Scripting modifications to LDAP inside Python script

Hi all,
I have written Python scripts to create redundant print services on two OS X Server 10.6 machines running print services for al hundred or so macs in computer labs. The Mac printing (which printers appear to users) is managed via MCX w/OD. Essentially how they work is this:
*script periodically tests socket connectivity on primary server IPP/LPR ports
*on failure script does command to start Print Service on backup print server
*script then does command on OD LDAP to import mcx settings for backup print server to all applicable managed clients
The commands are done with "Popen" so they are shell commands. To modify the LDAP directory, I would use the Popen equivalent of "/usr/bin/dscl -u <diradmin user> -P <diradmin pwd> /LDAPv3/127.0.0.1 -mcximport /<managed client path> <path to mcx settings>"
It would be much nicer to not have the auth info hardcoded into the script. I've tried logging in to a shell on the server under the diradmin credentials and running the python script, but get permission denied when trying to modify LDAP. I also tried giving a test user account "full" privileges in WGM to modify directory and running script logged into a shell as this user, with the same failure.
I may be missing something totally obvious, but I am coming up blank..
Is there any way to script modification to the LDAP directory without supplying credentials in the script?

Hi all,
I have written Python scripts to create redundant print services on two OS X Server 10.6 machines running print services for al hundred or so macs in computer labs. The Mac printing (which printers appear to users) is managed via MCX w/OD. Essentially how they work is this:
*script periodically tests socket connectivity on primary server IPP/LPR ports
*on failure script does command to start Print Service on backup print server
*script then does command on OD LDAP to import mcx settings for backup print server to all applicable managed clients
The commands are done with "Popen" so they are shell commands. To modify the LDAP directory, I would use the Popen equivalent of "/usr/bin/dscl -u <diradmin user> -P <diradmin pwd> /LDAPv3/127.0.0.1 -mcximport /<managed client path> <path to mcx settings>"
It would be much nicer to not have the auth info hardcoded into the script. I've tried logging in to a shell on the server under the diradmin credentials and running the python script, but get permission denied when trying to modify LDAP. I also tried giving a test user account "full" privileges in WGM to modify directory and running script logged into a shell as this user, with the same failure.
I may be missing something totally obvious, but I am coming up blank..
Is there any way to script modification to the LDAP directory without supplying credentials in the script?

Similar Messages

  • How can I replace the Python cgi script with CF

    I am testing the sample app and want to just use CF to track
    peer ids.
    Can you give me the api to the web service calls.
    I can then create the CFC to handle this.
    In order to use the sample application that you built, you
    need to setup your web server and host the provided Python script
    (reg.cgi) for exchanging peer IDs. Please note that setting up the
    web service is not needed for the hosted VideoPhone sample. In
    VideoPhoneLabs.mxml, please set WebServiceUrl accordingly. You may
    also use Google Apps to host this web service (minimal
    modifications required).
    The Python script should be placed in the cgi-bin location
    according to your web server installation. The database is an
    SQLite3 database. In reg.cgi, please edit the location of the
    database in variable dbFile.
    You also need to create a database scheme using the
    followings:
    CREATE TABLE registrations (
    m_username VARCHAR COLLATE NOCASE,
    m_identity VARCHAR,
    m_updatetime DATETIME,
    PRIMARY KEY (m_username)
    CREATE INDEX registrations_updatetime ON registrations
    (m_updatetime ASC);

    the sample web service we provided has the following API:
    to record peerID "1234" for username "foo", do
    http://your.domain/cgi-bin/reg.cgi?username=foo&identity=1234
    you should get back an XML document with result.update=true
    or false depending on whether the database was updated.
    to look up the peerID for username "foo", do
    http://your.domain/cgi-bin/reg.cgi?friends=foo
    you should get back an XML document like:
    <?xml version="1.0" encoding="utf-8"?>
    <result>
    <friend>
    <user>foo</user>
    <identity>1234</identity>
    </friend>
    </result>
    there will be no "identity" entry if the user is not found.
    the lookup is case-insensitive but case-preserving, so if you
    looked up "Foo", the user field would be "Foo" but there'd be an
    extra "registered" field with the username as it was registered.
    -mike

  • Delete key in System Python

    Hi all,
    I have removed a MacPython installation and returned to the /System python for Leopard. My Terminal works fine, and if I push delete key it just deletes to the right, as it should do. The problem is that inside python I get a '~' character instead of deleting.
    Any ideas on what may be causing this?
    Thanks,
    Albert

    When you switched the Terminal preference from Delete is Control-H to unchecked, did you try creating a new Terminal session? Or even quitting and restarting Terminal? Sometimes preferences such as this affect the Next Terminal session. Just want to turn over every possible "Rock".
    My python is the Mac OS X 10.5.8 version
    /usr/bin/python
    My locale is I assume the default for American English. The locale command says says
    locale
    LANG=
    LC_COLLATE="C"
    LC_CTYPE="C"
    LC_MESSAGES="C"
    LC_MONETARY="C"
    LC_NUMERIC="C"
    LC_TIME="C"
    LC_ALL=
    I DO NOT have a .inputrc (no readline customization).
    My keyboard is the MacBook keyboard.
    Just checking if you are getting 0x7F as the delete key. This is a situation where to only way out is to close the Terminal Window or Tab.
    stty raw; hexdump
    now just keep hitting the Delete key until you get a line of output (16 Deletes should do it):
    0000000 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f
    But because you put your session into Raw mode, you can not kill the hexdump command. So the only way out is to just close the Terminal session (Command-W), or Quit Terminal.
    If you can think of any other variables we could check, I'll be glad to provide what I can.
    Or maybe someone else will just provide a solution
    Message was edited by: BobHarris

  • Handling '\' in reg exp query while integrating it in phython

    Hi,
    I am using the oracle 10g . I am trying to write a below mention sql regular expression in Python script. This query is working fine when I am running this in the sql developer (using it independently) However when I am trying to integrate the same inside Python script it doesn't do the required job. As per my Initial analysis this may be because in my regex query I have use '\' (in bold) which it is escaping because in log it is getting replaced by ^
    Actual Query_
    query = "UPDATE "+self.schema+";."+table_name+" SET SSR_FREE_TEXT=REPLACE(REGEXP_REPLACE(:1,'(\d{6})(\d{2,9})(\d{4})','\1X\3'), 'X', LPAD('X',LENGTH(SSR_FREE_TEXT) - LENGTH(REGEXP_REPLACE(SSR_FREE_TEXT,'(\d{6})(\d{2,9})(\d{4})','\1\3')),'X')) WHERE SSR_ID=:2"
    In log_
    UPDATE OWNADSSMOHANTHY_AIR_AY.SSR SET SSR_FREE_TEXT=REPLACE(REGEXP_REPLACE(:1,'(\d{6})(\d{2,9})(\d{4})','^AX^C'), 'X', LPAD('X',LENGTH(SSR_FREE_TEXT) - LENGTH(REGEXP_REPLACE(SSR_FREE_TEXT,'(\d{6})(\d{2,9})(\d{4})','^A^C')),'X')) WHERE SSR_ID=:2
    The use of this regexp is IF I have a value of IDCCCA5475129999998943 it should be replaced to IDCCCA547512XXXXXX8943
    Whereas when using in python it replaced the value to IDCCCAXXXXXXXXXXXXXXXX
    Could you please help me in resolving this
    Regards

    I do not know much about Python but can you look into this line:
    Other programming languages like .NET languages, Java, and Python instead provide regular expressions through standard libraries.
    Please refer:
    http://en.wikipedia.org/wiki/Regular_expression

