RV180W ipsec vpn with multiple networks

Hello,
I am setting up a customer site.  One side is RV180W and the other side is Checkpoint 500W.
RV180W side
LAN - 192.168.100.0/24
Checkpoint side
LAN - 172.26.1.0/24
VOIP - 172.26.2.0/24
Need to setup an ipsec tunnel between the site.  However, from the RV180W side, I can only ping the VOIP network, but not LAN.  Need help.  I have heard that RV180W only can talk to one remote network via ipsec, correct?  Any other way to workaround this other than changing out the RV180W?  Thanks.
Ho

Hi Tom,
I have a similar situation, needing to setup 3 tunnels to the same endpoint.  Each tunnel has a different remote LAN setting, but I can only get one tunnel to work at a time.  I have to disable the other two.  For more details, see my posting: https://supportforums.cisco.com/message/3781143#3781143
How can I setup 3 IPSEC tunnels to the same endpoint?
Marshall

Similar Messages

  • ASA 5505 Site-to-Site VPN with multiple networks

    Hi,
    I have 2 Cisco ASAs 5505 in the different places with a created connection Site-to-Site VPN. It’s working fine in the networks where they are (10.1.1.0/24 and 10.2.1.0/24 respectively).
    Additionally to the ASA1 are connected two subnets: 10.1.2.0/24 and 10.1.3.0/24 and the ASA2 is connected to one subnet: 10.2.2.0/24
    A problem is when I’m trying to get to a host in the subnet behind the ASA2 from the subnet behind the ASA1  and vice versa.
    Any help would be greatly appreciated.

    It's all about the crypto ACL. You have to combine all networks behind ASA1 with all networks behind ASA2. You can use object-groups for that to handle it. What's the config of your crypto ACL?
    Sent from Cisco Technical Support iPad App

  • Need help in configuring Client to Site IPSec VPN with Hairpinning on Cisco ASA5510 8.2(1)

