Quickvpn / client to gateway vpn rv042 can only ping router

I am setting up remote access using an RV042 router.  Using quickvpn or a client-to gateway vpn and shrewsoft client,  I can only access/ping the LAN side of the remote router and one machine on the remote network.  The PPTP server and native Windows 7 connection provide access to all machines on the remote network.
I have 2 possible reasons for this and would like to find the real reason:
1) The remote RV042 is behind another router, and that router restricts access other than the PPTP traffic.
2)  The VPN tunnels other than PPTP only allow access to the remote LAN side of the router and remote machines that have the remote router defined as their gateway in the IP configuration.
Any ideas?

I've narrowed the problem down to option 2 above. If I change the gateway of a LAN resource to point to the LAN side of the router, it can be accessed through the VPN tunnel. 
I haven't had time to see if adding routing entries can fix this problem.  Any suggestions will be appreciated.
Also, I would appreciate an explanation of why the PPTP connection works.  I will research this myself (eventually) but am  already backed up with other projects..

Similar Messages

  • VPN client connected to VPN but can't ping or access to server

    HI ,
    i need help urgently, had been troubleshooting for a day, but have no ideal what wrong with the config.
    Basically there is 2 set of VPN configured, one is site to site IPSEC VPN and another one is connect via VPN client software coexist in same router.
    This recently we having problem on client can't access or ping to internal server which is 192.168.6.3 from VPN client software.
    VPN client will connect to VPN ip pool as10.20.1.0 to 10.20.1.100
    Software itself shown connected but request time out when ping.
    Below is the config. Some of the command might be extra as when i did some test, but end up didn't work.
    aaa new-model
    aaa authentication login userauthen local
    aaa authorization network adminmap group VPNClient
    aaa authorization network groupauthor local
    aaa authorization network map-singapore local
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key emptyspace address 203.142.83.218 no-xauth
    crypto isakmp keepalive 15 periodic
    crypto isakmp client configuration address-pool local ippool
    crypto isakmp client configuration group map-singapore
    key cisco123
    dns 192.168.6.3
    domain cisco.com
    pool ippool
    acl 102
    crypto isakmp profile VPNclient
       match identity address 27.54.43.210 255.255.255.255
       match identity group vpnclient
       client authentication list userauthen
       client configuration address respond
    crypto ipsec security-association idle-time 86400
    crypto ipsec transform-set REMSET esp-3des esp-md5-hmac
    crypto ipsec transform-set DYNSET esp-aes esp-md5-hmac
    crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10
    set transform-set DYNSET
    set isakmp-profile VPNclient
    reverse-route
    crypto map VPNMAP client authentication list userauthen
    crypto map VPNMAP isakmp authorization list map-singapore
    crypto map VPNMAP client configuration address respond
    crypto map VPNMAP 10 ipsec-isakmp dynamic dynmap
    crypto map VPNMAP 11 ipsec-isakmp
    description VPN to ASA5520
    set peer 203.142.83.218
    set security-association lifetime kilobytes 14608000
    set security-association lifetime seconds 86400
    set transform-set REMSET
    match address 100
    interface GigabitEthernet0/0
    ip address 27.54.43.210 255.255.255.240
    ip nat outside
    no ip virtual-reassembly
    duplex full
    speed 100
    crypto map VPNMAP
    interface GigabitEthernet0/1
    ip address 192.168.6.1 255.255.255.0
    ip nat inside
    no ip virtual-reassembly
    duplex full
    speed 100
    interface GigabitEthernet0/2
    description $ES_LAN$
    no ip address
    shutdown
    duplex auto
    speed auto
    ip local pool ippool 10.20.1.0 10.20.1.100
    ip forward-protocol nd
    ip pim bidir-enable
    no ip http server
    ip http authentication local
    no ip http secure-server
    ip nat inside source list 1 interface GigabitEthernet0/0 overload
    ip nat inside source list 101 interface GigabitEthernet0/0 overload
    ip nat inside source route-map nonat interface GigabitEthernet0/0 overload
    ip nat inside source static 192.168.6.3 27.54.43.212
    ip route 0.0.0.0 0.0.0.0 27.54.43.209
    ip route 192.168.1.0 255.255.255.0 27.54.43.209
    ip route 192.168.151.0 255.255.255.0 192.168.6.151
    ip route 192.168.208.0 255.255.255.0 27.54.43.209
    ip access-list extended RA_SING
    permit ip 192.168.6.0 0.0.0.255 192.168.1.0 0.0.0.255
    permit ip 192.168.6.0 0.0.0.255 10.0.0.0 0.255.255.255
    permit ip 10.0.0.0 0.255.255.255 192.168.6.0 0.0.0.255
    permit ip 192.168.6.0 0.0.0.255 192.168.208.0 0.0.0.255
    permit ip 10.20.1.1 0.0.0.100 192.168.6.0 0.0.0.255
    permit ip 10.20.1.0 0.0.0.255 10.0.0.0 0.255.255.255
    deny   ip any any log
    access-list 1 remark Local Network
    access-list 1 permit 192.168.6.0 0.0.0.255
    access-list 1 permit 192.168.102.0 0.0.0.255
    access-list 1 permit 192.168.151.0 0.0.0.255
    access-list 2 remark VPNClient-range
    access-list 2 permit 10.0.0.0 0.255.255.255
    access-list 10 permit 192.168.6.0 0.0.0.255
    access-list 10 permit 192.168.102.0 0.0.0.255
    access-list 10 permit 192.168.151.0 0.0.0.255
    access-list 10 permit 10.0.0.0 0.255.255.255
    access-list 100 permit ip 192.168.6.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 100 permit ip 192.168.102.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 100 permit ip 192.168.6.0 0.0.0.255 192.168.208.0 0.0.0.255
    access-list 100 permit ip host 192.168.6.7 host 192.168.208.48
    access-list 101 deny   ip 192.168.6.0 0.0.0.255 10.0.0.0 0.255.255.255
    access-list 101 permit ip 10.0.0.0 0.255.255.255 any
    access-list 101 permit ip 192.168.6.0 0.0.0.255 any
    access-list 102 permit ip 10.0.0.0 0.255.255.255 any
    access-list 120 deny   ip any any log
    access-list 120 deny   ip 192.168.6.0 0.0.0.255 192.168.1.0 0.0.0.255 log
    access-list 120 deny   ip 192.168.6.0 0.0.0.255 10.0.0.0 0.255.255.255
    access-list 120 deny   ip 192.168.6.0 0.0.0.255 192.168.208.0 0.0.0.255
    no cdp run
    route-map nonat permit 10
    match ip address 120
    control-plane
    alias isakmp-profile sh crypto isakmp sa
    alias exec ipsec sh crypto ipsec sa
    banner motd ^CC^C

    I did not try to ping 4.2.2.2. I just know I can not ping comcasts dns servers. I have updated the firmware on the router and it did not work. The computer was able to access the internet until about a week ago, I don't understand what could have changed that I would now need a static DNS.

