SNMP reporting down through Site to Site tunnel

Hello all,
I have a question that you might answer.
We monitor a Site to Site tunnel via SNMP and we receive a down message every 2 hours and 22 minutes. It automatically reports up again in less than a minute. This is reported because of SNMP traffic, not an unanswered ping.
The message looks like this:
Event: Down
Name: XXX
Document: Network
Address: W.X.Y.Z
Probe Type: SNMP Traffic (port 161 SNMPv1)
Condition:
Time since last reported down: 2 hours, 22 minutes, 28 seconds Device's up time: 184 days, 20 hours, 5 minutes, 43 seconds
Do you know what could cause this behaviour?
Thanks in advance.
Best regards,
Igor

Any ideas? Could it be any kind of VPN Site to Site timeout?

Similar Messages

ISAKMP Phase 1 dying for Site to Site tunnel between ASA and Fortigate

      I am facing strange issue on my asa and client Fortigate fw.
We have site to site tunnel with 3des and sha and DH-5 on asa
3des sha1 and dh-5 on Fortigate.
Tunnel came up when configured after some time it went down and it is throwing below errors. Please
some one help me here.
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 8
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, constructing ISAKMP SA payload
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, constructing Fragmentation VID + extended capabilities payload
Jul 24 17:25:13 [IKEv1]: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
Jul 24 17:25:13 [IKEv1]: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 244
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, processing ke payload
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, processing ISA_KE payload
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, processing nonce payload
Jul 24 17:25:13 [IKEv1]: IP = X.X.X.X, Unable to compute DH pair while processing SA!<<<<---------Please suggest if DH group 5 does not work with PSK.
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, IKE MM Responder FSM error history (struct &0xcf9255d8) <state>, <event>: MM_DONE, EV_ERROR-->MM_BLD_MSG4, EV_GEN_DH_KEY-->MM_WAIT_MSG3, EV_PROCESS_MSG-->MM_WAIT_MSG3, EV_RCV_MSG-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_BLD_MSG2, EV_BLD_MSG2
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, IKE SA MM:5f1fdffc terminating: flags 0x01000002, refcnt 0, tuncnt 0
Jul 24 17:25:13 [IKEv1 DEBUG]: IP = X.X.X.X, sending delete/delete with reason message
Mum-PRI-ASA#

Hey All,
I experienced same issue with my another tunnel. Lately I came to know it was higher level of DH computation which my ASA was not able to perform and ASA reboot worked here. See the logs for tunnel which came up after reboot.
Eror Before Reload
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing ISAKMP SA payload
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing Fragmentation VID + extended capabilities payload
Aug 06 21:17:33 [IKEv1]: IP = xx.xx.xx.xx, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 416
Aug 06 21:17:33 [IKEv1]: IP = xx.xx.xx.xx, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, processing SA payload
Aug 06 21:17:33 [IKEv1]: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 5 Cfg'd: Group 2
Aug 06 21:17:33 [IKEv1]: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 5 Cfg'd: Group 2
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Oakley proposal is acceptable
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, processing VID payload
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Received Fragmentation VID
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, IKE Peer included IKE fragmentation capability flags: Main Mode:        True Aggressive Mode: True
Aug 06 21:17:33 [IKEv1]: IP = xx.xx.xx.xx, Unable to compute DH pair while processing SA!
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, IKE MM Initiator FSM error history (struct &0xd0778588) , : MM_DONE, EV_ERROR-->MM_BLD_MSG3, EV_GEN_DH_KEY-->MM_WAIT_MSG2, EV_PROCESS_MSG-->MM_WAIT_MSG2, EV_RCV_MSG-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_BLD_MSG1, EV_BLD_MSG1
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, IKE SA MM:64cf4b96 terminating: flags 0x01000022, refcnt 0, tuncnt 0
Aug 06 21:17:33 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, sending delete/delete with reason message
Isakmp phase completion After reload
Aug 25 10:40:35 [IKEv1]: IP = xx.xx.xx.xx, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, processing SA payload
Aug 25 10:40:35 [IKEv1]: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 5 Cfg'd: Group 2
Aug 25 10:40:35 [IKEv1]: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 5 Cfg'd: Group 2
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Oakley proposal is acceptable
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, processing VID payload
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Received Fragmentation VID
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, IKE Peer included IKE fragmentation capability flags: Main Mode:        True Aggressive Mode: True
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing ke payload
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing nonce payload
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing Cisco Unity VID payload
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing xauth V6 VID payload
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Send IOS VID
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, constructing VID payload
Aug 25 10:40:35 [IKEv1 DEBUG]: IP = xx.xx.xx.xx, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Aug 25 10:40:35 [IKEv1]: IP = xx.xx.xx.xx, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 320
SENDING PACKET to xx.xx.xx.xx