    Need urgent help in configuring Client to Site IPSec VPN with Hairpinning on Cisco ASA5510 - 8.2(1).
    The following is the Layout:
    There are two Leased Lines for Internet access - 1.1.1.1 & 2.2.2.2, the latter being the Standard Default route, the former one is for backup.
    I have been able to configure  Client to Site IPSec VPN
    1) With access from Outside to only the Internal Network (172.16.0.0/24) behind the asa
    2) With Split tunnel with simultaneous assess to internal LAN and Outside Internet.
    But I have not been able to make tradiotional Hairpinng model work in this scenario.
    I followed every possible sugestions made in this regard in many Discussion Topics but still no luck. Can someone please help me out here???
    Following is the Running-Conf with Normal Client to Site IPSec VPN configured with No internat Access:
    LIMITATION: Can't Boot into any other ios image for some unavoidable reason, must use 8.2(1)
    running-conf  --- Working  normal Client to Site VPN without internet access/split tunnel
    ASA Version 8.2(1)
    hostname ciscoasa
    domain-name cisco.campus.com
    enable password xxxxxxxxxxxxxx encrypted
    passwd xxxxxxxxxxxxxx encrypted
    names
    interface GigabitEthernet0/0
    nameif internet1-outside
    security-level 0
    ip address 1.1.1.1 255.255.255.240
    interface GigabitEthernet0/1
    nameif internet2-outside
    security-level 0
    ip address 2.2.2.2 255.255.255.224
    interface GigabitEthernet0/2
    nameif dmz-interface
    security-level 0
    ip address 10.0.1.1 255.255.255.0
    interface GigabitEthernet0/3
    nameif campus-lan
    security-level 0
    ip address 172.16.0.1 255.255.0.0
    interface Management0/0
    nameif CSC-MGMT
    security-level 100
    ip address 10.0.0.4 255.255.255.0
    boot system disk0:/asa821-k8.bin
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name cisco.campus.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network cmps-lan
    object-group network csc-ip
    object-group network www-inside
    object-group network www-outside
    object-group service tcp-80
    object-group service udp-53
    object-group service https
    object-group service pop3
    object-group service smtp
    object-group service tcp80
    object-group service http-s
    object-group service pop3-110
    object-group service smtp25
    object-group service udp53
    object-group service ssh
    object-group service tcp-port
    object-group service udp-port
    object-group service ftp
    object-group service ftp-data
    object-group network csc1-ip
    object-group service all-tcp-udp
    access-list INTERNET1-IN extended permit ip host 1.2.2.2 host 2.2.2.3
    access-list CSC-OUT extended permit ip host 10.0.0.5 any
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq www
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq https
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq ssh
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq ftp
    access-list CAMPUS-LAN extended permit udp 172.16.0.0 255.255.0.0 any eq domain
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq smtp
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq pop3
    access-list CAMPUS-LAN extended permit ip any any
    access-list csc-acl remark scan web and mail traffic
    access-list csc-acl extended permit tcp any any eq smtp
    access-list csc-acl extended permit tcp any any eq pop3
    access-list csc-acl remark scan web and mail traffic
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq 993
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq imap4
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq 465
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq www
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq https
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq smtp
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq pop3
    access-list INTERNET2-IN extended permit ip any host 1.1.1.2
    access-list nonat extended permit ip 172.16.0.0 255.255.0.0 172.16.0.0 255.255.0.0
    access-list DNS-inspect extended permit tcp any any eq domain
    access-list DNS-inspect extended permit udp any any eq domain
    access-list capin extended permit ip host 172.16.1.234 any
    access-list capin extended permit ip host 172.16.1.52 any
    access-list capin extended permit ip any host 172.16.1.52
    access-list capin extended permit ip host 172.16.0.82 host 172.16.0.61
    access-list capin extended permit ip host 172.16.0.61 host 172.16.0.82
    access-list capout extended permit ip host 2.2.2.2 any
    access-list capout extended permit ip any host 2.2.2.2
    access-list campus-lan_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 192.168.150.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    mtu internet1-outside 1500
    mtu internet2-outside 1500
    mtu dmz-interface 1500
    mtu campus-lan 1500
    mtu CSC-MGMT 1500
    ip local pool vpnpool1 192.168.150.2-192.168.150.250 mask 255.255.255.0
    ip verify reverse-path interface internet2-outside
    ip verify reverse-path interface dmz-interface
    ip verify reverse-path interface campus-lan
    ip verify reverse-path interface CSC-MGMT
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-621.bin
    no asdm history enable
    arp timeout 14400
    global (internet1-outside) 1 interface
    global (internet2-outside) 1 interface
    nat (campus-lan) 0 access-list campus-lan_nat0_outbound
    nat (campus-lan) 1 0.0.0.0 0.0.0.0
    nat (CSC-MGMT) 1 10.0.0.5 255.255.255.255
    static (CSC-MGMT,internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255
    access-group INTERNET2-IN in interface internet1-outside
    access-group INTERNET1-IN in interface internet2-outside
    access-group CAMPUS-LAN in interface campus-lan
    access-group CSC-OUT in interface CSC-MGMT
    route internet2-outside 0.0.0.0 0.0.0.0 2.2.2.5 1
    route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    http server enable
    http 10.0.0.2 255.255.255.255 CSC-MGMT
    http 10.0.0.8 255.255.255.255 CSC-MGMT
    http 1.2.2.2 255.255.255.255 internet2-outside
    http 1.2.2.2 255.255.255.255 internet1-outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map internet2-outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map internet2-outside_map interface internet2-outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy
            a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as
      quit
    crypto isakmp enable internet2-outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes
    hash md5
    group 2
    lifetime 86400
    telnet 10.0.0.2 255.255.255.255 CSC-MGMT
    telnet 10.0.0.8 255.255.255.255 CSC-MGMT
    telnet timeout 5
    ssh 1.2.3.3 255.255.255.240 internet1-outside
    ssh 1.2.2.2 255.255.255.255 internet1-outside
    ssh 1.2.2.2 255.255.255.255 internet2-outside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy VPN_TG_1 internal
    group-policy VPN_TG_1 attributes
    vpn-tunnel-protocol IPSec
    username ssochelpdesk password xxxxxxxxxxxxxx encrypted privilege 15
    username administrator password xxxxxxxxxxxxxx encrypted privilege 15
    username vpnuser1 password xxxxxxxxxxxxxx encrypted privilege 0
    username vpnuser1 attributes
    vpn-group-policy VPN_TG_1
    tunnel-group VPN_TG_1 type remote-access
    tunnel-group VPN_TG_1 general-attributes
    address-pool vpnpool1
    default-group-policy VPN_TG_1
    tunnel-group VPN_TG_1 ipsec-attributes
    pre-shared-key *
    class-map cmap-DNS
    match access-list DNS-inspect
    class-map csc-class
    match access-list csc-acl
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class csc-class
      csc fail-open
    class cmap-DNS
      inspect dns preset_dns_map
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y
    : end
    Neither Adding dynamic NAT for 192.168.150.0/24 on outside interface works, nor does the sysopt connection permit-vpn works
    Please tell what needs to be done here, to hairpin all the traffic to internet comming from VPN Clients.
    That is I need clients conected via VPN tunnel, when connected to internet, should have their IP's NAT'ted  against the internet2-outside interface address 2.2.2.2, as it happens for the Campus Clients (172.16.0.0/16)
    I'm not much conversant with everything involved in here, therefore please be elaborative in your replies. Please let me know if you need any more information regarding this setup to answer my query.
    Thanks & Regards
    maxs

