to inside
    access-list outside_access_in permit icmp any any
    access-list outside_access_in remark Remote Desktop to any internal IP
    access-list outside_access_in permit tcp any any object-group RemoteDesktop
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside 10.20.58.30 255.255.255.0
    ip address inside 192.168.2.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool donkpool 192.168.2.50-192.168.2.60
    pdm location 10.20.58.0 255.255.255.0 outside
    pdm location 192.168.2.0 255.255.255.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    route outside 0.0.0.0 0.0.0.0 10.20.58.1 1
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http 10.20.58.0 255.255.255.0 outside
    http 192.168.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    vpngroup donk address-pool donkpool
    vpngroup donk idle-time 1800
    vpngroup donk password P@55w0rd!
    telnet 10.20.58.30 255.255.255.0 outside
    telnet 192.168.2.0 255.255.255.0 inside
    telnet timeout 5
    ssh 10.20.58.0 255.255.255.0 outside
    ssh 192.168.2.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.128-192.168.2.252 inside
    dhcpd dns 158.152.1.58
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    terminal width 80
    terminal width 80

    You are missing a lot of config, depending on what type of vpn you are trying to setup please follow the links below to complete it:
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/ipsecint.html
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/sit2site.html
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/basclnt.html

  • ASA 5505 Anyconnect VPN Users can't access Internet

    Vpn user cannot access the internet but able to ping the lan network (192.168.1.0).. it seem like im missing a lan or nat rule.. Possibly allowing the vpn subnet 192.168.2.0 /24 to pass through to the internet.  Im looking to accomplish this without split tunneling.. Thanks

    on 8.2.5 version or lower:  Let say your inside hosts are accessing Internet by using dynamic nat index "1" and now you can use the same nat index "1" allow your vpn-pool range to be part of the same dynamic-nat index "1" to access the Internet.  Note I am natting source interface is be outside for vpn-client users because they (vpn-users) are physically coming off the outside interface.
    nat (outside) 1 192.168.2.0 255.255.255.0
    on 8.3 version or greater:  
    object network vpn-user-subnet
     subnet 192.168.2.0 255.255.255.0
     nat (outside,outside) dynamic interface
    Hope this helps.
    Thanks
    Rizwan Rafeek

Maybe you are looking for

  • Sound

    I just turned on my MacBook Pro and notice my sound isn't working, I only get a "click, Click" everytime a sound is suppose to come out? Any ideas, I've never had this problem before. Thanks!

  • Direct to Apple Tech ...Re: Anti sales version of iTunes

    I am currently locked out of iTunes,  Will Apple provide a new functioning version of iTunes that addresses/fixes this glitch of the current version anytime soon? I refuse to waste any more of my time (nor should anyone else) attempting to 'fix' an o

  • SRM Server failure

    Hi all, We are running SRM 550 Extended classic and ERP backend in a virtual server environment. Last week we had a major hardware failure that took down all SAP systems, SRM, ERP. After the repair our Basis team restarted all SAP systems and everyth

  • Aperture Beginner

    I started using Aperture last night for the first time after letting it sit there for about a year and have a few questions which I hope someone can help with. I have some add on's that I purchased a long time ago while on sale such as Nik photo effe

  • COGI Movement type Error

    there are many item numbers that appearing in COGI for the "Movement Type" "261." and error text as "Sales order stock 330000172 000010 does not exist". what might be the problem? how can i fix this? could anyone help plz