Simple remote connection using Cisco AnyConnect and ISR router

Hi all,
I am just wondering what the easiest and simplest method would be to make remote PCs (running Cisco AnyConnect) establish a VPN IPsec to a Cisco ISR (881/887, 1900s,2900s series). I used to use EasyVPN method (simple and fast to configure and no need for special licences other than crypto licence) but since Cisco VPN Client is no longer supported I had to resort to WebVPN which requires a licence depending on the number of clients to support (SSL licences for 10,20 users and so forth). I've read a bit about FlexVPN but I can't find an easy example to what I want to do. The closest is this one (FlexVPN and Anyconnect IKEv2 Client Configuration Example):
http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115941-flexvpn-ikev2-config-00.html
But that example makes use of RADIUS. Is there a way to make use of local database (users configured on the router) instead of RADIUS?
Basically what I am after is the following
- Remote users install Cisco AnyConnect to establish a VPN connection to HQ
- HQ ISR (880s, 1900s, 2900s) terminates that VPN connections and allows access to local resources (shared drives, applications...).Authentication method would be local database on the router. No need of RADIUS/ACS as this is for very small companies with no IT resources to maintain and configure a RADIUS/ACS server.
I think what I need is this AnyConnect to IOS Headend Over IPsec with IKEv2 and Certificates Configuration Example:
http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115014-flexvpn-guide-cert-00.html
But the example is too highlevel for me to follow, basically I don't know how to generate such certificates and distribute it to remote clients.
Any help as to how to create such certificates or how to configure FlexVPN to just requiring the user to enter usr/pass (using local database not RADIUS nor ACS) would be highly appreciated.
Cheers
Alvaro

If you insist .. try this:
http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116032-flexvpn-aaa-config-example-00.html
http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115907-config-flexvpn-wcca-00.html
http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/50282-ios-ca-ios.html

Similar Messages

XE connection problem after using Cisco AnyConnect Client

Hello
I have a rather annoying problem connecting to an XE instance AFTER I have disconnected from a VPN via a Cisco AnyConnect VPN Agent.
Sequence of operations:
- start Oracle XE and work normally
- connect to client's vpn
- do other stuff
- DISCONNECT from Client's VPN
-> unable to connect to XE service any more, unless I reboot
The problem does not happen with other vpn clients like Cisco VPN Service, Juniper, Checkpoint.
Details:
- sqlplus connection WITH service name (eg sqlplus user/pwd@XE): FAILURE with ORA-12170
- but...sqlplus connection WITHOUT service name (eg sqlplus user/pwd): SUCCESS (weird !)
- tnsping XE: TNS-12535 error
- lsnrctl status output (sorry, italian localized)
LSNRCTL for 32-bit Windows: Version 10.2.0.1.0 - Production on 22-GIU-2011 14:19
:38
Copyright (c) 1991, 2005, Oracle. All rights reserved.
Connessione a (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC_FOR_XE)))
STATO del LISTENER
Alias LISTENER
Versione TNSLSNR for 32-bit Windows: Version 10.2.0.1.0 - Produ
ction
Data di inizio 22-GIU-2011 12:26:15
Tempo di attivitÓ 0 giorni 1 ore 53 min. 22 sec.
Livello trace off
Sicurezza ON: Local OS Authentication
SNMP OFF
Servizio predefinito XE
File di parametri listenerC:\programs\oraclexe\app\oracle\product\10.2.0\server\
network\admin\listener.ora
File di log listener C:\programs\oraclexe\app\oracle\product\10.2.0\server\
network\log\listener.log
Summary table degli endpoint di ascolto...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC_FOR_XEipc)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=MyPCName)(PORT=8080))(Presentation=HTTP)(Session=RAW))
Summary table dei servizi...
Il servizio "CLRExtProc" ha 1 istanze.
L'istanza "CLRExtProc", stato UNKNOWN, ha 1 handler per questo servizio...
Il servizio "PLSExtProc" ha 1 istanze.
L'istanza "PLSExtProc", stato UNKNOWN, ha 1 handler per questo servizio...
Il servizio "XEXDB" ha 1 istanze.
L'istanza "xe", stato READY, ha 1 handler per questo servizio...
Il servizio "XE_XPT" ha 1 istanze.
L'istanza "xe", stato READY, ha 1 handler per questo servizio...
Il servizio "xe" ha 1 istanze.
L'istanza "xe", stato READY, ha 1 handler per questo servizio...
Environment:
Win7 Pro SP1
Oracle XE 10.2.0
I have stopped the Win firewall and the problem is still there, so it is not a firewall problem
listener.ora configuration
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(SID_NAME = PLSExtProc)
(ORACLE_HOME = C:\programs\oraclexe\app\oracle\product\10.2.0\server)
(PROGRAM = extproc)
(SID_DESC =
(SID_NAME = CLRExtProc)
(ORACLE_HOME = C:\programs\oraclexe\app\oracle\product\10.2.0\server)
(PROGRAM = extproc)
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC_FOR_XE))
(ADDRESS = (PROTOCOL = TCP)(HOST = MyPCName)(PORT = 1521))
DEFAULT_SERVICE_LISTENER = (XE)
tnsnames.ora
XE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyPCName)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = XE)
EXTPROC_CONNECTION_DATA =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC_FOR_XE))
(CONNECT_DATA =
(SID = PLSExtProc)
(PRESENTATION = RO)
Any help ?