  • ASA 5505 VPN conenction issue

    Good morning everyone. I am in need of some help. I am a newbie when it comes to configuring the ASA. Here is my problem. I have the asa configure and it is allowing me to get out to the internet. I have several VLANs on my network and from inside I can ping everything. I have created the VPN and I am able to connect to it and get in IP assigned from the pool of address. If I have multiple connections I can ping the other PCs. Right now I am able to ping the outside and inside interfaces of the ASA but no where else. I have split tunneling enabled. Here is a copy of my config.
    Thanks
    Dave 
    Result of the command: "sh run"
    : Saved
    : Serial Number: *****
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.1(5)21
    hostname Main-ASA
    domain-name *****
    enable password ***** encrypted
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    ip local pool AnyC-CPN-Client-Pool 192.168.59.0-192.168.59.250 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 12
    interface Ethernet0/1
     switchport access vlan 2
    interface Ethernet0/2
     shutdown
    interface Ethernet0/3
     shutdown
    interface Ethernet0/4
     shutdown
    interface Ethernet0/5
     shutdown
    interface Ethernet0/6
     shutdown
    interface Ethernet0/7
     shutdown
    interface Vlan2
     nameif inside
     security-level 100
     ip address 192.168.0.1 255.255.255.252
    interface Vlan12
     nameif Outside
     security-level 0
     ip address dhcp setroute
    banner login *************************************
    banner login       Unuathorized access is prohibited !!
    banner login *************************************
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup Outside
    dns server-group DefaultDNS
     domain-name *****
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network VLAN54
     subnet 192.168.54.0 255.255.255.0
     description VLAN 54
    object network Management
     subnet 192.168.80.0 255.255.255.0
     description Management
    object network VLAN51
     subnet 192.168.51.0 255.255.255.0
     description VLAN 51
    object network VLAN52
     subnet 192.168.52.0 255.255.255.0
     description VLAN 52
    object network VLAN53
     subnet 192.168.53.0 255.255.255.0
     description VLAN 53
    object network VLAN55
     subnet 192.168.55.0 255.255.255.0
     description VLAN 55
    object network VLAN56
     subnet 192.168.56.0 255.255.255.0
     description VLAN 56
    object service 443
     service tcp destination eq https
    object service 80
     service tcp destination eq www
    object service 8245
     service tcp destination eq 8245
    object service 25295
     service udp destination eq 25295
     description Blocking 25295
    object network VPN-Connections
     subnet 192.168.59.0 255.255.255.0
     description VPN Connections
    object-group service No-IP
     description no-ip.com DDNS Update
     service-object object 80
     service-object object 8245
     service-object object 443
    access-list inside_access_in remark No-ip DDNS Update
    access-list inside_access_in extended permit object-group No-IP object VLAN51 any
    access-list inside_access_in extended permit ip any any
    access-list VPN standard permit 192.168.0.0 255.255.0.0
    access-list Outside_access_in remark Blocking 25295 to HTPC
    access-list Outside_access_in extended deny object 25295 any object VLAN54
    pager lines 24
    logging enable
    logging asdm warnings
    mtu inside 1500
    mtu Outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,Outside) source dynamic any interface
    access-group inside_access_in in interface inside
    access-group Outside_access_in in interface Outside
    router eigrp 1
     no auto-summary
     network 192.168.0.0 255.255.255.252
     network 192.168.59.0 255.255.255.0
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 192.168.51.1
     server-port 636
     ldap-base-dn cn=users,dc=spicerslocal
     ldap-scope subtree
     ldap-naming-attribute cn
     ldap-login-password *****
     ldap-login-dn cn=users,dc=*****
     sasl-mechanism digest-md5
     ldap-over-ssl enable
     server-type microsoft
    user-identity default-domain LOCAL
    http server enable
    http 192.168.0.0 255.255.0.0 inside
    http 0.0.0.0 0.0.0.0 Outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Outside_map interface Outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
     enrollment self
     subject-name CN=Main-ASA
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
     certificate
      quit
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable Outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh stricthostkeycheck
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    management-access inside
    vpn-addr-assign local reuse-delay 5
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 Outside
    ssl trust-point ASDM_TrustPoint0 inside
    webvpn
     enable Outside
     anyconnect image disk0:/anyconnect-win-3.1.06079-k9.pkg 1
     anyconnect image disk0:/anyconnect-linux-2.5.2014-k9.pkg 2
     anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3
     anyconnect profiles AnyC-SSL-VPN_client_profile disk0:/AnyC-SSL-VPN_client_profile.xml
     anyconnect enable
     tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
     dns-server value 192.168.51.1 8.8.8.8
     vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value VPN
     default-domain value *****
     split-dns value 8.8.8.8
    group-policy GroupPolicy_AnyC-SSL-VPN internal
    group-policy GroupPolicy_AnyC-SSL-VPN attributes
     wins-server none
     dns-server value 8.8.8.8
     vpn-tunnel-protocol ikev2 ssl-client
     default-domain value *****
     webvpn
      anyconnect profiles value AnyC-SSL-VPN_client_profile type user
    username Dave password ***** encrypted privilege 15
    username Don password ***** encrypted privilege 15
    tunnel-group AnyC-SSL-VPN type remote-access
    tunnel-group AnyC-SSL-VPN general-attributes
     address-pool AnyC-CPN-Client-Pool
    tunnel-group AnyC-SSL-VPN webvpn-attributes
     group-alias AnyC-SSL-VPN enable
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:af0fad1092e0314b0a80f20add03e3f7
    : end

    Hi Dave,
    It seems to be an issue with the NAT, I saw your VPN configuration:
    ip local pool AnyC-CPN-Client-Pool 192.168.59.0-192.168.59.250 mask 255.255.255.0
    unnel-group AnyC-SSL-VPN type remote-access
    tunnel-group AnyC-SSL-VPN general-attributes
     address-pool AnyC-CPN-Client-Pool
    tunnel-group AnyC-SSL-VPN webvpn-attributes
     group-alias AnyC-SSL-VPN enable
    group-policy DfltGrpPolicy attributes
     dns-server value 192.168.51.1 8.8.8.8
     vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value VPN
     default-domain value *****
     split-dns value 8.8.8.8
    access-list VPN standard permit 192.168.0.0 255.255.0.0
    You will need to set up a NAT exemption as follow:
    object-group network obj-192.168.59.0-Pool
     network-object 192.168.59.0 255.255.255.0
    object-group network obj-192.168.0.0
     network-object 192.168.0.0 255.255.0.0
    nat (inside,outside) 1 source static obj-192.168.0.0 obj-192.168.0.0 destination static obj-192.168.59.0-Pool obj-192.168.59.0-Pool no-proxy-arp route-lookup
    Please proceed to rate and mark as correct this post, if it helps!
    David Castro,
    Regards,

