Ssh via vpn: typing commands hangs (is slow)

Hello all,
for a long time i have got an annoying problem and i would like to fix it in the near future.
Establishing an ssh-connection via vpn from my Maxbook tomy FreeBSDsystem works
without any problems: the the password-prompt immediately.
But typing in any commands is very slow, it seems to hang anyhow. Typing with a normal
speed is impossible because all letters after the first letters are missing. After 1-2 seconds
the appear and i could keep on typing.
Erasing is the same: i hit the key and it takes a while until the letters are disappearing.
It remembers me a little bit at the keyboard-settings of MacOS itself: there you can configure
the speed and so on.
Has anybody an idea how to fix this?
Here some general annotations:
1) it is MacOS independent (10.5. and 10.6)
2) is is FreeBSD idenpedent (8.0 and 8.2)
3) it is terminal-application independent (MacOS-terminal and 3rdparty terminal).
Thank you very much, Stefan

Hi Darren,
The user's vim session dies when the users are actively typing.
As for there being a firewall or NAT device between the workstation and the server, yes, there is. The users are in one building and the server is housed in a datacenter in a separate building. The users do not have this issue with out other Solaris 8 and Solaris 10 servers...only this one particular server. A traceroute to the server takes only 5 hops and returns quickly.
As for the logs, I just checked /var/adm/messages and it is reporting the following types of messages over and over.:
[ID 317013 daemon.notice] bpcd[11746] from some IP
I think these messages are generated from Veritas Netbackup which is administered by a separate team than what I am on, but I can have them investigate.

Similar Messages

  • Ssh via vpn not working in Snow Leopard

    On a MacBook Pro with Snow Leopard, I want to log into a remote server on my employer's lan via ssh over a vpn connection. The vpn works because I can access a local twiki on that lan with no problem, but I can't run ssh or even ping. This is not a DNS issue because it happens even with explicit numerical IPv4 addresses.
    On an older G4 iBook with Tiger, ssh and ping both work. I can run the two laptops side by side with simultaneous VPN connections; and Tiger will succeed, but Snow Leopard fails. Turning off the firewall on the MacBook Pro makes no difference. Could someone please give me an idea of what is going on?
    I can't get help from my employer's IT staff because we are a Windows operation and would just as soon switch me over to Windows 7. Thanks.
    Clint

    My problem seems to be due to an advanced option in the Snow Leopard VPN preference to "Send all traffic over VPN connection." The domain that I was trying to reach is actually not on my company LAN, but successful ssh'ing to it seems to require that the request to come from a LAN IP address. Without the traffic redirection option, Snow Leopard tries to invoke ssh through my home IP address, which will then time out without making a connection. I think that Tiger automatically redirects traffic to the VPN whenever it is active.
    (Note that when setting a VPN preference, it does not go into effect until after leaving the Network preference pane.)

  • Slow finder Browsing when accessing LAN via VPN connexion

    I am running ML Server, latest upadte on a 2010 Mac Mini Server machine.
    When I am connected to my network from a remote location via VPN, and I try to browse my LAN structure with Finder, it takes ages for the list of folders/files to appear and refresh.
    I have checked my VPN configuration and tried different type (L2TP, PPTP) but nothing significantly differ in term of browsing speed.
    I also appreciate that the network connection at the remote location, as well as the upload speed on my local network can influence the overwal browsing speed... but after several test, I confirm I have more than 3 Mbps bandwith for upload on the local network, and 20 Mbps minimum on the remote location.
    I also tried AFP / SMB, but does not seem to change anything.
    So, I guess I hope the Community has already experienced the issue and some of you guys may have found a workaround to this issue.
    Many thanks.

    why not try cisco ipsec
    Input the following settings:
    Interface: VPN
    VPN Type: Cisco IPSec
    Service Name: This can be anything, I left the default.
    Edit the new interface details as follows:
    Server Address: cisco.vpntraffic.com or other country vpn such as Portugal VPN
    Account Name: Your vpn account
    Password: Your vpn password
    How to setup Mac OS X Built-In Cisco VPN

  • Do I need to run DNS on a colo server being accessed remotely via VPN?

    My Mac Mini Server is located in a colo site. We generally use it for Web, email and a couple of application-specific services. It has a dedicated IP address. We have a separate DNS service we use to point to the domains on the server located remotely from the server. Forward and reverse lookups work fine from the server, even though the local DNS service is turned off.
    However, we now have a couple of things we want to access remotely on the server via VPN (for example, some files via AFP). The firewall blocks remote AFP requests (using the built-in firewall, not a separate box). We can connect via VPN without problems. However, AFP does not work. If I allow AFP in the firewall and try to connect, no problems at all.
    Since the Mini is located by itself and will never likely have anything connected to a "local network" (never running DHCP, etc.), there generally doesn't seem to be a need to run DNS on the server.
    I suspect the problem is that when you VPN into the server you are on its "local network", whatever that means, so the DNS does not resolve since the local DNS service is not running. However, I am not positive of this.
    Must we run local DNS? Does it have to mirror the remote DNS that we currently reference? Can we somehow "reference" the local DNS from VPN clients trying to access local services?
    I hope this question makes some sense.

