Server cannot ping neightbour

I have VM servers (Windows 2003, 2008) sitting in same ESX host - 4.0, each of the server has 2 NIC (one is for user access, another is for backup purpose). 
Some of the servers backup NIC is not working, they can't ping neighbour and backup server, but some of the servers can. They are in the same VLAN and ESX host.
Any idea?
Regards, Wee Yang

Hi,
Are you using the computer NetBios when you ping? If so, please confirm you have select the TCP IP NetBIOS option and configured the correct WINS server.
The related third party article:
Enable NetBIOS over TCP/IP with Windows
http://ecross.mvps.org/howto/enable-netbios-over-tcp-ip-with-windows.htm
The related KB:
More about WINS server settings
http://technet.microsoft.com/en-us/library/cc771490.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

  • Cisco C6500 CSM - Real server cannot ping its VIP.

    I've been running into an issue with Cisco CSM for a number of years, but always found a way around it.  Im attempting to get to the bottom of this to find out once and for all, if this is infact a limitation of the device, or a config issue/work around is possible.
    Here is my situation.  My CSM's are configured in bridging mode.  Traffic works great, traffic bridges across vlans correctly.  Everything works and have many instances of smilar configurations running in production.  Every once and a while, a client requests that a "real" server (ie LWCMW-021)
    cannot ping its VIP address (10.95.88.68).  I am assuming this is related to the NAT Server, but not 100% sure.  Clients have requested this functionality for some type of application based purpose, but Im unaware if CSM in bridging mode can provide this or not. 
    Any suggestions?
    real LWCMW-021
    address 10.95.88.59
    inservice
    real LWCMW-022
    address 10.95.88.60
    inservice
    serverfarm LWCMW-80
    nat server
    no nat client
    real name LWCMW-021 80
      inservice
    real name LWCMW-022 80
      inservice
    probe HTTP-80 (defined elsewhere)
    vserver LWCMW-80
    virtual 10.95.88.68 tcp WWW
    vlan 120
    serverfarm LWCMW-80
    persistent rebalance
    inservice

    Sorry for giving false hope. It is only possible in ACE module. In case of CSM I believe we can only use workaround.
    In case of ACE we can bind the Virtual IP to mutliple vlan. In that case we see a ARP entry like this.
    10.10.10.111    e0.5f.b9.a1.72.2b  vlan345   VSERVER    LOCAL     _         up
    10.10.10.111    e0.5f.b9.a1.72.2b  vlan346   VSERVER    LOCAL     _         up
    As Virtual IP is not bound to a particular vlan in case of CSM it does not work here, but I can say for sure it is expected behavior.
    The logic would be that the server tries to resolve the ARP for Virtual IP and it does not get a response.
    In my case virtual ip is 10.10.10.111 before applying policy on ACE  you can see that it is exhibiting the same behaviour.
    Time     | Vmware_b4:72:11                       | 10.0.0.0                              | 10.10.10.4                            |
    |         |                   | Broadcast         |                   | 224.0.0.1         |                   | 224.0.0.22        |                  
    |0.000    |         Who has 10.10.10.11           |                   |                   |                   |                   |ARP: Who has 10.10.10.111?  Tell 10.10.10.11
    |         |(0)      ------------------>  (0)      |                   |                   |                   |          |
    |0.999    |         Who has 10.10.10.11           |                   |                   |                   |                   |ARP: Who has 10.10.10.111?  Tell 10.10.10.11
    |         |(0)      ------------------>  (0)      |                   |                   |                   |                   |
    |         |                   |                   |                   |                   |(0)      ------------------>  (0)      |
    |1.998    |         Who has 10.10.10.11           |                   |                   |                   |                   |ARP: Who has 10.10.10.111?  Tell 10.10.10.11
    |         |(0)      ------------------>  (0)      |                   |                   |                   |                   |
    |3.014    |         Who has 10.10.10.11           |                   |                   |                   |                   |ARP: Who has 10.10.10.111?  Tell 10.10.10.11
    |         |(0)      ------------------>  (0)      |                   |                   |                   |                   |
    |4.014    |         Who has 10.10.10.11           |                   |                   |                   |                   |ARP: Who has 10.10.10.111?  Tell 10.10.10.11
    |         |(0)      ------------------>  (0)      |                   |                   |                   |                   |
    Hope that helps.

  • Main Server cannot ping the 2nd server in another location but the 2nd server can ping the main server

       
    I have 3  servers :  Main server, and 2 file servers in another country.
    My main server can only ping the 2nd file server.
    But both of  our 2 file servers from another country can ping the main server.
    In short, I cannot remote to the first file server.
    The settings on both file servers are the same. And I don't have issues in accessing the 2nd file server using the Main server.
    Can somebody have the patience to help me figure out the issue?

    Being able to ping the server does not mean that you remotely access it.
    If you are trying to RDP a server then you need to check that RDP is enabled on the server and that traffic to port 3389 is not blocked or filtered. You can use PortQryUI for checking.
    For testing, you can temporary disable security software running on the servers and try again. Also, check the filtering done on network equipment in between your servers.
    This posting is provided AS IS with no warranties or guarantees , and confers no rights.
    Ahmed MALEK
    My Website Link
    My Linkedin Profile
    My MVP Profile

  • Cannot ping RRAS Client from RRAS server.

