Site-to-Site VPN Tunnel fails after upgrade 8.3(2) to 8.4(4)

Hello Team Cisco,
I upgraded an ASA 5505 from 8.3(2) to 8.4(4) this evening.  The 5505 is a backup and used to perform testing prior to production changes. After the upgrade was complete, a VPN tunnel began to fail.  I did a limited search online to see if this was a known issue or something new.  I also reviewed the release notes but did not see anything that matched the issue I received.
My concern is that this tunnel configuration is scheduled to be deployed to the production firewalls next week after their upgrade.  But if it failed on the upgraded test unit, it may fail on the production units.
I downgraded the backup unit to 8.3(1) and verified that the tunnel indeed worked at that level.
Any input or thoughts would be greatly appreciated.
Thanks,
Michael

Hi Chris,
Thanks for the response. Unfortunately not.  I'll need to upgrade and capture logs and upload for review.  I may not get to that until this afternoon or Monday of next week.
Regards,
Michael

Similar Messages

  • EZVPN Router to PIX - vpn tunnel fails after xauth

    I'm trying to configure a 1721 router to connect to a PIX at the office, essentially putting the router in place of a software VPN client. I can connect to the PIX with both a software VPN client and a hardware VPN 3002, but whenever I try to configure the router with EZVPN, the tunnel fails to come up after the XAUTH negotiation. I've tried a few variations on configurations with no luck. Can anyone comment if this is possible? I've attached a config and debug info. Thanks in advance for any help and comments.
    Ken

    Thank you for the suggestions. Currently, the PIX is configured to not allow the save password option on the remote end. Was hoping the PIX config wouldn't need any changes since its working for the software VPN clients. I tried your NAT suggestion:
    ip nat inside source list 100 interface Ethernet0 overload
    ip nat inside source list Lan_Addresses interface Ethernet0 overload
    ip access-list standard Lan_Addresses
    permit 192.168.5.0 0.0.0.255
    access-list 100 deny ip 192.168.5.0 0.0.0.255 10.0.0.0 0.0.15.255
    access-list 100 permit ip 192.168.5.0 0.0.0.255 any
    This didn't change things. Also, things behave differently when I use a bad username/password, for example:
    AADDAA#crypto ipsec client ezvpn xauth OfficeVPN
    Username: baduser
    Password:
    AADDAA#
    *Mar 14 06:27:07.891: xauth-type: 0
    *Mar 14 06:27:07.895: username: baduser
    *Mar 14 06:27:07.895: password:
    *Mar 14 06:27:07.899: ISAKMP:(1032): responding to peer config from 2XX.XXX.XXX.
    XX. ID = -475558296
    *Mar 14 06:27:07.903: ISAKMP:(1032): sending packet to 2XX.XXX.XXX.XX my_port 50
    0 peer_port 500 (I) CONF_XAUTH
    *Mar 14 06:27:07.907: ISAKMP:(1032):Sending an IKE IPv4 Packet.
    *Mar 14 06:27:07.907: ISAKMP:(1032):deleting node -475558296 error FALSE reason
    "Done with xauth request/reply exchange"
    *Mar 14 06:27:07.907: ISAKMP:(1032):Input = IKE_MESG_INTERNAL, IKE_XAUTH_REPLY_A
    TTR
    *Mar 14 06:27:07.907: ISAKMP:(1032):Old State = IKE_XAUTH_REPLY_AWAIT New State
    = IKE_XAUTH_REPLY_SENT
    *Mar 14 06:27:07.963: ISAKMP (0:1032): received packet from 2XX.XXX.XXX.XX dport
    500 sport 500 Global (I) CONF_XAUTH
    *Mar 14 06:27:07.967: ISAKMP: set new node 559535353 to CONF_XAUTH
    *Mar 14 06:27:07.971: ISAKMP:(1032):processing transaction payload from 2XX.XXX.
    XXX.XX. message ID = 559535353
    *Mar 14 06:27:07.979: ISAKMP: Config payload REQUEST
    *Mar 14 06:27:07.979: ISAKMP:(1032):Xauth process request
    *Mar 14 06:27:07.979: ISAKMP:(1032):Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST
    *Mar 14 06:27:07.979: ISAKMP:(1032):Old State = IKE_XAUTH_REPLY_SENT New State
    = IKE_XAUTH_REPLY_AWAIT
    *Mar 14 06:27:08.983: EZVPN(OfficeVPN): Pending XAuth Request, Please enter the fo
    llowing command:
    *Mar 14 06:27:08.983: EZVPN: crypto ipsec client ezvpn xauth
    Thanks again,
    Ken

  • Cannot establish site-site vpn tunnel through ASA 9.1(2)

    Hi,
    We use ASA 9.1(2) to filter traffic in/out of our organisation. A dept within the organisation also have a firewall. They want to establish a site-site VPN tunnel with a remote firewall. We have allowed full access between the public address of the dept firewall and the remote firewall and full access between the remote firewall address and the dept firewall address . We do not use NAT.
    The site-site VPN tunnel fails to establish.
    The dept sysadmin has requested that we enable IPSec Passthrough. From my reading this will not make any difference as we allow full access between the firewalls in both directions. Is that correct?
    Has anyone encountered issues with ASA 9.1(2) interfering with site-site tunnels?
    Regards

    >The dept sysadmin has requested that we enable IPSec Passthrough. From my reading this will not make any difference as we allow full access between the firewalls in both directions. Is that correct?
    Yes, in that case, no IPsec-pass-through is needed. All you need is (in both directions):
    UDP/500
    UDP/4500 (also if you don't use NAT, the remote gateway could be located behind a NAT gateway)
    IP/50
    for testing ICMP/Echo
    If you allowed full IP-access between these two endpoints, it is more than enough.
    When they start testing, do you see a connection on your ASA. There should be at least UDP/500 traffic.
    Can the two gateways ping each other? 

