Setting User# variable according to TS Client name

I need to set the user# environment variable upon RDP login according to which client the users are connecting from. The server is Windows 2008 R2 and the clients are currently Win XP Pro. The username is not important, only the name of the client computer.
The variable is needed to tell our POS software where the users are located. I have no scripting experience other than creating .bat files but that doesn't work in Windows 2008. Thanks in advance.

I am referring to an environment variable "User#" that needs to be a number (1-13) that corresponds to a workstation number defined within our software. The software looks for this variable to decide which workstation the user is logging in from
and therefor which address, phone number, location, etc. to print on reciepts and such. Each workstation is assigned a unique number and there cannot be duplicates as the number also determines which workstations can process credit card sales (i.e. cash registers).
This is easy using the RDP connection software on the workstation when I set it to run a specific .bat file on the server to set the variable within the users session when the user first logs on. I would rather not use that method. I want to set
that variable based on the name of the workstation and not the username. I cannot set a permenant user# for each user as our users will use workstations at different locations. If set permenantly and a user logged in from location 1 instead of location 2 the
reciepts and other things would not be correct. I hope that is clear enough. I would post a screenshot as an example but I don't know how on this forum. Thanks for any help you can provide.
I don't mean to sound like a newbie but I am new to scripting. Therefore I may require some help actually writing the script and putting it in the right place.

Similar Messages

Bi office and USER variable problem

Hello,
On my OBI (10.1.3.3.1) platform users are authenticated through LDAP using mail as username (user attribute equals mail in LDAP settings). If authentication succeed variable USER is set to uid (from LDAP) and so web user (created in presentation) has name uid. The problem is when I try to log to bi office using mail. User can log in (LDAP), but there is no presentation catalog. I've checked the logs of bi office and find out that I'ts looking for user mail, but web user has a name equals to value of uid (from LDAP) not mail. I think that when log to bi office It doesn't execute initialization block associated with LDAP - doesn't set USER variable to uid. Does anyone know how to get rid of this?
I have also another questions: How delete web user or change his name in Presentation Catalog? I think I cannot simply delete/rename directory using Catalog Administrator.
Thank you in advance.

I have a Date column in the dashboard prompt which is specifed as 'in between' because I want my report to return fields only in between the dates specified in the dashboard prompt by the user. In the report in answers I have the Date column filter as 'is prompted'.
Now I want to use a variable (not sure if it is presentation variable) in the title of the report so the dates picked by the user appear in the title of the report when we show up it dashabord.
Thanks

Forget to set environment variable export SAPINST_USE_HOSTNAME

Dear Experts
we have installed the SAP ECC6.0 EhP4 in HACMP environment with AIX6.1 ,Power HA cluster6.1, oracle 11g database
the problem is while installing the CI and ASCS and Dialog instance I missed to set environment variable
export SAPINST_USE_HOSTNAME = <virtual Host Name> and while starting the sap-inst also i didn't start as like
./sapint SAPINST_USE_HOSTNAME = <virtual Host Name>,Now i am facing problem while doing cluster fail over to another node
Node A host Name is not reflecting in Node B and I am not able to start the SAP with host name of Node A
in AIX6.1 in IBM Admin they didnt give any virtual host name they said that they have configured the cluster with two service IP there is no virtual IP in AIX6.1
please help me out how to resolve this host Name issue and to start the SAP in Node B
Thanks in Advance
krishna

Hi Krishna,
I dont agree with the AIX 6.1 having no virtual ip's, because i recently installed a HA instance with ASCS, SCS & also ERS on 6.1
to answer your questions:-
"can you tell is this correct setup or anything we did mistake for file system setup and installation"
This depends on what your requirement is. Typically a cluster will have Oracle on one host and SAP on the other host. Ill explain the VCS concept, so you will have a better understanding.
Lets consider Node1 & Node2. Now each node will have a physical IP and a virtual IP. The Virtual IP will be associated with a set of file systems. For example /oracle will be associated to virtual ip lets say "xyzDB" & the /usr/sap/<sid>, TRANS & sap mount will be associated with virtual ip lets say "abcCI". Now when the cluster fails over to which ever node, these file systems will still be associated with their respective virtual ip's.
So, the start profile will always have START_DVEBMGS_abcCI. Irrespective of which Node the sap is in, when you start the SAP, it will use the virtual hostname and start up SAP. I hope your getting the concept.?
Coming back to the setup, since you have ASCS, Oracle , CI & a dialog instance. Im not sure what file systems you have associated with VCS groups. Can you give command "hastatus -sum" and post the output?
Regarding your other question
"this file system is moving to Node B but while starting SAP on Node B host Name is not reflecting and SAP is not coming up due to there hostname didnt change in Node B,, can you advice me please ,,"
This is inline with what i explained above for cluster mechanism. The physical IP will not change. It is only the virtual IP that is associated with a set of file systems.
Ill give you one more example, Consider the parameter rdisp/mshost = <> . What should this be? Physical host or Virtual host?? :-) .It should be Virtual. Because the CI can be in Node1 or Node2. If we give the physical host, then if the SAP fails over to the other node. How will it start up? because the profiles still say the message server is in the other host... Getting my point?
Regards,
Shanser