  • ASA 5510 Multiple Public IP - Static NAT Issue - Dynamic PAT - SMTP

    Running into a little bit of a roadblock and hoping someone can help me figure out what the issue is.  My guess right now is that it has something to do with dynamic PAT.
    Essentially, I have a block of 5 static public IP's.  I have 1 assigned to the interface and am using another for email/webmail.  I have no problems accessing the internet, receving emails, etc...  The issue is that the static NAT public IP for email is using the outside IP instead of the one assigned through the static NAT.  I would really appreciate if anyone could help shed some light as to why this is happening for me.  I always thought a static nat should take precidence in the order of things.
    Recap:
    IP 1 -- 10.10.10.78 is assigned to outside interface.  Dynamic PAT for all network objects to use this address when going out.
    IP 2 -- 10.10.10.74 is assgned through static nat to email server.  Email server should respond to and send out using this IP address.
    Email server gets traffic from 10.10.10.74 like it is supposed to, but when sending out shows as 10.10.10.78 instead of 10.10.10.74.
    Thanks in advance for anyone that reads this and can lend a hand.
    - Justin
    Here is my running config (some items like IP's, domain names, etc... modified to hide actual values; ignore VPN stuff -- still work in progress):
    ASA Version 8.4(3)
    hostname MYHOSTNAME
    domain-name MYDOMAIN.COM
    enable password msTsgJ6BvY68//T7 encrypted
    passwd msTsgJ6BvY68//T7 encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    nameif outside
    security-level 0
    ip address 10.10.10.78 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 192.168.2.2 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
    domain-name MYDOMAIN.COM
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-network
    subnet 192.168.2.0 255.255.255.0
    object network Email
    host 192.168.2.7
    object network Webmail
    host 192.168.2.16
    object network WebmailSecure
    host 192.168.2.16
    access-list inside_access_out extended permit ip any any
    access-list inside_access_out extended permit icmp any any
    access-list VPN_Split_Tunnel_List remark The corporate network behind the ASA (inside)
    access-list VPN_Split_Tunnel_List standard permit 192.168.2.0 255.255.255.0
    access-list outside_access_in extended deny icmp any any
    access-list outside_access_in extended permit tcp any object Email eq smtp
    access-list outside_access_in extended permit tcp any object Webmail eq www
    access-list outside_access_in extended permit tcp any object WebmailSecure eq https
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    asdm history enable
    arp timeout 14400
    nat (inside,outside) source static inside-network inside-network destination static inside-network inside-network no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    object network Email
    nat (inside,outside) static 10.10.10.74 service tcp smtp smtp
    object network Webmail
    nat (inside,outside) static 10.10.10.74 service tcp www www
    object network WebmailSecure
    nat (inside,outside) static 10.10.10.74 service tcp https https
    access-group outside_access_in in interface outside
    access-group inside_access_out out interface inside
    route outside 0.0.0.0 0.0.0.0 10.10.10.73 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server MYDOMAIN protocol kerberos
    aaa-server MYDOMAIN (inside) host 192.168.2.8
    kerberos-realm MYDOMAIN.COM
    aaa-server MYDOMAIN (inside) host 192.168.2.9
    kerberos-realm MYDOMAIN.COM
    aaa-server MY-LDAP protocol ldap
    aaa-server MY-LDAP (inside) host 192.168.2.8
    ldap-base-dn DC=MYDOMAIN,DC=com
    ldap-group-base-dn DC=MYDOMAIN,DC=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=SOMEUSER,CN=Users,DC=MYDOMAIN,DC=com
    server-type microsoft
    aaa-server MY-LDAP (inside) host 192.168.2.9
    ldap-base-dn DC=MYDOMAIN,DC=com
    ldap-group-base-dn DC=MYDOMAIN,DC=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=SOMEUSER,CN=Users,DC=MYDOMAIN,DC=com
    server-type microsoft
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.2.0 255.255.255.0 inside
    http redirect outside 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    email [email protected]
    subject-name CN=MYHOSTNAME
    ip-address 10.10.10.78
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate e633854f
        30820298 30820201 a0030201 020204e6 33854f30 0d06092a 864886f7 0d010105
        0500305e 31143012 06035504 03130b47 46472d53 55532d41 53413146 301a0609
        2a864886 f70d0109 08130d39 382e3130 302e3232 322e3738 30280609 2a864886
        f70d0109 02161b47 46472d53 55532d41 53412e47 46472d50 4541424f 44592e43
        4f4d301e 170d3132 30343131 30373431 33355a17 0d323230 34303930 37343133
        355a305e 31143012 06035504 03130b47 46472d53 55532d41 53413146 301a0609
        2a864886 f70d0109 08130d39 382e3130 302e3232 322e3738 30280609 2a864886
        f70d0109 02161b47 46472d53 55532d41 53412e47 46472d50 4541424f 44592e43
        4f4d3081 9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100b4
        aa6e27de fbf8492b 74ba91aa e0fd8361 e0e85a31 f95c380d 6e5f43ac a695a810
        f50e893b 82b91870 a32f7e38 8f392607 7a69c814 36a71a9c 2dccca07 24fe7f88
        0f3451ed c64e85fc 8359c87e 62ebf166 0a570ac5 f9f1c64b 262eca66 ea05ab65
        78da1ac2 9867a115 b14a6ba1 cd82d04e 00fc6557 856f7c04 ab1b08a0 b9de8b02
        03010001 a3633061 300f0603 551d1301 01ff0405 30030101 ff300e06 03551d0f
        0101ff04 04030201 86301f06 03551d23 04183016 801430cf 97ef92bb 678e3ba3
        0002069c 8130550a 2664301d 0603551d 0e041604 1430cf97 ef92bb67 8e3ba300
        02069c81 30550a26 64300d06 092a8648 86f70d01 01050500 03818100 64c403bd
        d75717ab 24383e77 63e10ba7 4fdef625 73c5a952 19ceecbd 75bd23ca 86dc0298
        e6693a8a 2c7fb85f 096497a7 8d784ada a433ee0d d88e9219 f0615f3c 7814bf1c
        5b4fe847 7d8894eb 18fe2da7 05f15ae9 bc2c17ec 3a7831ee f95d6ced 4799fba2
        781c8228 48224843 dc07ebb5 d20abf2a b68cfa62 ac71a41b 1196a018
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable inside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.2.0 255.255.255.0 inside
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 20
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 192.168.2.8 source inside prefer
    ssl trust-point ASDM_TrustPoint0 inside
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    enable inside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.5080-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    group-policy GroupPolicy_VPN internal
    group-policy GroupPolicy_VPN attributes
    wins-server value 192.168.2.8 192.168.2.9
    dns-server value 192.168.2.8 192.168.2.9
    vpn-filter value VPN_Split_Tunnel_List
    vpn-tunnel-protocol ikev2 ssl-client
    group-lock value VPN
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Split_Tunnel_List
    default-domain value MYDOMAIN.COM
    webvpn
      anyconnect profiles value VPN_client_profile type user
    group-policy GroupPolicy-VPN-LAPTOP internal
    group-policy GroupPolicy-VPN-LAPTOP attributes
    wins-server value 192.168.2.8 192.168.2.9
    dns-server value 192.168.2.8 192.168.2.9
    vpn-filter value VPN_Split_Tunnel_List
    vpn-tunnel-protocol ikev2
    group-lock value VPN-LAPTOP
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Split_Tunnel_List
    default-domain value MYDOMAIN.COM
    webvpn
      anyconnect profiles value VPN_client_profile type user
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    authentication-server-group MYDOMAIN
    default-group-policy GroupPolicy_VPN
    dhcp-server 192.168.2.8
    dhcp-server 192.168.2.9
    dhcp-server 192.168.2.10
    tunnel-group VPN webvpn-attributes
    group-alias VPN enable
    tunnel-group VPN-LAPTOP type remote-access
    tunnel-group VPN-LAPTOP general-attributes
    authentication-server-group MY-LDAP
    default-group-policy GroupPolicy-VPN-LAPTOP
    dhcp-server 192.168.2.8
    dhcp-server 192.168.2.9
    dhcp-server 192.168.2.10
    tunnel-group VPN-LAPTOP webvpn-attributes
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    class class-default
      user-statistics accounting
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:951faceacf912d432fc228ecfcdffd3f

    Hi ,
    As per you config :
    object network obj_any
    nat (inside,outside) dynamic interface
    object network Email
    nat (inside,outside) static 10.10.10.74 service tcp smtp smtp
    object network Webmail
    nat (inside,outside) static 10.10.10.74 service tcp www www
    object network WebmailSecure
    nat (inside,outside) static 10.10.10.74 service tcp https https
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-network
    subnet 192.168.2.0 255.255.255.0
    object network Email
    host 192.168.2.7
    object network Webmail
    host 192.168.2.16
    object network WebmailSecure
    host 192.168.2.16
    The flows from email server ( 192.168.2.7 ) , will be NATed to 10.10.10.74, only if the source port is TCP/25. Any other souce port will use the interface IP for NAT.
      Are you saying that this is not happening ?
    Dan

  • AnyConnect VPN doesn't access the ASA

    Hello,
    I have an ASA 5512-x configured as a VPN AnyConnect concentrator, but when I connect I can't access the firewall... I can ping the address 10.4.11.2 but I can't connect... Any idea what to do? This is the running configuration:
    : Saved
    ASA Version 8.6(1)2
    hostname asa-oi
    domain-name xx.xx.xx.xx
    enable password 7Hb0WWuK1NRtRaEy encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 1.1.1.1 DefaultGW-Outside description Default Gateway Outside
    name 10.4.11.1 DefaultGW-Inside description Default Gateway Inside
    interface GigabitEthernet0/0
    nameif inside
    security-level 100
    ip address 10.4.11.2 255.255.255.0
    interface GigabitEthernet0/5
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5.2000
    vlan 2000
    nameif outside
    security-level 0
    ip address 1.1.1.2 255.255.255.252
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    management-only
    boot system disk0:/asa861-2-smp-k8.bin
    ftp mode passive
    clock timezone BRST -3
    clock summer-time BRDT recurring 2 Sun Oct 0:00 3 Sun Feb 0:00
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 1.1.1.1
    name-server 1.1.1.2
    domain-name xx.xx.xx.xx
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network PoolAnyConnect
    subnet 10.6.4.0 255.255.252.0
    access-list outside_in extended permit ip any any
    access-list tunneled standard permit 10.0.0.0 255.0.0.0
    pager lines 24
    logging enable
    logging timestamp
    logging buffer-size 1048576
    logging buffered informational
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool PoolAnyConnect 10.6.4.1-10.6.7.254 mask 255.255.252.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm image disk0:/asdm-66114.bin
    asdm history enable
    arp timeout 14400
    nat (inside,outside) source static any any destination static PoolAnyConnect PoolAnyConnect no-proxy-arp route-lookup
    nat (outside,inside) source static PoolAnyConnect PoolAnyConnect no-proxy-arp route-lookup
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 DefaultGW-Outside 1
    route inside 10.0.0.0 255.0.0.0 DefaultGW-Inside 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 3.3.3.3
    timeout 5
    ldap-base-dn o=xx
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    server-type novell
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 2.2.2.2 255.255.255.240 outside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 2.2.2.2 255.255.255.240 outside
    ssh timeout 10
    console timeout 10
    management-access inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GrpPolicyAnyConnect internal
    group-policy GrpPolicyAnyConnect attributes
    dns-server value 1.1.1.1 1.1.1.2
    vpn-simultaneous-logins 1000
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value tunneled
    default-domain value xx.xx.xx.xx
    username admin password Dp4l7Cmqr7SMHl.l encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool PoolAnyConnect
    authentication-server-group LDAP
    default-group-policy GrpPolicyAnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ctiqbe
      inspect http
      inspect dcerpc
      inspect dns
      inspect icmp
      inspect icmp error
      inspect ils
      inspect ipsec-pass-thru
      inspect mgcp
      inspect pptp
      inspect snmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:9399e42e238b5824eebaa115c93ad924
    : end
    Btw, I changed NAT configuration a lot of times trying to solve the problem, this one is the current one...