    I have recently created an RRAS pptp connection for an outside network. The RRAS client connects fine and can ping the RRAS server and every device on the RRAS servers local network. The RRAS server cannot ping the remote pptp client nor can any device on
    the RRAS servers local network. RRAS is configured to be within the same subnet as the RRAS servers local network. On connection it pulls from a static IP pool.
    Any help is truly appreciated

    The server is behind a nat device and for testing purposes i have disabled the firewall on both devices. Also I am having an issue where the pptp connection just stops accepting and sending data to the rras server but if you look at the active connections
    the client never disconnects.  I have attached ipconfig information
    CLIENT
    Windows IP Configuration
       Host Name . . . . . . . . . . . . : Fellows-PC
       Primary Dns Suffix  . . . . . . . :
       Node Type . . . . . . . . . . . . : Hybrid
       IP Routing Enabled. . . . . . . . : No
       WINS Proxy Enabled. . . . . . . . : No
    PPP adapter Welsh:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Welsh
       Physical Address. . . . . . . . . :
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
       IPv4 Address. . . . . . . . . . . : 172.16.128.66(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.255
       Default Gateway . . . . . . . . . :
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Ethernet adapter Local Area Connection:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
       Physical Address. . . . . . . . . : BC-5F-F4-75-C5-AD
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       Link-local IPv6 Address . . . . . : fe80::5418:aba9:4af2:1e12%11(Preferred)
       IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Lease Obtained. . . . . . . . . . : Wednesday, March 26, 2014 8:35:58 AM
       Lease Expires . . . . . . . . . . : Saturday, March 29, 2014 8:35:58 AM
       Default Gateway . . . . . . . . . : 192.168.1.1
       DHCP Server . . . . . . . . . . . : 192.168.1.1
       DHCPv6 IAID . . . . . . . . . . . : 247226356
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-C3-16-85-BC-5F-F4-75-C5-AD
       DNS Servers . . . . . . . . . . . : 75.75.75.75
                                           75.75.76.76
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Tunnel adapter isatap.{DF8CAC0D-588D-495A-9185-78C9992DC12F}:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Microsoft ISATAP Adapter
       Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
    Tunnel adapter Teredo Tunneling Pseudo-Interface:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
       Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
       IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6abd:1c88:1312:b8c2:97a9(Pref
    erred)
       Link-local IPv6 Address . . . . . : fe80::1c88:1312:b8c2:97a9%12(Preferred)
       Default Gateway . . . . . . . . . : ::
       NetBIOS over Tcpip. . . . . . . . : Disabled
    Tunnel adapter isatap.{D8973397-8880-4110-A7F9-4D1F6A1C2E8C}:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
       Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
    SERVER
    Windows IP Configuration
       Host Name . . . . . . . . . . . . : IMS
       Primary Dns Suffix  . . . . . . . :
       Node Type . . . . . . . . . . . . : Unknown
       IP Routing Enabled. . . . . . . . : Yes
       WINS Proxy Enabled. . . . . . . . : Yes
    PPP adapter RAS Server (Dial In) Interface:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
       Physical Address. . . . . . . . . : 00-53-45-00-00-00
       DHCP Enabled. . . . . . . . . . . : No
       IP Address. . . . . . . . . . . . : 172.16.128.65
       Subnet Mask . . . . . . . . . . . : 255.255.255.255
       Default Gateway . . . . . . . . . :
    Ethernet adapter Local Area Connection:
       Media State . . . . . . . . . . . : Media disconnected
       Description . . . . . . . . . . . : Broadcom BCM5709C NetXtreme II GigE (NDIS
     VBD Client)
       Physical Address. . . . . . . . . : 00-10-18-8D-BC-42
    Ethernet adapter Local Area Connection 2:
       Media State . . . . . . . . . . . : Media disconnected
       Description . . . . . . . . . . . : Broadcom BCM5709C NetXtreme II GigE (NDIS
     VBD Client) #2
       Physical Address. . . . . . . . . : 00-10-18-8D-BC-40
    Ethernet adapter Local Area Connection 4:
       Media State . . . . . . . . . . . : Media disconnected
       Description . . . . . . . . . . . : Broadcom BCM5716C NetXtreme II GigE (NDIS
     VBD Client)
       Physical Address. . . . . . . . . : 84-2B-2B-68-6A-FA
    Ethernet adapter Local Area Connection 3:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Broadcom BCM5716C NetXtreme II GigE (NDIS
     VBD Client) #2
       Physical Address. . . . . . . . . : 84-2B-2B-68-6A-F9
       DHCP Enabled. . . . . . . . . . . : No
       IP Address. . . . . . . . . . . . : 172.16.128.1
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 172.16.128.254
       DNS Servers . . . . . . . . . . . : 172.16.128.254
                                           75.75.75.75
       NetBIOS over Tcpip. . . . . . . . : Disabled

  • 1602i standalone AP cannot ping RADIUS server

    I have a new 1602i standalone AP trying to use RADIUS authentication.  For some reason the 1602 cannot ping the RADIUS server, but will get a response from other devices.  Both are on the same subnet, the new one at .213 and the RADIUS at .209.
    AP6#ping xxx.xx.120.209
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx..120.209, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    AP6#ping xxx.xx.120.217
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx..120.217, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
    The RADUIS server is able to ping the new AP successfully.
    AP1#ping xxx.xx.120.213
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx.120.213, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms
    Any thoughts to why that AP is unable to ping that one particular client?  Other APs are successfully contacting it for RADIUS authentication.