    Hi Jouni,
    Thanks again for your help, got it working. Actually the problem was ASA needed some time after configuring to work properly ( ?????? ). I configured and tested several times within a short period, during the day and was not working initially, GUI packet tracer was showing some problems (IPSEC Spoof detected) and also there was this left out dns. Its working fine now.
    But my problem is not solved fully here.
    Does hairpinning model allow access to the campus LAN behind ASA also?. Coz the setup is working now as i needed, and I can access Internet with the NAT'ed ip address (outside-interface). So far so good. But now I cannot access the Campus LAN behind the asa.
    Here the packet tracer output for the traffic:
    packet-tracer output
    asa# packet-tracer input internet2-outside tcp 192.168.150.1 56482 172.16.1.249 22
    Phase: 1
    Type: ACCESS-LIST
    Subtype:
    Result: ALLOW
    Config:
    Implicit Rule
    Additional Information:
    MAC Access list
    Phase: 2
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 3
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   172.16.0.0      255.255.0.0     campus-lan
    Phase: 4
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.150.1   255.255.255.255 internet2-outside
    Phase: 5
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group internnet1-in in interface internet2-outside
    access-list internnet1-in extended permit ip 192.168.150.0 255.255.255.0 any
    Additional Information:
    Phase: 6
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 7
    Type: CP-PUNT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 8
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 9
    Type: NAT-EXEMPT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 10
    Type: NAT
    Subtype:     
    Result: DROP
    Config:
    nat (internet2-outside) 1 192.168.150.0 255.255.255.0
      match ip internet2-outside 192.168.150.0 255.255.255.0 campus-lan any
        dynamic translation to pool 1 (No matching global)
        translate_hits = 14, untranslate_hits = 0
    Additional Information:
    Result:
    input-interface: internet2-outside
    input-status: up
    input-line-status: up
    output-interface: internet2-outside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    The problem here as you can see is the Rule for dynamic nat that I added to make hairpin work at first place
    dynamic nat
    asa(config)#nat (internet2-outside) 1 192.168.150.0 255.255.255.0
    Is it possible to access both
    1)LAN behind ASA
    2)INTERNET via HAIRPINNING  
    simultaneously via a single tunnel-group?
    If it can be done, how do I do it. What changes do I need to make here to get simultaneous access to my LAN also?
    Thanks & Regards
    Abhijit

  • ACS Database Replication over VPN with overlapping Network Addresses

    We currently have two co-locations each situated in different provinces. We have two ACS servers which we want to deploy at each co-location. All our network equipments are behind PIX/ASA devices. Getting them to replicate over the VPN should be easy but in our case we have overlapping Network Addresses at both ends of the tunnels.
    As per Cisco data does not transit a NAT device when the two Cisco Secure ACS servers communicate and a successful database replication can occur only if the secondary ACS server perceives no change in the IP header or content of the data it receives. So that means we will not be able to Implement NAT to achiever this.
    Has any one of you faced this problem of replicating ACS Database over the VPN with overlapping Network Addresses and was anyone able to successfully solve this issue using a work around ?
    All provided info and comments are greatly appreciated.