    I didn't remember if I already tried it, anyway, I tried now:
    asa-oi(config)# sh run nat
    nat (inside,outside) source static any any destination static PoolAnyConnect PoolAnyConnect route-lookup
    nat (outside,inside) source static PoolAnyConnect PoolAnyConnect route-lookup
    but no difference, had the same problem...
    Btw, when I try to connect via SSH, these logs messages appears: (don't know if it can help)
    Syslog ID: 302013
    Source IP Add: 10.6.4.1
    Source Port: 2181
    Dest IP Add: 10.4.11.2
    Dest Port: 22
    Description: Built inbound TCP connection 202412 for outside:10.6.4.1/2181 (10.6.4.1/2181)(LOCAL\VpnAnyConnect) to identity:10.4.11.2/22 (10.4.11.2/22) (VpnAnyConnect)
    Syslog ID: 302014
    Source IP Add: 10.6.4.1
    Source Port: 2181
    Dest IP Add: 10.4.11.2
    Dest Port: 22
    Description: Teardown TCP connection 202412 for outside:10.6.4.1/2181(LOCAL\VpnAnyConnect) to identity:10.4.11.2/22 duration 0:00:30 bytes 0 SYN Timeout (VpnAnyConnect)

  • Upgrading from PIX to ASA 5512X

    Hi everyone,
    We are in the middle of upgrading from two PIX's to some new ASA5512X's. To give you some background on the situation we are upgrading these since the PIXs are fairly old. We had one extra that we had to use since one PIX has failed already. The guy that implemented the PIXs orginally was learning how to do so as he went so there is alot of needless config in the PIX, atleast from what I can tell. Another guy that works with me has done some configuration on the new ASAs and has done the majority of it so far. Today we went to install the new ASAs and switch everything over hoping it would work, but that didn't happen. It seems that there is something wrong with our NAT and ACLs somewhere along the lines. The way our network is laid out is that we have two school campus with a site-to-site VPN one is 172.17.0.0/16 and the other is 172.18.0.0/16. We also have a remote-access VPN on both ASA's. When we connected the new ASAs up and brought up the interfaces, nothing on the inside could ping the internet nor the other side. The VPN showed active on the ASA's and each ASA could ping the others outside interface, but that was it. I have posted the configs below. If anyone could help out I would GREATLY appreciate it! Thank you in advance!
    ASA1:
    : Saved
    : Written by enable_15 at 04:26:18.240 CDT Tue Mar 12 2013
    ASA Version 8.6(1)2
    hostname dallasroadASA
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 70.x.x.x 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 172.18.1.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 172.18.2.21
    name-server 172.18.2.20
    object network WS_VLAN2
    subnet 172.17.2.0 255.255.255.0
    object network WS_VLAN3
    subnet 172.17.3.0 255.255.255.0
    object network WS_VLAN4
    subnet 172.17.4.0 255.255.255.0
    object network WS_VLAN5
    subnet 172.17.5.0 255.255.255.0
    object network WS_VLAN6
    subnet 172.17.6.0 255.255.255.0
    object network WS_VLAN7
    subnet 172.17.7.0 255.255.255.0
    object network WS_VLAN8
    subnet 172.17.8.0 255.255.255.0
    object network WS_VLAN9
    subnet 172.17.9.0 255.255.255.0
    object network WS_VLAN10
    subnet 172.17.10.0 255.255.255.0
    object network WS_VLAN11
    subnet 172.17.11.0 255.255.255.0
    object network WS_VLAN12
    subnet 172.17.12.0 255.255.255.0
    object network WS_VLAN13
    subnet 172.17.13.0 255.255.255.0
    object network WS_VLAN14
    subnet 172.17.14.0 255.255.255.0
    object network WS_VLAN15
    subnet 172.17.15.0 255.255.255.0
    object network WS_VLAN16
    subnet 172.17.16.0 255.255.255.0
    object network DR_VLAN2
    subnet 172.18.2.0 255.255.255.0
    object network DR_VLAN3
    subnet 172.18.3.0 255.255.255.0
    object network DR_VLAN4
    subnet 172.18.4.0 255.255.255.0
    object network DR_VLAN5
    subnet 172.18.5.0 255.255.255.0
    object network DR_VLAN6
    subnet 172.18.6.0 255.255.255.0
    object network DR_VLAN7
    subnet 172.18.7.0 255.255.255.0
    object network DR_VLAN8
    subnet 172.18.8.0 255.255.255.0
    object network DR_VLAN9
    subnet 172.18.9.0 255.255.255.0
    object network DR_VLAN10
    subnet 172.18.10.0 255.255.255.0
    object network DR_CORE_SW
    host 172.18.2.1
    object network dallasdns02_internal
    host 172.18.2.21
    object network faithdallas03_internal
    host 172.18.2.20
    object network dns_external
    host 70.x.x.x
    object network WorthStreet
    subnet 172.17.0.0 255.255.0.0
    object network DallasRoad
    subnet 172.18.0.0 255.255.0.0
    object-group network DALLAS_VLANS
    network-object object DR_VLAN10
    network-object object DR_VLAN2
    network-object object DR_VLAN3
    network-object object DR_VLAN4
    network-object object DR_VLAN5
    network-object object DR_VLAN6
    network-object object DR_VLAN7
    network-object object DR_VLAN8
    network-object object DR_VLAN9
    object-group network WORTH_VLANS
    network-object object WS_VLAN10
    network-object object WS_VLAN11
    network-object object WS_VLAN12
    network-object object WS_VLAN13
    network-object object WS_VLAN14
    network-object object WS_VLAN15
    network-object object WS_VLAN16
    network-object object WS_VLAN2
    network-object object WS_VLAN3
    network-object object WS_VLAN4
    network-object object WS_VLAN5
    network-object object WS_VLAN6
    network-object object WS_VLAN7
    network-object object WS_VLAN8
    network-object object WS_VLAN9
    object-group network dallasitnetwork
    network-object host 172.18.2.20
    network-object host 172.18.2.40
    object-group protocol tcpudp
    protocol-object udp
    protocol-object tcp
    object-group network dallasroaddns
    network-object host 172.18.2.20
    network-object host 172.18.2.21
    object-group service tcpservices tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq ssh
    object-group network remotevpnnetwork
    network-object 172.18.50.0 255.255.255.0
    access-list L2LAccesslist extended permit ip 172.18.0.0 255.255.0.0 172.17.0.0 255.255.0.0
    access-list NONAT extended permit ip any 172.18.50.0 255.255.255.0
    access-list inside_inbound_access extended permit ip 172.18.0.0 255.255.0.0 172.17.0.0 255.255.0.0
    access-list inside_inbound_access extended permit ip object-group dallasitnetwork any
    access-list inside_inbound_access extended permit object-group tcpudp object-group dallasroaddns any eq domain
    access-list inside_inbound_access extended permit ip host 172.18.4.10 any
    access-list inside_inbound_access extended deny object-group tcpudp any any eq domain
    access-list inside_inbound_access extended deny tcp any any eq smtp
    access-list inside_inbound_access extended permit ip any any
    access-list outside_inbound_access extended permit tcp any host 70.x.x.x object-group tcpservices
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpnaddresspool 172.18.50.0-172.18.50.255
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static dallasdns02_internal dns_external
    nat (inside,outside) source static faithdallas03_internal dns_external
    nat (inside,outside) source dynamic any interface
    nat (any,outside) source static remotevpnnetwork remotevpnnetwork destination static remotevpnnetwork remotevpnnetwork description NONAT for remote vpn users
    nat (inside,outside) source static DallasRoad DallasRoad destination static WorthStreet WorthStreet
    access-group outside_inbound_access in interface outside
    access-group inside_inbound_access in interface inside
    route outside 0.0.0.0 0.0.0.0 70.x.x.x 1
    route inside 172.18.0.0 255.255.0.0 172.18.1.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    ldap attribute-map CISCOMAP
      map-name  VPNALLOW IETF-Radius-Class
      map-value VPNALLOW FALSE NOACESS
      map-value VPNALLOW TRUE ALLOWACCESS
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 172.17.2.28
    server-port 389
    ldap-base-dn DC=campus,DC=fcschool,DC=org
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password ****
    ldap-login-dn CN=fcsadmin,CN=Users,DC=campus,DC=fcschool,DC=org
    server-type microsoft
    ldap-attribute-map CISCOMAP
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 172.17.11.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac
    crypto map outside_map 10 match address L2LAccesslist
    crypto map outside_map 10 set peer 71.x.x.x
    crypto map outside_map 10 set ikev1 transform-set myset
    crypto map outside_map 10 set reverse-route
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 172.18.0.0 255.255.0.0 inside
    ssh 172.17.0.0 255.255.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
    vpn-simultaneous-logins 0
    vpn-tunnel-protocol ikev1
    group-policy DfltGrpPolicy attributes
    dns-server value 172.18.2.20
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
    password-storage enable
    group-policy DallasRoad internal
    group-policy DallasRoad attributes
    dns-server value 172.18.2.20 172.18.2.21
    password-storage enable
    default-domain value campus.fcschool.org
    group-policy ALLOWACCESS internal
    group-policy ALLOWACCESS attributes
    banner value Now connected to the FCS Network
    vpn-tunnel-protocol ikev1
    username iwerkadmin password i6vIlW5ctGaR0l7n encrypted privilege 15
    tunnel-group remoteaccessvpn type remote-access
    tunnel-group remoteaccessvpn general-attributes
    address-pool vpnaddresspool