    Bear with me please....
    The Mac Mini is in a data center on a shelf, getting a direct connection to the Internet via ethernet with a fixed IP address (under the covers, I suspect that the data center is using some sort of router or switch, but I am not paying for a hardware firewall or other gateway). There is no local network for the Mini. It is not running DHCP, not handing out NAT addresses, etc. DNS is currently off. Rather than using the local DNS, the Mini is resolving its DNS needs with a DNS server located at another site, over the Internet. This seems to work fine (i.e., changeip confirms it is working and services seem to work).
    I am currently using the software firewall built into SLS.
    I want to turn on VPN so that remotely located computers can access services on the Mini without having to make the services visible through the firewall.
    I am able to connect devices via VPN with little difficulty (iPhones, Macs, etc.). However, when I try to access services (let's use AFP as an example), I cannot access them UNLESS they are allowed through the firewall. This tells me that I am not seeing the services through the VPN, but rather through the Internet directly.
    What I meant by "local network" is that the VPN allocates local IP addresses when devices log into the VPN service (10.0.x.x). There is no DHCP allocating these addresses, just VPN.
    My question is: why can I not see the services on the Mini blocked by the firewall when successfully logged into VPN on the server? Isn't the whole point of the VPN to gain access to services behind the firewall?
    I am guessing (with no particular information to support my thesis) that somehow without DNS running on the Mini, VPN clients are unable to access services on the Mini. I do not know for sure, however, if this is the problem. If it IS a problem, then the question is whether I should completely copy the DNS entries from the remote DNS server to the Mini and start the service. Will that solve the issue? Create conflicts with the DNS (since it is now located on both a remote service and on the Mini)? It certainly will create a maintenance headache since now I will have to maintain the DNS in both places.
    I am hesitant to migrate all of my DNS services to the Mini (because I will also have to go to the domain registrars to change where they point, etc.) to eliminate the remote one. And I am not sure it will solve this problem anyway.
    Sorry for all of the typing!