Failed to send a report to FTP site

hi There
i am tring to create a schedule to send my reports to the FTP site, i can access that FTP by DOS FTP with login ID/Pssword, however my job in the business objects failed, it said connection error "WSA0"
can some one please tell me how i can send a report to FTP site under business objects?
thanks

Hi Cleo,
Could you please try the following workflow.
1.Are you getting this error message when trying to schedule a single report or when bursting the reports in a bunch?
2. We need to check the seeting on the FTP server if this is an issue with the report bursting.
Tracing the Destination server or something would help[ You can put a trace by stopping the destination server and putting -trace in the command line of destination and the job server that are involved in it], but I can think of a test that may be faster to reproduce:
With such a test running, do repeated netstat -a from the command line on the server running the job. This should tell us if we're just adding more and more connections without closing them, for instance. The FTP server itself may also have a limit on the number of connections it allows in altogether, or from a single host. At the point that things start failing, from the same machine, make also an interactive FTP request from the command line. This should tell you whether you can still log in. If you cannot, you know that your FTP server is no longer accepting connections, and is perhaps waiting for things to time out. Also, since it is external, we may well be trying to upload 130 docs at the same time, with the first one still being written, when the next upload request comes in. Maybe the server just can't handle that many writing streams at the same time. There may be a bandwidth constraint as well, so maybe we're getting connection errors because we trying to logon yet again, when already we're sending MBs down the pipe in multiple streams.
I hope this helps.
Regards,
Sarbhjeet Kaur

Site to Site Tunnel - Traffic just flowing in one direction.

Greetings to everyone,
I have configured an IPSec (Site-to-Site) tunnel between an ASA5510 and a Linux Sytem connection a Network A with a Network B in the following way:
* Diagram:
#---------------IPSec-----------------#
private network (A) ---- Linux Router (GW1) -------- WAN -------- (GW2) ASA5510 ---- public network (B)
* Results:
I have checked the IPSec Tunnel on the linux Router and both Phase 1 and Phase 2 are UP. ASDM shows also an IPSec connection with the correct parameters (GW, Local Network, Left Network etc.).
If I have correctly understand it "show crypto iskmp sa", "show crypto ikev1 sa" and "show crypto ipsec sa" show also that the connection is correct and UP.
*Now comes the interesting thing:
If I ping from Network A to Network B, the icmp echo request go thorugh the tunnel and I can see the Rx bytes on the cisco ASA going UP.
If I ping from Network B to Network A, I do not see any Tx Bytes on the Tunnel. The Linux router does not also see any packets going through the tunnel.
When I ping from Network B to Network A, the Firewall Logs ICMP Denies. That means that the traffic from B to A, I do not know why, is not matching the corresponding Tunnel ACL, the icmp packets are being routed to the default gateway instead through the tunnel and they are then matching a less specific droping rule on the main firewall.
*Configurations:
I have specially configured a Crypto Map that matches the Networks in Both directions.
There exists an ACL that permits the traffic in both directions.
There exist a NAT rules that permits traffic between both networks without being NATed, in order for both networks to transmit through the tunnels freely.
* Ideas ?
crypto map?
NAT?
ACL?
interface level security?
Thanks in advance.