Set SSIS variable = database connection manager name

Is it possible to set a SSIS string to only the name of a database connection manager or even the connection string it uses ? I don't see an option for that in Evaluate as expression property of ssis variable.
This is what I mean -
SSIS Connection manager name = SQL_DBASE
SSIS String str_managerName = SSIS Connection manager name: Can you do this dynamically in SSIS ?

I'm guessing what they really want to do is evaluate some indicator (some input from a user or an infrastructure setting) and then dynamically connect to any one of 10 (arbitrary example) database servers based on what they get as input. They
don't care about the connection manager per se. What seems reasonable is the that the Connection Manager might take a server variable but if they wanted to do things like that they would have bought Datastage.
You might try attacking this problem at the Control Level and then connect to the database you want based on a variable you set. I'm seeing that a Sequence Container can branch on the contents of a variable.
Or if the dba is your friend you might get the dba to add all your servers as linked servers to a central connection machine and then you might be able to do this by putting the ssis variable in a "Sql Command from a Variable" variable.
It might look something like this:
Server is designated in ssis var @[User::Machine]
then executing from a variable
"select top 100 * from " + @[User::Machine] + ".mydb.dbo.mytable"
Be careful as hades about levels of indirection and what quotes you want at what level. Evaluate Expression in ssis helps with this. The syntax I show works only with an ms sql connection server to a remote ms sql server. This is what a
dynamic connection to a linked server connection to Oracle would look like:
"select * from
openquery("+ @[User::Machine] + ",'select * from oradb.oratable where rownum < 100')"
When ever a thousand of your best friends are helping you connect to your database (using tools like linked servers as opposed to direct connections) it's probably best to use with only small specific updates or queries, large queries or large
updates would probably take a long time and or might not finish. But try it before you give up. We are actually doing fairly large Oracle queries (5-10 million rows) through ms sql linked server.

Reading locale system properties like set-variables of a windows Client

Hello,
is there a possibility to read locale system properties like set-variables of a windows Client?
We want to read path-Info and user-info. Can I perhaps user javascript?
Best regards
Oliver Prodinger

Hi Oliver,
This code will work (assuming the client approves running of ActiveX)
<html>
<script>
var shell = new ActiveXObject("WScript.Shell");
var env = shell.Environment("process");
alert(env("COMPUTERNAME"));
alert(env("USERNAME"));
</script>
</html>
You can't really run it from WD, but what you can do is run this code from a portal component (DynPage/JspDynPage) that is running in the same page as your WD application and pass data by using portal eventing.
The portal component iview can have size of 1 pixel so it won't be seen...
Regards,
Omri

What's user variable name using Smart View POV function (ex:HypGetActiveMember)?

Hi,
We want to use Smart View POV function (ex:HypGetActiveMember) to get the active member of user variables from HFM forms selected into Excel, but we don't know the user variable name in the following paragraph of Smart View developer guide:
"To uniquely identify the user variable, provide the user variable name rather than the dimension name."
For example, what's the user variable name of Year dimension? How to get the user variable name?
Any information would be appreciated. Thank you!

Hi,
I guess user variable name is set by users/developers. I am not very clear on your question. If you have defined some variables to select any members from a dimension then it will be in HFM only. In planning we have two kinds of variables User Variables (we set it from Planning Preferences) and Substitution variable (we set it from Essbase Consol in the backend). Without looking into your application it is difficult to say the user variable name. Like for Year the user variables can be "PreviousYear", "CurrentYear", or "NextYear" etc.
Soumya

Error trying to run SSIS Package via SQL Server Agent: DTExec: Could not set \Package.Variables[User::VarObjectDataSet].Properties[Value] value to System.Object