  • Cisco ASA 5520 Site-to-site VPN TUNNELS disconnection problem

    Hi,
    i recently purchased a Cisco ASA 5520 and running firmware v. 8.4(2) and ASDM v. 6.4(5)106.
    I have installed 50 Site-to-Site VPN tunnels, and they work fine.
    but randomly the VPN Tunnels keep disconnecting and few seconds after it connects it self automaticly....
    it happens when there is no TRAFIC on, i suspect.
    in ASDM in Group Policies under DfltGrpPolicy (system default) i have "idle timeout" to "UNLMITED" but still they keep disconnecting and connecting again... i have also verified that all VPN TUNNELS are using this Group Policie. and all VPN tunnels have "Idle Timeout: 0"
    this is very annoying as in my case i have customers having a RDP (remote dekstop client) open 24/7 and suddenly it gets disconnected due to no traffic ?
    in ASDM under Monitoring -> VPN .. i can see all VPN tunnels recently disconnected in "Login Time Duration"... some 30minutes, 52minutes, 40minutes and some 12 minutes ago.. and so on... they dont DISCONNECT at SAME time.. all randomly..
    i dont WANT the VPN TUNNELS to disconnect, i want them to RUN until we manually disconnect them.
    Any idea?
    Thanks,
    Daniel

    What is the lifetime value configured for in your crypto policies?
    For example:
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400

  • Multiple Site-Site VPN Tunnel on a Single PiX Firewall

    I cureently have a site to site VPN tunnel (VPN1) between HK (Pix ver 6.1(2) & Leeds (ASA version 7.2(2). I am in the process of migrating the VPN tunnel to a newly deployed 10 Mb internet link in Leeds which has a Pix 506E Ver 7.0(2). I have decided to create a 2nd VPN tunnel to HK (VPN2) and will shutdown VPN1 when VPN2 is up.
    On the HK PIX I am using the same isakmp policy, transform-set and have created another crypto map for the the new VPN (VPN2).
    On passing intersting traffic to establish the new tunnel for the Leeds end, I am gettting the following debugging errors.
    Feb 04 15:06:42 [IKEv1]: QM FSM error (P2 struct &0x1b24150, mess id 0x47595d7)!
    Feb 04 15:06:42 [IKEv1]: Group = 192.168.0.1, IP = 192.168.0.1, Removing peer from correlator table failed, no match!
    Feb 04 15:06:42 [IKEv1]: QM FSM error (P2 struct &0x1b24860, mess id 0x9cafcd4d)!
    Feb 04 15:06:42 [IKEv1]: Group = 192.168.0.1, IP = 192.168.0.1, Removing peer from correlator table failed, no match!
    sh Feb 04 15:06:47 [IKEv1]: QM FSM error (P2 struct &0x1d085d0, mess id 0x458d4091)!
    Feb 04 15:06:47 [IKEv1]: Group = 192.168.0.1, IP = 192.168.0.1, Removing peer from correlator table failed, no match!
    sh crypto isakmp sa
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 192.168.0.1
    Type : L2L Role : initiator
    Rekey : no State : MM_ACTIVE
    Site HK - PIX1(192.168.0.1)
    crypto ipsec transform-set chevvie esp-des esp-md5-hmac
    (crypto map for existing VPN (VPN1)
    crypto map transam 1 ipsec-isakmp
    crypto map transam 1 match address 101
    crypto map transam 1 set peer 192.168.0.2
    crypto map transam 1 set transform-set chevvie
    (New Crpto Map for new VPN (VPN2)
    crypto map transam 2 ipsec-isakmp
    crypto map transam 2 match address 101
    crypto map transam 2 set peer 192.168.0.3
    crypto map transam 2 set transform-set chevvie
    crypto map transam interface outside
    isakmp enable outside
    isakmp key ****** address 192.168.0.2 netmask 255.255.255.255
    isakmp key ev0lut10n address 192.168.0.3 netmask 255.255.255.255
    isakmp identity address
    isakmp policy 1 authentication pre-share
    isakmp policy 1 encryption des
    isakmp policy 1 hash md5
    isakmp policy 1 group 1
    isakmp policy 1 lifetime 1000
    isakmp am-disable
    floodguard enable
    sysopt connection permit-ipsec
    no sysopt route dnat
    Site - Leeds PIX2 (192.168.0.3)
    crypto ipsec transform-set ford esp-des esp-md5-hmac
    crypto map VPNHK 2 match address outside_crypto_acl
    crypto map VPNHK 2 set peer 192.168.0.1
    crypto map VPNHK 2 set transform-set ford
    crypto map VPNHK interface outside
    isakmp identity address
    isakmp enable outside
    isakmp policy 1 authentication pre-share
    isakmp policy 1 encryption des
    isakmp policy 1 hash md5
    isakmp policy 1 group 1
    isakmp policy 1 lifetime 1000
    isakmp am-disable
    tunnel-group 192.168.0.1 type ipsec-l2l
    tunnel-group 192.168.0.1 ipsec-attributes
    pre-shared-key ev0lut10n
    sysopt connection permit-ipsec
    Your assistance will be grately appreciated.

    How could the HK PIX decide which tunnel to use if you apply the same ACL to both? You have to choose a different subnet to Leeds2.
    Peter

  • Configure a VPN client and Site to Site VPN tunnel

    Hi, I'm setting up a test network between 2 sites. SiteA has a 515E PIX and SiteB has a 501 PIX. Both sites have been setup with a site to site VPN tunnel, see SiteA config below. I also require that remote clients using Cisco VPN client 3.6 be able to connect into SiteA, be authenticated, get DHCP info and connect to hosts inside the network. However, when I add these config lines, see below, to SiteA PIX it stops the vpn tunnel to SiteB. However, the client can conect and do as needed so that part of my config is correct but I cannot see why the site to site vpn tunnel is then no longer.
    SiteA config with working VPN tunnel to SiteB:
    SITE A
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.x.x.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.x.x.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.x.x.0.0 201.201.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    SiteA-pix(config)#
    Lines I add for Cisco VPN clients is attached
    I entered each line one by one and did a reload and sh crypto map all was OK until I entered the crypto map VPNPEER lines.
    Anyone any ideas what this can be?
    Thanks

    Heres my config:
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.11.11.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    access-list 80 permit ip SiteA_INT 255.255.0.0 200.220.0.0 255.255.0.0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.255.255.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool pix_inside 200.x.x.100-200.220.200.150
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.0 0.0.0.x.x.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host 200.200.200.20 letmein timeout 10
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set AAADES esp-3des esp-md5-hmac
    crypto dynamic-map DYNOMAP 10 match address 80
    crypto dynamic-map DYNOMAP 10 set transform-set AAADES
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map 30 ipsec-isakmp dynamic DYNOMAP
    crypto map outside_map client authentication RADIUS
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption 3des
    isakmp policy 30 hash sha
    isakmp policy 30 group 2
    isakmp policy 30 lifetime 86400
    vpngroup Remote address-pool pix_inside
    vpngroup Remote dns-server 200.200.200.20
    vpngroup Remote wins-server 200.200.200.20
    vpngroup Remote default-domain mycorp.co.uk
    vpngroup Remote idle-time 1800
    vpngroup Remote password password
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    I will attach debug output later today.
    Thanks