Hi Guys,
Thank you all for your help. The packet was being dropped on the "implicit rule", that means that the packet was not finding an ACL to match.
I checked the ACLs that the VPN Wizard generates by itself when used to configure an IPSec connection, and the ACLs where correct and "before" the implicit rule . (They are called by default outside_cryptomap_"number")
It seems that since I am not using "sysopt connection permit-vpn" I have to add the same ACLs to the "Local Network" interface (VPN_LAN).
Since there was inbound ACLs related to the VPN_LAN interface, the firewall jumped directly to the "implicit rule".
So the result is that I have two times the same rules first inbound on the VPN_LAN and second on the default outside_cryptomap ACLs.
Greetings,
Daniel

VoIP QoS for Site-to-Site Tunnel

Hi all,
I need some help with setting up QoS for VoIP between two Cisco ASA 5505 with Site-to-Site VPN.
There is no need for bandwith reservation, only DSCP 46 (EF) should be highest and DSCP 26 second highest queue and the rules should only apply to a site-to-site VPN.
Usually i try to configure the ASAs via ASDM and found out in the Cisco Documentations how to setup QoS for the DSCP bits with a Service Policy and how to set up QoS for a Site-to-Site VPN (Service Policy Rule -> Traffic Match). But how do i configure the QoS for a DSCP bit to only apply to a Site-to-Site Tunnel? And how do i configure different priorities for the two DSCP bits, is this defined by the order of Service Policies?
The QoS has to be enabled on both ASAs for the inside interface?
Thanks in advance
Tobias

Hi Collin,
ok so from the document i think this has to be added on both ASAs to prioritize DSCP 46. Could you have a quick look if this is all i need?
class-map voice_traffic
match dscp ef
class-map data
match tunnel-group <Tunnel Name>
match flow ip destination-address
policy-map voice_policy
class voice_traffic
priority
class Data
police output 200000 37500
service-policy voice_policy interface outside
But there is still the question how two configure another DSCP bit for priority 2, I could not find out how this is done, neither CLI nor ASDM. Any ideas?
BR
Tobias

Can i make a button change anchor link when you scroll down the site?

I am trying to make a scroll site.. and i have navigation buttons on the right, a full menu, but also a "1 topic up" button and "1 topic down" button.
Is there any way that i can have those buttons change anchor link when you scroll down the site.
Example:
I am at home, then i press "1 topic down" and gets scrolled to the next topic on the website, but then i cant make the button change to link to the anchor below that, so the button becomes useless after that 1 press.
Is that in any way possible in Muse to make it change link?

Hi
You can try to create different buttons on page positions where down scrolling will be active with separate button actions. For example you click on "I topic down" , page scrolls and there is another button placed with "Next Topic down" , on click this would scroll the page more and similarly along the length of page.
Button with anchor link scrolling down the page cannot be used for different anchor links, creating different buttons with anchors is the solution.
Thanks,
Sanjit

Mutiple contributor contribute through Site Studio

Hi,
Just a quick question here, can multiple user/contributor make a check in through Site Studio at one time?
I use the Site Studio for check in doc from Oracle Portal into UCM. As everyone knows, when do a contribution from Site Studio, only one user can do that at a time. Can we change that so multiple user can do check in at the same time?
Thanks in advance.

First of all, user don't wan to use the native UCM interface,Any detail why?
so I need to find a way for them to be able to do a check in from Oracle PortalActually, as far as I know Oracle Portal has its content store (by default, sadly, not UCM). Personally, I don't know much about it, but when I take the example of WebCenter (once PS3 is finally out), it takes:
- hit a portal button triggering the "Add New Content" activity
- if necessary, provide metadata, or just the content file
- get the file uploaded (at the background, it is stored in UCM by calling a service - most likely)
- alternatively, the ADF component might be capable of drag-and-drop to skip the first two steps
Sorry to repeat myself, but I don't get why you need a SS Site (or even the native UCM) to do this? Isn't the portal sufficient? If you cannot use CPS (yes, I meant this one) you should be able to write a simple Java app (probably interfacing UCM via RIDC or web services) that will do a similar work like UCM check-in form, will look like your users want and will be hosted by your portal. In fact, I'd be surprised if something like that does not exist somewhere in the world (ask at this forum: Oracle Application Server Portal
If you insist to use Site Studio, you solution can look similar to what is described above - create a form-like page whose 'post' button will call a check-in service. If you have a chance to take a look at the Oracle standard Ravenna demo, there is a very similar scenario - Contact Us form, which contains several fields that are transformed to a XML file, checked-in and sent to a workflow for review.