  • RV320 Client-to-Gateway VPN IP address

    Is there anyway to have the VPN client be a member of the LAN IP address space - VPN bridge mode? Would like for the client machine to be in the same address space so it can discover printers, scanners, broadcast packets, Bounjour discovery, NETBIOS broadcasts, etc.
    The RV320 seems to enforce: "Start IP can not be in LAN or Multi-Subnet IP range"
    VPN client-to-gateway works well using VPN Tracker 8 from e-quinux.
    73/gus
    Dr. Gus Lott

    Hello Kevin,
    Thanks for responding!
    We have one headquarter - unfortunately I called it location B - and a new branch Location A with a newly purchased RV0082, new computer, it needs to be connected to the headquarter's server to have access to inventory software located on the server.
    The document you shared was well used already for the recent days and was great help.
    The setup from headquarter was not mine, I found out today that apparently there is a router between splitter and the RV082 - a Comcast business router, and its address is the one RV082 pulls.
    I have no idea how I can work around the Comcast router, I can't attach the RV082 directly to the splitter and I can't simply unplug the Comcast router because of other services it provides.
    I reset the Comcast router to gain access with default login, but it failed - seems to be a usual problem as far as I could find out via internet.
    Is there any way that I can create a VPN tunnel with the comcast router in between?
    The headquarter is an actively running store, the new location opens Saturday (I'm a kind of in a hurry)
    I very much hope you have a hint for me.
    Thanks,
    PS: I just learned that the splitter is only for telephone. So it's a parallel structure: incoming cable splits in TV, Telephone and the Comcast router. It looks like I have to live with the Comcast router in between.
    Thanks so much for any help

  • Cisco ASA 5510 - Cisco Client Can Connect To VPN But Can't Ping!

    Hi,
    I have an ASA 5510 with the configuration below. I have configure the ASA as remote access vpn server with cisco vpn client, my problem now is I can connect but I can't ping.
    Config
    ciscoasa# sh run
    : Saved
    ASA Version 8.0(3)
    hostname ciscoasa
    enable password 5QB4svsHoIHxXpF/ encrypted
    names
    name xxx.xxx.xxx.xxx SAP_router_IP_on_SAP
    name xxx.xxx.xxx.xxx ISA_Server_second_external_IP
    name xxx.xxx.xxx.xxx Mail_Server
    name xxx.xxx.xxx.xxx IncomingIP
    name xxx.xxx.xxx.xxx SAP
    name xxx.xxx.xxx.xxx WebServer
    name xxx.xxx.xxx.xxx cms_eservices_projects_sharepointold
    name 192.168.2.2 isa_server_outside
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address IncomingIP 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.253 255.255.255.0
    management-only
    passwd 123
    ftp mode passive
    clock timezone EEST 2
    clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
    object-group service TCP_8081 tcp
    port-object eq 8081
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq 3389
    port-object eq ftp
    port-object eq www
    port-object eq https
    port-object eq smtp
    port-object eq pop3
    port-object eq 3200
    port-object eq 3300
    port-object eq 3600
    port-object eq 3299
    port-object eq 3390
    port-object eq 50000
    port-object eq 3396
    port-object eq 3397
    port-object eq 3398
    port-object eq imap4
    port-object eq 587
    port-object eq 993
    port-object eq 8000
    port-object eq 8443
    port-object eq telnet
    port-object eq 3901
    group-object TCP_8081
    port-object eq 1433
    port-object eq 3391
    port-object eq 3399
    port-object eq 8080
    port-object eq 3128
    port-object eq 3900
    port-object eq 3902
    port-object eq 7777
    port-object eq 3392
    port-object eq 3393
    port-object eq 3394
    port-object eq 3395
    port-object eq 92
    port-object eq 91
    port-object eq 3206
    port-object eq 8001
    port-object eq 8181
    port-object eq 7778
    port-object eq 8180
    port-object eq 22222
    port-object eq 11001
    port-object eq 11002
    port-object eq 1555
    port-object eq 2223
    port-object eq 2224
    object-group service RDP tcp
    port-object eq 3389
    object-group service 3901 tcp
    description 3901
    port-object eq 3901
    object-group service 50000 tcp
    description 50000
    port-object eq 50000
    object-group service Enable_Transparent_Tunneling_UDP udp
    port-object eq 4500
    access-list inside_access_in remark connection to SAP
    access-list inside_access_in extended permit ip 192.168.2.0 255.255.255.0 host SAP_router_IP_on_SAP
    access-list inside_access_in remark VPN Outgoing - PPTP
    access-list inside_access_in extended permit tcp 192.168.2.0 255.255.255.0 any eq pptp
    access-list inside_access_in remark VPN Outgoing - GRE
    access-list inside_access_in extended permit gre 192.168.2.0 255.255.255.0 any
    access-list inside_access_in remark VPN - GRE
    access-list inside_access_in extended permit gre any any
    access-list inside_access_in remark VPN Outgoing - IKE Client
    access-list inside_access_in extended permit udp 192.168.2.0 255.255.255.0 any eq isakmp
    access-list inside_access_in remark VPN Outgoing - IPSecNAT - T
    access-list inside_access_in extended permit udp 192.168.2.0 255.255.255.0 any eq 4500
    access-list inside_access_in remark DNS Outgoing
    access-list inside_access_in extended permit udp any any eq domain
    access-list inside_access_in remark DNS Outgoing
    access-list inside_access_in extended permit tcp any any eq domain
    access-list inside_access_in remark Outoing Ports
    access-list inside_access_in extended permit tcp 192.168.2.0 255.255.255.0 any object-group DM_INLINE_TCP_1
    access-list inside_access_in extended permit ip 172.16.1.0 255.255.255.0 any
    access-list outside_access_in extended permit ip any any
    access-list outside_access_in extended permit tcp any any eq pptp
    access-list outside_access_in extended permit gre any any
    access-list outside_access_in extended permit gre any host Mail_Server
    access-list outside_access_in extended permit tcp any host Mail_Server eq pptp
    access-list outside_access_in extended permit esp any any
    access-list outside_access_in extended permit ah any any
    access-list outside_access_in extended permit udp any any eq isakmp
    access-list outside_access_in extended permit udp any any object-group Enable_Transparent_Tunneling_UDP
    access-list VPN standard permit 192.168.2.0 255.255.255.0
    access-list corp_vpn extended permit ip 192.168.2.0 255.255.255.0 172.16.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool POOL 172.16.1.10-172.16.1.20 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-603.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 2 Mail_Server netmask 255.0.0.0
    global (outside) 1 interface
    global (inside) 2 interface
    nat (inside) 0 access-list corp_vpn
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp Mail_Server 8001 ISA_Server_second_external_IP 8001 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 8000 ISA_Server_second_external_IP 8000 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server pptp isa_server_outside pptp netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server smtp isa_server_outside smtp netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 587 isa_server_outside 587 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 9444 isa_server_outside 9444 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 9443 isa_server_outside 9443 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 3389 isa_server_outside 3389 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 3390 isa_server_outside 3390 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server 3901 isa_server_outside 3901 netmask 255.255.255.255
    static (inside,outside) tcp SAP 50000 isa_server_outside 50000 netmask 255.255.255.255
    static (inside,outside) tcp SAP 3200 isa_server_outside 3200 netmask 255.255.255.255
    static (inside,outside) tcp SAP 3299 isa_server_outside 3299 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server www isa_server_outside www netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server https isa_server_outside https netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server pop3 isa_server_outside pop3 netmask 255.255.255.255
    static (inside,outside) tcp Mail_Server imap4 isa_server_outside imap4 netmask 255.255.255.255
    static (inside,outside) tcp cms_eservices_projects_sharepointold 9999 isa_server_outside 9999 netmask 255.255.255.255
    static (inside,outside) 192.168.2.0  access-list corp_vpn
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set transet esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set pfs
    crypto dynamic-map dynmap 10 set transform-set transet ESP-3DES-SHA
    crypto map cryptomap 10 ipsec-isakmp dynamic dynmap
    crypto map cryptomap interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    no crypto isakmp nat-traversal
    telnet 192.168.2.0 255.255.255.0 inside
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd dns xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx interface inside
    dhcpd domain domain.local interface inside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    tftp-server management 192.168.1.123 /
    group-policy mypolicy internal
    group-policy mypolicy attributes
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN
    username vpdn password 123
    username vpdn attributes
    vpn-group-policy mypolicy
    service-type remote-access
    tunnel-group mypolicy type remote-access
    tunnel-group mypolicy general-attributes
    address-pool POOL
    default-group-policy mypolicy
    tunnel-group mypolicy ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:b8bb19b6cb05cfa9ee125ad7bc5444ac
    : end
    Thank you very much.