  • Unable to access secondary subnet via VPN

    I am having a problem with clients accessing a secondary subnet via VPN.
    Clients on VPN are given the address on the 192.168.15.0 subnet. Once connected they can access 192.168.16.0 (Production subnet) fine, but are unable to access the 192.168.8.0 secondary subnet. If you are on the 192.168.16.0 subnet in the office you can access 192.168.8.0 subnet fine. The traffic is coming in via an ASA 5510 then traverses a Juniper firewall and a MPLS router to the secondary subnet. I'm not sure if it's a nat issue or not. Any help would be helpful.
    Below is the config of the ASA. Thank you in advance
    ASA Version 8.2(5)
    hostname charlotte
    domain-name tg.local
    enable password v4DuEgO1ZTlkUiaA encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.254.0 Peak10 description Peak10
    name 192.168.116.0 Charlotte_Phones description Charlotte_Phones
    name 192.168.15.0 Charlotte_SSL_VPN_Clients description Charlotte_SSL_VPN_Client                                                                                                                                                             s
    name 192.168.17.0 Charlotte_Wireless_Data description Charlotte_Wireless_Data
    name 192.168.117.0 Charlotte_Wireless_Phones description Charlotte_Wireless_Phon                                                                                                                                                             es
    name 192.168.5.0 Huntersville description Huntersville
    name 192.168.16.1 SRX_Gateway description Juniper_SRX
    name 192.168.108.0 Canton_Data description Canton_Data
    name 192.168.8.0 Canton_Phones description Canton_Phones
    name 192.168.9.0 Canton_Wireless_Data description Canton_Wireless_Data
    name 192.168.109.0 Canton_Wireless_Phones description Canton_Wireless_Phones
    name 192.168.16.4 TEST_IP description TEST_IP
    name 192.168.16.2 CantonGW description Canton GW 192.168.16.2
    name 192.168.5.1 HuntersvilleGW
    name 10.176.0.0 RS_Cloud description 10.176.0.0/12
    name 172.16.8.0 RS_172.16.8.0
    name 172.16.48.0 RS_172.16.48.0
    name 172.16.52.0 RS_172.16.52.0
    name 10.208.0.0 RS_Cloud_New
    name 10.178.0.0 RS_10.178.0.0 description Rackspace DEV servers
    name 10.178.0.6 RS_10.178.0.6
    name 172.16.20.0 RS_172.16.20.0
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 70.63.165.219 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.16.202 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    banner login ASA Login - Unauthorized access is prohibited
    banner login ASA Login - Unauthorized access is prohibited
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup Outside
    dns domain-lookup Inside
    dns domain-lookup management
    dns server-group DefaultDNS
    name-server 192.168.16.122
    name-server 8.8.8.8
    domain-name tg.local
    dns server-group defaultdns
    name-server 192.168.16.122
    domain-name tg.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network DM_INLINE_NETWORK_2
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_3
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object Huntersville 255.255.255.0
    object-group network DM_INLINE_NETWORK_4
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object Huntersville 255.255.255.0
    object-group network DM_INLINE_NETWORK_10
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.48.0 255.255.252.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_7
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.48.0 255.255.240.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_8
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_9
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_11
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_12
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_13
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_14
    network-object RS_Cloud 255.240.0.0
    network-object RS_172.16.48.0 255.255.252.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object 172.16.0.0 255.255.252.0
    object-group network DM_INLINE_NETWORK_5
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_6
    network-object RS_Cloud 255.240.0.0
    network-object RS_Cloud_New 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object Canton_Phones 255.255.255.0
    object-group network tgnc074.tg.local
    object-group icmp-type DM_INLINE_ICMP_1
    icmp-object echo
    icmp-object echo-reply
    icmp-object traceroute
    icmp-object unreachable
    object-group service DM_INLINE_SERVICE_1
    service-object ip
    service-object tcp eq https
    object-group icmp-type DM_INLINE_ICMP_2
    icmp-object echo
    icmp-object echo-reply
    icmp-object traceroute
    icmp-object unreachable
    object-group service DM_INLINE_SERVICE_2
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_3
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    object-group network DM_INLINE_NETWORK_1
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    object-group service DM_INLINE_SERVICE_4
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_5
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group network DM_INLINE_NETWORK_15
    network-object Canton_Data 255.255.255.0
    network-object host CantonGW
    object-group service DM_INLINE_SERVICE_6
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_7
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_2 Ch                                                                                                                                                             arlotte_SSL_VPN_Clients 255.255.255.0 any
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_5 ho                                                                                                                                                             st SRX_Gateway Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_7 Ch                                                                                                                                                             arlotte_SSL_VPN_Clients 255.255.255.0 host SRX_Gateway
    access-list Inside_access_in extended permit icmp any any object-group DM_INLINE                                                                                                                                                             _ICMP_1
    access-list Inside_access_in remark Permit all in Char_ORD_VPN
    access-list Inside_access_in extended permit ip object-group DM_INLINE_NETWORK_7                                                                                                                                                              object-group DM_INLINE_NETWORK_8
    access-list Inside_access_in remark Permit all out Char_ORD_VPN
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_1 ob                                                                                                                                                             ject-group DM_INLINE_NETWORK_9 object-group DM_INLINE_NETWORK_10
    access-list Inside_access_in extended permit ip Charlotte_SSL_VPN_Clients 255.25                                                                                                                                                             5.255.0 any
    access-list Inside_access_in remark Permit all in Char_ORD_VPN
    access-list Inside_access_in remark Permit all out Char_ORD_VPN
    access-list Inside_access_in extended permit ip object-group DM_INLINE_NETWORK_9                                                                                                                                                              object-group DM_INLINE_NETWORK_10 log disable
    access-list Tunneled_Network_List standard permit 192.168.16.0 255.255.255.0
    access-list Tunneled_Network_List standard permit Charlotte_Phones 255.255.255.0                                                                                                                                                            
    access-list Tunneled_Network_List standard permit Charlotte_Wireless_Data 255.25                                                                                                                                                             5.255.0
    access-list Tunneled_Network_List standard permit Charlotte_Wireless_Phones 255.                                                                                                                                                             255.255.0
    access-list Tunneled_Network_List standard permit Peak10 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Data 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Phones 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Wireless_Data 255.255.2                                                                                                                                                             55.0
    access-list Tunneled_Network_List standard permit Canton_Wireless_Phones 255.255                                                                                                                                                             .255.0
    access-list Tunneled_Network_List standard permit Huntersville 255.255.255.0
    access-list Tunneled_Network_List standard permit 172.16.0.0 255.255.252.0
    access-list Tunneled_Network_List standard permit RS_172.16.8.0 255.255.252.0
    access-list Tunneled_Network_List standard permit RS_Cloud 255.240.0.0
    access-list Tunneled_Network_List standard permit RS_Cloud_New 255.240.0.0
    access-list Tunneled_Network_List standard permit RS_172.16.20.0 255.255.252.0
    access-list Tunneled_Network_List standard permit Charlotte_SSL_VPN_Clients 255.                                                                                                                                                             255.255.0
    access-list Tunneled_Network_List standard permit 172.16.0.0 255.255.0.0
    access-list Inside_nat0_outbound extended permit ip Charlotte_SSL_VPN_Clients 25                                                                                                                                                             5.255.255.0 object-group DM_INLINE_NETWORK_2
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_11 object-group DM_INLINE_NETWORK_12
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_5 object-group DM_INLINE_NETWORK_6
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_1 object-group DM_INLINE_NETWORK_2
    access-list Limited_Access extended permit ip Charlotte_SSL_VPN_Clients 255.255.                                                                                                                                                             255.0 host TEST_IP
    access-list Limited__VPN_Acccess_List standard permit host 192.168.16.123