Situation:
SSIS Package designed in SQL Server 2012 - SQL Server Data Tools
Windows 7 - 64 bit.
The package (32 bit) extracts data from a SQL Server db to an Excel Output file, via an OLE DB connection.
It uses 3 package variables:
*) SQLCommand (String) to specify the SQL Statement to be executed by the package
Property path: \Package.Variables[User::ExcelOutputFile].Properties[Value]
Value: f:\Output Data.xls
*) EXCELOutputFIle (String) to specify path and filename of the Excel output file
Property path: \Package.Variables[User::SQLCommand].Properties[Value]
Value: select * from CartOrder
*) VarObjectDataSet (Object) to hold the data returned by SQL Server)
Property path: \Package.Variables[User::VarObjectDataSet].Properties[Value]
Value: System.Object
It consists out of 2 components:
*) Execute SQL Task: executes the SQL Statement passed on via a package variable. The resultng rows are stored in the package variable VarObjectDataSet
*) Script Task: creates the physical output file and iterates VarObjectDataSet to populate the Excel file.
Outcome and issue:The package runs perfectly fine both in SQL Server Data Tools itself and in DTEXECUI.
However, whenever I run it via SQL Server Agent (with 32 bit runtime option set), it returns the errror message below.
This package contains 3 package variables but the error stating that a package variable can not be set, pops up for the VarObjectDataSet only. This makes me wonder if it is uberhaupt possible to set the value of a package variable
of type Object.
Can anybody help me on this please ?
Message
Executed as user: NT Service\SQLSERVERAGENT. Microsoft (R) SQL Server Execute Package Utility Version 11.0.2100.60 for 32-bit Copyright (C) Microsoft Corporation. All rights reserved. Started: 6:40:20 PM DTExec: Could
not set \Package.Variables[User::VarObjectDataSet].Properties[Value] value to System.Object. Started: 6:40:20 PM Finished: 6:40:21 PM Elapsed: 0.281 seconds. The package execution failed. The step failed.
Thank you very much in advance
Jurgen

Hi Visakh,
thank you for your reply.
So, judging by your reply, not all package variables used inside a package need to be set a value for when run in DTEXEC ?
I already tried that but my package ended up in error (something to do with "... invocation ...." and that error is anything but clearly documented. Judging by the error message itself, it looks like it could be just about anything. that is why I asked my
first question about the object type package variable.
Now, I will remove it from the 'set values' list and try another go cracking the unclear error-message " ... invocation ...". Does an error message about " ... invocation ..." ring any bells, now that we are talking about it here ?
Thx in advance
Jurgen
Yes exactly
You need to set values only forthem which needs to be controlled from outside the package
Any variable which gets its value through expression set inside package or through a query inside execute sql task/script task can be ignored from DTExec
Ok I've seen the invocation error mostly inside script task. This may be because some error inside script written in script task. If it appeared after you removed the variable then it may because some reference of variable existing within script task.
Please Mark This As Answer if it helps to solve the issue Visakh ---------------------------- http://visakhm.blogspot.com/ https://www.facebook.com/VmBlogs

Unable to publish in Swf format. Get error message: 'Swf compilation failed. Note: Please verify if any of the actionscript keywords is used as user variable name'. Anyone know how to fix?

Unable to publish in Swf format. Get error message reads: 'Swf compilation failed. Note: Please verify if any of the actionscript keywords is used as user variable name'. Anyone know how to fix?

Hi There,
Can you tell me the Operating System and Captivate version you are using?
Also can you confirm if you are getting this issue will this one project or all the projects? Try to copy paste this project on a new blank project and then try to publish.
Regards,
Mayank

How user variable table names in select statement

Dear all,
I have three table gp1,gp2,g3. i want user variable table in sql query
for example at oracle forms have a list table showing table names gp1,gp2,gp3
at form i want user this query
select gpno from :table where gpno=120;
how i can specify table name Dynamicly in select query
Thanks

Forms_DDL is a one-way street: You can only pass DDL commands TO the database; you cannot get data back using Forms_DDL.
Exec_SQL is the Forms package that enables dynamic sql within a form. But to retrieve data, you have to make a Exec_SQL call for every column in every row. So it is not a good thing to use, either.
The ref cursor method should work. You could also retrieve the data into a record group using populate_group_with_query -- it also enables dynamic data retrieval.
But if you already know you have three distinct tables and you know their names, I would keep it simple and just write three sql select statements.

When publishing a captivate I get the message "Swf compilation failed. Note: Please verify if any of the actionscript keywords is used as user variable name." and it won't allow me to publish the Captivate, can anyone help?

When publishing a captivate I get the message "Swf compilation failed. Note: Please verify if any of the actionscript keywords is used as user variable name." and it won't allow me to publish the Captivate, can anyone help?