    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname AP6
    logging rate-limit console 9
    enable secret 5 xxxxxxxxxxxx
    aaa new-model
    aaa group server radius rad_eap
     server xxx.xx.120.209 auth-port 1812 acct-port 1813
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    clock timezone -0500 -5 0
    clock summer-time -0400 recurring
    no ip routing
    no ip cef
    dot11 syslog
    dot11 ssid xxx.xx
       authentication open eap eap_methods
       authentication network-eap eap_methods
       authentication key-management wpa
    crypto pki token default removal timeout 0
    username Cisco privilege 15 password 7 xxxxx
    bridge irb
    interface Dot11Radio0
     no ip address
     no ip route-cache
     encryption mode ciphers tkip
     ssid  MANH
     antenna gain 0
     stbc
     beamform ofdm
     station-role root
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface Dot11Radio1
     no ip address
     no ip route-cache
     shutdown
     antenna gain 0
     dfs band 3 block
     channel dfs
     station-role root
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface GigabitEthernet0
     no ip address
     no ip route-cache
     duplex auto
     speed auto
     bridge-group 1
     bridge-group 1 spanning-disabled
     no bridge-group 1 source-learning
    interface BVI1
     ip address dhcp client-id GigabitEthernet0
     no ip route-cache
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    snmp-server view dot11view ieee802dot11 included
    snmp-server community  RW
    snmp-server chassis-id AP6
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps tty
    snmp-server enable traps entity
    snmp-server enable traps disassociate
    snmp-server enable traps deauthenticate
    snmp-server enable traps authenticate-fail
    snmp-server enable traps dot11-qos
    snmp-server enable traps switch-over
    snmp-server enable traps rogue-ap
    snmp-server enable traps wlan-wep
    snmp-server enable traps config-copy
    snmp-server enable traps config
    snmp-server enable traps syslog
    snmp-server enable traps cpu threshold
    snmp-server enable traps aaa_server
    snmp-server host .0.39 public
    radius-server local
      user user1 nthash 7
    radius-server attribute 32 include-in-access-req format %h
    radius-server host xxx.xx.120.209 auth-port 1812 acct-port 1813 key 7
    radius-server vsa send accounting
    bridge 1 route ip
    line con 0
    line vty 0 4
     transport input all
    sntp server xxx.xx.0.11
    sntp broadcast client
    end

  • Cannot ping from zone or ping zone from another server

    Hi all,
    I've just setup a zone, configured the OS on it and booted it.
    1) From the global zone I can ping the zone
    2) From another server(s) I cannot ping the zone although I can ping the global zone
    3) From the zone I cannot even ping the global zone let alone anything else
    Any ideas whats gone wrong. the zone xml looks like:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE zone PUBLIC "-//Sun Microsystems Inc//DTD Zones//EN" "file:///usr/share/lib/xml/dtd/zonecfg.dtd.1">
    <!--
    DO NOT EDIT THIS FILE. Use zonecfg(1M) instead.
    -->
    <zone name="ivcp0.lon.oss.colt.net" zonepath="/zones/ivcp0.lon.oss.colt.net" autoboot="true">
    <inherited-pkg-dir directory="/lib"/>
    <inherited-pkg-dir directory="/platform"/>
    <inherited-pkg-dir directory="/sbin"/>
    <inherited-pkg-dir directory="/usr"/>
    <inherited-pkg-dir directory="/opt/sfw"/>
    <filesystem special="/home" directory="/home" type="lofs"/>
    <network address="212.74.77.211/25" physical="bge1"/>
    </zone>
    zoneadm list -vc
    ID NAME STATUS PATH
    0 global running /
    2 ptl1.lon.oss.colt.net running /zones/ptl1.lon.oss.colt.net
    3 ptl1.dev.lon.oss.colt.net running /zones/ptl1.dev.lon.oss.colt.net
    7 ivcp0.lon.oss.colt.net running /zones/ivcp0.lon.oss.colt.net

    Might help to send along the "ifconfig -a" and "netstat -rnv" output from both the global zone and the local zones that are having problems.
    Traceroute might also help you isolate the problem

  • Cannot ping REAL server IP addresses from CSM 6500

    I have a dual 6500/CSM routed topology in which the traffic from clients to the server VIP works fine. However, in preparation for some upcoming work, I find that I cannot ping the REAL server IP addresses. This would seem to be an important troubleshooting step. Any ideas why this wouldn't work?

    Gilles, followup question. If I understand this, what you outlined above will allow traffic external coming into the 6500/CSM to be forwarded thru to the REAL server IPs. If it wasn't clear, I was trying to ping from the native-mode 6500 that contains the CSM. I've tried regular and extended pings using the CSM-configured server VLAN's IP and alias IP, but get no response back from any of the REAL server IP addresses.
    Is what you've indicated required to ping even if I'm on the 6500 which contains the CSM?

  • Cannot Ping Vodaphone Server

    Hi,
    anybody know why I cannot ping the Vodaphone server?  It seems to stop at a BT backbone server and gets no further??
    thnaks for any help...you can offer
    C:\Users\Iain>tracert 212.183.133.177
    Tracing route to cluster4.vap.vodafone.co.uk [212.183.133.177]
    over a maximum of 30 hops:
      1     1 ms    <1 ms    <1 ms  READYSHARE [192.168.0.1]
      2    23 ms    25 ms    25 ms  217.47.108.186
      3    23 ms    25 ms    23 ms  217.47.109.193
      4    26 ms    24 ms    26 ms  213.1.69.102
      5    26 ms    24 ms    25 ms  213.120.162.71
      6    27 ms    27 ms    28 ms  31.55.165.109
      7    25 ms    27 ms    26 ms  109.159.250.178
      8    32 ms    37 ms    40 ms  109.159.250.148
      9    30 ms    30 ms    30 ms  peer2-xe3-3-0.telehouse.ukcore.bt.net [109.159.2
    54.231]
     10    33 ms    33 ms    31 ms  t2c3-xe-0-2-2-0.uk-lon1.eu.bt.net [166.49.211.17
    4]
     11    30 ms    31 ms    30 ms  166-49-211-254.eu.bt.net [166.49.211.254]
     12     *        *        *     Request timed out.
     13     *        *        *     Request timed out.
     14     *        *        *     Request timed out.
     15     *        *        *     Request timed out.
     16     *        *        *     Request timed out.
     17     *        *        *     Request timed out.
     18     *        *        *     Request timed out.
     19     *        *        *     Request timed out.
     20     *        *        *     Request timed out.
     21     *        *        *     Request timed out.
     22     *        *        *     Request timed out.
     23     *        *        *     Request timed out.
     24     *        *        *     Request timed out.
     25     *        *        *     Request timed out.
     26     *        *        *     Request timed out.
     27     *        *        *     Request timed out.
     28     *        *        *     Request timed out.
     29     *        *        *     Request timed out.
     30     *        *        *     Request timed out.
    Trace complete.