  • 501 site-to-site vpn tunnel timeout

    What is the maximum session timeout that you can configure on a site-to-site vpn tunnel using 2 pix 501s. 24 hours??
    Thanks for any help, also, if you have documentation (I have looked but with no luck) could you post a link please....
    Thanks,

    There's no timeout setting as such. You can setup ISAKMP and IPSEC lifetimes though.
    For Phase 1, default is 24 Hrs and "0" means infinte.
    isakmp policy 1 lifetime 0
    For phase 2 , default is 28800 seconds.
    crypto map mymap 10 set security-association lifetime seconds 28800
    HEre's the doc :
    http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1027585
    http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/c.htm#wp1034654
    *Please rate if helped.
    -Kanishka

  • Unit test fails after upgrading to Kodo 4.0.0 from 4.0.0-EA4

    I have a group of 6 unit tests failing after upgrading to the new Kodo
    4.0.0 (with BEA) from Kodo-4.0.0-EA4 (with Solarmetric). I'm getting
    exceptions like the one at the bottom of this email. It seems to be an
    interaction with the PostgreSQL driver, though I can't be sure. I
    haven't changed my JDO configuration or the related classes in months
    since I've been focusing on using the objects that have already been
    defined. The .jdo, .jdoquery, and .java code are below the exception,
    just in case there's something wrong in there. Does anyone have advice
    as to how I might debug this?
    Thanks,
    Mark
    Testsuite: edu.ucsc.whisper.test.integration.UserManagerQueryIntegrationTest
    Tests run: 15, Failures: 0, Errors: 6, Time elapsed: 23.308 sec
    Testcase:
    testGetAllUsersWithFirstName(edu.ucsc.whisper.test.integration.UserManagerQueryIntegrationTest):
    Caused an ERROR
    The column index is out of range: 2, number of columns: 1.
    <2|false|4.0.0> kodo.jdo.DataStoreException: The column index is out of
    range: 2, number of columns: 1.
    at
    kodo.jdbc.sql.DBDictionary.newStoreException(DBDictionary.java:4092)
    at kodo.jdbc.sql.SQLExceptions.getStore(SQLExceptions.java:82)
    at kodo.jdbc.sql.SQLExceptions.getStore(SQLExceptions.java:66)
    at kodo.jdbc.sql.SQLExceptions.getStore(SQLExceptions.java:46)
    at
    kodo.jdbc.kernel.SelectResultObjectProvider.handleCheckedException(SelectResultObjectProvider.java:176)
    at
    kodo.kernel.QueryImpl$PackingResultObjectProvider.handleCheckedException(QueryImpl.java:2460)
    at
    com.solarmetric.rop.EagerResultList.<init>(EagerResultList.java:32)
    at kodo.kernel.QueryImpl.toResult(QueryImpl.java:1445)
    at kodo.kernel.QueryImpl.execute(QueryImpl.java:1136)
    at kodo.kernel.QueryImpl.execute(QueryImpl.java:901)
    at kodo.kernel.QueryImpl.execute(QueryImpl.java:865)
    at kodo.kernel.DelegatingQuery.execute(DelegatingQuery.java:787)
    at kodo.jdo.QueryImpl.executeWithArray(QueryImpl.java:210)
    at kodo.jdo.QueryImpl.execute(QueryImpl.java:137)
    at
    edu.ucsc.whisper.core.dao.JdoUserDao.findAllUsersWithFirstName(JdoUserDao.java:232)
    at
    edu.ucsc.whisper.core.manager.DefaultUserManager.getAllUsersWithFirstName(DefaultUserManager.java:252)
    NestedThrowablesStackTrace:
    org.postgresql.util.PSQLException: The column index is out of range: 2,
    number of columns: 1.
    at
    org.postgresql.core.v3.SimpleParameterList.bind(SimpleParameterList.java:57)
    at
    org.postgresql.core.v3.SimpleParameterList.setLiteralParameter(SimpleParameterList.java:101)
    at
    org.postgresql.jdbc2.AbstractJdbc2Statement.bindLiteral(AbstractJdbc2Statement.java:2085)
    at
    org.postgresql.jdbc2.AbstractJdbc2Statement.setInt(AbstractJdbc2Statement.java:1133)
    at
    com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
    at
    com.solarmetric.jdbc.PoolConnection$PoolPreparedStatement.setInt(PoolConnection.java:440)
    at
    com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
    at
    com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
    at
    com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
    at
    com.solarmetric.jdbc.LoggingConnectionDecorator$LoggingConnection$LoggingPreparedStatement.setInt(LoggingConnectionDecorator.java:1
    257)
    at
    com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
    at
    com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
    at kodo.jdbc.sql.DBDictionary.setInt(DBDictionary.java:980)
    at kodo.jdbc.sql.DBDictionary.setUnknown(DBDictionary.java:1299)
    at kodo.jdbc.sql.SQLBuffer.setParameters(SQLBuffer.java:638)
    at kodo.jdbc.sql.SQLBuffer.prepareStatement(SQLBuffer.java:539)
    at kodo.jdbc.sql.SQLBuffer.prepareStatement(SQLBuffer.java:512)
    at kodo.jdbc.sql.SelectImpl.execute(SelectImpl.java:332)
    at kodo.jdbc.sql.SelectImpl.execute(SelectImpl.java:301)
    at kodo.jdbc.sql.Union$UnionSelect.execute(Union.java:642)
    at kodo.jdbc.sql.Union.execute(Union.java:326)
    at kodo.jdbc.sql.Union.execute(Union.java:313)
    at
    kodo.jdbc.kernel.SelectResultObjectProvider.open(SelectResultObjectProvider.java:98)
    at
    kodo.kernel.QueryImpl$PackingResultObjectProvider.open(QueryImpl.java:2405)
    at
    com.solarmetric.rop.EagerResultList.<init>(EagerResultList.java:22)
    at kodo.kernel.QueryImpl.toResult(QueryImpl.java:1445)
    at kodo.kernel.QueryImpl.execute(QueryImpl.java:1136)
    at kodo.kernel.QueryImpl.execute(QueryImpl.java:901)
    at kodo.kernel.QueryImpl.execute(QueryImpl.java:865)
    at kodo.kernel.DelegatingQuery.execute(DelegatingQuery.java:787)
    at kodo.jdo.QueryImpl.executeWithArray(QueryImpl.java:210)
    at kodo.jdo.QueryImpl.execute(QueryImpl.java:137)
    at
    edu.ucsc.whisper.core.dao.JdoUserDao.findAllUsersWithFirstName(JdoUserDao.java:232)
    --- DefaultUser.java -------------------------------------------------
    public class DefaultUser
    implements User
    /** The account username. */
    private String username;
    /** The account password. */
    private String password;
    /** A flag indicating whether or not the account is enabled. */
    private boolean enabled;
    /** The authorities granted to this account. */
    private Set<Authority> authorities;
    /** Information about the user, including their name and text that
    describes them. */
    private UserInfo userInfo;
    /** The set of organizations where this user works. */
    private Set<Organization> organizations;
    --- DefaultUser.jdo --------------------------------------------------
    <?xml version="1.0"?>
    <!DOCTYPE jdo PUBLIC
    "-//Sun Microsystems, Inc.//DTD Java Data Objects Metadata 2.0//EN"
    "http://java.sun.com/dtd/jdo_2_0.dtd">
    <jdo>
    <package name="edu.ucsc.whisper.core">
    <sequence name="user_id_seq"
    factory-class="native(Sequence=user_id_seq)"/>
    <class name="DefaultUser" detachable="true"
    table="whisper_user" identity-type="datastore">
    <datastore-identity sequence="user_id_seq" column="userId"/>
    <field name="username">
    <column name="username" length="80" jdbc-type="VARCHAR" />
    </field>
    <field name="password">
    <column name="password" length="40" jdbc-type="CHAR" />
    </field>
    <field name="enabled">
    <column name="enabled" />
    </field>
    <field name="userInfo" persistence-modifier="persistent"
    default-fetch-group="true" dependent="true">
    <extension vendor-name="jpox"
    key="implementation-classes"
    value="edu.ucsc.whisper.core.DefaultUserInfo" />
    <extension vendor-name="kodo"
    key="type"
    value="edu.ucsc.whisper.core.DefaultUserInfo" />
    </field>
    <field name="authorities" persistence-modifier="persistent"
    table="user_authorities"
    default-fetch-group="true">
    <collection
    element-type="edu.ucsc.whisper.core.DefaultAuthority" />
    <join column="userId" delete-action="cascade"/>
    <element column="authorityId" delete-action="cascade"/>
    </field>
    <field name="organizations" persistence-modifier="persistent"
    table="user_organizations" mapped-by="user"
    default-fetch-group="true" dependent="true">
    <collection
    element-type="edu.ucsc.whisper.core.DefaultOrganization"
    dependent-element="true"/>
    <join column="userId"/>
    <!--<element column="organizationId"/>-->
    </field>
    </class>
    </package>
    </jdo>
    --- DefaultUser.jdoquery ---------------------------------------------
    <?xml version="1.0"?>
    <!DOCTYPE jdo PUBLIC
    "-//Sun Microsystems, Inc.//DTD Java Data Objects Metadata 2.0//EN"
    "http://java.sun.com/dtd/jdo_2_0.dtd">
    <jdo>
    <package name="edu.ucsc.whisper.core">
    <class name="DefaultUser">
    <query name="UserByUsername"
    language="javax.jdo.query.JDOQL"><![CDATA[
    SELECT UNIQUE FROM edu.ucsc.whisper.core.DefaultUser
    WHERE username==searchName
    PARAMETERS java.lang.String searchName
    ]]></query>
    <query name="DisabledUsers"
    language="javax.jdo.query.JDOQL"><![CDATA[
    SELECT FROM edu.ucsc.whisper.core.DefaultUser WHERE
    enabled==false
    ]]></query>
    <query name="EnabledUsers"
    language="javax.jdo.query.JDOQL"><![CDATA[
    SELECT FROM edu.ucsc.whisper.core.DefaultUser WHERE
    enabled==true
    ]]></query>
    <query name="CountUsers"
    language="javax.jdo.query.JDOQL"><![CDATA[
    SELECT count( this ) FROM edu.ucsc.whisper.core.DefaultUser
    ]]></query>
    </class>
    </package>
    </jdo>