    Here is the output:
    ciscoasa# packet-tracer input outside icmp 172.16.1.10 8 0 192.168.2.1
    Phase: 1
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 2
    Type: UN-NAT
    Subtype: static
    Result: ALLOW
    Config:
    static (inside,outside) 192.168.2.0  access-list corp_vpn
    nat-control
      match ip inside 192.168.2.0 255.255.255.0 outside 172.16.1.0 255.255.255.0
        static translation to 192.168.2.0
        translate_hits = 0, untranslate_hits = 139
    Additional Information:
    NAT divert to egress interface inside
    Untranslate 192.168.2.0/0 to 192.168.2.0/0 using netmask 255.255.255.0
    Phase: 3
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group outside_access_in in interface outside
    access-list outside_access_in extended permit ip any any
    Additional Information:
    Phase: 4
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 5
    Type: CP-PUNT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 6
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    Additional Information:
    Phase: 7
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 8
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 9
    Type: NAT-EXEMPT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 10
    Type: NAT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    static (inside,outside) 192.168.2.0  access-list corp_vpn
    nat-control
      match ip inside 192.168.2.0 255.255.255.0 outside 172.16.1.0 255.255.255.0
        static translation to 192.168.2.0
        translate_hits = 0, untranslate_hits = 140
    Additional Information:
    Phase: 11
    Type: ACCESS-LIST
    Subtype:
    Result: DROP
    Config:
    Implicit Rule
    Additional Information:
    Result:
    input-interface: outside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule

  • ASA 5505 VPN clients can't ping router or other clients on network

    I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
    Result of the command: "show running-config"
    : Saved
    ASA Version 7.2(4)
    hostname ASA
    domain-name default.domain.invalid
    enable password kdnFT44SJ1UFX5Us encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.4 Server
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list vpn_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
    static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface www Server www netmask 255.255.255.255
    static (inside,outside) tcp interface https Server https netmask 255.255.255.255
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable 480
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    group-policy vpn internal
    group-policy vpn attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_splitTunnelAcl
    username admin password wwYXKJulWcFrrhXN encrypted privilege 15
    username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
    username VPNuser attributes
    vpn-group-policy vpn
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool VPNpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:df7d1e4f34ee0e155cebe86465f367f5
    : end
    Any ideas what I need to add to get the vpn client to be able to ping the router and clients?
    Thanks.

    I tried that and it didn't work. As for upgrading the ASA version, I'd like to but this is an old router and I don't have a support contract with Cisco anymore, so I can't access the latest firmware.
    here is the runnign config again:
    Result of the command: "show startup-config"
    : Saved
    : Written by enable_15 at 01:48:37.789 MDT Wed Jun 20 2012
    ASA Version 7.2(4)
    hostname ASA
    domain-name default.domain.invalid
    enable password kdnFT44SJ1UFX5Us encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.4 Server
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list vpn_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    asdm location Server 255.255.255.255 inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
    static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface www Server www netmask 255.255.255.255
    static (inside,outside) tcp interface https Server https netmask 255.255.255.255
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable 480
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    group-policy vpn internal
    group-policy vpn attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_splitTunnelAcl
    username admin password wwYXKJulWcFrrhXN encrypted privilege 15
    username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
    username VPNuser attributes
    vpn-group-policy vpn
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool VPNpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:78864f4099f215f4ebdd710051bdb493