    some servers do not accept being pinged or sometimes only at a very low priority
    If you want to say thanks for a helpful answer,please click on the Ratings star on the left-hand side If the reply answers your question then please mark as ’Mark as Accepted Solution’

  • IPV6 clients cannot ping each other while getting IP from DHCP server running in windows 2008

    I have two windows 7 clients and a windows 2008 server connected to a switch with static IP 172:16:5::1/64.
    DHCP server is configured with static IP 172:16:5::20/64
    when i statically assign IP to windows 7 clients like 172:16:5::21 & ::22, they can ping each other. if they get ip from DHCP server, they cannot ping each other.
    if i configure the gateway (172:16:5::1) in the clients manually, they can ping each other.
    is there any way we can make dhcp server to give gateway to the clients along with IP?

    From what I have gathered:
    IPv6 won't route because the DHCP server is setup in 'stateless' mode and the switches do not support IPv6. (
    "But if your routers are not IPv6 supported (yet), you can
    reconfigure DHCPv6 to Disable Stateless mode, and that'll issue IPv6 addresses that
    will eliminate the Ping problem." -
    http://www.networkworld.com/article/2228461/microsoft-subnet/setting-up-dhcpv6-to-dynamically-issue-ipv6-addresses-in-a-network.html)
    So you must change to 'disable stateless' mode. Which the only way I can THINK to do this is to uninstall DHCP and reinstall DHCP and select 'disable stateless' during the installation (which I haven't confirmed). (In
    case, “Disable DHCPv6 stateless mode for this server” option was selected duringrole installation" -
    http://blogs.technet.com/b/teamdhcp/archive/2009/03/03/dhcpv6-understanding-of-address-configuration-in-automatic-mode-and-installation-of-dhcpv6-server.aspx)
    zz.. but my understanding of DHCP is fragmented, please take what I find with a grain of salt. I am off to reinstall DHCP :] .. fun.
    Mediocre Access 2010 | (Baby) Beginner C Sharp | OK at Active Directory (2012) | Fragmented understanding of DNS/DHCP | Laughable experience with Group Policy | Expert question asker on MSDN Forums

  • Puzzling situation: XP clients cannot ping server while W7 clients can

    We have an SBS 2011 server with XP and Win7 clients.  The server provides DHCP and DNS services. Clients are all DHCP.
    Another DHCP server was on the network, which caused the 2011 box to shut down DHCP services. We have fixed that and all is working now, but....
    While troubleshooting, we found differences between the behavior of XP and W7 machines.  All could still connect to the internet and ping the gateway.  But only the W7 machines could communicate with the server (email, ping, DNS, RDP). 
    The XP machines could not even ping the server's IP address. Around 5-6 of each client OS were examined and the results were consistent.  Examples of configurations are as follows:
    Server
    IP:  192.168.3.1
    SM:  255.255.252.0
    GW:  192.168.3.2
    DNS:  192.168.3.1, 8..8.8.8
    W7 client
    IP:  192.168.0.20
    SM: 255.255.252.0
    GW:  192.168.3.2
    DNS:  192.168.3.1, 8.8.8.8
    DHCP:  192.168.3.1
    XP client
    IP:  192.168.1.26
    SM:  255.255.252.0
    GW:  192.168.3.2
    DNS:  192.168.3.1, 8.8.8.8
    DHCP:  192.168.3.1
    Also, upon booting an XP machine, it would not get any IP address.  After booting a W7 box, it would have the appropriate IP configuration and we were able to RDP to the server and browse the internet.
    As I said, everything is working now after removing the foreign DHCP server, but we found the behavior odd and would like to understand why there were differences between the two client platforms.

    Well, I can't really do this now, because everything is working.  I know - why waste time trying to fix something that isn't broken.  It just doesn't make sense to me. 
    I am just trying to determine why XP machines behaved in one way and W7 machines in another - but only while the DHCP service was down on the SBS box.  I looked at several of each, so I don't think I was a problem with the IP stack, unless
    all XP clients had the same issue at the same time, and all spontaneously resolved when the DHCP server came back up.
    I tested multiple XP machines and multiple W7 machines in multiple buildings, so I'm confident that the problem was platform-specific.

  • Cisco ASA 9.1(1) Cannot Ping Public Server

    Cisco ASA 9.1(1) I have defined a public server.  Ping from outside fails.  Packet Tracer shows the following:

    Thank you for responding, Vibhor:  Here are the pertinent NAT statements in my running configuration:
    object network Grede-Test-Server
    host xx.xx.xx.xx (Public IP Address)
    description Grede Test Server Menocon
    object network Grede-Test-Server-Private
    host 10.1.104.21
    description Grede-Test Server
    nat (Inside-Test,Outside) source static Grede-Test-Server-Private Grede-Test-Server
    Cheers,
    M.