    I'm sorry, I have no idea. I suggest sending a test case that
    reproduces the problem to support.

  • Anybody know why superdrives fail after upgrading os

    anybody know why superdrives fail after upgrading os

    Upgrading the OS often also triggers issues with PRAM.  If the PRAM battery is over 4 years old, then the Superdrive can fail.    If it is under 4 years old, zapping it can fix some issues like these.

  • Cisco ASA 5505 Site to Site VPN tunnel up, but not passing traffic

    Thanks to a previous thread, I do have a 5505 up and running, and passing data....
    https://supportforums.cisco.com/message/3900751
    Now I am trying to get a IPSEC VPN tunnel working.
    I actually have it up (IKE phase 1 & 2 both passed), but it is not sending/receiving data through the tunnel.
    The networks concerned:
    name 10.0.0.0  Eventual  (HQ Site behind Firewall)
    name 1.1.1.0  CFS  (Public Network Gateway for Palo Alto Firewall - Firewall IP: 1.1.1.1)
    name 2.2.2.0  T1  (Remote site - Outside interface of 5505: 2.2.2.2)
    name 10.209.0.0  Local  (Remote Network - internal interface of 5505: 10.209.0.3)
    On a ping to the HQ network from behind the ASA, I get....
    portmap translation creation failed for icmp src inside:10.209.0.9 dst inside:10.0.0.33 (type 8, code 0)
    I am suspecting that there is a NAT error and/or a lack of a static route for the rest of the 10.0.0.0 traffic, and that I may have to exempt/route the traffic for the HQ network (10.0.0.0), but I haven't been able to get the correct entries to make it work.
    Below is the config.
    Can anyone see if there is something sticking out?
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 2.2.2.0 T1
    name 1.1.1.0 CFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object CFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 67.139.113.217 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:701d8da28ee256692a1e49d904e9cb04
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location CFS 255.255.255.240 inside
    asdm history enable
    Thank You.

    I'm just re-engaging on the firewall this afternoon, but right now I'm getting request timed out on the pings....
    Here's the output requested:
    Result of the command: "show crypto isakmp sa"
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 1.1.1.1
    Type : L2L Role : initiator
    Rekey : no State : AM_ACTIVE
    Result of the command: "show crypto ipsec sa"
    interface: outside
    Crypto map tag: outside_map, seq num: 1, local addr: 2.2.2.2
    access-list outside_1_cryptomap extended permit ip 10.209.0.0 255.255.255.0 10.0.0.0 255.0.0.0
    local ident (addr/mask/prot/port): (Local/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (Eventual/255.0.0.0/0/0)
    current_peer: 1.1.1.1
    #pkts encaps: 84, #pkts encrypt: 84, #pkts digest: 84
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 84, #pkts comp failed: 0, #pkts decomp failed: 0
    #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
    #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
    #send errors: 0, #recv errors: 0
    local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
    path mtu 1500, ipsec overhead 58, media mtu 1500
    current outbound spi: 8FC06BD1
    current inbound spi : 42EC16F4
    inbound esp sas:
    spi: 0x42EC16F4 (1122768628)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62207/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    outbound esp sas:
    spi: 0x8FC06BD1 (2411752401)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62201/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    Here's the current config:
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 67.139.113.216 T1
    name 1.1.1.0 IntegraCFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object IntegraCFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list No_NAT extended permit ip Local 255.255.255.0 Eventual 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list No_NAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 2.2.2.0 1
    route outside Eventual 255.255.255.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set security-association lifetime kilobytes 65535
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:301e573544ce0f89b3c597bdfe2c414a
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location IntegraCFS 255.255.255.240 inside
    asdm history enable