    I can help with the 3005 setup if you decide to go that route.
    You will need to add 2 network list entries under Configuration>Policy Management>Traffic Management>Network Lists.
    You will need to configure a local and remote address. The local will be one of the public ip's for the site.(Provided by your ISP)The remote will be the device you are connecting to on the other end.
    You will also need to add a Nat Lan to Lan rule under Configuration>Policy Management>Traffic Management>Nat>Lan to Lan.
    Use a static Nat type. The rest will look similar to my example.
    Source(Local address)Translated(Public Ip Address used in the network local list)Remote(Ip address of the device on the other end)
    Now just create an Ipsec lan to lan tunnel. You will need to agree with the ISP on des type and auth type. Use you local and remote networks you created earlier.

  • Cisco ASA 5505 site to site IPSec VPN with RV220W issue

    I have a ASA5505 connected to RV220W through IPSec VPN. When  using SMB to transfer large file, the ASA5505 will show error message:
    CTM ERROR: Invalid input parameters, ctm_get_scb_prot_stats:1561
    The error message from the debug crypto engine. When  the message show, the speed of the transfer will slow down quickly, and  even no data can be go through between ASA and the RV220W. But the IPSec  SA and the IKE SA is active, and can ping the inside network in both  site.
    Both ASA5505 and the RV220W has been updated the latest firmware. I have surf the Google but no such related issue found.
    Any suggestions on where to look would be much appreciated.
    Thanks in advance
    Terry

    Hi Ted thanks for your reply and information.
    The strange things happened in RV220W shows the IPSec sa is expired, but the ASA5505 IPSec and IKEv1 sa is active. Inside both site internal network can ping to other side, but cant transfer file through Windows SMB. It seems when I transfer over 4GBytes of file, it will start happening and required clear IPSec and IKEv1 sa so that the VPN tunnel will start up again.
    I am already surrander for this issue......

  • Lion Server VPN with 2 networks

    I hope someone has come across a similar problem to what I have had.
    I am having great difficulty trying to configure our OSX Lion Server (7.4) VPN service. The configuration I am trying to reach is one where we have an external IP for the server itself. A VPN configuration where we can use the external IP to get onto the VPN. When successfully on the VPN we would like to route through internal the network for all VPN traffic. We are having difficulty with the source routing so all traffic when successfully authenticated onto the VPN goes via VLAN0.
    I have used the guide:
    http://macminicolo.net/lionservervpn
    When on the VPN all internal network services should be available. But it seems to take the gateway of the public interface for all routing. I have tried adding routing entries with no luck
    Open to suggestion on how we can get this to successfully work. Thanks in advance.

    I am having a similar if not the same problem.  What happens when you log in with the VPN is that instead of giving a proper route the the VPN network, a second "default route is added".
    Internet:
    Destination        Gateway            Flags        Refs      Use   Netif Expire
    default            172.16.200.1       UGSc          166        0     en0
    default            172.16.150.109     UGScI           0        0    ppp0
    69.27.134.89       172.16.200.1       UGHS            0        0     en0
    127                127.0.0.1          UCS             0        0     lo0
    127.0.0.1          127.0.0.1          UH              3       22     lo0
    169.254            link#4             UCS             0        0     en0
    172.16.150/23      ppp0               USc             1        0    ppp0
    172.16.150.109     172.16.150.5       UH              1        0    ppp0
    172.16.200/23      link#4             UCS             5        0     en0
    172.16.200.1       a0:21:b7:60:b:4e   UHLWIi        167      109     en0    845
    172.16.200.11      b8:ac:6f:ff:b6:66  UHLWIi          0      202     en0   1200
    172.16.200.20      127.0.0.1          UHS             0        0     lo0
    172.16.200.54      d8:30:62:6a:4f:4b  UHLWIi          0        0     en0    881
    172.16.201.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       32     en0
    I can add a manual route using:
    route add 172.16.0.0/23 172.16.150.9  and everything works fine.  But if you disconnect the VPN and reconnect you also have to re-enter the route,
    BTW.... works fine from my Win7 PC.