    access-list Limited__VPN_Acccess_List standard permit Huntersville 255.255.255.0                                                                                                                                                            
    access-list Limited__VPN_Acccess_List standard permit host 192.168.16.124
    access-list Limited__VPN_Acccess_List standard permit 192.168.16.0 255.255.255.0                                                                                                                                                            
    access-list Limited__VPN_Acccess_List standard permit host 172.16.8.52
    access-list Limited__VPN_Acccess_List standard permit Canton_Phones 255.255.255.                                                                                                                                                             0
    access-list Limited__VPN_Acccess_List remark ORD-VM-DEV1
    access-list Limited__VPN_Acccess_List standard permit host RS_10.178.0.6
    access-list Limited__VPN_Acccess_List remark ORD-VM-DEV2
    access-list Limited__VPN_Acccess_List standard permit host 10.178.192.103
    access-list Limited__VPN_Acccess_List standard permit host 192.168.8.10
    access-list Limited__VPN_Acccess_List standard permit RS_172.16.8.0 255.255.252.                                                                                                                                                             0
    access-list Limited__VPN_Acccess_List standard permit 172.16.0.0 255.255.0.0
    access-list Limited__VPN_Acccess_List standard permit host 10.178.133.26
    access-list Limited__VPN_Acccess_List standard permit RS_Cloud_New 255.240.0.0
    access-list Limited__VPN_Acccess_List standard permit host CantonGW
    access-list Limited__VPN_Acccess_List standard permit host SRX_Gateway
    access-list Limited__VPN_Acccess_List standard permit host 192.168.8.1
    access-list Limited__VPN_Acccess_List standard permit RS_Cloud 255.240.0.0
    access-list Limited__VPN_Acccess_List standard permit any
    access-list Limited__VPN_Acccess_List remark TGTFS
    access-list Limited__VPN_Acccess_List remark TGDEV
    access-list Limited__VPN_Acccess_List remark TGTFS
    access-list Limited__VPN_Acccess_List remark TGDEV
    access-list Outside_cryptomap extended permit ip 192.168.16.0 255.255.255.0 Huntersville 255.255.255.0
    access-list Outside_cryptomap extended permit ip Huntersville 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 Huntersville 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Huntersville 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Canton_Phones 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 Canton_Phones 255.255.255.0
    access-list Outside_2_cryptomap extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
    access-list Outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_13 object-group DM_INLINE_NETWORK_14
    access-list Outside_access_in extended permit icmp any any object-group DM_INLINE_ICMP_2 log disable
    access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Outside_access_in extended permit ip Huntersville 255.255.255.0 any log disable
    access-list Outside_access_in extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 any log disable
    access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_4 host SRX_Gateway Charlotte_SSL_VPN_Clients 255.255.255.0 inactive
    access-list Outside_cryptomap_2 extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
    access-list Outside_cryptomap_2 extended permit ip 192.168.16.0 255.255.255.0 RS_172.16.20.0 255.255.252.0
    access-list Canton_nat_outbound extended permit object-group DM_INLINE_SERVICE_6 Charlotte_SSL_VPN_Clients 255.255.255.0 object-group DM_INLINE_NETWORK_15
    access-list splitacl standard permit 192.168.16.0 255.255.255.0
    pager lines 24
    logging enable
    logging console emergencies
    logging monitor informational
    logging asdm informational
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool SSL_VPN_Pool 192.168.15.10-192.168.15.254 mask 255.255.255.0
    ip local pool New_VPN_Pool 192.168.16.50-192.168.16.200 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Inside
    no asdm history enable
    arp timeout 14400
    nat (Outside) 0 access-list Huntersville_nat_outbound
    nat (Inside) 0 access-list Inside_nat0_outbound
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    route Outside 0.0.0.0 0.0.0.0 70.63.165.217 1
    route Inside Canton_Phones 255.255.255.0 CantonGW 1
    route Inside Canton_Wireless_Data 255.255.255.0 CantonGW 1
    route Inside Charlotte_SSL_VPN_Clients 255.255.255.0 SRX_Gateway 1
    route Inside Charlotte_Wireless_Data 255.255.255.0 SRX_Gateway 1
    route Inside Canton_Data 255.255.255.0 CantonGW 1
    route Inside Canton_Wireless_Phones 255.255.255.0 CantonGW 1
    route Inside Charlotte_Phones 255.255.255.0 SRX_Gateway 1
    route Inside 192.168.116.219 255.255.255.255 CantonGW 1
    route Inside Charlotte_Wireless_Phones 255.255.255.0 SRX_Gateway 1
    route Inside Peak10 255.255.255.0 SRX_Gateway 1
    timeout xlate 3:00:00
    timeout conn 8:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    dynamic-access-policy-record TGAD_AccessPolicy
    aaa-server TGAD protocol ldap
    aaa-server TGAD (Inside) host 192.168.16.122
    ldap-base-dn DC=tg,DC=local
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=vpn user,CN=Users,DC=tg,DC=local
    server-type microsoft
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication telnet console LOCAL
    aaa local authentication attempts max-fail 10
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.16.0 255.255.255.0 Inside
    http Charlotte_SSL_VPN_Clients 255.255.255.0 Inside
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 1 match address Outside_cryptomap
    crypto map Outside_map0 1 set pfs
    crypto map Outside_map0 1 set peer 74.218.175.168
    crypto map Outside_map0 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 2 match address Outside_cryptomap_2
    crypto map Outside_map0 2 set peer 192.237.229.119
    crypto map Outside_map0 2 set transform-set ESP-3DES-MD5
    crypto map Outside_map0 3 match address Outside_cryptomap_1
    crypto map Outside_map0 3 set peer 174.143.192.65
    crypto map Outside_map0 3 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Outside_map0 interface Outside
    crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Inside_map interface Inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=charlotte
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment self
    subject-name CN=charlotte
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint1
    certificate 48676150
        3082024c 308201b5 a0030201 02020448 67615030 0d06092a 864886f7 0d010105
        05003038 31123010 06035504 03130963 6861726c 6f747465 31223020 06092a86
        4886f70d 01090216 13636861 726c6f74 74652e74 68696e6b 67617465 301e170d
        31323039 32353038 31373333 5a170d32 32303932 33303831 3733335a 30383112
        30100603 55040313 09636861 726c6f74 74653122 30200609 2a864886 f70d0109
        02161363 6861726c 6f747465 2e746869 6e6b6761 74653081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181008e d3e1ac63 a8a39dab 02170491
        2bf104d2 732c7fd7 7065758b 03bb9772 c8ab9faf 0e5e9e93 bfb57eea a849c875
        7899d261 8d426c37 9749d3d7 c86ca8e0 1d978069 3d43e7c5 569bb738 37e9bb31
        0ebd5065 01eb7a05 87933d2d 786a722e 8eee16e7 3207510b f5e7e704 cbddbda2
        a6b9ae45 efaba898 b8c921b6 2b05c0fb 1b0a9b02 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 8014fb93 35da7dd5 15d8e2ad 8e05ccf7 b5c333cc 95ac301d
        0603551d 0e041604 14fb9335 da7dd515 d8e2ad8e 05ccf7b5 c333cc95 ac300d06
        092a8648 86f70d01 01050500 03818100 6851ae52 5383c6f6 9e3ea714 85b2c5a0
        fd720959 a0b91899 806bad7a 08e2208e de22cad0 6692b09a 7152b21e 3bbfce68
        cc9f1391 8c460a04 a15e1a9e b18f829d 6d42d9bd ed5346bd 73a402f7 21e0c746
        02757fb6 b60405a9 ac3b9070 8c0f2fba d12f157b 85dd0a8b 2e9cf830 90a19412
        c7af1667 37b5ed8e c023ea4d 0c434609
      quit
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 170
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    vpn-addr-assign local reuse-delay 5
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 Outside
    ssh 172.221.228.164 255.255.255.255 Outside
    ssh Charlotte_SSL_VPN_Clients 255.255.255.0 Inside
    ssh 192.168.16.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ssl trust-point ASDM_TrustPoint1 Outside
    webvpn
    enable Outside
    enable Inside
    anyconnect-essentials
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1 regex "Windows NT"
    svc enable
    group-policy DfltGrpPolicy attributes
    dns-server value 192.168.16.122 8.8.8.8
    vpn-idle-timeout none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Limited__VPN_Acccess_List
    default-domain value tg.local
    split-dns value tg.local
    group-policy LimitedAccessGroupPolicy internal
    group-policy LimitedAccessGroupPolicy attributes
    wins-server none
    dns-server value 192.168.16.122 8.8.8.8
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Limited__VPN_Acccess_List
    default-domain value thinkgate.local
    split-tunnel-all-dns disable
    group-policy GroupPolicy2 internal
    group-policy GroupPolicy2 attributes
    vpn-tunnel-protocol IPSec
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    wins-server none
    dns-server value 192.168.16.122 8.8.8.8
    vpn-tunnel-protocol svc
    default-domain value tg.local
    group-policy Site-to-Site_Policy internal
    group-policy Site-to-Site_Policy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec
    tunnel-group DefaultRAGroup general-attributes
    default-group-policy LimitedAccessGroupPolicy
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool SSL_VPN_Pool
    tunnel-group LimitedAccessTunnelGroup type remote-access
    tunnel-group LimitedAccessTunnelGroup general-attributes
    address-pool SSL_VPN_Pool
    default-group-policy LimitedAccessGroupPolicy
    tunnel-group 208.104.76.178 type ipsec-l2l
    tunnel-group 208.104.76.178 ipsec-attributes
    pre-shared-key *****
    tunnel-group 74.218.175.168 type ipsec-l2l
    tunnel-group 74.218.175.168 ipsec-attributes
    pre-shared-key *****
    tunnel-group TGAD_ConnectionProfile type remote-access
    tunnel-group TGAD_ConnectionProfile general-attributes
    authentication-server-group TGAD
    default-group-policy GroupPolicy1
    tunnel-group 174.143.192.65 type ipsec-l2l
    tunnel-group 174.143.192.65 general-attributes
    default-group-policy GroupPolicy2
    tunnel-group 174.143.192.65 ipsec-attributes
    pre-shared-key *****
    tunnel-group 192.237.229.119 type ipsec-l2l
    tunnel-group 192.237.229.119 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:ef741b4905b43dc36d0f621e06508840
    : end
    charlotte#