    authentication-server-group LDAP
    tunnel-group 71.x.x.x type ipsec-l2l
    tunnel-group 71.x.x.x ipsec-attributes
    ikev1 pre-shared-key ****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:fd69fbd7a2cb0a6a125308dd85302198
    : end
    ASA2:
    : Saved
    : Written by enable_15 at 09:27:47.579 UTC Tue Mar 12 2013
    ASA Version 8.6(1)2
    hostname worthstreetASA
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 71.x.x.x 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 172.17.1.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa861-2-smp-k8.bin
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 172.17.2.23
    name-server 172.17.2.28
    object network mail_external
    host 71.x.x.x
    object network mail_internal
    host 172.17.2.57
    object network faweb_external
    host 71.x.x.x
    object network netclassroom_external
    host 71.x.x.x
    object network blackbaud_external
    host 71.x.x.x
    object network netclassroom_internal
    host 172.17.2.41
    object network nagios
    host 208.x.x.x
    object network DallasRoad_ASA
    host 70.x.x.x
    object network WS_VLAN2
    subnet 172.17.2.0 255.255.255.0
    object network WS_VLAN3
    subnet 172.17.3.0 255.255.255.0
    object network WS_VLAN4
    subnet 172.17.4.0 255.255.255.0
    object network WS_VLAN5
    subnet 172.17.5.0 255.255.255.0
    object network WS_VLAN6
    subnet 172.17.6.0 255.255.255.0
    object network WS_VLAN7
    subnet 172.17.7.0 255.255.255.0
    object network WS_VLAN8
    subnet 172.17.8.0 255.255.255.0
    object network WS_VLAN9
    subnet 172.17.9.0 255.255.255.0
    object network WS_VLAN10
    subnet 172.17.10.0 255.255.255.0
    object network WS_VLAN11
    subnet 172.17.11.0 255.255.255.0
    object network WS_VLAN12
    subnet 172.17.12.0 255.255.255.0
    object network WS_VLAN13
    subnet 172.17.13.0 255.255.255.0
    object network WS_VLAN14
    subnet 172.17.14.0 255.255.255.0
    object network WS_VLAN15
    subnet 172.17.15.0 255.255.255.0
    object network WS_VLAN16
    subnet 172.17.16.0 255.255.255.0
    object network DR_VLAN2
    subnet 172.18.2.0 255.255.255.0
    object network DR_VLAN3
    subnet 172.18.3.0 255.255.255.0
    object network DR_VLAN4
    subnet 172.18.4.0 255.255.255.0
    object network DR_VLAN5
    subnet 172.18.5.0 255.255.255.0
    object network DR_VLAN6
    subnet 172.18.6.0 255.255.255.0
    object network DR_VLAN7
    subnet 172.18.7.0 255.255.255.0
    object network DR_VLAN8
    subnet 172.18.8.0 255.255.255.0
    object network DR_VLAN9
    subnet 172.18.9.0 255.255.255.0
    object network DR_VLAN10
    subnet 172.18.10.0 255.255.255.0
    object network WS_CORE_SW
    host 172.17.2.1
    object network blackbaud_internal
    host 172.17.2.26
    object network spiceworks_internal
    host 172.17.2.15
    object network faweb_internal
    host 172.17.2.31
    object network spiceworks_external
    host 71.x.x.x
    object network WorthStreet
    subnet 172.17.0.0 255.255.0.0
    object network DallasRoad
    subnet 172.18.0.0 255.255.0.0
    object network remotevpnnetwork
    subnet 172.17.50.0 255.255.255.0
    object-group icmp-type echo_svc_group
    icmp-object echo
    icmp-object echo-reply
    object-group service mail.fcshool.org_svc_group
    service-object icmp
    service-object icmp echo
    service-object icmp echo-reply
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq imap4
    service-object tcp destination eq pop3
    service-object tcp destination eq smtp
    object-group service nagios_svc_group tcp
    port-object eq 12489
    object-group service http_s_svc_group tcp
    port-object eq www
    port-object eq https
    object-group network DALLAS_VLANS
    network-object object DR_VLAN10
    network-object object DR_VLAN2
    network-object object DR_VLAN3
    network-object object DR_VLAN4
    network-object object DR_VLAN5
    network-object object DR_VLAN6
    network-object object DR_VLAN7
    network-object object DR_VLAN8
    network-object object DR_VLAN9
    object-group network WORTH_VLANS
    network-object object WS_VLAN10
    network-object object WS_VLAN11
    network-object object WS_VLAN12
    network-object object WS_VLAN13
    network-object object WS_VLAN14
    network-object object WS_VLAN15
    network-object object WS_VLAN16
    network-object object WS_VLAN2
    network-object object WS_VLAN3
    network-object object WS_VLAN4
    network-object object WS_VLAN5
    network-object object WS_VLAN6
    network-object object WS_VLAN7
    network-object object WS_VLAN8
    network-object object WS_VLAN9
    object-group network MailServers
    network-object host 172.17.2.57
    network-object host 172.17.2.58
    network-object host 172.17.2.17
    object-group protocol DM_INLINE_PROTOCOL
    protocol-object ip
    protocol-object udp
    protocol-object tcp
    object-group network DNS_Servers
    network-object host 172.17.2.23
    network-object host 172.17.2.28
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    access-list outside_access_in extended permit object-group mail.fcshool.org_svc_group any object mail_internal
    access-list outside_access_in extended permit tcp object nagios object mail_internal object-group nagios_svc_group
    access-list outside_access_in extended permit tcp any object faweb_external object-group http_s_svc_group
    access-list outside_access_in extended permit tcp any object netclassroom_external object-group http_s_svc_group
    access-list outside_access_in extended permit tcp any object blackbaud_external eq https
    access-list outside_access_in extended permit tcp any object spiceworks_external object-group http_s_svc_group
    access-list L2LAccesslist extended permit ip 172.17.0.0 255.255.0.0 172.18.0.0 255.255.0.0
    access-list inside_inbound extended permit object-group TCPUDP object-group DNS_Servers any eq domain
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL host 172.17.15.10 any inactive
    access-list inside_access_in extended permit tcp object-group MailServers any eq smtp
    access-list inside_access_in extended permit tcp host 172.17.14.10 any eq smtp
    access-list inside_access_in extended deny object-group TCPUDP any any eq domain
    access-list inside_access_in extended deny tcp any any eq smtp
    access-list inside_access_in extended permit ip any any
    access-list vpn_access extended permit ip any any
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpnaddresspool 172.17.50.1-172.17.50.255
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-66114.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static mail_internal mail_external
    nat (inside,outside) source static netclassroom_internal netclassroom_external
    nat (inside,outside) source static faweb_internal faweb_external
    nat (inside,outside) source static spiceworks_internal interface
    nat (inside,outside) source static blackbaud_internal blackbaud_external
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source static WorthStreet WorthStreet destination static DallasRoad DallasRoad
    nat (any,outside) source static remotevpnnetwork remotevpnnetwork destination static remotevpnnetwork remotevpnnetwork description NONAT for remote vpn users
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 71.x.x.x 1
    route inside 172.17.0.0 255.255.0.0 172.17.2.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    ldap attribute-map CISCOMAP
      map-name  VPNALLOW IETF-Radius-Class
      map-value VPNALLOW FALSE NOACESS
      map-value VPNALLOW TRUE ALLOWACCESS
    dynamic-access-policy-record DfltAccessPolicy
    network-acl vpn_access
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 172.17.2.28
    ldap-base-dn DC=campus,DC=fcschool,DC=org
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password Iw@FCS730w
    ldap-login-dn CN=VPN Admin,CN=Users,DC=campus,DC=fcschool,DC=org
    server-type microsoft
    ldap-attribute-map CISCOMAP
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 172.17.0.0 255.255.0.0 inside
    http 172.18.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac
    crypto map outside_map 10 match address L2LAccesslist
    crypto map outside_map 10 set peer 70.x.x.x
    crypto map outside_map 10 set ikev1 transform-set myset
    crypto map outside_map 10 set reverse-route
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    telnet 172.17.0.0 255.255.0.0 inside
    telnet 172.18.0.0 255.255.0.0 inside
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh 172.17.0.0 255.255.0.0 inside
    ssh 172.18.0.0 255.255.0.0 inside
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access management
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes256-sha1 aes128-sha1 3des-sha1
    webvpn
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
    vpn-simultaneous-logins 0
    vpn-tunnel-protocol ikev1
    group-policy ALLOWACCESS internal
    group-policy ALLOWACCESS attributes
    banner value Now connected to the FCS Network
    vpn-tunnel-protocol ikev1
    username iwerkadmin password i6vIlW5ctGaR0l7n encrypted privilege 15
    tunnel-group 70.x.x.x type ipsec-l2l
    tunnel-group 70.x.x.x ipsec-attributes
    ikev1 pre-shared-key FC$vpnn3tw0rk
    tunnel-group remoteaccessvpn type remote-access
    tunnel-group remoteaccessvpn general-attributes
    address-pool vpnaddresspool
    authentication-server-group LDAP
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:b599ba0f719f39b213e7f01fe55588ac
    : end