  • I can connect my cisco mobile vpn but can't ping & access internal IP

    Hi somebody,
    i've configured mobile vpn configuration in cisco 7200 with GNS3. i can connect VPN to my cisco router with cisco vpn client software from outside. but i can't ping to internal ip and can't access internal resources.
    My Internal IP is 192.168.1.x . And IP for mobile VPN client from outside is 172.60.1.x.
    Your advise will be appreciate.
    here is my configuration with cisco 7200 in GNS 3,
    OfficeVPN_Router#sh run
    Building configuration...
    Current configuration : 2186 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname OfficeVPN_Router
    boot-start-marker
    boot-end-marker
    enable secret 5 $1$E0Gz$U8UzNtHOXy2CeoEFj30by0
    aaa new-model
    aaa authentication login userlist local
    aaa authorization network grouplist local
    aaa session-id common
    ip cef
    no ip domain lookup
    username asm privilege 15 password 0 pncsadmin
    username user privilege 15 password 0 pncsadmin
    username user1 privilege 15 password 0 pncsadmin
    username cisco123 secret 5 $1$lCOc$Db.e8AFd/0f02ZI4/aeV./
    crypto isakmp policy 10
    encr aes
    authentication pre-share
    group 2
    crypto isakmp client configuration group MWG
    key cisco
    dns 165.21.83.88
    pool vpnpool
    acl 101
    netmask 255.255.0.0
    crypto ipsec transform-set myset esp-aes esp-sha-hmac
    crypto dynamic-map dynmap 10
    set transform-set myset
    reverse-route
    crypto map mymap client authentication list userlist
    crypto map mymap isakmp authorization list grouplist
    crypto map mymap client configuration address initiate
    crypto map mymap client configuration address respond
    crypto map mymap 10 ipsec-isakmp dynamic dynmap
    interface FastEthernet0/0
    no ip address
    shutdown
    duplex half
    interface FastEthernet1/0
    ip address 192.168.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex full
    speed 100
    interface FastEthernet1/1
    ip address 200.200.200.200 255.255.255.0
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map mymap
    ip local pool vpnpool 172.60.1.10 172.60.1.100
    no ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 200.200.200.201
    no ip http server
    no ip http secure-server
    ip nat inside source list 111 interface FastEthernet1/1 overload
    access-list 101 permit ip 192.168.1.0 0.0.0.255 172.60.0.0 0.0.255.255
    access-list 111 deny   ip 192.168.1.0 0.0.0.255 172.60.0.0 0.0.255.255
    access-list 111 permit ip any any
    control-plane
    gatekeeper
    shutdown
    line con 0
    exec-timeout 0 0
    password cisco123
    logging synchronous
    stopbits 1
    line aux 0
    stopbits 1
    line vty 0 4
    password cisco123
    end
    OfficeVPN_Router#sh ver
    Cisco IOS Software, 7200 Software (C7200-A3JK9S-M), Version 12.4(25), RELEASE SOFTWARE (fc2)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2009 by Cisco Systems, Inc.
    Compiled Tue 21-Apr-09 18:50 by prod_rel_team
    ROM: ROMMON Emulation Microcode
    BOOTLDR: 7200 Software (C7200-A3JK9S-M), Version 12.4(25), RELEASE SOFTWARE (fc2)
    OfficeVPN_Router uptime is 30 minutes
    System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19
    System image file is "tftp://255.255.255.255/unknown"
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco 7206VXR (NPE400) processor (revision A) with 245760K/16384K bytes of memory.
    Processor board ID 4279256517
    R7000 CPU at 150MHz, Implementation 39, Rev 2.1, 256KB L2 Cache
    6 slot VXR midplane, Version 2.1
    Last reset from power-on
    PCI bus mb0_mb1 (Slots 0, 1, 3 and 5) has a capacity of 600 bandwidth points.
    Current configuration on bus mb0_mb1 has a total of 600 bandwidth points.
    This configuration is within the PCI bus capacity and is supported.
    PCI bus mb2 (Slots 2, 4, 6) has a capacity of 600 bandwidth points.
    Current configuration on bus mb2 has a total of 0 bandwidth points
    This configuration is within the PCI bus capacity and is supported.
    Please refer to the following document "Cisco 7200 Series Port Adaptor
    Hardware Configuration Guidelines" on Cisco.com <http://www.cisco.com>
    for c7200 bandwidth points oversubscription and usage guidelines.
    3 FastEthernet interfaces
    125K bytes of NVRAM.
    65536K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes).
    8192K bytes of Flash internal SIMM (Sector size 256K).
    Configuration register is 0x2102
    OfficeVPN_Router#

    Dear Javier ,
    Thanks for your info. i already tested as you say. but still i can't use & ping to my internal IP which is behind cisco VPN router. i posted my config file.
    OfficeVPN_Router(config)#ip access-list resequence 111 10 10
    OfficeVPN_Router(config)#do sh run
    Building configuration...
    Current configuration : 2201 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname OfficeVPN_Router
    boot-start-marker
    boot-end-marker
    enable secret 5 $1$E0Gz$U8UzNtHOXy2CeoEFj30by0
    aaa new-model
    aaa authentication login userlist local
    aaa authorization network grouplist local
    aaa session-id common
    ip cef
    no ip domain lookup
    username asm privilege 15 password 0 pncsadmin
    username user privilege 15 password 0 pncsadmin
    username user1 privilege 15 password 0 pncsadmin
    username cisco123 secret 5 $1$lCOc$Db.e8AFd/0f02ZI4/aeV./
    crypto isakmp policy 10
    encr aes
    authentication pre-share
    group 2
    crypto isakmp client configuration group MWG
    key cisco
    dns 165.21.83.88
    pool vpnpool
    acl 101
    netmask 255.255.0.0
    crypto ipsec transform-set myset esp-aes esp-sha-hmac
    crypto dynamic-map dynmap 10
    set transform-set myset
    reverse-route
    crypto map mymap client authentication list userlist
    crypto map mymap isakmp authorization list grouplist
    crypto map mymap client configuration address initiate
    crypto map mymap client configuration address respond
    crypto map mymap 10 ipsec-isakmp dynamic dynmap
    interface FastEthernet0/0
    no ip address
    shutdown
    duplex half
    interface FastEthernet1/0
    ip address 192.168.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex full
    speed 100
    interface FastEthernet1/1
    ip address 200.200.200.200 255.255.255.0
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map mymap
    ip local pool vpnpool 172.60.1.10 172.60.1.100
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 200.200.200.201
    no ip http server
    no ip http secure-server
    ip nat inside source list 111 interface FastEthernet1/1 overload
    access-list 101 permit ip 192.168.1.0 0.0.0.255 172.60.0.0 0.0.255.255
    access-list 111 deny   ip 192.168.1.0 0.0.0.255 172.60.0.0 0.0.255.255
    access-list 111 permit ip 192.168.1.0 0.0.0.255 any
    control-plane
    gatekeeper
    shutdown
    line con 0
    exec-timeout 0 0
    password cisco123
    logging synchronous
    stopbits 1
    line aux 0
    stopbits 1
    line vty 0 4
    password cisco123
    end

  • Can only ping, nothing else

    Hi,
    I am in contact with BT regarding this problem, but since there seems to be no progress there I thought I'd try this. I had my BT infinity installed last Wednesday (after an amazing wait of 2 months). Anyway, the engineer installed everything, all lights on the modem are green, all lights on the hub are blue, but I have no internet connection. I can ping machines on the internet (such as 8.8.4.4), but that's it. DNS doesn't work, nor anything else; only ping. BT sent 3 engineers so far; they all say the line is fine, and they don't know what to do. I also ran out of ideas of what else to try; naturally I have checked firewalls etc. on my end, tried multiple devices, wireless/wired, different cables, etc. The engineers also tried different equipement, replaced modem, hub, nothing changed. To me it seems like BT is blocking me somewhere, but all the helpdesk people say all seems fine from their end and they do not know what could be wrong. Did anyone else ever experience anything like this?

    I get what seems like a reasonable trace route:
    > tracert 8.8.8.8
    Tracing route to 8.8.8.8 over a maximum of 30 hops
      1     1 ms    <1 ms    <1 ms  api.home [192.168.1.254]
      2    21 ms    20 ms    20 ms  217.32.141.144
      3    21 ms    21 ms    21 ms  217.32.141.222
      4    25 ms    25 ms    24 ms  213.120.161.58
      5    23 ms    23 ms    23 ms  31.55.164.227
      6    23 ms    23 ms    24 ms  31.55.164.109
      7    24 ms    24 ms    24 ms  109.159.248.232
      8    35 ms    35 ms    35 ms  109.159.248.156
      9    32 ms    35 ms    35 ms  62.172.103.189
     10   114 ms    28 ms    28 ms  194.72.9.2
     11    27 ms    28 ms    28 ms  166.49.168.1
     12    28 ms    27 ms    28 ms  166.49.237.25
     13    28 ms    28 ms    28 ms  166.49.164.138
     14    63 ms    40 ms    30 ms  166.49.135.48
     15    34 ms    29 ms    41 ms  166.49.214.134
     16    28 ms    28 ms    29 ms  209.85.240.61
     17    29 ms    29 ms    29 ms  209.85.253.90
     18    35 ms    35 ms    35 ms  209.85.240.28
     19    72 ms    37 ms    37 ms  216.239.49.36
     20     *       40 ms    39 ms  209.85.255.118
     21    38 ms    38 ms    38 ms  8.8.8.8
    Trace complete.