    What does the packet-tracer say, what does the IPsec associations say (packets encrypted/decrypted)?
    This might be faster that going through your hundreds of lines of config.

  • Can't access management interface via vpn connection

    Hi all,
    I can't seem to be able to manage my ASA 5510 when I connect via vpn. My asa sits at a remote colo, and from my office i can connect fine. I have it configured as management-access (dmz), bc as of now we are just doing some staging and all the servers are in the dmz interface.
    When i connect with the vpn client, in the routes it sees 192.168.1.0 255.255.255.0 which is the management network/interface.
    For some reason I can't get access to 192.168.1.1 to use the ASDM.
    Here is how i did my vpn via CLI
    isakmp enable outside
    isakmp identity address
    isakmp policy 10
    authentication pre-share
    encryption des
    hash md5
    group 2
    lifetime 86400
    ip local pool vpnpool 10.1.1.2-10.1.1.10
    access-list split_tunnel standard permit 192.168.200.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    group-policy xxxxx internal
    group-policy xxxxx attributes
    dns value
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split_tunnel
    username xxxxx password
    username xxxxxx attributes
    vpn-group-policy xxxx
    username xxxxxx password
    username xxxxxx attributes
    vpn-group-policy xxxx
    username xxxx password
    username xxxx attributes
    vpn-group-policy xxxx
    tunnel-group xxxx type ipsec-ra
    tunnel-group xxxx general-attributes
    address-pool vpnpool
    tunnel-group xxxx ipsec-attributes
    pre-shared-key
    access-list vpnra permit ip 192.168.200.0 255.255.255.0 10.1.1.0 255.255.255.0
    access-list vpnra permit ip 192.168.100.0 255.255.255.0 10.1.1.0 255.255.255.0
    access-list vpnra permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
    nat (inside) 0 access-list vpnra
    nat (dmz) 0 access-list vpnra
    nat (management) 0 access-list vprna
    crypto ipsec transform-set md5des esp-des esp-md5-hmac
    crypto dynamic-map dynomap 10 set transform-set md5des
    crypto map vpnpeer 20 ipsec-isakmp dynamic dynomap
    crypto map vpnpeer interface outside
    Any help would be much appreciated

    it seems like you are missing a line:
    management-access "interface"
    http://www.cisco.com/en/US/docs/security/asa/asa71/command/reference/m_711.html#wp1631964

  • Server Admin not connecting to Leopard Server when accessing via VPN

    Hi everyone,
    Recently, as the title suggests, Server Admin (or Server Preferences, for that matter) would not connect to my remote server via VPN. I'm quite sure that the server is working nicely, as the users (both of them lovely young ladies with considerable charms, which makes on-site support quite interesting, if distracting) didn't call me to complain, and I can login via SSH with no problems.
    The server is a Mac Mini, connected to an Airport Extreme (gigabit N), which in turn connects to our ADSL modem, if that helps any.
    Now, I did tinker around a bit with the settings before this happened, so I think it's probably my fault (well, I started my "career" of administering this server a week ago, what do you expect), so I suppose I may have inadvertently limited access to a service required for Server Admin and Server Preferences to function.
    If anyone could tell me which services are absolutely necessary for Server Admin to function, or at least where to start looking, I'd be immensely grateful. I didn't yet go on site to try and wrestle the whole thing from there, as the travel costs are non-trivial, so I'd rather do it remotely, if at all possible.