  • VPN with 2 network cards - vpn clients cannot see LAN.

    Problem: When a VPN client connects they can only access the server and not any LAN computers. Unable to even ping the LAN computers. The VPN client machine connects via PPTP and receives the appropriate IP address but the subnet mask field is blank. The router is being set to 192.168.1.2
    Here's my network setup:
    en0: (external) IP: 192.168.1.2 and is connected to aDSL modem (192.168.1.1)
    en1: (internal net) IP: 192.168.2.1
    The internal en1 network range is: 192.168.2.2 - 192.168.2.25
    The VPN range being handed out is: 192.168.2.26 - 192.168.2.30
    VPN client machines are able to fully interact with the server, just cannot reach any LAN computers.
    Any ideas??
    XServe Mac OS X (10.4.9) Various Intel laptops and G5/G4 Lan machines
    XServe   Mac OS X (10.4.9)   Various Intel laptops and G5/G4 Lan machines

    >The network address at the vpn client location is not 192.168.2.0/24. The vpn client has a public IP.
    So you're saying that your client system has a 192.168.2.x address, and that's also the address range you're using behind the VPN?
    That won't work.
    You now have two 192.168.2.x networks - one local to the client and one over the VPN.
    Normal routing rules dictate that the local connection wil always take priority over the remote connection, so the client will look on the local LAN for anything in the 192.168.2.x range, completely ignoring the VPN.
    If you think about it, your machine is told that it has two paths to get to anything in the 192.168.2.x network, either directly connected, or across the VPN connection. Given teh choice, which one do you think you'd take?
    The only real solution here is to use a different subnet at each end of the link - either change the client network to something else, or change the internal corp network. If you don't do that you'll have to set up host-based routes (one per system over the VPN) that overrides the local routing table (assuming that's even possible... I'd have to think about it).

  • IPSec VPN with VTI behind DSL router

    Hi All,
    Is it possible to use a vti tunnel interface on a router when the outside interface has a private IP address connected to a DSL modem with a static public IP address, in other words the router sits behind the DSL modem?
    Router gi0/1        -->        DSL Modem     -->     Internet  --> to HQ (Firewall with static IP)
    Outside 192.168.1.2            WAN static public IP
                                                           LAN 192.168.1.1
    Interface config:
    interface GigabitEthernet0/1
     ip vrf forwarding Internet-VRF
     ip address 192.168.1.2 255.255.255.0
     ip nat outside
     ip virtual-reassembly in
     duplex auto
     speed auto
    end
    Tunnel config:
    crypto isakmp policy 282
     encr aes 256
     authentication pre-share
     group 2
     lifetime 28800
     hash sha
    crypto isakmp key 0 PSK address xxx.xxx.xxx.xxx
    crypto ipsec transform-set aes256-sha esp-aes 256 esp-sha-hmac
     mode tunnel
    crypto ipsec profile VPN
     set transform-set aes256-sha
     set pfs group2
    interface Tunnel1
     ip vrf forwarding Internet-VRF
     ip address 172.27.82.254 255.255.255.252
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     tunnel source Gi0/1
     tunnel mode ipsec ipv4
     tunnel destination xxx.xxx.xxx.xxx
     tunnel protection ipsec profile VPN
    I have been digging into Cisco documentation but have no answer found.
    Thanks in advance.

    Both the remote and hub router will detect existence of NAT device in between, which caused the both routers switching over from UDP port 500 to UDP port 4500 to exchange IKE message. I can suspect there is no switch over taking place from you log(both using UDP 500), So I suggest you validate if both routers support NAT-T feature by checking if they are listening on UDP port 4500?