  • WinXp Pro as Virtualbox Guest can't ping router/internet

    Hi:
    I am running Arch 64 and installed virtualbox_bin 2.0.4-1 from AUR and guest additions 2.0.2-1 from AUR.
    I have installed as a guest os, WinXP Pro and set up bridge networking per
    http://mychael.gotdns.com/blog/2007/05/ … -bridging/.
    My Arch host works fine (it can access the internet and ping the guest WinXP Pro). My WinXP Pro guest can ping my Arch host and other local machines on my network. However it cannot ping my router or access or ping the internet.
    I log onto the WinXP Pro as the Administrator and I have the firewall disabled, so I don't think it is being blocked on the XP side by anything.
    As far as Arch goes, I have tried adding the host name of the WinXP Pro machine to /etc/hosts and put the ip adress of the XP machine into /etc/hosts.allow. Neither of these actions resulted in success. I don't think I have a firewall or other special security measures on my Arch? I just did a fresh ftp install yesterday and did not add ssh or other security measures that weren't included in the default install and the base-devel install.
    My search of the forums turned up a similar problem to mine that was solved by removing the firewall in the WinXP guest. I have already done that still without success.
    My uneducated guess is that the gateway ip is not getting to the guest. I am using static ip for both the Arch host and the WinXP guest. The WinXP guest says that it is connected and reports no problems. I tried using dhcp on the XP guest but that didn't work either.
    Here is the network section of my /etc/rc.conf
    lo="lo 127.0.0.1"
    BRIDGE_INTERFACES=(br0)
    bridge_br0=(eth0)
    br0="br0 192.168.1.201 netmask 255.255.255.0 broadcast 192.168.0.255"
    eth0="eth0 0.0.0.0 promisc"
    INTERFACES=(lo br0 eth0)
    gateway="default gw 192.168.1.1"
    ROUTES=(gateway)
    Any help would be much appreciated.
    bdika

    Hi Floris:
    Thanks for the reply.
    I originally tried the Arch Way without success, that is why I tried the other way.
    However at your suggestion, I have tried the Arch Way again, with the same results. That is I can ping other computers on my network but I can't ping my router nor access the internet from my guest.
    Seeing that I have the same problem regardless of which method I use leads me to believe that it must be something simple and obvious that I am doing wrong. But what??! I have no idea.
    Any thoughts you have would be much appreciated.
    bdika

  • NW Client 3.4 - unattend.txt -- can only be created/edited on W98 for W98

    FYI:
    After spinning my wheels, trying to figure out why the ACU.EXE and
    SETUP.EXE /ACU options wouldn't install with an UNATTEND.TXT, I dis-
    covered the problem had to do with having created the file on a Win2K
    system.
    Unpacking the Novell Client 3.4 on my Windows 2000 professional
    I mistakenly thought I could run the NCIMAN.EXE, for version 3.4,
    create the UNATTEND.TXT file, and then use this with my install.
    Unfortunately, NCIMAN.EXE senses what system you're on and saves the
    UNATTEND.TXT file under whatever format is consistant with the O/S
    you're working on. [There doesn't seem to be any way to tell NCIMAN
    to save the configuration file for a different O/S.]
    If, like myself, you miss this . . . the UNATTEND.TXT file will be created
    (or saved after editing) under a Windows 2000 format--which won't run
    on a Client 3.4 install. [You can verify the version it was saved under
    by looking at the second line of the UNATTEND.TXT file . . . the one
    that reads: "Novell_Client=" ("95" for Win95/98) or "NT" (for 2000 or
    XP).]
    'Hope this saves some others from similar grief . . .
    Steve Conrad

    [email protected] wrote:
    > FYI:
    >
    > After spinning my wheels, trying to figure out why the ACU.EXE and
    > SETUP.EXE /ACU options wouldn't install with an UNATTEND.TXT, I dis-
    > covered the problem had to do with having created the file on a Win2K
    > system.
    >
    > Unpacking the Novell Client 3.4 on my Windows 2000 professional
    > I mistakenly thought I could run the NCIMAN.EXE, for version 3.4,
    > create the UNATTEND.TXT file, and then use this with my install.
    > Unfortunately, NCIMAN.EXE senses what system you're on and saves the
    > UNATTEND.TXT file under whatever format is consistant with the O/S
    > you're working on. [There doesn't seem to be any way to tell NCIMAN
    > to save the configuration file for a different O/S.]
    >
    > If, like myself, you miss this . . . the UNATTEND.TXT file will be created
    > (or saved after editing) under a Windows 2000 format--which won't run
    > on a Client 3.4 install. [You can verify the version it was saved under
    > by looking at the second line of the UNATTEND.TXT file . . . the one
    > that reads: "Novell_Client=" ("95" for Win95/98) or "NT" (for 2000 or
    > XP).]
    >
    > 'Hope this saves some others from similar grief . . .
    >
    > Steve Conrad
    >
    >
    >
    You can also run NCIMAN, Go to File -> New File, and choose the O/S of
    choice. :-)