    This is exactly the difficulty I am having with a 10.5.4 Intel xserve. I have established a VPN connection that connects me to my business LAN, and I know it has carried out the connection because there are a number of things I can access properly that are not available on the public internet. For instance, my LOM ports are restricted to my business LAN, and when I connect to the server via VPN I can access teh LOM ports and using server monitor. However, when I try to use Server Admin, nothing works. It won't connect. I too am confused. All traffic to the xserve is allowed via the business LAN. I thought all traffic was supposed to be routed to the VPN server when connected via a VPN. If this is the case, shouldn't Server Admin work? When I go on site and connect my computer directly to the business LAN, I have no difficulty using Server Admin.

  • Access to DFS root via VPN not working - error 0x80070035 keeps popping up

    Dear all,
    when trying to access the DFS root via VPN from a Windows 7 non-domain member computer I always receive an error stating "Windows cannot access \\eggs.local\dfs", Error Code: 0x80070035, The Network Path was not found.
    I searched the internet as well as these forums in order to get to grips with this error message but didn't find anything to solve my problem.
    I made sure, that NetBIOS over TCP/IP is enabled, that I have access to the VPN adapter's DNS as well as WINS servers, that DNS name resolution is working properly, DNS split tunneling is enabled, Windows Firewall is disabled, and so forth. Still no luck.
    Any ideas?
    Thanks Alex
    Alexander Ollischer Diplom-Wirtschaftsinformatiker (FH) Citrix & Microsoft Certified Engineer (CCEA, CCEE, MCSA, MCSE, MCDBA, MCTS) Afontis IT+Services GmbH Baierbrunner Straße 15 81379 München Deutschland Telefon (089) 74 34 55-0 Fax (089) 74 34 55-55
    mailto:[email protected] http://www.afontis.de http://www.itganzeinfach.de Amtsgericht München, HRB 109 005 Geschäftsführer: Thomas Klimmer

    Hi,
    Though you mentioned DNS is working properly, please check if DNS forwarder is set as set correctly. 
    And incase it is caused by authentication, please try to force Kerberos to use TCP - by default it using UDP and on a slow VPN connection, UDP packets may be dropped. 
    How to force Kerberos to use TCP instead of UDP in Windows
    http://support.microsoft.com/kb/244474
    Also check NTFS and Sharing permission on top of the DFS Namespace. At least give users a Read permission. 
    If you have any feedback on our support, please send to [email protected]

  • Is there any way to enable SSH via Terminal in the OSX Installer utility list?

    Hi guys, I've messed up my install a little on my internal HDD.. I can't boot into OSX as I keep getting kernel panics on boot. I was just wondering if there's any way I can SSH into my Mac Pro via the Terminal on the OSX Installer Utilities list.. I have a Macbook Pro to SSH from but I need a way to enable SSH via that Terminal "-bash-3.2#"..
    I've tried to use the systemsetup -setremotelogin on command but I know SSH requires login keys and as I have no idea what can be used as those keys for the OSX Installer version of Terminal I have no idea how I can enable SSH..
    Tried some sudo commands but as I guess it runs at a completely different level to sudo it won't actually recognise the sudo command..
    Any help would be greatly appreciated guys, if you need me to post any info or results to help then just let me know.
    Thanks alot
    Chris

    If your Mac cannot boot to the OS X installation then you will not be able to set up the SSH (Remote Login) sharing service. The OS X installer does not support any of the system's sharing services. Technically it does have the sshd daemon (server process) that you can set up to accept a connection; however, this will not give you any additional benefit.
    The only reason to SSH into the system would be to get to the Terminal command prompt anyway, which is available when you boot to the Recovery HD partition and choose Terminal from the Utilities menu. If you were to set up SSH and log in, you would still only have the functionality provided by the Terminal in the Utilities menu, and not have access to your Mac's full OS installation.

  • Accessing a subnet via VPN session

    Hi everybody.
    I have not to much experience configuring and managing VPN´s and at this moment I am facing a bit issue. I've got a remote site which is connected to the headquarters via VPN site to site IP Sec tunnel. When I am in my office I have no problem to reach the remote network, but, when I try to connect to the remote network via VPN client, I can't reach it.
    in the remote office I've hot a Router 3800 (Cisco IOS Software, 3800 Software (C3845-ADVENTERPRISEK9-M), Version 12.4(13c), RELEASE SOFTWARE (fc2)) in the headquarters I've got an ASA 5520 Version 8.0(3) I've chequed access-list, and network objects and it seems everythink ok.
    local network: 10.30.0.0 0.0.0.0
    remote network 10.31.0.0 0.0.0.0
    ASA
    object-group network remote-network
    network-object 172.16.27.0 255.255.255.0
    network-object 10.31.0.0 255.255.0.0
    object-group network network-local
    network-object 0.0.0.0 0.0.0.0
    access-list VPN_Remote_Access_splitTunnelAcl standard permit 10.31.0.0 255.255.0.0
    Router 3800
    ip access-list extended vpn
      permit ip 10.31.0.0 0.0.255.255 any
    Can someone guide me about what is missing in the config? no problem if you need more "sho run" lines.
    Regards and Thanks very much!!