  • Setting up site to site IPSec VPN with RV 120W

    Hi All,
    I am looking to set up a site to site VPN between a local and remote office, with a RV 120w as the gateway at either side. Aside from changing the remote site's IP and Subnet, what do I need to do to get this functional? to call myself a well tooled novice would be appropriate. Any help is appreciated.
    Thanks,
    Scott

    You will most likely need to call the Cisco Small Business Support Center at 1-866-606-1866 so that
    we can assist you in setting up the Gateway to Gateway VPN Tunnel.
    THANKS
    Rick Roe
    Cisco Small Business Support Center

  • Site to Site VPN with Overlapping network and other network Access..

    Hi all,
    i need to setup a site to site Tunnel to a remote site. My remote site got the network which has overlapped with one of our network(192.168.10.0/24) in my site. remote site dont need to access this network(192.168.10.0/24) in my site ,but they have to access other networks (192.168.x.0)
    i have prepared the below configuration ,relevant to nat to achiev the goal. Appreciate help to verify and help to achive this...
    i have attached one rough diagram also..
    Mysite
    access-list acl-httsamorocco extended permit ip 192.168.73.0 255.255.255.0 192.168.74.0 255.255.255.0
    access-list nonat extended permit ip 192.168.x.0 255.255.255.0 192.168.74.0 255.255.255.0
    access-list policy-nat extended permit ip 192.168.10.0 255.255.255.0 192.168.74.0 255.255.255.0
    static (inside,outside) 192.168.73.0  access-list policy-nat
    Remote Site
    access-list policy-nat extended permit ip 192.168.10.0 255.255.255.0 192.168.73.0 255.255.255.0
    static (inside,outside) 192.168.74.0  access-list policy-nat
    Thanks in Advance..
    Shanil

    It has to be configured on both sides.
    X and Y are unused networks in this example: Site A has to hide 172.16.1.0/24 behind X when communicating to Y, site B has to hide 172.16.1.0/24 behind Y when communicating to X. The users in site A have to use Y as a destination, users in site B have to use X as destination. To make it usable for the users you should include the destinations in the DNS so that they never need the destination-IP.
    On the ASA you describe the communication 172.16.1.0/24 -> Y with an access-list and add that ACL to your static-command. You find an example here:
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9950.shtml
    Don't stop after you've improved your network! Improve the world by lending money to the working poor:
    http://www.kiva.org/invitedby/karsteni

  • Increasing file transfer speeds with multiple network adapters?

    Hello,
    I want to move gigabytes of data from my PC to my PowerBook G4 at a faster rate. My PC has 802.11g WiFi and 100Mb/s ethernet and I've got my Airport's WiFi and 100Mb/s ethernet on my laptop so I'd like to somehow combine these two network interfaces to speed up my file transfers. How can I do this?
    I've read a little about 802.3ad link aggregation, but AFAIK this applies exclusively to 802.3 ethernet ports.
    Thanks,
    Shaun
    PowerBook G4   Mac OS X (10.3.9)  

    Does your PC have a FireWire port? you can use IP over FireWire for better throughput than the wired ethernet.
    You can't use link aggregation in this case since it requires multiple interfaces of the same type (e.g. two gigabit ethernet cards), but you cannot mix media such as AirPort and Ethernet.
    The alternative would be to install a gigabit ethernet card in your PC. You'd at least then get gigabit ethernet speed between the two devices which is also a step up.

  • Share file with multiple network devices

    hhow do I share the files on my airport time capsule with my Mac mini, iPad, iphone, windows based computers?