  • Connect to VPN but can't ping past inside interface

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

  • Dynamin VPN/GRE can't ping other side of tunnel

    I am new at this VPN stuff and tryiong to setup a GRE Dynamic IP VPN between my offfice and home.  Here is what I ahve done thus far:
    OFFICE
    interface Tunnel0
    ip address 172.30.1.1 255.255.255.252
    no ip redirects
    ip mtu 1400
    ip nhrp map multicast dynamic
    ip nhrp network-id 1
    ip tcp adjust-mss 1360
    tunnel source FastEthernet0/0
    tunnel mode gre multipoint
    tunnel key 1
    interface FastEthernet0/0
    ip address 40.197.68.9 255.255.255.248
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    HOME
    interface Tunnel0
    ip address 172.30.1.2 255.255.255.252
    ip mtu 1400
    ip nhrp map multicast 40.197.68.9
    ip nhrp map 172.30.1.1 40.197.68.9
    ip nhrp network-id 1
    ip nhrp nhs 172.30.1.1
    ip tcp adjust-mss 1360
    tunnel source GigabitEthernet0/0
    tunnel destination 40.197.68.9
    tunnel key 1
    interface GigabitEthernet0/0
    description Router
    ip address 192.168.30.1 255.255.255.252
    duplex auto
    speed auto
    When I ping 172.30.1.1 from the HOME router, I get 0/5 success.  Not good!  I have not setup any IPSec yet.
    Results for HOME router
    show ip nhrp nhs detail
    Legend: E=Expecting replies, R=Responding, W=Waiting
    Tunnel0:
    172.30.1.1   E priority = 0 cluster = 0  req-sent 53  req-failed 0  repl-recv 0
    sh int t0
    Tunnel0 is up, line protocol is up
      Hardware is Tunnel
      Internet address is 172.30.1.2/30
      MTU 17912 bytes, BW 100 Kbit/sec, DLY 50000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation TUNNEL, loopback not set
      Keepalive not set
      Tunnel source 192.168.30.1 (GigabitEthernet0/0), destination 40.197.68.9
       Tunnel Subblocks:
          src-track:
             Tunnel0 source tracking subblock associated with GigabitEthernet0/0
              Set of tunnels with source GigabitEthernet0/0, 1 member (includes iterators), on interface <OK>
      Tunnel protocol/transport GRE/IP
        Key 0x1, sequencing disabled
        Checksumming of packets disabled
      Tunnel TTL 255, Fast tunneling enabled
      Tunnel transport MTU 1472 bytes
      Tunnel transmit bandwidth 8000 (kbps)
      Tunnel receive bandwidth 8000 (kbps)
      Last input 00:40:28, output 00:00:25, output hang never
      Last clearing of "show interface" counters never
      Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/0 (size/max)
      5 minute input rate 0 bits/sec, 0 packets/sec
      5 minute output rate 0 bits/sec, 0 packets/sec
         0 packets input, 0 bytes, 0 no buffer
         Received 0 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 0 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
         106 packets output, 12612 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 unknown protocol drops
         0 output buffer failures, 0 output buffers swapped out
    sh ip route
    Gateway of last resort is 192.168.30.2 to network 0.0.0.0
    S*    0.0.0.0/0 [1/0] via 192.168.30.2
          10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
    C        10.110.0.0/24 is directly connected, GigabitEthernet0/1.110
    L        10.110.0.1/32 is directly connected, GigabitEthernet0/1.110
    C        10.115.0.0/24 is directly connected, GigabitEthernet0/1.115
    L        10.115.0.1/32 is directly connected, GigabitEthernet0/1.115
          172.16.0.0/30 is subnetted, 1 subnets
    S        172.16.2.0 [1/0] via 192.168.30.6
          172.30.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        172.30.1.0/30 is directly connected, Tunnel0
    L        172.30.1.2/32 is directly connected, Tunnel0
    S     192.168.2.0/24 is directly connected, GigabitEthernet0/0
    S     192.168.10.0/24 is directly connected, GigabitEthernet0/0
          192.168.30.0/24 is variably subnetted, 4 subnets, 2 masks
    C        192.168.30.0/30 is directly connected, GigabitEthernet0/0
    L        192.168.30.1/32 is directly connected, GigabitEthernet0/0
    C        192.168.30.4/30 is directly connected, GigabitEthernet0/1.30
    L        192.168.30.5/32 is directly connected, GigabitEthernet0/1.30
    S     192.168.50.0/24 [1/0] via 192.168.30.6
          192.168.69.0/24 is variably subnetted, 2 subnets, 2 masks
    C        192.168.69.0/24 is directly connected, GigabitEthernet0/1.69
    L        192.168.69.3/32 is directly connected, GigabitEthernet0/1.69
    S     192.168.100.0/24 [1/0] via 192.168.30.6
    S     192.168.125.0/24 [1/0] via 192.168.30.6
    S     192.168.200.0/24 [1/0] via 192.168.30.6
    sh dmvpn
    Interface: Tunnel0, IPv4 NHRP Details
    Type:Spoke, NHRP Peers:1,
    # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
         1    50.197.68.90      172.30.1.1  NHRP 02:30:17     S
    Results for OFFICE router
    show ip nhrp nhs detail
    sh dmvpn
    sh int t0
    Tunnel0 is up, line protocol is up
      Hardware is Tunnel
      Internet address is 172.30.1.1/30
      MTU 17912 bytes, BW 100 Kbit/sec, DLY 50000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation TUNNEL, loopback not set
      Keepalive not set
      Tunnel source 40.197.68.9 (FastEthernet0/0)
       Tunnel Subblocks:
          src-track:
             Tunnel0 source tracking subblock associated with FastEthernet0/0
              Set of tunnels with source FastEthernet0/0, 1 member (includes iterators), on interface <OK>
      Tunnel protocol/transport multi-GRE/IP
        Key 0x1, sequencing disabled
        Checksumming of packets disabled
      Tunnel TTL 255, Fast tunneling enabled
      Tunnel transport MTU 1472 bytes
      Tunnel transmit bandwidth 8000 (kbps)
      Tunnel receive bandwidth 8000 (kbps)
      Last input 00:43:56, output never, output hang never
      Last clearing of "show interface" counters never
      Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/0 (size/max)
      5 minute input rate 0 bits/sec, 0 packets/sec
      5 minute output rate 0 bits/sec, 0 packets/sec
         0 packets input, 0 bytes, 0 no buffer
         Received 0 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 0 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
         0 packets output, 0 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 unknown protocol drops
         0 output buffer failures, 0 output buffers swapped out
    show ip route
    S*    0.0.0.0/0 [1/0] via 40.197.68.94
          40.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C        40.197.68.8/29 is directly connected, FastEthernet0/0
    L        40.197.68.9/32 is directly connected, FastEthernet0/0
          172.30.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        172.30.1.0/30 is directly connected, Tunnel0
    L        172.30.1.1/32 is directly connected, Tunnel0
    S     192.168.2.0/24 [1/0] via 192.168.10.5
          192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
    C        192.168.10.0/24 is directly connected, FastEthernet0/1
    L        192.168.10.1/32 is directly connected, FastEthernet0/1
    S     192.168.69.0/24 is directly connected, FastEthernet0/0
    Why can't Io ping from the HOME router to the OFFICE router?

    I fugured this problem out.  I needed to setup PKI/IKE and once that was done on both routers, my tunned now passes some data.

  • Solaris 10 Dev. Edition - Network config issue (NIC,DHCP,Can't ping router)

    I am a developer getting started with Solaris 10 configuration. I recently installed Solaris 10 and have run into an issue with network connectivity.
    I have done much research on this and I was able to get communiction to the internet established once, but the settings were lost on reboot.
    Overview - The Solaris box is connected to a router which is acting as a DHCP server.
    AMD 64 dual 2.6
    nForce4+ integrated NIC
    1) I am not able to obtain an address from the router. Nor do I get a respons back when I ping it. I get an IP etc if I boot into Windows so phyicial connectivity is fine.
    2) Upon reboot the device nfo0 as shown using ifconfig -a has an IP of 0.0.0.0.
    3) If I run ifconfig [hostname] my machine gets the ip from the hosts file, but I would like to obtain this from the router.
    4) NOTE - the machine shows as active on my router, but the Solaris box cannot be reached from other computers on the networ, nor do I get a reply back when pinging the router from the Solaris box.
    GOAL - reach and obtain a DHCP from the router and have the changes stick upon reboot.
    /etc/hosts contents
    127.0.0.1 localhost loghost
    192.168.1.55 solarisX /*<-- this is what I get when I do ifconfig nfo0 solarisX */
    /etc/hosname.nfo0
    netmask + 255.255.255.0
    solarisX
    /etc/defaultrouter
    192.168.1.254
    /et c/netmasks
    192.168.0.0 255.255.2550
    Specific Steps taken:
    Using the driver nfo-2.4.5 locate at http://homepage2.nifty.com/mrym3/taiyodo/eng/ I did the following.
    % cd /.../nfo-x.x.x
    % rm obj Makefile
    % ln -s Makefile.${KARCH}_${COMPILER} Makefile
    % ln -s ${KARCH} obj
    where ${KARCH} is the result of `isainfo -n`, and ${COMPILER} is
    "gcc" or "suncc" which you want to use to make the driver.
    4. Testing
    Testing before installation is strongly recommended.
    # cd /.../nfo-x.x.x
    # /usr/ccs/bin/make install
    # ./adddrv.sh
    # /usr/ccs/bin/make uninstall (for solaris7, don't remove the file )
    # modload obj/nfo
    # devfsadm -i nfo (for solaris7, use drvconfig and reboot with -r )
    # ifconfig nfoN plumb ( where N is an instance number, typcally 0 for first card)
    # ifconfig -a ( you will see an entry for nfoN)
    # ifconfig nfoN YOUR-HOST-NAME
    # ifconfig nfoN ( ensure IP address is correct)
    # ifconfig nfoN up ( and then you can test with ping, telnet, ftp ...)
    5. Installation
    After you ensure that the nfo driver is fully functional, install it.
    (1) copy the nfo driver into the kernel directory
    # cd /.../nfo-x.x.x
    # /usr/ccs/bin/make install
    If you do not test the nfo driver yet, execute the following commands:
    # ./adddrv.sh
    # devfsadm -i nfo (for solaris7, use drvconfig and reboot with -r)
    (2) Configure the network interface. Create and/or modify the following file:
    /etc/hostname.nfoN
    (3) Reboot the system.
    # init 6
    Edited by: hedger on Nov 16, 2007 11:17 PM