Calling Pulse Generator Matlab model dll in Labview through SIT

Hi ,
I have a Matlab model dll which generates PWM output. I Would like to integrate this "dll" through SIT connection Manager and generate the Physical signal.
But while configuring the Tools->SIT Connection manager->Hardware I/O->Configure NI-DAQ i am getting only Analog input & Analog outputs, but i need Timer/Counter channels.
Could any one tell what i should do for generating the PWM output with the help of matlab model?
Thanks
naveen

Hi Naveen,
I apologize that I did not post sooner. I have determined that this is not directly possible. I am actually currently looking for a workaround. This workaround should be possible but may not be all that straightforward to implement. I will post back as soon as I find something.
Best regards,
Steven

Web analytic report for sub site

Hi Team,
how enable web analytic report for sub sites
site collection level working fine but sub site level not working please help on this
while checking web analyitics reports i got below error.

Hi Venkigani,
As I understand, the site web analytics reports cannot work in SharePoint 2010.
1. You could check the details about the error in the ULS log.
2. Install the hotfix that is dated June 29, 2010 to check if it can work.
The article below is about the hotfix.
http://support.microsoft.com/?id=2204024
Best regards,
Sara Fan
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Site to Site tunnel: ESP request discarded

Hello. I've got a site to site tunnel configured in an ASA-5540 (8.3) and at first working fine. After several hours, the tunnel is disconnected and I this log appear without stopping:
%ASA-7-710006: ESP request discarded from "tunnel IP peer" to outside_int:"my tunnel IP"
I can't figure out why the tunnel stop working and the meaning of this message. The explanation in Cisco documents does't fix to me.
Thanks.

Hi,
At HQ ASA atleast the NAT0 configuration is wrong
You have configured this
nat (inside) 5 access-list inside_nat0_outbound
This isnt NAT0 however. It would be configured with ID 5 if you had a corresponding "global" commands using ID 5 also. It would be a Dynamic Policy NAT/PAT.
The NAT0 configurations should use the ID 0
If an existing NAT0 "nat" statement/configuration already exists then you would use the existing ACL to define the traffic that doesnt need NAT
So your configuration should probably be this
nat (inside) 0 access-list inside_nat0_outbound
I can't see a different in the actual L2L VPN configurations though there are some configurations that are not visible that might affect connectivity BUT the above mentioned NAT0 configurations is clearly a problem.
Hope this helps
Please remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni

Usage Reports in all Site collections

Hi all,
We are using Sharepoint 2013 Server and we want to use Usage reports, but my question is, is it possible to obtain the usage reports of all site collections with one button?
We don't want to go trough each site collection and run the site collection reports to see the statistics.
Anyone knows about a third party application that does the work?
Thanks,

albandrod
Unfortunately, Usage Reporting capabilities in SharePoint 2013 have been greatly reduced and I suspect they will be further reduced in coming versions. Here are some third-party approaches in varying levels of complexity:
Google analytics
HarePoint
DocAve Analytics for SharePoint
Webtrends
More can be found: search under "web Analytics." You may also want to have a look at a free solution:
The SharePoint Flavored Weblog Reader(SFWR) v1.4
This solution is something I am currently planning to implement for my customer's farm

2800 w/ site-site tunnel using NAT and user tunnels

I am using a 2800 to terminate a site-site IPSec tunnel using a crypto map. It is also used to terminate several user tunnels.
Because of overlapping private address space there is a source NAT rule in place that overloads addresses prior to routing them across the site-site tunnel.
The problem is that the user tunnels are not able to communicate with any host located on the far end of the site-site tunnel. The site-site tunnel (and it's NAT) works just fine for users coming from any other interface on the 2800.
Does anyone have any ideas? I've gone ahead and attached the existing configuration for those that are brave or incredibly smart :) It is a fairly trashed config though, and I'm still trying to clean it up from where it was.
Thank you VERY much ahead of time,
Steve