Hi There,
Can you tell me the Operating System and Captivate version you are using?
Also can you confirm if you are getting this issue will this one project or all the projects? Try to copy paste this project on a new blank project and then try to publish.
Regards,
Mayank

I want to set a variable with default value and can be changed by the user

hi,
i want to set a variable with default value and can be changed by the user, so i new a variable with setting : customer exit, single value, optional, ready for input.
in my customer exit code, i set a default value, eg. 20070530
when the variable screen popup, it display the default value 20070530, i changed it to 20070529, but it doesn't work , it still display the data in 20070530, how can i solve this problem?
your help is appreciated.

Liu,
As mentioned by Anil, you need to restrict your customerr Exit code to I_STEP = 1.
or.
<u>Open your Variable in change mode, in the Last Page os the Variable Maintenance you can provide default value. Note: you are doing same thing in Customer Exit. In your case no need of Customer Exit.</u>
Nagesh Ganisetti.
Assign points if it helps.

Issue with User Variable Due Shared Member Security Access

Hi All,
One of my client is using User variable in data form to define POV.
Now if user has access to 2 member in the Dimension, he should able to see 2 member when he try to assign the value to this "user variable"
but he can see some of the parent member name ,this parent name has only one child which is a shared member of the 2 base member for which he has access.
For Example:
Entity Dimension:
E1 (user has access)
E2
E3(user has access)
E4
Alt_Entity
Alt_Entity1E1 (sharedmember)
Alt_Entity2E2 (sharedmember)
Alt_Entity3E3 (sharedmember)
Alt_Entity4E4 (sharedmember)
User is able to see below members, when he try to assign value
E1 (user has access)
E3(user has access)
Alt_Entity1
Alt_Entity3
Now if I add another member under this parent, than user are unable to see this parent member.
For Example:
Entity Dimension:
E1 (user has access)
E2
E3(user has access)
E4
Alt_Entity
Alt_Entity1
E1 (sharedmember)
E2 (sharedmember)
Alt_Entity2E2 (sharedmember)
Alt_Entity3
E3 (sharedmember)
E2 (sharedmember)
Alt_Entity4E4 (sharedmember)
User is able to see below members, when he try to assign value
E1 (user has access)
E3(user has access)
Any idea?

Sorry, but actually its the parent that needs tagging with "Never Share", not the level 0 member, so Alt_Entity1 and Alt_Entity2 etc, see Essbase DBA guide
understanding Implied
Sharing
The shared member property defines a shared data relationship explicitly. Some
members are shared even if you do not explicitly set them as shared. These
members are said to be implied shared members.
If you do not want a member to be shared implicitly, mark the parent as Never Share so
that the data is duplicated, and is not shared. See Understanding Shared Members for an
explanation of how shared members work.
So in the example above
Entity Dimension:
E1 (user has access)
E2
E3(user has access)
E4
Alt_Entity
Alt_Entity1 - Set to "Never Share"E1 (sharedmember)
Alt_Entity2E2 (sharedmember)
Alt_Entity3 - Set to "Never Share"E3 (sharedmember)
Alt_Entity4E4 (sharedmember
Thanks
Anthony

ZCM Agent 11.3.x - Remote Management - Windows User Variable

I noticed this back during the initial deployment of 11.3.1, however have not had a chance to comeback to it. Now we are at 11.3.2 and the issue seems to still be.
On login we have a script that runs via a bundle it tracks user, date, time, computer login info to 2 locations, one on the local workstation to a hidden folder and 2 on the network.....
It looks like this in the log file
"pwolfe" , "192.168.x.x" , "LPTP-PWOLFE" , "Tue 02/03/2015" , "11:44:20.05"
What I have noticed is if someone uses ZRM (Zen Remote Management) to manage the workstation / shadow a user for help or any other such thing...the next logon on the box will look like this
"LPTP-PWOLFE$" , "192.168.x.x" , "LPTP-PWOLFE" , "Tue 02/03/2015" , "11:44:20.05"
Notice the user variable went from the username to the computer name with a dollar sign. I would say it could be the script, however see below it works fine with the old agent installed.
If you reboot the computer its fine, you can login and out time after time and it will display correctly. However if someone remote manages the computer it is broke until the next restart.
here is the script that runs:
for /f "Tokens=2 Delims=[]" %%i in ('ping -4 -n 1 "%computername%"') do set IP=%%i
Echo "%username%" , "%IP%" , "%ComputerName%" , "%date%" , "%Time%" >>"\\192.168.x.x\support\utilities\logfiles\IPaddr essLog.txt"
Echo "%username%" , "%IP%" , "%ComputerName%" , "%date%" , "%Time%" >>"C:\Utilities\IPaddressLog.txt"
This is being called as a launch item under a user run bundle, it is set to run as logged in user.
This is not happening on the older 11.2.4 separate Zone / server setup that is still in use for the majority of people. Just on the newer 11.3.x environment.
If I remove the 11.3.x agent and install the 11.2.4 agent and point it to the old environment / server it works fine.
Any ideas?
Thanks,
Patrick