  • Cisco ASA 5505 Cannot ping local traffic and local hosts cannot get out

    I have, what I believe to be, a simple issue - I must be missing something.
    Site to Site VPN with Cisco ASA's. VPN is up, and remote hosts can ping the inside int of ASA (10.51.253.209).
    There is a PC (10.51.253.210) plugged into e0/1.
    I know the PC is configured correctly with Windows firewall tuned off.
    The PC cannot get to the ouside world, and the ASA cannot ping 10.51.253.210.
    I have seen this before, and I deleted VLAN 1, recreated it, and I could ping the local host without issue.
    Basically, the VPN is up and running but PC 10.51.253.210 cannot get out.
    Any ideas? Sanitized Config is below. Thanks !
    ASA Version 7.2(4)
    hostname *****
    domain-name *****
    enable password N7FecZuSHJlVZC2P encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif Inside
    security-level 100
    ip address 10.51.253.209 255.255.255.248
    interface Vlan2
    nameif Outside
    security-level 0
    ip address ***** 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    shutdown
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    ftp mode passive
    dns server-group DefaultDNS
    domain-name *****
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 10.1.7.0 255.255.255.0
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.1.10.250
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.200
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.9
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.14
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.15
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.16
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 10.1.9.0 255.255.255.0
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 10.10.9.0 255.255.255.0
    access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 ***** 255.255.255.240
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 10.1.7.0 255.255.255.0
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.1.10.250
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.200
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.9
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.14
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.15
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.16
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 10.1.9.0 255.255.255.0
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 10.10.9.0 255.255.255.0
    access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 ***** 255.255.255.240
    pager lines 24
    mtu Outside 1500
    mtu Inside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    no asdm history enable
    arp timeout 14400
    global (Outside) 1 interface
    nat (Inside) 0 access-list No_NAT
    route Outside 0.0.0.0 0.0.0.0 ***** 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    aaa authentication enable console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set DPS_Set esp-3des esp-md5-hmac
    crypto map DPS_Map 10 match address Outside_VPN
    crypto map DPS_Map 10 set peer *****
    crypto map DPS_Map 10 set transform-set *****
    crypto map DPS_Map interface Outside
    crypto isakmp enable Outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 Outside
    ssh timeout 60
    console timeout 0
    management-access Inside
    username test password P4ttSyrm33SV8TYp encrypted
    tunnel-group ***** type ipsec-l2l
    tunnel-group ***** ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:8d0adca63eab6c6c738cc4ab432f609d
    : end
    1500

    Hi Martin,
    Which way you are trying. Sending traffic via site to site is not working or traffic which you generate to outside world is not working?
    But you say ASA connected interface to PC itself is not pinging that is strange. But try setting up the specific rules for the outgoing connection and check. Instead of not having any ACL.
    If it is outside world the you may need to check on the NAT rules which is not correct.
    If it is site to site then you may need to check few other things.
    Please do rate for the helpful posts.
    By
    Karthik

  • ASA 5505 8.2 - SSL VPN - Cannot Ping inside host's

    Hello All,
    I'm an ASA Newb. 
    I feel like I have tried everything posted and still no success.
    PROBLEM:  When connected to the SSL VPN I cannot ping any internal host's.  I cannot ping anything on this inside?
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.2(5)
    hostname MCASA01
    domain-name mydomain.org
    enable password xxbtzv6P4Hqevn4N encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.2.0 VLAN
    name 192.168.5.0 VPNPOOL
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ddns update hostname MC_DNS
    dhcp client update dns server both
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    no forward interface Vlan1
    nameif outside
    security-level 0
    ip address 11.11.11.202 255.255.255.252