  • ASA 5505 site-to-site VPN tunnel and client VPN sessions

    Hello all
    I have several years of general networking experience, but I have not yet had to set up an ASA from the ground up, so please bear with me.
    I have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z).  His satellite office will have a single PC sitting behind the ASA.  In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.
    The first question I have is about the ASA 5505 and the various licensing options.  I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A.  Would someone please confirm or deny that for me?
    Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)
    Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules?  Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?
    I don't yet have the equipment in-hand, so I can't provide any sample configs for you to look over, but I will certainly do so once I've got it.
    Thanks in advance for any assistance provided!

    First question:
    Yes, 5505 will be able to establish site-to-site tunnel, and he can use IPSec vpn client, and SSL VPN (it comes with 2 default SSL VPN license).
    Second question:
    Yes, you are right. No special routing is required. All you need to configure is site-to-site VPN between Site A and Site Z LAN, and the internet traffic will be routed via Site A internet. Assuming you have all the NAT statement configured for that.
    Last question:
    This needs to be configured, it wouldn't automatically allow access to Site Z when he VPNs in to Site A.
    Here is what needs to be configured:
    1) Split tunnel ACL for VPN Client should include both Site Z and Site A LAN subnets.
    2) On site A configures: same-security-traffic permit intra-interface
    3) Crypto ACL for the site-to-site tunnel between Site Z and Site A needs to include the VPN Client pool subnet as follows:
    On Site Z:
    access-list permit ip
    On Site A:
    access-list permit ip
    4) NAT exemption on site Z needs to include vpn client pool subnet as well.
    Hope that helps.
    Message was edited by: Jennifer Halim

  • Vpn fails after upgrade to 10.8.5

    After upgrading from SL to Mountain Lion the Apple vpn client connections fail. They were connecting fine before the upgrade. They also work fine from other computers (Windows) on my network to the same addresses, so the remote side is functioning, and there have been no changes on the remote side.
    The error message is "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator." The Console messages indicate the server does in fact respond, but there is a problem with Phase 1 IKE. Message lines are pasted here with the IP addresses masked (the addresses are correct though).
    10/12/13 5:33:39.340 PM configd[18]: SCNC: start, triggered by SystemUIServer, type L2TP, status 0
    10/12/13 5:33:39.360 PM pppd[2104]: pppd 2.4.2 (Apple version 596.15.2) started by admin, uid 503
    10/12/13 5:33:39.363 PM pppd[2104]: L2TP connecting to server '999.999.999.999' (999.999.999.999)...
    10/12/13 5:33:39.363 PM pppd[2104]: IPSec connection started
    10/12/13 5:33:39.379 PM racoon[2105]: Connecting.
    10/12/13 5:33:39.380 PM racoon[2105]: IPSec Phase1 started (Initiated by me).
    10/12/13 5:33:39.380 PM racoon[2105]: IKE Packet: transmit success. (Initiator, Main-Mode message 1).
    10/12/13 5:33:39.465 PM racoon[2105]: IKE Packet: receive success. (Initiator, Main-Mode message 2).
    10/12/13 5:33:39.469 PM racoon[2105]: IKE Packet: transmit success. (Initiator, Main-Mode message 3).
    10/12/13 5:33:39.583 PM racoon[2105]: IKE Packet: receive success. (Initiator, Main-Mode message 4).
    10/12/13 5:33:39.588 PM racoon[2105]: IKE Packet: transmit success. (Initiator, Main-Mode message 5).
    10/12/13 5:33:42.671 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
    10/12/13 5:33:45.754 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
    10/12/13 5:33:45.760 PM racoon[2105]: Received retransmitted packet from 999.999.999.999[500].
    10/12/13 5:33:48.839 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
    10/12/13 5:33:57.752 PM racoon[2105]: Received retransmitted packet from 999.999.999.999[500].
    10/12/13 5:34:00.832 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
    10/12/13 5:34:09.465 PM pppd[2104]: IPSec connection failed
    10/12/13 5:34:09.466 PM racoon[2105]: IPSec disconnecting from server 999.999.999.999
    About the configuration -- the apple client is using preshared key with ppp user/password auth. The user/password and psk all work in other clients, have re-entered them many times, have deleted then recreated the connection in Network Preferences. Have restarted the racoon service, and even rebooted several times.
    Googled around and found a number of reports of similar problem after upgrade to Lion or Mountain Lion, haven't found anything that works so far. Have disabled my antivirus, have rebooted network router, have changed access control in Keychain Access to allow access from all applications. Can't change the remote side configuration because of other users, need to find a way to solve this on my client side. I do have backups that would allow me to roll back to Snow Leopard, but does anyone have any other solution, would like to have a better alternative. Appreciate any/all suggestions, thanks.

    Thanks again, good point. I wasn't doing this on first few tries but eventually realized I needed to clean up Keychain Access because of all the duplicates I created (orphans) so yes I did delete connection and corresponding keychains then recreate then change access. Along the way I noticed that every time I later applied a change to an existing connection setting I had to return to Keychain Access and change the access control settings again, they revert back to 'confirm' from 'all access' at each change. So even if it worked for me I realize it isn't a permanent fix.
    And iCloud is 'inactive', so I guess Back to My Mac is disabled too, I don't know that app but assume so since it needs iCloud. Is there a better way to be sure it can't interfere? I do think I'm getting some phase 1 traffic out and back to the remote server evidenced by the console log, so seems the ports are not being blocked.