Originally Posted by CRAIGDWILSON
What happens if you create a Shortcut to this bundle and run it manually after the desktop is up and active? (after a RC session that messes stuff up?)
What happens if you create a bundle that runs "cmd.exe" as logged on user and run it manually while this other bundle is having issues? (type "set" from the cmd session....)
Thanks Craig,
I finally got some time to look at this again.
It appears on the first logon to a computer it runs correctly, if a Remote Management session takes place and once logged off and a log in is initiated you get the incorrect information. If you run the application from the Zen App Window it displays correctly. If you reboot the computer it works as expected for the first logon and then stops working if a remote session is initiated.
3 Straight logons, the 4th entry is when I ran it manually from the zen app window:
"pwolfe" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:53:33.77"
"TDLARM280-50125$" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:54:51.09"
"TDLARM280-50125$" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:57:24.29"
"pwolfe" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:58:22.51"
Here is the "Set" CMD
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\pwolfe\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=TDLARM280-50125
ComSpec=C:\Windows\system32\cmd.exe
DEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\pwolfe
LOCALAPPDATA=C:\Users\pwolfe\AppData\Local
LOGONSERVER=\\TDLARM280-50125
NUMBER_OF_PROCESSORS=4
NWLANGUAGE=ENGLISH
NWUSERNAME=pwolfe
OS=Windows_NT
Path=C:\ProgramData\Oracle\Java\javapath;C:\Progra m Files (x86)\Intel\iCLS Clien
t\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows
\System32\Wbem;C:\Windows\System32\WindowsPowerShe ll\v1.0\;C:\Program Files\Inte
l\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Mana
gement Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management En
gine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Comp
onents\IPT;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Progra
m Files (x86)\Novell\ZENworks\bin;C:\Program Files (x86)\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WS F;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3a09
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell \v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\pwolfe\AppData\Local\Temp
TMP=C:\Users\pwolfe\AppData\Local\Temp
USERDOMAIN=TDLARM280-50125
USERNAME=pwolfe
USERPROFILE=C:\Users\pwolfe
VSEDEFLOGDIR=C:\ProgramData\McAfee\DesktopProtecti on
windir=C:\Windows
WINDOWS_LOGIN=0
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpac kage\csilogfile.log
ZENWORKS_HOME=C:\Program Files (x86)\Novell\ZENworks

Utilizing XML Publisher Report Bursting Program user-variables

When running the XML Publisher Report Bursting Program against a bursting control file, I see the following in the log:
Bursting propertes.....
{user-variable:cp:territory=US, user-variable:cp:ReportRequestID=4413342, user-variable:cp:language=en, user-variable:cp:responsibility=20678, user-variable.OA_MEDIA=http://hostname:8000/OA_MEDIA, burstng-source=EBS, user-variable:cp:DebugFlag=N, user-variable:cp:parent_request_id=4413342, user-variable:cp:locale=en-US, user-variable:cp:user=USER, user-variable:cp:application_short_name=XDO, user-variable:cp:request_id=4413368, user-variable:cp:org_id=204, user-variable:cp:reportdescription=Report Name, user-variable:cp:Dummy for Data Security=Y}
I would like to reference one or more of these in
1. My bursting control file
2. My template (to be output in final PDF).
I cannot seem to get this to work in my bursting control file by referencing:
${cp:user} (note that it just returns the word 'null' here instead of the value)
nor can I get it to work in my RTF template by referencing:
<?xdoxslt:get_variable($_XDOCTX, ‘cp:user’)?>
Should this work, or I am missing something?
Thanks

Thanks Ike, it likely would. The thing I keep coming back to is an example in the BIP Developer's Guide that suggests you can set a property and have it made available:
DocumentProcessor dp = new DocumentProcessor (cfgFile, xmlFile, dir);
Properties prop= new Properties();
prop.put("user-variable:ADMIN_EMAIL","[email protected]");
dp.setConfig(prop);
dp.process()
Seems to me that the work going on behind the scenes here (based on log statements alone) suggest the same sort of integration.. but I suppose not.
Thanks

AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
Ingo

Hi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo

Setting User# variable according to TS Client name

Similar Messages

Maybe you are looking for