    Mac Mini can access the Time Capsule under the SHARED heading on the left side panel in the Finder.
    The iPad and iPhone will need an App installed like FileBrowser.   Stratospherix - FileBrowser - Overview
    PCs can access the Time Capsule drive by opening Windows Explorer and typing in the LAN IP address of the Time Capsule.  Example....
    \\10.0.1.1

  • Cisco ISE with multiple Network interface

    Hello,
    I am deploying Cisco ISE 1.2 in a distributed deployment and the requirement is to use external Radius proxy feature. ISE PSNs are designed to have 2 L3 NIC's, Eth0 for administration and Eth1 as client side facing NIC for Radius requests. I am interested to know would Cisco ISE in version 1.2 use Eth1 interface to send RADIUS  authentication request to external RADIUS Proxy server.
    Could not find above information in Cisco SNS-3400 Series Appliance Ports Reference.
    http://www.cisco.com/en/US/docs/security/ise/1.2/installation_guide/ise_app_c-ports.html
    Thanks
    Kumar

    Thanks Ahmad for the reply.
    Cisco ISE uses standard RADIUS authentication and authorization port to send request to Exteranl RADIUS proxy. As per the interface/port refrence guide of version 1.2 this is listed that is causing a confusion :-
    Eth0
    Eth1
    Eth2
    Eth3
    Policy   Service node
    Session
    •UDP:1645, 1812 (RADIUS Authentication)
    •UDP:1646, 1813 (RADIUS Accounting)
    •UDP: 1700 (RADIUS change of authorization Send)
    •UDP: 1700, 3799 (RADIUS change of authorization Listen/Relay)
    External   Identity Stores
    and Resources
    •TCP: 389, 3268, UDP: 389 (LDAP)
    •TCP: 445 (SMB)
    •TCP: 88, UDP: 88 (KDC)
    •TCP: 464 (KPASS)
    •UDP: 123 (NTP)
    •TCP: 53, UDP: 53 (DNS)
    (Admin user interface authentication and endpoint authentication)
    In external Identity Stores and Resources it says Eth0 is used for (Admin user interface authentication and endpoint authentication), where under sessions it lists that all ports can be used for RADIUS Authentication and Authorization.
    I am not sure what I am missing to understand between the two if you can highlight that.
    Thanks
    Kumar

  • Does CISCO C3560X VLAN support multiple Network segments which are further configured with HSRP function

    Hi Cisco experts,
        My name is Kumagai and I need your expert opinions below.
    I am trying to configure one VLAN1 support multiple network segments as below.
    (this should be a very straight forward configuration and should be OK, I think ? )
     interface Vlan1
     ip address 172.30.0.0 255.255.128.0
     ip address 172.30.31.253 255.255.254.0 secondary
     ip address 172.30.61.253 255.255.254.0 secondary
     ip address 172.30.71.253 255.255.254.0 secondary
     ip address 172.30.4.253 255.255.255.0 secondary
     The only issue that is eating me is the above network segments are using HSRP too
     and I am not sure is this possible with a combination of VLAN1 supporting multiples which are
     further supported with HSRP settings in Cisco environment.
    !example of HSRP:
    interface Vlan4
     ip address 172.30.4.253 255.255.255.0
     no ip redirects
     standby 4 ip 172.30.4.254
     standby 4 priority 105
     standby 4 preempt
    <<< what will happen if I add the HSRP configuration as below into the above VLAN1 with multiple Network segment ??)
     I would like to summarize my "Combined" configurations as below but I need your expert opinions on
     whether the configuration below is workable without any problem ??
     Or it is a total flop because Cisco does not support the configuration below !!!
     interface Vlan1
     ip address 172.30.0.0 255.255.128.0
     ip address 172.30.31.253 255.255.254.0 secondary
     ip address 172.30.61.253 255.255.254.0 secondary
     ip address 172.30.71.253 255.255.254.0 secondary
     ip address 172.30.4.253 255.255.255.0  secondary
     standby 30 ip 172.30.31.254
     standby 30 priority 105
     standby 30 preempt
     standby 60 ip 172.30.61.254
     standby 60 priority 105
     standby 60 preempt
     standby 70 ip 172.30.71.254
     standby 70 priority 105
     standby 70 preempt
     standby  4 ip 172.30.4.254
     standby  4 priority 105
     standby  4 preempt
    Thanking you in advance !!!!!