    Hi Derrick,
    I just did the same for a customer; replaced 2 PIX515s failover cluster with 5512X. The NAT change is major with ASAs version 8.3 and later...
    here's what you need: a manual NAT rule called twice NAT (policy NAT or NONAT is the old terminology) for the VPNs to work. also add the no-proxy-arp keyword:
    nat (inside,outside) source static INSIDE_NETWORKS INSIDE_NETWORKS VPN_NETWORKS VPN_NETWORKS no-proxy-arp
    nat (inside,outside) source static INSIDE_NETWORKS INSIDE_NETWORKS RA_VPN_NETWORKS RA_VPN_NETWORKS no-proxy-arp
    then the dynamic PAT for internet access (after the twice NATs for VPN); could be a manual NAT like you did, or preferred an object NAT.
    you did:
    nat (inside,outside) source dynamic any interface
    would also work with object nat:
    object network INSIDE_NETWORKS
    subnet ...
    nat (inside,outside) dynamic interface
    Same on the other side (except the networks are reversed since the inside network is now what the other side refers to as vpn network and vice versa)
    If you don't put the no-proxy-arp, your NAT configuration will cause network issues.
    also to be able to pass pings through ASA, add the following:
    policy-map global_policy
    class inspection_default
      inspect icmp
    The asa will do some basic inspection of the ICMP protocol with that config ex. it will make sure there is 1 echo-reply for each echo-request...
    hope that helps,
    Patrick

  • Cisco AnyConnect Configuration

    Can someone assist me with configuring Cisco AnyConnect VPN? For some reason with the config below, I seem to get connected but then my internet connection randomly drops and reconnects.  Ive tried several different times to get this to work properly but Im obivously missing something here.  Any help is appreciated.
    ASA Version 8.2(2)
    hostname FW01
    enable password .MlTybcgwEXNF1HM encrypted
    passwd .MlTybcgwEXNF1HM encrypted
    names
    dns-guard
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    description ### Link to Internet ###
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    description ### Link to GUEST WIFI  ###
    nameif guest
    security-level 50
    ip address 172.16.10.1 255.255.255.0
    interface Vlan4
    description ### Link to INSIDE LAN ###
    nameif inside
    security-level 100
    ip address 172.16.1.1 255.255.255.0
    interface Vlan5
    description ### Link to INSIDE WIFI ###
    nameif insidewifi
    security-level 50
    ip address 172.16.2.1 255.255.255.0
    interface Ethernet0/0
    description ### Link to Internet ###
    switchport access vlan 2
    interface Ethernet0/1
    description ### Link to GUEST WIFI  ###
    switchport access vlan 3
    interface Ethernet0/2
    description ### Link to INSIDE LAN ###
    switchport access vlan 4
    interface Ethernet0/3
    description ### Link to INSIDE WIFI ###
    switchport access vlan 5
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    banner exec
    banner exec ******* ENGLISH *** ATTENTION *** ENGLISH *** ATTENTION *** ENGLISH **********
    banner exec *                                                                  
    banner exec *      This system is for the use of authorized users only.        
    banner exec *      Individuals using this system are subject to having all of their  
    banner exec *      activities on this system monitored and recorded by system  
    banner exec *      personnel.                                                  
    banner exec *                                                                  
    banner exec *      Anyone using this system expressly consents to such monitoring    
    banner exec *      and is advised that if such monitoring reveals possible     
    banner exec *      evidence of criminal activity, system personnel may provide the   
    banner exec *      evidence of such monitoring to law enforcement officials.   
    banner exec *                                                                  
    banner exec ******* ENGLISH *** ATTENTION *** ENGLISH *** ATTENTION *** ENGLISH **********
    banner exec
    banner exec
    banner exec Name:.......FW01
    banner exec Address:....172.16.1.1
    banner exec Location:...CST -5
    ftp mode passive
    clock timezone CST -5
    same-security-traffic permit inter-interface
    access-list inside extended permit ip any any
    access-list outside extended permit ip any any
    access-list guest extended permit udp any host 172.16.1.102 eq domain
    access-list guest extended permit udp any host 172.16.1.103 eq domain
    access-list guest extended permit udp any any range bootps tftp
    access-list guest extended deny ip any 172.16.1.0 255.255.255.0 log
    access-list guest extended deny ip any 172.16.2.0 255.255.255.0 log
    access-list guest extended permit ip any any
    access-list insidewifi extended permit ip any any
    access-list Outside_In extended permit tcp any any eq 3389
    pager lines 50
    logging enable
    logging list TEST level alerts
    logging buffered debugging
    logging asdm informational
    logging mail TEST
    logging from-address [email protected]
    logging recipient-address ************* level errors
    mtu outside 1500
    mtu guest 1500
    mtu inside 1500
    mtu insidewifi 1500
    ip local pool SSLClientPool 172.16.9.1-172.16.9.2 mask 255.255.255.0
    ip audit name FW01-INFO info action alarm
    ip audit name FW01-ATTACK attack action alarm reset
    ip audit interface outside FW01-INFO
    ip audit interface outside FW01-ATTACK
    ip audit signature 2000 disable
    ip audit signature 2001 disable
    ip audit signature 2004 disable
    ip audit signature 2005 disable
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any echo-reply outside
    icmp permit any guest
    icmp permit any inside
    icmp permit any insidewifi
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (guest) 1 172.16.10.0 255.255.255.0
    nat (inside) 1 172.16.1.0 255.255.255.0
    nat (insidewifi) 1 172.16.2.0 255.255.255.0
    static (inside,outside) tcp interface 3389 172.16.1.200 3389 netmask 255.255.255.255
    static (inside,guest) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
    static (inside,insidewifi) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
    access-group Outside_In in interface outside
    access-group guest in interface guest
    access-group inside in interface inside
    access-group insidewifi in interface insidewifi
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 172.16.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    fragment chain 1 outside
    sysopt noproxyarp outside
    service resetoutside
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn sslvpn.moore.net
    subject-name CN=sslvpn.moore.net
    keypair sslvpnkeypair
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 956e1350
        308201ef 30820158 a0030201 02020495 6e135030 0d06092a 864886f7 0d010105
        0500303c 31193017 06035504 03131073 736c7670 6e2e6d6f 6f72652e 6e657431
        1f301d06 092a8648 86f70d01 09021610 73736c76 706e2e6d 6f6f7265 2e6e6574
        301e170d 31323037 32383034 34363133 5a170d32 32303732 36303434 3631335a
        303c3119 30170603 55040313 1073736c 76706e2e 6d6f6f72 652e6e65 74311f30
        1d06092a 864886f7 0d010902 16107373 6c76706e 2e6d6f6f 72652e6e 65743081
        9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100c8 167e2c3d
        04c16a6c b6639fda c60f085a 8ea6a2ea 6e0bcafb acb3ec8e 3c659274 37636c34
        0df9e770 17fb97f6 c2b8641e ff3675f3 3d906e01 a7056bb0 9c0bf54c 3475729e
        74caf157 068464d3 e235c46f a8525867 c3911d9c 760253d0 c7bbb7c8 84f91f92
        858866c6 e0c1033d 6cfba6f0 b732158f 3d2d7ef5 9bbb0821 4d093f02 03010001
        300d0609 2a864886 f70d0101 05050003 81810062 65e2455a cb4e87ea 7879099d
        06ed1c5e 7eab180a 4d7564be c36810eb fe6a5bb9 94348ded 1336d811 d0949342
        2718400c 8cc32395 23e7d722 3e2758a9 a2116a38 07500bd5 5b96f3c2 1d7c5769
        dc5b876b 858cb447 355aa323 abbaf45d bed3814d a04f503a 21cddb47 aaecd5aa
        1c82f701 22969424 f6845937 a21568a1 ecaa0e
      quit
    telnet timeout 5
    ssh 172.16.1.0 255.255.255.0 inside
    ssh timeout 60
    console timeout 0
    management-access inside
    dhcpd dns 172.16.1.102
    dhcpd ping_timeout 750
    dhcprelay server 172.16.1.102 inside
    dhcprelay enable guest
    dhcprelay enable insidewifi
    dhcprelay setroute guest
    dhcprelay setroute insidewifi
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection scanning-threat shun except ip-address 172.16.0.0 255.255.0.0
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 211.233.40.78
    ntp server 61.153.197.226
    ntp server 202.150.213.154 prefer
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy SSLClientPolicy internal
    group-policy SSLClientPolicy attributes
    dns-server value 172.16.1.102 172.16.1.103
    vpn-tunnel-protocol svc
    default-domain value moore.net
    address-pools value SSLClientPool
    username gmoore_a password PNUmTwjDhevRqhkT encrypted privilege 15
    tunnel-group SSLClientProfile type remote-access
    tunnel-group SSLClientProfile general-attributes
    default-group-policy SSLClientPolicy
    tunnel-group SSLClientProfile webvpn-attributes
    group-alias SSLVPNClient enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    smtp-server 68.1.17.8
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:847a9a2b25e6a8ea2d4b68d17cdd41d2
    : end
    no asdm history enable