    Hi Ankur, thanks very much for your reply!
    this is the "sho run" in my remote router:
    I do not undesrtand well your first question, but if it is usefull, I loggin to headquerters "headquerters public ip address"
    this is a simple diagram of where I want to connect to:
    REMOTE_SITE --------------------------( vpn site to site IP sec tunnel )-------------------------HEADQUERTERS
    (10.31.0.0/24 network)                                                                                      (10.30.0.0/16network)
                                                                                                                                            |
                                                                                                                                            |
                                                                                                                                            |
                                                                                                                                            |
                                                                                                                                  REMOTE USER
                                                                                                                                 (10.30.23.130/25)
    REMOTESITE#sho run
    Building configuration...
    Current configuration : 10834 bytes
    version 12.4
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname PYASU1ROU01
    boot-start-marker
    boot-end-marker
    logging buffered 64000 debugging
    no logging console
    aaa new-model
    aaa authentication login default group tac-auth local
    aaa authentication enable default group tac-auth enable
    aaa authorization console
    aaa authorization exec default group tac-auth local if-authenticated
    aaa authorization network default local
    aaa accounting exec default start-stop group tac-auth
    aaa session-id common
    clock timezone PR -3
    ip cef
    voice-card 0
    no dspfarm
    crypto pki trustpoint TP-self-signed-4112391703
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4112391703
    revocation-check none
    rsakeypair TP-self-signed-4112391703
    crypto pki certificate chain TP-self-signed-4112391703
    certificate self-signed 01
      30820243 308201AC A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 34313132 33393137 3033301E 170D3131 31313234 30323430
      34335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 31313233
      39313730 3330819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100A09B 8740E68A 0C5BB452 D4D26D1B C91E4B5A 71FF0E11 411D70DB ED09EE4C
      95C67911 0DFB9557 EB17CE79 9A3AF1C8 3B4DC1C0 75F6B938 F3431C4D 6DEAB793
      A560C0AE 88007146 4312FBDF F979476B AB55CACD 9EE00DAC B3227CD6 9861DE87
      DD462212 6E8FDA90 7BEA7967 26FCF6B6 6DDDBD5A A6E3D7F8 12AE4F5E 71BDDEE3
      D5130203 010001A3 6B306930 0F060355 1D130101 FF040530 030101FF 30160603
      551D1104 0F300D82 0B505941 53553152 4F553031 301F0603 551D2304 18301680
      14C86D3D 3AF1854B 977D5BD8 A9ABAF33 4E7483BC 3B301D06 03551D0E 04160414
      C86D3D3A F1854B97 7D5BD8A9 ABAF334E 7483BC3B 300D0609 2A864886 F70D0101
      04050003 8181005A 5A20ACB9 EE50A66C 054B5449 62A98E5F B42E5193 6D3D71A8
      B0949BE2 70BE6F3C 2FAD7E2D AA0FCF6C 4D8E8344 035A33D6 6538EF32 33F8C746
      31119E9C F08091A2 9F8DCF8F 1B779D90 82F3366C D0F84D6B AB7E3248 E532E224
      91E404E9 608ECF11 5525D52B A02C3D9C 7BC1C1EF 496D1246 1125086B 54EEF4A2
      94350AFF EA7CB2
      quit
    username admin privilege 15 secret 5 $1$P3xv$e99l3YcRWgFPEp/m6uXZg1
    username cwuser privilege 15 secret 5 $1$Ir9X$CZgLaFy7XKsmT9avFHTTk/
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    ip ssh version 2
    crypto keyring apex
      pre-shared-key address "headquerters public ip address"
    key apex
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp profile companyname
       keyring apex
       match identity address "headquerters public ip address"
    crypto ipsec transform-set esp-aes256-sha esp-aes 256 esp-sha-hmac
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto map outside 10 ipsec-isakmp
    set peer "headquerters public ip address"
    set transform-set 3DES
    set isakmp-profile companyname
    match address vpn-companyname
    interface Loopback1
    description monitoreo
    ip address 10.31.21.255 255.255.255.255
    interface GigabitEthernet0/0
    description Teysa
    ip address public ip address
    ip nat outside
    no ip virtual-reassembly
    load-interval 30
    duplex auto
    speed auto
    media-type rj45
    crypto map outside
    interface GigabitEthernet0/1
    description TO CORE-SW
    ip address 192.168.255.249 255.255.255.252
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    media-type rj45
    interface FastEthernet0/0/0
    switchport access vlan 2
    duplex full
    speed 100
    interface FastEthernet0/0/1
    switchport access vlan 10
    shutdown
    duplex full
    speed 100
    interface FastEthernet0/0/2
    switchport mode trunk
    shutdown
    interface FastEthernet0/0/3
    switchport access vlan 10
    shutdown
    duplex full
    speed 100
    interface Vlan1
    no ip address
    no ip http server
    ip http authentication aaa login-authentication default
    ip http authentication aaa exec-authorization default
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source route-map nat interface GigabitEthernet0/0 overload
    ip access-list extended nat
    deny   ip host 172.16.27.236 10.0.0.0 0.255.255.255
    deny   ip 10.31.0.0 0.0.255.255 10.0.0.0 0.255.255.255
    deny   ip 172.16.27.0 0.0.0.255 10.0.0.0 0.255.255.255
    permit ip 10.31.11.0 0.0.0.255 any
    permit ip 10.31.13.0 0.0.0.255 any
    permit ip 172.16.27.0 0.0.0.255 host 209.59.188.93
    permit ip 172.16.27.0 0.0.0.255 host 190.180.145.46
    permit ip 172.16.27.0 0.0.0.255 host 46.51.171.127
    permit ip 172.16.27.224 0.0.0.31 any
    ip access-list extended vpn-apex
    permit ip 10.50.20.0 0.0.1.255 any
    permit ip 172.16.27.0 0.0.0.255 any
    permit ip 10.31.0.0 0.0.255.255 any
    permit ip 10.30.0.0 0.0.255.255 any
    route-map nat permit 10
    match ip address nat
    control-plane
    line con 0
    password 7 xxxxxxxxxx
    stopbits 1
    line aux 0
    stopbits 1
    line vty 0 4
    password 7 xxxxxxxxxx
    scheduler allocate 20000 1000
    ntp server 10.30.5.38
    end
    REMOTESITE#
    Regards!