Hi;
Pelase close this tread as answered and keep update issue at:
Re: XE connection problem after using Cisco AnyConnect Client
Regard
Helios

Network becomes limited or unavailable as soon as i connect to cisco anyconnect secure mobility client, version - 3.1.05170

Hiee,
I am using cisco anyconnect secure mobility client, version - 3.1.05170 , in my windows 8.1 PC to access vpn to my office desktop. But as soon as i connect cisco anyconnect client, my wifi networks becomes limited or unavailable. Thus, i am not able to get remote access to my office desktop. And not even able to access any other websites also. But as soon as i disconnect from the cisco anyconnect vpn client, every thing becomes normal, and the exclamation mark from the network icon also disappears.
kindly help me in this regard.
Thanks and regards
Neeraj

There are a few things to consider here:
- The IPSec VPN client is EoL, so even if we consider this as a bug, it wouldn't be fixed
- fixing the file server access would break the DHCP renew which means there is no completely clean way to fix this, at least not at the IP level since the client can't route to the same destination using 2 different paths.
Is there any chance we could do a static policy NAT for the DHCP traffic so it appears to come from another IP? It's twisted and it may not work (the client might use the DHCP server IP embedded inside the payload and not the source IP) but if it does, then we'd fix the overlap.
Could the server use another IP address for the DHCP service (much like using a loopback for a certain service on a router?)
A third solution would be to NAT the destination server IP on the ASA for traffic from the IP pool going to the server. We'd need DNS doctoring as well to resolve the server's name to the NATted IP. This way the server would appear from the VPN client as being at a different IP, thereby fixing the overlap.
All these potential solutions are quite involved... you may be better off wityh a simpler design: splitting of your server into 2 or using something else to do DHCP for the VPN clients.

Debug IP Policy on Cisco 4451-X ISR Router

Cisco 4451-X ISR router is running IOS XE Software version 03.13.00.S. I am trying to run the command "debug ip policy" on the router to verify if the traffics are policy-routed correctly, but I get no output displayed on the router for the debug command. I am connected via a console cable and the logging console is enabled. How do I get the debug outputs to display on the router for monitoring? Thanks.