    Javier,
    Thanks for the explaination.  I have one more question, maybe I should open a seperate discussion.  If so please let me know...
    After I got the Anyconnect VPN configuraiton working I tried to configure LDAP configuration.  Now when I try to connect I get and error stating
    "Login denied.  Your environment does not meet the access criteria defined by your administrator."
    Then at the bottom of the AnyConnect client I see
    "Access Denied: Your system does not meet policy requirement (DAP)
    Looking at the DAP configuration I cant see what the policy is not accepting.  The partial config is below
    ASA Version 8.2(2)
    same-security-traffic permit inter-interface
    access-list inside extended permit ip any any
    access-list outside extended permit ip any any
    access-list guest extended permit udp any host 172.16.1.102 eq domain
    access-list guest extended permit udp any host 172.16.1.103 eq domain
    access-list guest extended permit udp any any range bootps tftp
    access-list guest extended deny ip any 172.16.1.0 255.255.255.0 log
    access-list guest extended deny ip any 172.16.2.0 255.255.255.0 log
    access-list guest extended permit ip any any
    access-list insidewifi extended permit ip any any
    access-list Outside_In extended permit tcp any any eq 3389
    access-list SSLClientProfile_SPLIT standard permit 172.16.1.0 255.255.255.0
    access-list SSLClientProfile_SPLIT standard permit 172.16.2.0 255.255.255.0
    access-list nonat_inside extended permit ip 172.16.1.0 255.255.255.0 172.16.9.0 255.255.255.0
    access-list nonat_insidewifi extended permit ip 172.16.2.0 255.255.255.0 172.16.9.0 255.255.255.0
    pager lines 50
    logging enable
    logging list TEST level alerts
    logging buffered debugging
    logging asdm informational
    logging mail TEST
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu outside 1500
    mtu guest 1500
    mtu inside 1500
    mtu insidewifi 1500
    ip local pool SSLClientPool 172.16.9.1-172.16.9.2 mask 255.255.255.0
    ip audit name FW01-INFO info action alarm
    ip audit name FW01-ATTACK attack action alarm reset
    ip audit interface outside FW01-INFO
    ip audit interface outside FW01-ATTACK
    ip audit signature 2000 disable
    ip audit signature 2001 disable
    ip audit signature 2004 disable
    ip audit signature 2005 disable
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any echo-reply outside
    icmp permit any guest
    icmp permit any inside
    icmp permit any insidewifi
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (guest) 1 172.16.10.0 255.255.255.0
    nat (inside) 0 access-list nonat_inside
    nat (inside) 1 172.16.1.0 255.255.255.0
    nat (insidewifi) 0 access-list nonat_insidewifi
    nat (insidewifi) 1 172.16.2.0 255.255.255.0
    static (inside,outside) tcp interface 3389 172.16.1.200 3389 netmask 255.255.255.255
    static (inside,guest) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
    static (inside,insidewifi) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
    access-group Outside_In in interface outside
    access-group guest in interface guest
    access-group inside in interface inside
    access-group insidewifi in interface insidewifi
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record SSLVPNPolicy
    description "SSL VPN Policy (AD Login)"
    dynamic-access-policy-record DfltAccessPolicy
    action terminate
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 172.16.1.102
    server-port 389
    ldap-base-dn DC=MOORE,DC=NET
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=LDAP Service Account,OU=ServiceAccounts,OU=MooreNetwork,DC=moore,DC=net
    server-type microsoft
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 172.16.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    fragment chain 1 outside
    sysopt noproxyarp outside
    service resetoutside
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn sslvpn.moore.net
    subject-name CN=sslvpn.moore.net
    keypair sslvpnkeypair
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 956e1350
        308201ef 30820158 a0030201 02020495 6e135030 0d06092a 864886f7 0d010105
        0500303c 31193017 06035504 03131073 736c7670 6e2e6d6f 6f72652e 6e657431
        1f301d06 092a8648 86f70d01 09021610 73736c76 706e2e6d 6f6f7265 2e6e6574
        301e170d 31323037 32383034 34363133 5a170d32 32303732 36303434 3631335a
        303c3119 30170603 55040313 1073736c 76706e2e 6d6f6f72 652e6e65 74311f30
        1d06092a 864886f7 0d010902 16107373 6c76706e 2e6d6f6f 72652e6e 65743081
        9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100c8 167e2c3d
        04c16a6c b6639fda c60f085a 8ea6a2ea 6e0bcafb acb3ec8e 3c659274 37636c34
        0df9e770 17fb97f6 c2b8641e ff3675f3 3d906e01 a7056bb0 9c0bf54c 3475729e
        74caf157 068464d3 e235c46f a8525867 c3911d9c 760253d0 c7bbb7c8 84f91f92
        858866c6 e0c1033d 6cfba6f0 b732158f 3d2d7ef5 9bbb0821 4d093f02 03010001
        300d0609 2a864886 f70d0101 05050003 81810062 65e2455a cb4e87ea 7879099d
        06ed1c5e 7eab180a 4d7564be c36810eb fe6a5bb9 94348ded 1336d811 d0949342
        2718400c 8cc32395 23e7d722 3e2758a9 a2116a38 07500bd5 5b96f3c2 1d7c5769
        dc5b876b 858cb447 355aa323 abbaf45d bed3814d a04f503a 21cddb47 aaecd5aa
        1c82f701 22969424 f6845937 a21568a1 ecaa0e
      quit
    telnet timeout 5
    ssh 172.16.1.0 255.255.255.0 inside
    ssh timeout 20
    console timeout 0
    management-access inside
    dhcpd dns 172.16.1.102
    dhcpd ping_timeout 750
    dhcprelay server 172.16.1.102 inside
    dhcprelay enable guest
    dhcprelay enable insidewifi
    dhcprelay setroute guest
    dhcprelay setroute insidewifi
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection scanning-threat shun except ip-address 172.16.0.0 255.255.0.0
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 211.233.40.78
    ntp server 61.153.197.226
    ntp server 202.150.213.154 prefer
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy SSLClientPolicy internal
    group-policy SSLClientPolicy attributes
    dns-server value 172.16.1.102 172.16.1.103
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SSLClientProfile_SPLIT
    default-domain value moore.net
    address-pools value SSLClientPool
    username gmoore_a password PNUmTwjDhevRqhkT encrypted privilege 15
    tunnel-group SSLClientProfile type remote-access
    tunnel-group SSLClientProfile general-attributes
    authentication-server-group LDAP LOCAL
    default-group-policy SSLClientPolicy
    tunnel-group SSLClientProfile webvpn-attributes
    group-alias SSLVPNClient enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    smtp-server 68.1.17.8
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:db7d3afda8f35ce1733b3fcd3f5f468d
    : end
    no asdm history enable

  • Mboxutil -r behavior -  renamed mailbox is moved on to default partition

    Hi Everybody,
    I have question related to behavior of mboxutil -r (renaming mailbox.) SUN messaging server 6.3.11-01
    We are facing the problem when renaming one mailbox. When executed
    command
    mboxutil -r user/maibox/INBOX user/new_mailbox/INBOX
    is mailbox renamed and also moved to default partition which is configured
    for SUN MS server.
    configutil -o store.defaultpartition
    partition6
    mboxutil -lxp user/436608797735/INBOX msgs Kbytes last
    msg partition quotaroot mailbox path and acl
    2 600 2010/10/11 11:05 partition3 1954 user/436608797735/INBOX
    /home2/imap-home/store/partition/partition3/=user/b2/b6/=436608797735 436608797735 lrswipcda
    # /opt/local/bin/ldapsearch -LLLL -h ds01 -D "cn=<login>" -w <pass> -s sub -b "o=<suffix>"
    telephonenumber=436608797735 mailquota mailmessagestore*
    mailquota: 2000000
    mailmessagestore: partition3
    Rename command:
    # mboxutil -r user/[email protected]/INBOX user/[email protected]/INBOX*
    in the logs:
    /[03/Nov/2010:13:07:52 +0100] ms01 mboxutil[16670]: General
    Notice: /opt/sun/messaging/sbin/mboxutil -r
    user/[email protected]/INBOX user/[email protected]/INBOX
    # /opt/local/bin/ldapsearch -LLLL -h ds01 -D "cn=<login>" -w <pass> -s sub -b "o=<suffix>"
    telephonenumber=436608797735 mailquota mailmessagestore
    # /opt/local/bin/ldapsearch -LLLL -h ds01 -D "cn=<login>" -w <pass> -s sub -b "o=<suffix>"
    telephonenumber=436608797738 mailquota mailmessagestore
    mailquota: 2000000
    mailmessagestore: partition3
    # mboxutil -lxp user/436608797735/INBOX
    msgs Kbytes last msg partition quotaroot mailbox path and acl
    # mboxutil -lxp user/436608797738/INBOX msgs Kbytes last
    msg partition quotaroot mailbox path and acl
    2 600 2010/10/11 11:05 partition6 1954 user/436608797738/INBOX
    /home2/imap-home/store/partition/partition6/=user/e2/b6/=436608797738 436608797738 lrswipcda
    This behavior seems to me like bug. Because even moving subscriber to the default partition is not written in the documentation, this move
    should also evoke modification of LDAP profile of subscriber to keep information about used partition aligned with physical occurrence.
    Could you answer my question? And if it is really bug and you can reproduce it, is it fixed already in hot fix release?
    Thanks.
    Edited by: 810208 on Nov 11, 2010 11:46 PM