Duplicate posts. :P
Go here: http://supportforums.cisco.com/discussion/12152361/2nd-site-site-ipsec-tunnel-nat-traversal-setting-fail-establish-however-1st

Reporting Services through ISA server for All Authenticated Users

Hello colleagues.
I have MS SQL 2012 server with Reporting Services and it work via link:
https://reports2.domain.com/reports
In LAN all work fine, but I want publish this resource via ISA for All Authenticated Users.
When in publish rule I configure (in Condition) "All users" - all work fine, but when I configure "All Authenticated Users" - I have trouble on web form on
https://reports2.domain.com/reports/Pages/Report.aspx?ItemPat... - scripts not work, because it run how "anonymous" (I see on ISA logging) and ISA block scripts.
I can't use "All Users", because it's not secure.
Maybe somebody publish Reporting Services through ISA server for All Authenticated Users?
OR maybe - how on Reporting Services configure Negotiate authenticated for scripts?

Hi Alexander,
All users or applications who request access to report server content or operations must be authenticated using the authentication type configured on the report server before access is allowed. The AuthenticationType named RSWindowsNegotiate is supported
by Reporting Services. To configure Windows Authentication on the Report Server, please see:
http://msdn.microsoft.com/en-us/library/cc281253(v=sql.110).aspx
Besides, we can publish report server via ISA server. Please note that you should use a new web port number with a new listener which shouldn’t be used by other web site for report server. Reference:
http://social.technet.microsoft.com/Forums/forefront/en-US/1cc68996-1ce6-4d88-a30d-2bfd13fba06e/how-to-publish-ssrs-2008-through-isa-2006?forum=Forefrontedgegeneral
Hope this helps.
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support
Katherine thanks for answer.
Report Server service started as Domain account.
I have in RSReportServer.config this:
<Authentication>
<AuthenticationTypes>
<RSWindowsNegotiate />
</AuthenticationTypes>
<RSWindowsExtendedProtectionLevel>Allow</RSWindowsExtendedProtectionLevel>
<RSWindowsExtendedProtectionScenario>Proxy</RSWindowsExtendedProtectionScenario>
<EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>
In web.config I have this:
<authentication mode="Windows" />
<identity impersonate="true" />
I can go (from Internet through ISA) to
https://reports2.domain.com/reports and LogOn Authentication is work, but scripts not work, because it run how "anonymous" (I see this on ISA logging) and ISA block scripts.
Do you know where in Reporting Services configure run scripts with Negotiate authentication?

I have some long spreadsheets and want to open them at the bottom instead of scrolling down through all the data. How do I do this?

I have some long spreadsheets and want to go to the bottom to add new data without scrolling down through all the old entries. When I open a table now it goes to the top row and I have almost 300 rows to scroll through. I would like to set the table up to automatically go to the bottom row.

Zach,
You have a couple of options. If you use 100% View Zoom, and if you leave a cell selected in the bottom row of the table when you Save and Close the document, it will reopen with that cell in view.
You could also sort your table in the opposite order and add new rows at the top. Then you wouldn't have to worry about what zoom you use. To insert a row at the top, select a cell in the current top row and press Option-UpArrow. That will add a new blank Top Body Row.
Jerry

Problems when trying to surf the Internet through a SSL VPN tunnel

Hi,
I have a small/big problem, I have a customer who have the need for the possibility to surf the internet through the SA500W when they are connected through a SSL VPN tunnel in to their network. I am not using a Split Tunnel. What I have seen until now, when you run IPCONFIG/ALL the default gateway for the SSL VPN IP settings is 0.0.0.0. Is this the problem and if so, how can this be solved?
Thanks in advance!
Brg
Niklas Eklov

There are various causes for this error, see [[Firefox is already running but is not responding]] for details.

SNMP reporting down through Site to Site tunnel

Similar Messages

Maybe you are looking for