Actually, you can use a TFTP server...
First of all, create a text file using a text editor (call it 'dhcpstatic', for instance) with the following contents (don't include the dashes):
*time* Jan 21 2005 03:52 PM
*version* 1
!IP address Type Hardware address Lease expiration
172.16.12.100 /24 1 0011.4342.e9a5 Infinite
Then do the following:
no service dhcp
ip dhcp pool pool1
network 172.16.12.0 255.255.255.0
domain-name xxxdomain.com
dns-server 172.16.12.20 172.16.12.21
netbios-name-server x.x.x.x
default-router 172.16.12.1
lease 0 12
origin file tftp:///dhcpstatic
Then do a 'service dhcp'...
Once you have this working, we can do a further optimisation by storing the file on your switch so that you don't need to use a TFTP server...
Hope that helps - pls rate the post if it does.
Paresh

Urgent!!! Cisco ACE and asymetric routing assistance needed

I am wondering if someone can give me pointers on the cisco ACE
and asymetric routes. I've attached the diagram:
-Cisco IOS IP address is 192.168.15.4/24 and 4.1.1.4/24
-Firewall External interface is 192.168.15.1/24,
-Firewall Internal interface is 192.168.192.1/24,
-F5_BigIP External interface is 192.168.192.4/24,
-F5_BigIP Internal interface is 192.168.196.1/24 and 192.168.197.1/24,
-host_y has IP addresses of 192.168.196.10/24 and 192.168.197.10/24,
-Checkpoint has static route for 192.168.196.0/24 and 192.168.197.0/24
pointing to the F5_BigIP,
-host_y is dual-home to both VLAN_A and VLAN_B with the default
gateway on host_y pointing to VLAN_A which is 192.168.196.1,
-host_x CAN ssh/telnet/http/https to both of host_y IP addresses
of 192.168.196.10 and 192.168.197.10.
In other words, from host_x, when I try to connect to host_y
via IP address of 192.168.197.10, the traffics will go through VLAN_B
but the return traffics will go through VLAN_A. Everything
is working perfectly for me so far.
Now customer just replaces the F5_BigIP with Cisco ACE. Now,
I could not get it to work with Asymetric route with Cisco ACE. In
other words, from host_x, I can no longer ssh or telnet to host_y
via IP address of 192.168.197.10.
Anyone knows how to get asymetric route to work on Cisco ACE?
Thanks in advance.

That won't work because ACE uses the vlan id to distinguish between flows.
So when the response comes back on a different vlan, ACE can't find the flow it belongs to and it drops it.
Even if we could force it to accept the packet, ACE would then try to create a new flow for this packet and it will collide with the flow already existing on the frontend.
You would need to force your host to respond on the same vlan the traffic came in.
This could be done with client nat on ACE using different nat pool.
Gilles.

I want to set up my Epson printer using an airport and RR router. It was previously set up using a different router through HTC but same printer. How do I do this?

I want to set up my Epson printer using an Airport and RR router. The same Mac Book and printer was formerly set up using a HTC router. How do I reset computer so it communicates with printer?

http://support.apple.com/kb/HT3771
Mac 101: Printing (Mac OS X v10.6)

Connections drop when using Cisco Anyconnect Secure Mobility Client

Folks I have a strange issues. I have a few laptops that I'm testing using the Cisco AnyConnect Secure Mobility Client Network Access Manager. We like the interface and overall are happy, but have one nagging issue. Periodically the connection drops when using the client, and the only way to reconnect is to choose the Network repair option on the client. That fixes it just fine, but we shouldn't have to do this. The same clients using the built in WIndows supplicant do not have this problem. We are on version 3.0.07059.

Right now I'm testing on a single access point (autonomous) with WEP! The same laptop works fine without the Cisco client. Usually it is several hours, 12 or more when it happens, but I've seen it less than that. And I've seen it up for over a day and a half. At this point I just don't trust the client to roll out to a larger audience.

Has anyone ever used their iPad to remotely connect to a iMac and use programs like Photoshop on their iPad?

Hi everyone,
I had an iMac at home, but I've recently taken on some freelance work and they would like me to come into the office every now and then. I don't want to purchase a laptop and I know you can remotely connect to your desktop with an iPad, but I need to know if anyone has ever done that and successfully used programs like Photoshop on their iPad. Is there lag time when trying to use the software? Or is it just not possible and I should consider getting a laptop again?
Thank you!

iPads are not exact laptop replacements. If you need to be using Photoshop, then buy a normal laptop computer.
Using a remote access app on an IPad or any tablet conputer to remote access your computer to operate will be quite a lot slower and clumsier than just having a laptop with a normal OS and Photoshop application installed.