  • IPsec VPN not working after upgrade to 8.4.7

    Hi
    Here is some small digram of my firewalls
    LAN ---- FW(A) ----- S2S Tunnel ------- FW (B)------------------ LAN
                      |                                                                  |
                       --------- Cisco VPN need to be run -------------
    I used to run that VPN for more than three years with no issue, but after upgrading FW (A) from 8.2.5 to 8.4.7 I got below error msg
    Group = XXXX, Username = XXXX, IP = x..x.x.x, Skipping dynamic map SYSTEM_DEFAULT_CRYPTO_MAP sequence 65535: cannot match peerless map when peer found in previous map entry.
    Please does any body have any clue about it and I solve that?
    Mike

    Hello Mike,
    Basically, in older versions, when you hit a static crypto map and you did not match that static crypto map completely the connection continues until the dynamic crypto map. For that reason you could connect your IPSec clients before. A bug was opened about this vulnerability.
    CSCuc75090  Bug Details
    Crypto IPSec SA's are created by dynamic crypto map for static peers
    Symptom:
    When a static VPN peer adds any traffic to the crypto ACL, an SA is built even though the IP pair is not allowed in the crypto acl at the main side. Those SA's are eventually matched and  setup by the dynamic crypto map instance.
    Conditions:
    This was a intended design since day one that enabled customers to fall through in case of static crypto map didn't provide a needed crypto services.
    The SA need to be initiated from a statically configured peer and a dynamic crypto map instance must be configured on the receiving end.
    Workaround:
    N/A
    Meaning, if you are on the local network and would like to reach any host on the remote site you could use the L2L tunnel that is already established with the remote peer. However, if you are on any other external network you will need to use the VPN client to connect to the sites.
    I hope this helps.
    Luis.

  • ASA5510 VPN not working after upgrade from 8.2 to 8.3

    Hi,
    I have recently upgraded a customer ASA5510 to version 8.3.
    After upgrade web access etc is working fine however VPN is down.
    The config looks very different after the upgrade plus what looks to be duplicate entries.
    I suspect its an access list issue but I'm not sure.
    If anyone has any ideas based on the config below it would be greatly appreciated as I'm at a loss....?!
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password NvZgxFP5WhDo0hQl encrypted
    passwd FNeDAwBbhVaOtVAu encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 217.75.8.203 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    management-only
    boot system disk0:/asa832-k8.bin
    ftp mode passive
    clock timezone GMT/IST 0
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup Inside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network obj-192.168.1.2-04
    host 192.168.1.2
    object network obj-192.168.1.7-04
    host 192.168.1.7
    object network obj-192.168.1.0-02
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.0-02
    subnet 192.168.2.0 255.255.255.0
    object network obj-10.1.2.0-02
    subnet 10.1.2.0 255.255.255.0
    object network obj-192.168.1.224-02
    subnet 192.168.1.224 255.255.255.240
    object network obj-192.168.1.9-02
    host 192.168.1.9
    object network obj-192.168.1.2-05
    host 192.168.1.2
    object network obj-192.168.1.103-02
    host 192.168.1.103
    object network obj-192.168.1.7-05
    host 192.168.1.7
    object network NETWORK_OBJ_10.1.2.0_24
    subnet 10.1.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group network obj-192.168.1.2-02
    object-group network obj-192.168.1.7-02
    object-group network obj-192.168.1.0-01
    object-group network obj-192.168.2.0-01
    object-group network obj-10.1.2.0-01
    object-group network obj-192.168.1.224-01
    object-group network obj-192.168.1.9-01
    object-group network obj-192.168.1.2-03
    object-group network obj-192.168.1.103-01
    object-group network obj-192.168.1.7-03
    object-group network obj-192.168.1.2
    object-group network obj-192.168.1.7
    object-group network obj-192.168.1.0
    object-group network obj-192.168.2.0
    object-group network obj-10.1.2.0
    object-group network obj-192.168.1.224
    object-group network obj-192.168.1.9
    object-group network obj-192.168.1.2-01
    object-group network obj-192.168.1.103
    object-group network obj-192.168.1.7-01
    object-group network obj_any
    object-group network obj-0.0.0.0
    object-group network obj_any-01
    object-group service MonitcomUDP udp
    port-object range 3924 3924
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip any 192.168.1.224 255.255.255.240
    access-list Outside_cryptomap_60 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_cryptomap_60 extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq smtp
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq pop3
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq 2000 inactive
    access-list Outside_access_in extended permit icmp any any
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in extended permit tcp any host 217.75.8.204 eq 1200
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in extended permit tcp host 87.232.117.66 host 217.75.8.205 eq 5900
    access-list Outside_access_in extended permit udp any host 217.75.8.205 eq 3924
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 220
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 230
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 240
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 250
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 260
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 1433
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in extended permit tcp any host 217.75.8.206 eq www
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq https
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq www
    access-list Outside_access_in extended permit udp any any eq 4500 inactive
    access-list Outside_access_in extended permit udp any any eq isakmp inactive
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Inside_access_in extended permit ip any any
    access-list Inside_access_in extended permit icmp any any
    access-list RemoteVPN_splitTunnelAcl standard permit any
    access-list Outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Outside_cryptomap_dyn_20 extended permit ip any 192.168.1.224 255.255.255.240
    pager lines 24
    logging enable
    logging asdm warnings
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool VPNPool 192.168.1.230-192.168.1.240 mask 255.255.255.0
    ip verify reverse-path interface Outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    icmp permit any Inside
    asdm location 192.168.1.208 255.255.255.252 Inside
    asdm location 192.168.1.103 255.255.255.255 Inside
    asdm location 192.168.1.6 255.255.255.255 Inside
    asdm location 192.168.1.7 255.255.255.255 Inside
    asdm location 192.168.1.9 255.255.255.255 Inside
    no asdm history enable
    arp timeout 14400
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-192.168.2.0-02 obj-192.168.2.0-02 unidirectional
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-10.1.2.0-02 obj-10.1.2.0-02 unidirectional
    nat (Inside,any) source static any any destination static obj-192.168.1.224-02 obj-192.168.1.224-02 unidirectional
    nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.1.2.0_24 NETWORK_OBJ_10.1.2.0_24
    object network obj-192.168.1.2-04
    nat (Outside,Inside) static 217.75.8.204
    object network obj-192.168.1.7-04
    nat (Outside,Inside) static 217.75.8.206
    object network obj-192.168.1.0-02
    nat (Inside,Outside) dynamic interface
    object network obj-192.168.1.9-02
    nat (Inside,Outside) static 217.75.8.201
    object network obj-192.168.1.2-05
    nat (Inside,Outside) static 217.75.8.204
    object network obj-192.168.1.103-02
    nat (Inside,Outside) static 217.75.8.205
    object network obj-192.168.1.7-05
    nat (Inside,Outside) static 217.75.8.206
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    route Outside 0.0.0.0 0.0.0.0 217.75.8.198 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server DellServerAAA protocol radius
    aaa-server DellServerAAA (Inside) host 192.168.1.4
    key test
    http server enable
    http 62.17.29.2 255.255.255.255 Outside
    http 82.141.224.155 255.255.255.255 Outside
    http 63.218.54.8 255.255.255.252 Outside
    http 213.79.44.213 255.255.255.255 Outside
    http 192.168.1.0 255.255.255.0 Inside
    http 10.1.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec df-bit clear-df Outside
    crypto ipsec df-bit clear-df Inside
    crypto dynamic-map Outside_dyn_map 20 match address Outside_cryptomap_dyn_20
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set peer 89.127.172.29
    crypto map Outside_map 1 set transform-set ESP-3DES-SHA
    crypto map Outside_map 60 match address Outside_cryptomap_60
    crypto map Outside_map 60 set peer 89.105.114.98
    crypto map Outside_map 60 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface Outside
    crypto isakmp identity key-id nattingreallymatters
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet 192.168.1.0 255.255.255.0 Inside
    telnet timeout 5
    ssh 82.141.224.155 255.255.255.255 Outside
    ssh 62.17.29.2 255.255.255.255 Outside
    ssh 213.79.44.213 255.255.255.255 Outside
    ssh 192.168.1.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy RemoteVPN internal
    group-policy RemoteVPN attributes
    wins-server value 192.168.1.31
    dns-server value 192.168.1.31
    default-domain value freefoam.ie
    username freefoam password JLYaVf7FqRM2LH0e encrypted
    username cork password qbK2Hqt1H5ttJzPD encrypted
    tunnel-group 193.114.70.130 type ipsec-l2l
    tunnel-group 193.114.70.130 ipsec-attributes
    pre-shared-key ******
    tunnel-group 89.127.172.29 type ipsec-l2l
    tunnel-group 89.127.172.29 ipsec-attributes
    pre-shared-key ******
    tunnel-group 89.105.114.98 type ipsec-l2l
    tunnel-group 89.105.114.98 ipsec-attributes
    pre-shared-key *****
    tunnel-group RemoteVPN type remote-access
    tunnel-group RemoteVPN general-attributes
    address-pool VPNPool
    authentication-server-group DellServerAAA
    default-group-policy RemoteVPN
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:0dc16fe893bd4bba6fdf6b7eed93e553