    interface Vlan3
    no nameif
    security-level 50
    ip address 192.168.2.1 255.255.255.0
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name mydomain.org
    access-list SPLIT-TUNNEL standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNPOOL 192.168.5.1-192.168.5.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 74.7.217.201 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    subject-name CN=vpn.mydomain.org,OU=IT,O="mydomain",C=US,St=CA,L=Chino
    keypair digicert.key
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 00b63edadf5efa057ea49da56b179132e8
        3082051c 30820404 a0030201 02021100 b63edadf 5efa057e a49da56b 179132e8
        300d0609 2a864886 f70d0101 05050030 72310b30 09060355 04061302 4742311b
        30190603 55040813 12477265 61746572 204d616e 63686573 74657231 10300e06
        03550407 13075361 6c666f72 64311a30 18060355 040a1311 434f4d4f 444f2043
        41204c69 6d697465 64311830 16060355 0403130f 45737365 6e746961 6c53534c
        20434130 1e170d31 33313130 35303030 3030305a 170d3134 30323033 32333539
        35395a30 52312130 1f060355 040b1318 446f6d61 696e2043 6f6e7472 6f6c2056
        616c6964 61746564 3111300f 06035504 0b130846 72656520 53534c31 1a301806
        03550403 13117670 6e2e6d65 74726f63 656c6c2e 6f726730 82012230 0d06092a
        864886f7 0d010101 05000382 010f0030 82010a02 82010100 a0d97d51 fcd18293
        eaf8e9b2 d632b2e3 e4d92eb1 5b639766 52677a26 2aa7d09d 437be3b6 dfb8649c
        4d715278 e1745955 27e8aab2 9c9da997 694a73e8 c1c426f3 a519adba acc2ad94
        aa0e09af 6db7bfc6 bad90bf2 b057dc56 c69a4276 1b826c83 6cd7ae09 af39bd7d
        4abe60b4 9b04613a 287a1ae6 9d117d05 c7cdc15f 09d588b0 fcc05c47 c1cb6d67
        c3701389 d3b7691d b05ff82c b0be475d 746a4916 0bbf11a6 7ee1b7ec bd05e1d2
        dda305a6 918bfd35 17447b04 bca1e6d9 10955649 d8211878 168c4c21 279a6584
        4b560a9f 414aea15 91e21581 a71d6b98 86d9eac3 47ea3a1d a172c71a ecf77aaa
        536d73e4 bc53eb68 c7bfacdd fab87ea5 121baf55 067dbd19 02030100 01a38201
        cb308201 c7301f06 03551d23 04183016 8014dacb eaad5b08 5dccfffc 2654ce49
        e555c638 f4f8301d 0603551d 0e041604 14fabb1d f439c41f e59207c7 202c2fda
        b46bcacc ee300e06 03551d0f 0101ff04 04030205 a0300c06 03551d13 0101ff04
        02300030 34060355 1d25042d 302b0608 2b060105 05070301 06082b06 01050507
        0302060a 2b060104 0182370a 03030609 60864801 86f84204 01304f06 03551d20
        04483046 303a060b 2b060104 01b23101 02020730 2b302906 082b0601 05050702
        01161d68 74747073 3a2f2f73 65637572 652e636f 6d6f646f 2e636f6d 2f435053
        30080606 67810c01 0201303b 0603551d 1f043430 323030a0 2ea02c86 2a687474
        703a2f2f 63726c2e 636f6d6f 646f6361 2e636f6d 2f457373 656e7469 616c5353
        4c43412e 63726c30 6e06082b 06010505 07010104 62306030 3806082b 06010505
        07300286 2c687474 703a2f2f 6372742e 636f6d6f 646f6361 2e636f6d 2f457373
        656e7469 616c5353 4c43415f 322e6372 74302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e63 6f6d6f64 6f63612e 636f6d30 33060355 1d11042c
        302a8211 76706e2e 6d657472 6f63656c 6c2e6f72 67821577 77772e76 706e2e6d
        6574726f 63656c6c 2e6f7267 300d0609 2a864886 f70d0101 05050003 82010100
        2484b72c 56161585 c9caa1a3 43cbc754 d3b43cef 7902a775 d40d064f 6918d52f
        0aaaea0c ad873124 11b68847 406812da fd0c5d71 6e110898 1ebddcab ddf980e4
        b95be4e2 0633cc23 7a4cbc27 f1f5e4e8 1de3c127 2b28a364 f1f26764 98afe871
        45547855 c0ceaf39 256f46db 4ac412a7 2b594817 a967ba5a 24986b24 57002ce4
        f046c6b3 5f7c9cc2 e6cd8ede 8fbcac60 b87fd497 71328783 8b148f7f affec249
        191c460b 3d46d352 0651f35e 96a60fbe 7b22e057 06aa7722 da447cd3 0ea72e7f
        5ec8c13c b550f502 b020efdc 35f62b89 52d7e6e3 14ade632 802dee70 1cdbf7ad
        a39a173b 916406e4 887ba623 4813b925 8a63a300 fd016981 a8d70651 a736267a
      quit
    no crypto isakmp nat-traversal
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 66.180.96.12 64.238.96.12 interface inside
    dhcpd lease 86400 interface inside
    dhcpd ping_timeout 4000 interface inside
    dhcpd domain mydomain.org interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 64.147.116.229 source outside
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy VPNGP internal
    group-policy VPNGP attributes
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    username GaryC password TGbvzEO3d6HlfU66 encrypted privilege 15
    username GaryC attributes
    vpn-group-policy VPNGP
    tunnel-group MCVPN type remote-access
    tunnel-group MCVPN general-attributes
    address-pool VPNPOOL
    default-group-policy VPNGP
    tunnel-group MCVPN webvpn-attributes
    group-alias MCVPN enable
    group-url https://11.11.11.202/MCVPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:1e950c041cc2c25116d30e5c884abbfc
    : end
    My goal is to allow Remote Users to RDP(3389) through VPN.
    Thank you,
    Gary
    Message was edited by: Gary Culwell