New vpn conncetion using Cisco Anyconnect Secure Mobility Client

(Not sure if I'm in the right forum.)
I'd like to connect via VPN to complete work tasks while not on the network. My Windows 8 laptop came with Cisco Anyconnect Secure Mobility. How do I or where do I go to add the new settings for this new vpn location? I have connections in the drop down list that I no longer use/need.
The VPN connetion failed due to unsuccessful domain name resolution.

Right now I'm testing on a single access point (autonomous) with WEP! The same laptop works fine without the Cisco client. Usually it is several hours, 12 or more when it happens, but I've seen it less than that. And I've seen it up for over a day and a half. At this point I just don't trust the client to roll out to a larger audience.

How do I use Cisco Anyconnect?

I'm not sure if this is the right place for this.
My work has provided Cisco Anyconnect to access their network. I'm able to download and install successfully but once I establish the connection, then what. I'm connected but nothing seems to happen. How do I actually access my works network? Do I need to connect to a server (Using Go/Connect to a server...)?
Thanks

All Anyconnect does is connect you to you work's network. Once you've established a connection, you should have access to work resources (servers, desktops, printers) by connecting to them as you would if you were at your office.
If there are any special connection requirements to use your work resources, you would need to contact the I/T people at your workplace.

MS SQL 2005 remote connection using sqljdbc

Hi,
I have production line computer with software using java code and firebird database, i also have sqljdbc.jar also in the library.
my software is trying to connect to mssql2005 database in a remote computer and got this error message:
java.lang.classnotfoundexception: com.microsoft.sqlserver.jdbc.SQLServerDriver.
I have no problem when connecting to my local mssql2005 database though. but have problems when trying to make remote connection.
May i know what could seem to be the cause of the problem, is there anything missing ? do i need to instal anything else on the production line computer? currently it does not have mssql2005 instal on the production computer do i need to instal it ? please help. thanks

Btreksun wrote:
Hi,
Im using MS SQL 2005 Express edition, I dont find any sqljdbc.jar driver inside the installation,
I dont see any other driver or driver folder in the installation path.
Inside my instalation path C:\Program Files\Microsoft SQL Server: only shows these folders
MSSQL$MSSQL2000
MSSQL.1
80
90
100
"Class path" applies to java. None of the above is java.
I dont know what to set my classpath with?You are running your java in "something". That "something" is an application. That "something" does not have the correct class path. You didn't tell us what it is so we can't help you with it.
I even download sqljdbc.jar and put it inside C:\Program Files\Microsoft SQL Server and set the classpath but doesnt work ?I suggest you google for class path, read several articles about it and try some of the stuff that they talk about.

BPF Package Manager won't open in remote connection using Public IP address

I have a problem to open BPF package manager.
Im able to open bpf package manager in my server and to all local bpc users but on the remote connection (vpn/web) they couldn't open the bpf.
Our server uses an private Ip address which is 10.1.25.81 (local LAN) but we also access BPC remotely using an
Public IP address (202.129.238.46 or http://servername.example.com/osft ) using a configuration of IP Forwarding in our router.
example:
(LAN)
User 1 on System 1 - does the BPF work?yes
User 1 on System 2 - does the BPF work?yes
User 2 on System 1 - does the BPF work?yes
User 2 on System 2 - does the BPF work?yes
(WAN/VPN)
User 1 on System 1 - does the BPF work?no
User 1 on System 2 - does the BPF work?no
User 2 on System 1 - does the BPF work?no
User 2 on System 2 - does the BPF work?no