  • Has anyone used SFTP/ssh via any process in OWB?

    Has anyone used SFTP/ssh via any process in OWB?
    We need to SFTP a file from an SFTP server(unix) to our OWB environement.

    You can use the FTP operator in a process flow. Configure it as such -
    Command - /usr/bin/sftp
    Parameter_List - ?${Remote.User}@${Remote.Host}?
    Script -
    lcd ${Working.RootPath}
    cd ${Remote.RootPath}
    get myfile
    bye
    You have to configure the operator to define remote and working locations.
    There is another example for this in the documentation -
    http://www.oracle.com/technology/products/warehouse/casestudies/10gr2/ftpprocessflow/ftp_linux_to_winxp.html
    I personally prefer scp to sftp as in my experience OWB handles errors better with it.

  • SSH via a SOCKS proxy ?

    I need to be able to make an ssh shell connection via a SOCKS5 proxy, and can't find out how to do it. It's possible to do this in putty on the PC, so I hope something similar is available for the Mac, whether it's a separate application or a way of configuring the ssh command.
    Does anybody know how to do it ?

    Hi Andrew,
       The command to whose source Andy provides a link is designed to be used as a ProxyCommand by Sun on Solaris systems. The web page, Hack 92 SSH SOCKS 4 Proxy discusses the use of built in SOCKS 4 proxy support in OpenSSH on OS X and claims at the bottom that built in SOCKS 5 support is in the works. I don't know the status of that effort.
       This post in the BSDForums.org, HTTP proxy auth for nc(1) offers a patch for NetCat that is purported to allow it to be used as a ProxyCommand for OpenSSH. The "connect" command can be used as a ProxyCommand and SSH via a Socks proxy on OS X with connect.c discusses how to compile and use it on OS X. More detail is provided at SSH Proxy Command -- connect.c but I'm currently unable to connect to the machine on which the source resides.
    Gary
    ~~~~
       It's hard to get ivory in Africa, but in Alabama the Tuscaloosa.
             -- Groucho Marx

  • SSH dead in Terminal - always hangs

    Hi,
    I've lost the ability to SSH from Terminal. The verbose output shows that I can connect to servers but the process hangs after "SSH2MSG_SERVICEACCEPT received". I have no firewall or any type of peer guardian software running.
    Things I've tried so far are - deleting adding new version of the known hosts and ssh_config files, installing a new version of SSH via Macports, playing with various settings in the ssh_config files, trying to SSH from a guest account. All fail.
    Bizarrely, I can still use programmes like Meerkat and SSH Tunnel Manager to open an SSH connection for tunnelling and they work fine. Perhaps they have there own SSH within their packages.
    I was wondering if anyone has had a similar problem to this, or can recommend how to completely remove the OpenSSH that comes with OS 10.6.
    Thanks,
    Paul

    Have you looked that the sshd daemon log messages on the destination system? Depending on the system they should be in console message equivalent, such as /var/log/messages, or maybe /var/log/system.log, or maybe /var/log/secure.log, or perhaps /var/adm/messages, etc.... Different Unix systems use a different way of storing the console log messages.
    In any event, seeing if the sshd log messages on the destination system say anything useful may be of help.

  • Cisco VPN connection just 'hangs', during connection.

    Hello all.
    I have installed Cisco VPN Client 4.6.00.0045, every so often when I try to connect it, it prompts for the username and password, which I enter, then it appears to try and connect but nothing, I have left it and left it for over 1hr at times, to see is its just slow, but nothing.
    If I try and click on the Cancel Connection option, it doesnt cancel, if I use Task Manager, to end task it doesnt, the only way I appear to be able to 'get the system running' is by restarting the workstation.
    My workstation is on a works network, other PCs are able to connect using the same VPN details, so it cant be Firewall etc...
    My PC is running XP Pro SP2
    Any ideas on what could be the problem?
    Extract from a screen shot and logs belows;
    Securing communications channel
    Initializing the connection
    Contacting the security gateway at xxx.xxx.xxx.xxx?
    Authenticating user
    Contacting the security gateway at xxx.xxx.xxx.xxx?
    Negotiating security policies
    Securing communications channel
    64 06:46:59.335 06/13/07
    Assigned VA private interface addr xx.xx.xx.xxx

    Have been having the same issue for several months. Similar configuration with XP Pro (SP3 now) using VPN Client 5.0.02.0090.
    When the VPN client hangs, the svchost.exe uses up 100% of the CPU and a reboot is the only solution. Sometimes it take 5 or 6 reboots before the VPN will connect.
    If I wait long enough after the initial login, I can usually connect but this does not always help. If I wait too long, however, or run other programs before I start the VPN Client, it will hang. If the system disconnects for some reason, the VPN client usually hangs on the reconnect.
    I've been looking for an answer to this problem for some time now and this is the fist place I've seen where another user was experiencing the same issue.

  • Can I use domain name to access local web (& other) services via VPN?

    I've just set up a VPN service for our office but, when connected via VPN, I can't seem to access our Wiki Server via our domain (http://example.private/groups/). Instead it will only let me access it via IP (http://192.168.1.2/groups/)
    Is it possible to access it via http://example.private/groups/ and if so what do I need to do?
    EDIT: actually, same goes with the local iChat and iCal services too.
    Message was edited by: Christiaan

    Okay, it's sorted. I phone Apple Support.
    The solution is to open Server Admin. Go to VPN Settings, then click on the Client Information tab, then add your local DNS server to the DNS Servers list (in our case 192.168.1.2).
    I would have expected the Standard configuration of Leopard Server setup to have added this by default, so I'll submit a bug report when I get a chance.

Maybe you are looking for