    I believe a support case was opened about this and the resolution was that you need to recognize that you are not only changing the name of the folders but also changing them from one userid (mailbox) to another (new_mailbox). The partition on which the folders should be stored should be defined by the mailMessageStore attribute on the user. If the destination userid does not exist in LDAP, it will use the default partition.
    Also note the discussion under "To Change the Default Message Store Partition" in the Admin Guide:
    http://wikis.sun.com/display/CommSuite/Managing+Message+Store+Partitions+and+Adding+Storage#ManagingMessageStorePartitionsandAddingStorage-ToChangetheDefaultMessageStorePartition

  • 113022: AAA Marking server 0.0.0.0 as failed

    Just changed AAA to use LDAP to MS2K8 AD rather than former RADIUS. Simply added hosts to existing LDAP group through ASDM. It is working fine, but I am getting tons of the following in the logs ...
    May 29 12:54:14 pix2-inside May 29 2009 12:56:11: %PIX-2-113022: AAA Marking RADIUS server 0.0.0.0 in aaa-server group RADIUS as FAILED
    May 29 12:55:46 pix2-inside May 29 2009 12:57:43: %PIX-2-113022: AAA Marking LDAP server 0.0.0.0 in aaa-server group LDAP as FAILED
    May 29 12:58:51 pix2-inside May 29 2009 13:00:47: %PIX-2-113022: AAA Marking LDAP server 0.0.0.0 in aaa-server group LDAP as FAILED
    Config ...
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host LAN-EVE
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host LAN-JAMES
    aaa-server LDAP (inside) host LAN-JOHN
    aaa authentication ssh console LDAP LOCAL
    aaa authentication enable console LDAP LOCAL
    aaa authentication http console LDAP LOCAL
    aaa authentication secure-http-client
    Test through ASDM working for each configured host.
    Anyone know why I am getting these messages?

    Here is the bug id for what you are hitting: CSCsj64402
    I tried to find the exact details of the bug but for some reason cannot access the bug toolkit at the moment. Basically there is a delay before cdp settles which fails the first few dns lookup when you have you servers configured by name instead of ip.The individual before my post is correct if you want to move past this you can configure the servers by ip address and move pass this issue. Usually this shows up when the PIX is first booted up. Did this occur during bootup or intial configuration of the servers or does this occur everytime you test authentication?
    Thanks,

  • IGroupSeachFilter/IUserSearchFilter for specific UME datasource

    Hi all,
    When using the "Identity Management" iview, there is an option to filter groups/users by selecting "All Data Sources"/"LDAP"/"UME Database".
    How can I do this kind of filtering by code? (by using IGroupSeachFilter/IUserSearchFilter).
    Thanks,
    Omri

    Hi Omri,
    Once I was asked to perform similar task, and I couldn't find a way to set the DataSource in the filter.
    This problem relates to the fact that UME doesn't know how many sources you have, until the XML config file is loaded, and (at least to my understanding) becuase of that standard API doesn't include anything related to source of data.
    The only way to try to find it is through
    UMFactory.getUserFactory().getUserSearchFilter().setSearchAttribute(blablabla);
    The problem is that we don't know the technical name of the attribute...
    What I did back then is looked for appearances of "LDAP" inside the user full unique name for this purpose.
    Regards, Ivan.

  • Two table maintenance generator for one table

    Can we created two table maintenance generator for one ztable. if yes then what will be the steps.

    Hi Prem,
    Why you need two table maintenance generator for a single table?
    We can generate only single table maintenance  generator for a single table.
    you can add modification event in  inside table maintenance if you need anything to change or validate in insde your table maintenance generator.
    Regards,
    Prasenjit

  • Oracle 9.2 OLE DB Provider Not Found

    Hi people,
    Seem to have a similar issue with an earlier poster.... on two different machines (one with Visual Studio Enterprise Architect and the .Net Framework installed and one without using the default general purpose enterprise edition of 9.2 database install). Existing IIS + ADO applications now complain that the OraOLEDB.Oracle provider is not found. However, existing C++ -> ADO component applications do not have the same issue....
    Giving "Everyone" "Full Control" to %ORACLE_HOME% and subdirs as an NTFS permssion seems to work but also seems a bit drastic.... Anyone with a more focused explanation of what is going wrong? Anyone with a more secure workaround, perhaps?
    Thanks in advance,
    Lachlan Pitts

    All,
    Although not part of the Oracle OLE DB Team, or with any real qualifications, I do have a little information gained from experimentation...
    For those not up to date on this thread, the issue we all seem to have is when using the Oracle 9i Release 2 (9.2.0.1.0) OLE DB Provider (OraOLEDB.Oracle) with Microsoft's .NET framework, we receive the error OraOLEDB.Oracle not found when we attempt to open a connection. In the past, some have suggested that giving Everyone the security access Full Control to the Oracle home directory (such as C:\oracle\ora92) solves the problem. I tried this and to my surprise it did work. Unfortunately, I did not try giving the ASPNET user full control first (doh).
    The reason this frustrates me is that something permanently changed while the permissions were open. The permissions can now be removed, and the provider still works fine.
    The only modification I saw inside the Oracle home directory was to new oramts/trace/OracleMTSRecoveryService(*).trc files, with the timestamps corresponding to when the ASP.NET worker process (aspnet_wp) was started/restarted. I do not see the Oracle MTS Recovery service running on another machine with Oracle 9.0.x on it (although this may not mean anything). After these trace files were written I was able to remove the permissions changes I made (Everyone/Full Control), restarted the machine, and the OLE DB provider still worked fine -- seemingly using the latest trace file available (as I could delete all but the latest trace file). This file was being locked by the Oracle MTS Recovery service.
    However, I can stop the Oracle MTS recovery service, delete the trace files, restart the web service, reboot the machine, etc, and still, the OLEDB provider works fine. Something else must have permanently changed while the permissions were open, maybe even something that didn't go into the Oracle home directory but something that was able to go somewhere else after the first trace file was written... If anyone can find out what it is (in the registry maybe?) that allows the OLEDB provider to work, I'd really like to know.
    I think that this is a big enough problem that the Oracle developers should look at it -- maybe they would have insight as to what that MTS recovery service is up to, and how it relates to the OLE DB provider in regards to a fresh installation. Especially considering that Oracle is advertising this as the first OLEDB provider with full support for the .NET framework.
    Best Regards,
    Paul Hooper

  • New Class definition

    For specific usage, I need to add new attributes to standard schema.
    Next, in order to mantain compatibility for standard classes, I included these attributes in a new class.
    I work on IDS 5.1 SP1 on Solaris 8.
    From docs, I know that this modification can be done directly by the Console or through 99user.ldif.
    Are theese two approaches equivalent or there are some differences ?
    Which is the suggested approach in order to have modification traced both in Console and in 99user.ldif ?
    In fact, I noticed that if I add new definition through the Console, everything is ok but I don't see the corresponding new definition in 99user.ldif.
    I need to have a trace in 99user.ldif file in order to share information in different instances of IDS.
    Is there some further operation to do in order to force writing changes to schema in 99user.ldif ?
    Thanks for any explanation.
    Marina

    The approaches are the same, except that if you modify 99user.ldif with an editor, you must first shutdown the server, edit the file, then restart DS. If you do the schema modifications over LDAP, you do not have to restart the server.
    I don't know why the schema changes were not written when you used the console. Try using the command line ldapmodify to add the schema. Also, check the server access and error logs to see if there was some unreported problem with your schema.

Maybe you are looking for

  • JomboBox L&F in a JTable Cell

    When a JCombobox is displayed in your basic panel, the text field and drop down arrow can been seen, by default. But when a JComboBox is placed inside a JTable cell, the drop-down arrow disappears until the cell has been clicked in. Is there a way to

  • A very strange stripy iCloud icon next to "Music" in iTunes?

    I've looked at the other discussion that showed the various icons and none of what was there is what I'm seeing.  It's the iCloud icon, however it's animated with grey stripes.  It seems to have been like that for a few days.  I went in and signed ou

  • Redo log files in case of NOARCHIVELOG Mode.

    Question is related with the oracle architure.. database requires a minimum of two redo log files to guarantee that one is always available for writing while the other is being archived, this sounds perfect when DB is running in ARCHIVELOG mode but a

  • HT5022 Airport Utility 5.6 does not fix the old Airport Express!

    My old airport express does not work anymore - the Airport Utility 5.6 makes changes but after re-starting, the Airport Express cannot be found. Now I am forced to buy a new one. Not good (and sold out as many experienced the same apparently)

  • Cc Hierarchy level deletion

    I had to delete some cost centres.  After that when I see the hierarchy, the cost centre ID is still there with a red indicator saying that no valid master data is available.  Why is this ?  Because of this, I am not able to delete the hierarchy leve