    Hi,
    Many thanks for your reply.
    Finally got access to implement your suggestions.
    Initially none of the VPN's were up.
    After making the change the two VPN's came up.
    However only data via the first VPN is possible.
    Accessing resources on the 10.1.2.0 network is still not possible.
    Attached is the latest config, any input is greatly appreciated;
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password NvZgxFP5WhDo0hQl encrypted
    passwd FNeDAwBbhVaOtVAu encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 217.75.8.203 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    management-only
    boot system disk0:/asa832-k8.bin
    ftp mode passive
    clock timezone GMT/IST 0
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup Inside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network obj-192.168.1.2-04
    host 192.168.1.2
    object network obj-192.168.1.7-04
    host 192.168.1.7
    object network obj-192.168.1.0-02
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.0-02
    subnet 192.168.2.0 255.255.255.0
    object network obj-10.1.2.0-02
    subnet 10.1.2.0 255.255.255.0
    object network obj-192.168.1.224-02
    subnet 192.168.1.224 255.255.255.240
    object network obj-192.168.1.9-02
    host 192.168.1.9
    object network obj-192.168.1.2-05
    host 192.168.1.2
    object network obj-192.168.1.103-02
    host 192.168.1.103
    object network obj-192.168.1.7-05
    host 192.168.1.7
    object network NETWORK_OBJ_10.1.2.0_24
    subnet 10.1.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group network obj-192.168.1.2-02
    object-group network obj-192.168.1.7-02
    object-group network obj-192.168.1.0-01
    object-group network obj-192.168.2.0-01
    object-group network obj-10.1.2.0-01
    object-group network obj-192.168.1.224-01
    object-group network obj-192.168.1.9-01
    object-group network obj-192.168.1.2-03
    object-group network obj-192.168.1.103-01
    object-group network obj-192.168.1.7-03
    object-group network obj-192.168.1.2
    object-group network obj-192.168.1.7
    object-group network obj-192.168.1.0
    object-group network obj-192.168.2.0
    object-group network obj-10.1.2.0
    object-group network obj-192.168.1.224
    object-group network obj-192.168.1.9
    object-group network obj-192.168.1.2-01
    object-group network obj-192.168.1.103
    object-group network obj-192.168.1.7-01
    object-group network obj_any
    object-group network obj-0.0.0.0
    object-group network obj_any-01
    object-group service MonitcomUDP udp
    port-object range 3924 3924
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip any 192.168.1.224 255.255.255.240
    access-list Outside_cryptomap_60 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_cryptomap_60 extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq smtp
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq pop3
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq 2000 inactive
    access-list Outside_access_in extended permit icmp any any
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in extended permit tcp any host 217.75.8.204 eq 1200
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in extended permit tcp host 87.232.117.66 host 217.75.8.205 eq 5900
    access-list Outside_access_in extended permit udp any host 217.75.8.205 eq 3924
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 220
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 230
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 240
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 250
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 260
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 1433
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in extended permit tcp any host 217.75.8.206 eq www
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq https
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq www
    access-list Outside_access_in extended permit udp any any eq 4500 inactive
    access-list Outside_access_in extended permit udp any any eq isakmp inactive
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Inside_access_in extended permit ip any any
    access-list Inside_access_in extended permit icmp any any
    access-list RemoteVPN_splitTunnelAcl standard permit any
    access-list Outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Outside_cryptomap_dyn_20 extended permit ip any 192.168.1.224 255.255.255.240
    access-list global_access extended permit ip any any
    access-list Outside_cryptomap_80_3 extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Split-tunnel standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm warnings
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool VPNPool 192.168.1.230-192.168.1.240 mask 255.255.255.0
    ip verify reverse-path interface Outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    icmp permit any Inside
    asdm image disk0:/asdm-647.bin
    asdm location 192.168.1.208 255.255.255.252 Inside
    asdm location 192.168.1.103 255.255.255.255 Inside
    asdm location 192.168.1.6 255.255.255.255 Inside
    asdm location 192.168.1.7 255.255.255.255 Inside
    asdm location 192.168.1.9 255.255.255.255 Inside
    no asdm history enable
    arp timeout 14400
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-192.168.2.0-02 obj-192.168.2.0-02
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-10.1.2.0-02 obj-10.1.2.0-02
    nat (Inside,any) source static any any destination static obj-192.168.1.224-02 obj-192.168.1.224-02 unidirectional
    nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.1.2.0_24 NETWORK_OBJ_10.1.2.0_24
    object network obj-192.168.1.2-04
    nat (Outside,Inside) static 217.75.8.204
    object network obj-192.168.1.7-04
    nat (Outside,Inside) static 217.75.8.206
    object network obj-192.168.1.0-02
    nat (Inside,Outside) dynamic interface
    object network obj-192.168.1.9-02
    nat (Inside,Outside) static 217.75.8.201
    object network obj-192.168.1.2-05
    nat (Inside,Outside) static 217.75.8.204
    object network obj-192.168.1.103-02
    nat (Inside,Outside) static 217.75.8.205
    object network obj-192.168.1.7-05
    nat (Inside,Outside) static 217.75.8.206
    nat (Inside,Outside) after-auto source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    access-group global_access global
    route Outside 0.0.0.0 0.0.0.0 217.75.8.198 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server DellServerAAA protocol radius
    aaa-server DellServerAAA (Inside) host 192.168.1.4
    key test
    http server enable
    http 62.17.29.2 255.255.255.255 Outside
    http 82.141.224.155 255.255.255.255 Outside
    http 63.218.54.8 255.255.255.252 Outside
    http 213.79.44.213 255.255.255.255 Outside
    http 192.168.1.0 255.255.255.0 Inside
    http 10.1.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec df-bit clear-df Outside
    crypto ipsec df-bit clear-df Inside
    crypto dynamic-map Outside_dyn_map 20 match address Outside_cryptomap_dyn_20
    crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set peer 89.127.172.29
    crypto map Outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-DES-SHA ESP-3DES-MD5 ESP-AES-256-MD5 ESP-3DES-SHA ESP-DES-MD5
    crypto map Outside_map 60 match address Outside_cryptomap_60
    crypto map Outside_map 60 set peer 89.105.114.98
    crypto map Outside_map 60 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface Outside
    crypto isakmp identity key-id nattingreallymatters
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash md5
    group 5
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet 192.168.1.0 255.255.255.0 Inside
    telnet timeout 5
    ssh 82.141.224.155 255.255.255.255 Outside
    ssh 62.17.29.2 255.255.255.255 Outside
    ssh 213.79.44.213 255.255.255.255 Outside
    ssh 192.168.1.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable Outside
    anyconnect-essentials
    svc image disk0:/anyconnect-dart-win-2.5.3055-k9.pkg 1
    svc image disk0:/anyconnect-macosx-powerpc-2.5.3055-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy RemoteVPN internal
    group-policy RemoteVPN attributes
    wins-server value 192.168.1.31
    dns-server value 192.168.1.31
    vpn-tunnel-protocol IPSec svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Split-tunnel
    default-domain value freefoam.ie
    username freefoam password JLYaVf7FqRM2LH0e encrypted
    username cisco password DfO7NBd5PZ1b0kZ1 encrypted privilege 15
    username cork password qbK2Hqt1H5ttJzPD encrypted
    tunnel-group 193.114.70.130 type ipsec-l2l
    tunnel-group 193.114.70.130 ipsec-attributes
    pre-shared-key ************
    tunnel-group 89.127.172.29 type ipsec-l2l
    tunnel-group 89.127.172.29 ipsec-attributes
    pre-shared-key ************
    tunnel-group 89.105.114.98 type ipsec-l2l
    tunnel-group 89.105.114.98 ipsec-attributes
    pre-shared-key ************
    tunnel-group RemoteVPN type remote-access
    tunnel-group RemoteVPN general-attributes
    address-pool VPNPool
    authentication-server-group DellServerAAA
    default-group-policy RemoteVPN
    tunnel-group RemoteVPN webvpn-attributes
    group-alias Anyconnect enable
    tunnel-group RemoteVPN ipsec-attributes
    pre-shared-key c0nnect10nParameter$
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:fae6b7bc25fcf39daffbcdc6b91c9d8e