When you are performing installation of BPC or after if you are looking into Server Manager - Server Option you will see for application server, web server and reporting services server you have two fields where you can specify name for internal and nae Example for application server:
Application Server name: FQDN (or IP)
External Application Name: FQDN (or IP)
Normally we recommedn to use FQDN (Fully qualified DNS name)
because if the DNS entry are set correct then you will be able to connect from internal and also from external without any problem.
The system will provide every time the correct IP.
In my opinion you used IP and the problem it is that internal the external IP is not recognized.
Please verify the configuration and provide more information about the landscape.
Only in this way we will be able to provide you the right sugestions to fix this issue.
Kind Regards
Sorin Radulescu

Oracle database connectivity using oledb provider and atl classes in c++

dear friend ,
i m connecting oracle database in c++. i m using ATL classes and oledb provider for oracle. however i m facing some defficulties in stored procedure.
Normally MYSQL and sql server database is resulting result set in stored procedure i.e. we can use " select * from tablename" query in c++ to returning result. but in oracle we can not use this approch as because it dosent support. so how can i execute below stored procedure in c++ code. i have to retuen result set in STP. i m using SYS_REFCURSER in oracle . but how do i execute it in c++ code.
create PROCEDURE stp_getRecord ( p_curser SYS_REFCURSER) as
begin
open p_curser for select * from table_name;
end;
please help me asap.

I tried it, commented out the reader.read and have the following connection string
string connectionString = "provider=ORAOLEDB.ORACLE; data source=ORCL; password=****; user id=****; OLEDB.NET=True"
Unfortunately the result is the same.
Edited by: Dino2dy on Nov 24, 2011 12:53 AM

How to Use Cisco 3660 or 3745 router for FAx

I want to use Cisco 3660 Router or 3745 Router for Receiving FAX on email. I have NM-2CE1T1-PRI which supports E1 R2 signalling on 3660 and 3745 both. What are the additional hardware requires? Kindly Help.

Hi,
You could use T.37 Store and forward fax which has the feature called Onramp faxing.
On-ramp faxing, in which a voice gateway that handles incoming calls from a standard fax machine or the PSTN converts a traditional Group 3 fax to an e-mail message with a Tagged Image File Format (TIFF) attachment. The fax e-mail message and attachment are handled by an e-mail server while traversing the packet network and can be stored for later delivery or delivered immediately to a PC or to an off-ramp gateway. Below URL is for detaield config.
http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide_chapter09186a00800b5dcf.html
You would not require any extra hardware for the same.
Thanks
GS

Remote connection using SAProuter and Service Connector

Hello everyone!
What I am trying to do is to connect to an SAP system of a client of ours.
This is what I have found out and what works -
I found out that for such a scenario a SAProuter and the Service Connector somewhow come into play. I worked with the SAProuter and could connect to a test IDES system in our company with the following router string -
/H/<localsystem_where_SAProuter_is_running>/H/<IP_of_IDES>/S/3200
This basically means that I would have to connect my SAProuter with the client's SAProuter and the client router would then pass on my connection to their SAP system like this -
/H/<mySAProuter>/H/<clientSAProuter>/S/<port_client_SAProuter>/W/<client_password_if_specified>
When this connection is established, I can access the client's SAP system through a SAPGui (Windows or Java) from my side using the connection string as specified above.
If this works, why do I need a service connector? What would it's function be?
Another question being - I have been told that a connection can also be established by using a connection from us to SAP and then from SAP to the client's SAP system (this has been suggested by the client). Where does this scenario fit in? If it is indeed possible, what do I need to do to make such a connection work?
I would appreciate it if someone answers who has actually worked on such a situation.
Bye!
Sameer

The service connector is used by SAP to automatically open your systems for customer messages; it's not relevant in the scenario you describe.
You can't use SAP's servers as a "stepping stone" to get to another customer's system.... you can directly link the two organizations by allowing the connections through both firewalls to specific saprouters at each end though:
CustA <> saprouter <> firewall <> INTERNET <> firewall <> saprouter <> CustB
It requires coordination between both customers and the use of saprouter strings in the SAPGUI configuration, as you've described.
Rich

Simple remote connection using Cisco AnyConnect and ISR router

Similar Messages

Maybe you are looking for