    Hello Jon,
      Thank you so much for your response. Clients will not be connect to a specific RDP server.  I was hoping if we were to establish a VPN Client tunnel I would like that tunnel to provide full local are access.  So the way the clients are used to is while in the field they use RDP to connect to their desktops on the internal LAN.
    Would you say this would work:
    route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
    Do you have examples?
    Thank you,
    Gary

  • Need HELPS! ASA 5505 8.4 Cisco VPN Client cannot ping any internal host

    Hi:
    Need your great help for my new ASA 5505 (8.4)
    I just set a new ASA 5505 with 8.4. However, I cannot ping any host after VPN in with Cisco VPN client. Please see below posted configuration file, thanks for any suggestion.
    ASA Version 8.4(3)
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 2
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 172.29.8.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 177.164.222.140 255.255.255.248
    ftp mode passive
    clock timezone GMT 0
    dns server-group DefaultDNS
    domain-name ABCtech.com
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 172.29.8.0 255.255.255.0
    object service RDP
    service tcp source eq 3389
    object network orange
    host 172.29.8.151
    object network WAN_173_164_222_138
    host 177.164.222.138
    object service SMTP
    service tcp source eq smtp
    object service PPTP
    service tcp source eq pptp
    object service JT_WWW
    service tcp source eq www
    object service JT_HTTPS
    service tcp source eq https
    object network obj_lex
    subnet 172.29.88.0 255.255.255.0
    description Lexington office network
    object network obj_HQ
    subnet 172.29.8.0 255.255.255.0
    object network guava
    host 172.29.8.3
    object service L2TP
    service udp source eq 1701
    access-list VPN_Tunnel_User standard permit 172.29.8.0 255.255.255.0
    access-list VPN_Tunnel_User standard permit 172.29.88.0 255.255.255.0
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended deny tcp any any eq 135
    access-list inside_access_in extended deny tcp any eq 135 any
    access-list inside_access_in extended deny udp any eq 135 any
    access-list inside_access_in extended deny udp any any eq 135
    access-list inside_access_in extended deny tcp any any eq 1591
    access-list inside_access_in extended deny tcp any eq 1591 any
    access-list inside_access_in extended deny udp any eq 1591 any
    access-list inside_access_in extended deny udp any any eq 1591
    access-list inside_access_in extended deny tcp any any eq 1214
    access-list inside_access_in extended deny tcp any eq 1214 any
    access-list inside_access_in extended deny udp any any eq 1214
    access-list inside_access_in extended deny udp any eq 1214 any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in extended permit tcp any any eq www
    access-list inside_access_in extended permit tcp any eq www any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq 33
    89
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq sm
    tp
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq pp
    tp
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq ww
    w
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq ht
    tps
    access-list outside_access_in extended permit gre any host 177.164.222.138
    access-list outside_access_in extended permit udp any host 177.164.222.138 eq 17
    01
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit icmp any any
    access-list inside_access_out extended permit ip any any
    access-list outside_cryptomap extended permit ip 172.29.8.0 255.255.255.0 172.29
    .88.0 255.255.255.0
    access-list inside_in extended permit icmp any any
    access-list inside_in extended permit ip any any
    access-list inside_in extended permit udp any any eq isakmp
    access-list inside_in extended permit udp any eq isakmp any
    access-list inside_in extended permit udp any any
    access-list inside_in extended permit tcp any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool ABC_HQVPN_DHCP 172.29.8.210-172.29.8.230 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm history enable
    arp timeout 14400
    nat (inside,outside) source static orange interface service RDP RDP
    nat (inside,outside) source static obj_HQ obj_HQ destination static obj_lex obj_
    lex route-lookup
    nat (inside,outside) source static guava WAN_173_164_222_138 service JT_WWW JT_W
    WW
    nat (inside,outside) source static guava WAN_173_164_222_138 service JT_HTTPS JT
    _HTTPS
    nat (inside,outside) source static guava WAN_173_164_222_138 service RDP RDP
    nat (inside,outside) source static guava WAN_173_164_222_138 service SMTP SMTP
    nat (inside,outside) source static guava WAN_173_164_222_138 service PPTP PPTP
    nat (inside,outside) source static guava WAN_173_164_222_138 service L2TP L2TP
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group inside_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 177.164.222.142 1
    route inside 172.29.168.0 255.255.255.0 172.29.8.253 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server Guava protocol nt
    aaa-server Guava (inside) host 172.29.8.3
    timeout 15
    nt-auth-domain-controller guava
    user-identity default-domain LOCAL
    http server enable
    http 172.29.8.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set Remote_VPN_Set esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set Remote_vpn_set esp-3des esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set Remote_VPN_Set
    crypto dynamic-map outside_dyn_map 20 set reverse-route
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set peer 173.190.123.138
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5
    ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ES
    P-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.1.0 255.255.255.0 inside
    telnet 172.29.8.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcprelay server 172.29.8.3 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    group-policy ABCtech_VPN internal
    group-policy ABCtech_VPN attributes
    dns-server value 172.29.8.3
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Tunnel_User
    default-domain value ABCtech.local
    group-policy GroupPolicy_10.8.8.1 internal
    group-policy GroupPolicy_10.8.8.1 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username who password eicyrfJBrqOaxQvS encrypted
    tunnel-group 10.8.8.1 type ipsec-l2l
    tunnel-group 10.8.8.1 general-attributes
    default-group-policy GroupPolicy_10.8.8.1
    tunnel-group 10.8.8.1 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 remote-authentication certificate
    ikev2 local-authentication pre-shared-key *****
    tunnel-group ABCtech type remote-access
    tunnel-group ABCtech general-attributes
    address-pool ABC_HQVPN_DHCP
    authentication-server-group Guava
    default-group-policy ABCtech_VPN
    tunnel-group ABCtech ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 173.190.123.138 type ipsec-l2l
    tunnel-group 173.190.123.138 general-attributes
    default-group-policy GroupPolicy_10.8.8.1
    tunnel-group 173.190.123.138 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 remote-authentication certificate
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect pptp
      inspect ftp
      inspect netbios
    smtp-server 172.29.8.3
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:6a26676668b742900360f924b4bc80de
    : end

    Hello Wayne,
    Can you use a different subnet range than the internal interface, this could cause you a LOT of issues and hours on troubleshooting, so use a dedicated different Ip address range...
    I can see that the local Pool range is included into the inside interface Ip address subnet range, change that and the related config ( NAT,etc, ) and let us know what happens,
    Regards,
    Julio
    Security Trainer