  • Cisco IPSEC VPN not working after upgrade to Mavericks

    I have been using the Cisco IPSEC VPN for almost 2 years with no issues. When I upgraded to Mavericks this week it stopped working. When i tell it to connect it prompts for password and attempts to connect for about 30 seconds then comes back with the following message...
    VPN Connection
    The negotiation with the VPN server failed. Verify the server address and try reconnecting.
    The address, group, shared secret, user and password are correct. Any help would be greatly appreiated.

    Hry, I'm not sure if this fixes the Cisco IPSec issue, but I can vouch for it fixing the L2TP issue that occurs after tha mavericks upgrade!
    I’ve got L2TP VPN working in Mavericks 10.9 and Server App 3.0.0 / 3.0.1.
    It really is quite a simple fix.
    Obviously, the standard caveats apply: This is a temporary, unsupported, workaround, and only a suggested idea at that. Again, this workaround is NOT supported by Apple.
    Proceed with this workaround on your own equipment at your own risk. And remember the golden rule: Always backup your data!
    OK so here goes… copy and paste the following into termini ONE LINE AT A TIME!
    cd /tmp
    curl -sO http://c5mart.co/mavericks-vpn-fix/racoon.tar.gz
    tar -xzvf racoon.tar.gz
    rm racoon.tar.gz
    sudo chown root:wheel racoon
    sudo chmod 555 racoon
    if [ ! -f /usr/sbin/racoon.mavericks ]; then sudo mv /usr/sbin/racoon /usr/sbin/racoon.mavericks; fi;
    sudo mv racoon /usr/sbin/racoon
    sudo killall racoon
    This works fine for me and I'm running a OSX Server for my entire office.
    …et voilà!

Maybe you are looking for

  • Repeated source system in 0logsys infoobject.

    Hi friends, I'm facing small problem in my project.I want to extract data from three clients so that i have used 0logsys in my target.When i perfrom data extraction it's bring two logical systems i mean duplicate logical system e.g: actual logical sy

  • Why should i use Java in Web form

    I am making a web calculator. Its takes some inputs from the user and evaluates input to calculate the result. I dont want the user to see the interpretation of their result. I am new to java. Can anybody tell me if i can do that with ASP?

  • How to zoom the webpage in CS3

    Hey guys I have a standard website, but need to create another copy which enlarges this by 400%. I know that internet explorer has this facility, but I want my website to already have this, so that a visually impaired user can use this straight away.

  • Change of due date field in F-36 t.code

    Hi I posted Bills of exchange transaction thru F-36 t.code. Due on will be the future maturity date of Bill. While entering user made mistake. Now i want to change the date. I tried with Fb02 but it is grayed. Pls suggest me. Thanks Sneha

  • My Imovie'09 keeps crashing everytime i try to export my 2:30 movie.

    My Imovie'09 keeps crashing everytime i try to export my 2:30 movie. i've tried several different ways. it worked when i eported it to youtube in the smallest option but nothing else works.