    Thanks Alan. I worked on trying to get the NIC working again last night. I had it working once, although the settings did not perist. I can still get the device to load, but I can't communciate with the router (it's not physical because another OS can reach it.
    I took your advice and tried the sys-unconfig. But I did not have much success.
    I am wondering if plopping in a new PCI NIC would be the most efficient route to get the server up.
    What kind of NIC do you utilize and have had success with?
    I am looking at possibly a DLINK DFE-530 or NetGear FA-311. I don't need wireless at this point just a rock solid DEV box.
    Thanks again for the previous info.
    Ted

  • VPN Problem: Can't route to other network clients

    Hi,
    I can't ping the other clients on the network when I'm connected to VPN from outside.
    But accessing internet trough VPN works. (Sending all data through VPN).
    So in fact, I can only ping the VPN server I'm connected to.
    Maybe someone here has an idea what I'm doing wrong here.
    Here is my setup:
    internet
    I
    I
    Airport Extreme (internal IP 192.168.3.1, Router with NAT Port forwarding to 192.168.3.3)
    I
    I
    Switch----macMini (192.168.3.3, OS X Server 10.4.10 with VPN, DHCP, DNS, NAT enabled)
    l
    l
    Other Clients on the Network (Clients have DNS entry 192.168.3.3 192.168.3.1, Router is 192.168.3.1)
    The services DHCP, DNS working well for internal clients.
    Has someone an idea?
    Thanks a lot.
    Alex
    Message was edited by: Syndrome

    First, ping is ICMP traffic, different from other kinds of (eg, TCP) traffic like AFP.
    See http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/productstechnote09186a00800a6057.shtml
    traceroute also uses some ICMP traffic but might also be using UDP, see
    http://en.wikipedia.org/wiki/Traceroute
    http://www.linuxplanet.com/linuxplanet/tutorials/6524/1/
    However, in testing, I can indeed ping the server, when I connect to a remote Mac OS X Server via the Mac OS X supplied vpn. But there is no AP Extreme in the path. So the two big factors are: limitations and/or configuration of the AP, and firewall settings for each/any machine involved.
    The Airport Extreme is really quite limited, compared to any more full-featured routing device - in terms of just how granular you can be with controlling traffic flow.
    (As a total aside, I'd recommend investing in something like a Zyxel Zywall 2 Plus (or similar or better) and running the AP in bridge mode for wireless clients.)
    When you've connected via VPN, please run
    netstat -rn to see what your default gateway is, that's actually being used.
    Finally, what led you to try these tests ? What other problems are you having, what primary issue(s) are you trying to solve ?

  • Fresh BW Installation : You Can Only Work in Client 001

    Hello All,
    I am doing a BI 7.4 installation.
    Till now i have just installed NW7.4 ABAP system. I did some of post processing steps after installation like STMS, SGEN.. etc.
    We want to have client 100 for BI usage. So i created 100 client with client copy with SAP_CUST profile.. is this corrrect ?
    Now i have 2 question..
    1. When i run RSA1 in 100 client, I get error "You Can Only Work in Client 001" ? Did i performed wrong client copy ? What is correct procedure. I do not find anything in Installation guide for NW.
    2. I need to deploy BI_CONT addon. I can do this with SAINT.. is there some post activity.. which activate something ?
    best regards
    ashish

    Hi
    1. When i run RSA1 in 100 client, I get error "You Can Only Work in Client 001" ? Did i performed wrong client copy ? What is correct procedure. I do not find anything in Installation guide for NW.
    Kindly refer the SAP Note 316923 - Termination of program RS_CLIENT_COPY_BW
    2. I need to deploy BI_CONT addon. I can do this with SAINT.. is there some post activity.. which activate something ?
    Kindly refer the SAP Note   153967 - BI Content Release Strategy
    1808103 - BI_CONT 737/747 SP04 and higher: Information on Add-On SPs
      1808103 - BI_CONT 737/747 SP04 and higher: Information on Add-On SPs
    BR
    SS