  • 2851 router vpn to 851 router lan clients cannot ping

    Greets - I'm expanding my lab experience by adding a 2851 router to my mix of 18xx and 851/871 units. Some of this infrastructure is in production, some just lab work. I have established good connectivity between 18xx's and 851/871's with IPSEC VPNs (site-to-site static and dynamic), but my problem is with adding in a 2851.
    Setup: 2851 with 12.4 ADVENTK9, WAN on GE0/0 as 216.189.223.bbb/26, LAN on GE0/1 as 172.20.0.1/20 (VPN module, but no additional HWIC modules)
    851 with 12.4 ADVENTK9, WAN on FE4 as 216.53.254.aaa/24, LAN on FE0..3 via BVI1 as 172.21.1.1/24
    The two router WAN ports are bridged via a 3rd router (a Zywall with 216.0.0.0/8 route, with the router at 216.1.1.1) affectionately called the "InterNOT", which provides a surrogate to the great web, minus actual other hosts and dns, but it doesn't matter. As both my WAN addresses are within 216.x.x.x, this works quite well. This surrogate has tested fine and is known to not be part of a problem.
    The 851 has been tested against another 851 with complementary setup and a successful VPN can run between the two.
    I have good LAN-WAN connections on each router. I do have a "Good" VPN connection between the two routers.
    The problem: I cannot ping from a LAN host on 172.20.x.x on the 2851 to any 172.21.1.x (eg 172.21.1.1) host on the 851, and vice versa.
    From a LAN host, I can ping to my InterNOT - for example a dhcp host 172.20.6.2 on the 2851 LAN can ping 216.1.1.1 fine. I can also ping the 851's WAN address at 216.53.254.aaa.
    To complicate matters, if I connect to the routers via console, I CAN ping across the vpn to the destination LAN hosts, in both directions.
    This seems to indicate that there is a bridging problem between the LAN interfaces to the VPN interfaces. I suspect this is a config problem on the 2851, as I have had a similar config working on my 851 to 851 site-to-site setups. I also suspect it is in the 2851's config as I'm still just starting out with this particular router.
    So some stripped-down configs:
    For the 2851:
    no service config
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname router2851
    boot-start-marker
    boot-end-marker
    no logging buffered
    no logging console
    enable password mypassword2
    no aaa new-model
    dot11 syslog
    no ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 172.20.0.1 172.20.6.1
    ip dhcp excluded-address 172.20.6.254 172.20.15.254
    ip dhcp pool Internal_2000
       import all
       network 172.20.0.0 255.255.240.0
       domain-name myseconddomain.int
       default-router 172.20.0.1
       lease 7
    no ip domain lookup
    multilink bundle-name authenticated
    voice-card 0
     no dspfarm
    crypto pki <<truncated>>
    crypto pki certificate chain TP-self-signed-2995823027
     <<truncated>>
          quit
    username myusername privilege 15 password 0 mypassword2
    archive
     log config
      hidekeys
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp key mysharedkey address 216.53.254.aaa
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
     description Tunnel to216.53.254.aaa
     set peer 216.53.254.aaa
     set transform-set ESP-3DES-SHA
     match address 100
    interface GigabitEthernet0/0
     description $ETH-WAN$
     ip address 216.189.223.bbb 255.255.255.192
     ip nat outside
     ip virtual-reassembly
     duplex auto
     speed auto
     crypto map SDM_CMAP_1
     no shut
    interface GigabitEthernet0/1
     description $FW_INSIDE$$ETH-LAN$
     ip address 172.20.0.1 255.255.240.0
     ip nat inside
     ip virtual-reassembly
     no ip route-cache
     duplex auto
     speed auto
     no mop enabled
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
    ip http server
    ip http authentication local
    ip http secure-server
    ip dns server
    ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.20.0.0 0.0.15.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
    access-list 101 permit ip 172.20.0.0 0.0.15.255 any
    route-map SDM_RMAP_1 permit 1
     match ip address 101
    control-plane
    banner motd ~This is a private computer system for authorized use only. And Stuff~
    line con 0
    line aux 0
    line vty 0 4
     privilege level 15
     password mypassword
     login local
     transport input telnet ssh
    scheduler allocate 20000 1000
    end
    And for the 851:
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname router851
    boot-start-marker
    boot-end-marker
    logging buffered 52000 debugging
    no logging console
    enable password mypassword
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa session-id common
    resource policy
    clock timezone PCTime -5
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    no ip dhcp use vrf connected
    ip dhcp excluded-address 172.21.1.1 172.21.1.100
    ip dhcp pool Internal_2101
       import all
       network 172.21.1.0 255.255.255.0
       default-router 172.21.1.1
       domain-name mydomain.int
       dns-server 172.21.1.10
       lease 4
    ip cef
    ip domain name mydomain.int
    ip name-server 172.21.1.10
    crypto pki <<truncated>>
    crypto pki certificate chain TP-self-signed-3077836316
     <<truncated>>
      quit
    username myusername privilege 15 password 0 mypassword2
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp key mysharedkey address 216.189.223.aaa
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
     description Tunnel to216.189.223.bbb
     set peer 216.189.223.bbb
     set transform-set ESP-3DES-SHA2
     match address 100
    bridge irb
    interface FastEthernet0
     spanning-tree portfast
    interface FastEthernet1
     spanning-tree portfast
    interface FastEthernet2
     spanning-tree portfast
    interface FastEthernet3
     spanning-tree portfast
    interface FastEthernet4
     description $ETH-WAN$
     ip address 216.53.254.aaa 255.255.254.0
     ip nat outside
     ip virtual-reassembly
     ip tcp adjust-mss 1460
     duplex auto
     speed auto
     no cdp enable
     crypto map SDM_CMAP_1
     no shut
    interface Vlan1
     description Internal Network
     no ip address
     ip nat inside
     ip virtual-reassembly
     bridge-group 1
     bridge-group 1 spanning-disabled
    interface BVI1
     description Bridge to Internal Network
     ip address 172.21.1.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    ip route 0.0.0.0 0.0.0.0 FastEthernet4
    ip route 172.21.1.0 255.255.255.0 BVI1
    ip http server
    ip http secure-server
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.21.1.0 0.0.0.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.21.101.0 0.0.0.31
    access-list 101 permit ip 172.21.1.0 0.0.0.255 any
    route-map SDM_RMAP_1 permit 1
     match ip address 101
    control-plane
    bridge 1 route ip
    banner motd ~This is a private computer system for authorized use only. And Stuff.~
    line con 0
     password mypassword
     no modem enable
    line aux 0
    line vty 0 4
     password mypassword
    scheduler max-task-time 5000
    end
    Note that the above are somewhat stripped-down configs, without firewall or WAN ACL's - interestingly my default WAN-Inbound ACLs seem to break connectivity when included, so I realize I have some more cleanup to do there, but the 2851 LAN bridging seems to be what I should concentrate on first.
    I'm still googling some of the particulars with the 2851, but any assistance is appreciated.
    Regards,
    Ted.

    Hi,
    First,please delete NAT.If we configured the NAT in the RRAS,the source IP address in all packets sent to 192.168.1.0/24 would be translated to 192.168.1.224.
    Second,please enable the LAN routing in RRAS server.To enable LAN routing,please follow the steps below,
    1.In the RRAS server,Open Routing and Remote Access.
    2.Right-click the server name,then click
    properties.
    3.On the General tab,select
    IPv4 Router check box,and then click Local area network(LAN) routing only.
    Then,announce the 172.16.0.0 network to the router.
    To learn more details about enabling LAN routing, please refer to the link below,
    http://technet.microsoft.com/en-us/library/dd458974.aspx
    Best Regards,
    Tina

Maybe you are looking for