    Hi,
    As far as i know we dont set the ip helper address on the radio interface. It should be on the L3 interface of corresposding VLANs i.e.
    int vlan 20
    ip helper-address 192.168.33.xxx
    int vlan 60
    ip helper-address 130.20.1.xxx
    I'm assuming that your using SVI's (int Vlan 20 and int Vlan 60) rahter than physical interfaces. Also hope you have configured switch port as trunk where this AP is connected.
    Modify the AP config as below since you are using data vlan as the native vlan
    interface Dot11Radio0.20
    encapsulation dot1Q 20 native
    interface FastEthernet0.20
    encapsulation dot1Q 20 native
    Ideally your AP fastethernet configuration should looks like below and not sure how you missed this as this comes by default when you have multiple vlans for multiple ssids.
    interface FastEthernet0.20
    encapsulation dot1Q 20 native
    no ip route-cache
    bridge-group 20
    no bridge-group 20 source-learning
    bridge-group 20 spanning-disabled
    interface FastEthernet0.60
    encapsulation dot1Q 60
    no ip route-cache
    bridge-group 60
    no bridge-group 60 source-learning
    bridge-group 60 spanning-disabled
    Hope this helps.
    Regards
    Najaf

  • Cisco ASA Site to Site IPSEC VPN and NAT question

    Hi Folks,
    I have a question regarding both Site to Site IPSEC VPN and NAT. Basically what I want to achieve is to do the following:
    ASA2  is at HQ and ASA1 is a remote site. I have no problem setting up a  static static Site to Site IPSEC VPN between sites. Hosts residing at  10.1.0.0/16 are able to communicate with hosts at 192.168.1.0/24, but  what i want is to setup NAT with IPSEC VPN so that host at 10.1.0.0/16  will communicate with hosts at 192.168.1.0/24 with translated addresses
    Just an example:
    Host N2 (10.1.0.1/16) will communicate with host N1 192.168.1.5 with  destination lets say 10.23.1.5 not 192.168.1.5 (Notice the last octet  should be the same in this case .5)
    The same  translation for the rest of the communication (Host N2 pings host N3  destination ip 10.23.1.6 not 192.168.1.6. again last octet is the same)
    It sounds a bit confusing for me but i have seen this type of setup  before when I worked for managed service provider where we had  connection to our clients (Site to Site Ipsec VPN with NAT, not sure how  it was setup)
    Basically we were communicating  with client hosts over site to site VPN but their real addresses were  hidden and we were using translated address as mentioned above  10.23.1.0/24 instead of (real) 192.168.1.0/24, last octet should be the  same.
    Appreciate if someone can shed some light on it.

    Hi,
    Ok so were going with the older NAT configuration format
    To me it seems you could do the following:
    Configure the ASA1 with Static Policy NAT 
    access-list L2LVPN-POLICYNAT permit ip 192.168.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    static (inside,outside) 10.23.1.0 access-list L2LVPN-POLICYNAT
    Because the above is a Static Policy NAT it means that the translation will only be done when the destination network is 10.1.0.0/16
    If you for example have a basic PAT configuration for inside -> outside traffic, the above NAT configuration and the actual PAT configuration wont interfere with eachother
    On ASA2 side you can normally configure NAT0 / NAT Exemption for the 10.1.0.0/16 network 
    access-list INSIDE-NONAT remark L2LVPN NONAT
    access-list INSIDE-NONAT permit ip 10.1.0.0 255.255.0.0 10.23.1.0 255.255.255.0
    nat (inside) 0 access-list INSIDE-NONAT
    You will have to take into consideration that your access-list defining the L2L-VPN encrypted traffic must reflect the new NAT network 
    ASA1: access-list L2LVPN-ENCRYPTIONDOMAIN permit ip 10.23.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    ASA2: access-list L2LVPN-ENCRYPTIONDOMAIN permit ip 10.1.0.0 255.255.0.0 10.23.1.0 255.255.255.0
    I could test this setup tomorrow at work but let me know if it works out.
    Please rate if it was helpful
    - Jouni

Maybe you are looking for