  • Clients behind shared wireless can only connect one at a time to RV042

    I am using a RV042 HW version 3 (black front panel and blue user interface).
    I have have 2 vpn users who share an apartment.
    They use a wireless router to get to the internet.
    Both use Windows 7 (firewall enabled) and the latest QuickVPN client.
    As it is, only one of the users can connect at the same time.
    When one is already connected the other gets a message "the remote gateway is not responding"
    Has anyone else experienced something like this ?
    Thanks in advance.
    These are the logs from the PC that connected ok:
    From wget_stop_error.txt
    --10:29:50--  https://Serena:*password*@180.243.235.82/StopConnection.htm?version=1?status=disable?IP=192.168.0.101?PASSWD=*password*?USER=Serena
               => `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//stopconn.conf'
    Connecting to 180.243.235.82:443... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: unspecified [text/html]
        0K                                                          96.68 KB/s
    10:29:50 (96.68 KB/s) - `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//stopconn.conf' saved [99]
    From wget_request_error.txt
    --10:29:45--  https://Serena:*password*@www.vantagebanking.com:60443/CheckIsakmp.htm?version=1?IP=192.168.0.101?PASSWD=*password*?USER=Serena*password*@www.vantagebanking.com:60443/CheckIsakmp.htm?version=1?IP=192.168.0.101?PASSWD=*password*?USER=Serena
               => `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//isakmp_status.conf'
    Resolving www.vantagebanking.com... 180.243.235.82
    Connecting to www.vantagebanking.com[180.243.235.82]:60443... connected.
    HTTP request sent, awaiting response...
    End of file while parsing headers.
    Giving up.
    From wget_error.txt
    --10:29:13--  https://Serena:*password*@180.243.235.82/StartConnection.htm?version=1?IP=192.168.0.101?PASSWD=*password*?USER=Serena
               => `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//vpnserver.conf'
    Connecting to 180.243.235.82:443... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: unspecified [text/html]
        0K                                                         176.76 KB/s
    10:29:14 (176.76 KB/s) - `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//vpnserver.conf' saved [181]
    From Log.txt
    2011/07/16 10:29:12 [STATUS]OS Version: Windows 7
    2011/07/16 10:29:12 [STATUS]Windows Firewall Domain Profile Settings: ON
    2011/07/16 10:29:12 [STATUS]Windows Firewall Private Profile Settings: ON
    2011/07/16 10:29:12 [STATUS]Windows Firewall Private Profile Settings: ON
    2011/07/16 10:29:12 [STATUS]One network interface detected with IP address 192.168.0.101
    2011/07/16 10:29:12 [STATUS]Connecting...
    2011/07/16 10:29:12 [DEBUG]Input VPN Server Address = www.vantagebanking.com
    2011/07/16 10:29:13 [STATUS]Connecting to remote gateway with IP address: 180.243.235.82
    2011/07/16 10:29:14 [STATUS]Remote gateway was reached by https ...
    2011/07/16 10:29:14 [STATUS]Provisioning...
    2011/07/16 10:29:24 [STATUS]Success to connect.
    2011/07/16 10:29:24 [STATUS]Tunnel is configured. Ping test is about to start.
    2011/07/16 10:29:24 [STATUS]Verifying Network...
    2011/07/16 10:29:30 [WARNING]Failed to ping remote VPN Router!
    2011/07/16 10:29:33 [WARNING]Failed to ping remote VPN Router!
    2011/07/16 10:29:36 [WARNING]Failed to ping remote VPN Router!
    2011/07/16 10:29:39 [WARNING]Failed to ping remote VPN Router!
    2011/07/16 10:29:42 [WARNING]Failed to ping remote VPN Router!
    2011/07/16 10:29:45 [WARNING]Ping was blocked, which can be caused by an unexpected disconnect.
    2011/07/16 10:29:49 [STATUS]Disconnecting...
    2011/07/16 10:29:53 [WARNING]Failed to disconnect.
    And these are the ones from PC # 2 which failed to connect with error  "The remote gateway is not responding"
    This error just keeps looping around
    From wget_error.txt
    --10:29:21--  https://Paul:*password*@180.243.235.82/StartConnection.htm?version=1?IP=192.168.0.100?PASSWD=*password*?USER=Paul
               => `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//vpnserver.conf'
    Connecting to 180.243.235.82:443... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: unspecified [text/html]
        0K                                                         174.80 KB/s
    10:29:22 (174.80 KB/s) - `C://Program Files (x86)//Cisco Small Business//QuickVPN Client//vpnserver.conf' saved [179]
    From Log.txt
    2011/07/16 10:29:18 [STATUS]OS Version: Windows 7
    2011/07/16 10:29:18 [STATUS]Windows Firewall Domain Profile Settings: ON
    2011/07/16 10:29:18 [STATUS]Windows Firewall Private Profile Settings: ON
    2011/07/16 10:29:18 [STATUS]Windows Firewall Private Profile Settings: ON
    2011/07/16 10:29:18 [STATUS]One network interface detected with IP address 192.168.0.100
    2011/07/16 10:29:18 [STATUS]Connecting...
    2011/07/16 10:29:18 [DEBUG]Input VPN Server Address = www.vantagebanking.com
    2011/07/16 10:29:20 [STATUS]Connecting to remote gateway with IP address: 180.243.235.82
    2011/07/16 10:29:22 [STATUS]Remote gateway was reached by https ...
    2011/07/16 10:29:22 [STATUS]Provisioning...
    2011/07/16 10:29:32 [STATUS]Success to connect.
    2011/07/16 10:29:32 [STATUS]Tunnel is configured. Ping test is about to start.
    2011/07/16 10:29:32 [STATUS]Verifying Network...
    2011/07/16 10:29:38 [WARNING]Failed to ping remote VPN Router!
    2011/07/16 10:30:51 [WARNING]Failed to ping remote VPN Router!

    I just removed the tunnel and after that I cannot log in any more.
    I rebooted the router after removing the tunnel.
    I have tried many times.
    I use remote management from Singapore with the RV042 in Jakarta.
    Other users also cannot log in.
    "Verifying network" is as far as we get.
    This is the log:
    2011/07/19 14:54:06 [STATUS]OS Version: Windows XP
    2011/07/19 14:54:06 [STATUS]Windows Firewall is OFF
    2011/07/19 14:54:07 [STATUS]One network interface detected with IP address 10.71.11.9
    2011/07/19 14:54:07 [STATUS]Connecting...
    2011/07/19 14:54:07 [DEBUG]Input VPN Server Address = 180.243.235.82
    2011/07/19 14:54:07 [STATUS]Connecting to remote gateway with IP address: 180.243.235.82
    2011/07/19 14:54:09 [STATUS]Remote gateway was reached by https ...
    2011/07/19 14:54:09 [STATUS]Provisioning...
    2011/07/19 14:54:19 [STATUS]Success to connect.
    2011/07/19 14:54:19 [STATUS]Tunnel is configured. Ping test is about to start.
    2011/07/19 14:54:19 [STATUS]Verifying Network...
    2011/07/19 14:54:23 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:24 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:25 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:26 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:27 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:28 [WARNING]Ping was blocked, which can be caused by an unexpected disconnect.
    2011/07/19 14:54:37 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:38 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:39 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:40 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:42 [WARNING]Failed to ping remote VPN Router!
    2011/07/19 14:54:42 [WARNING]Ping was blocked, which can be caused by an unexpected disconnect.
    I have restored from the export .config file and all is back to normal.
    So I better leave the single tunnel as it is.
    I will try with spare RV042 when I am back in Jakarta

Maybe you are looking for

  • [JS][CS3]how to get refrence for source file

    Hi All I am new and learning javascript Gradually Could any one help on this as i do have a code for load style but don't know how to get refrence for "source file" and "targetDoc" targetDoc.importStyles(charImport, sourceFile, clashPolicy); targetDo

  • Aperture 3: Geotagged Photos show up in wrong part of world

    I imported a set of geotagged photos. When I look at places in Aperture 3 several of the photos are appearing in the wrong part of the world ( Kazakhstan instead of Nova Scotia). The photos were taken / geotagged by my Blackberry Storm. When I travel

  • MWST Condition Type

    Hi All, MWST condition type  is only available in Purchasing pricing procedure MM not in Tax procedure under FI. 1) How can i use this condition type & post value to VST key. 2) should i include MWST in Tax procedure also. Pls advise how to use this

  • Set data type property

    Hi all. I'm on devsuite 10g. Is there a way to set the data type property of an item at runtime??? Thanks all for the collaboration, Fabrizio

  • How to delete photos on iPad2 without deleting all of the same photo?

    How can a photo be deleted on an iPad2 without deleting all other photos in other albums?