Unable to FTP to remote site

After upgrading to the Quantum router, I can not FTP to my site using a script that has been working fine for over 10yr.  Here's what happens:
ftp> open {edited for privacy}
connected to {edited for privacy}
Connection refused by remote host
ftp>
I've tried with Filzilla and a Mac terminal.  Normally, the remote host asks for a username and then for the PW.  For some reason, the connection is refused.  I've been on the phone to my hosting company for 2wk tomorrow with no success.  
Does anyone have any suggestions as to what might be wrong.  Upgrading to the Quantum router and the issue occurred at about the same time, but I can't be sure one caused the other.
Solved!
Go to Solution.

Have you tried adjusting the firewall setting in the router?   It may have different settings than your old router.
I was able to connect to that server through my Quantum router.  I've got the firewall set to "typical."
ftp> open {edited for privacy}
Connected to {edited for privacy}.
220 (vsFTPd 2.3.4)
User ({edited for privacy}none)):
331 Please specify the password.
Password:
503 Login with USER first.
Login failed.
ftp>
Good Luck.
If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer as Accepted Solution so others can see the solution to the problem.

Similar Messages

  • Updated DW CS6 and now I can't FTP to any site

    Good morning,
    I have been using DW CS6 for a long time without problems accessing multiple sites with FTP. I just downloaded the latest DW CS6 update version 12.0 build 5861 and the update appeared to go OK. Now I find I'm unable to FTP to multiple sites, it fails with an error message "An FTP error occurred - cannot make connection to host". I contacted one of the hosts and their tech support said my params were correct and they were able to access my site using filezilla.
    I tried deleting my cache - no luck and also my configuration folder - same failure message. This happens on multiple sites with multiple hosts so I think the problem is with DW. Could anyone suggest how I can fix this?
    Thanks,
    Tony

    Thanks Ben,
    Nice to hear from you again.
    I reviewed the suggestions and have tried them all - I didn't delete the site from Site Manager but tried creating a new site with a different name and nothing worked. I also tried downloading filezilla and connecting using that and had a similar message
    Status: Connection attempt failed with "EACCES - Permission denied". So, two different programs can't connect to the site with FTP. DW also can't connect to several other sites hosted by two different firms.
    The site is hosted by GoDaddy so I went to the GoDaddy Control Panel and tried uploading a couple of files using their file manager and that worked. So it seems like the site is OK - GoDaddy tech support said they could connect using filezilla. Looks like the problem is in my PC somewhere as two programs can't connect using FTP. I have no idea where to look next. All I can think of is to uninstall DW then re-install from the original CD and not update it - ever as I'm pretty sure the update caused these problems. Do you have any other thoughts?
    If you'd like to try I can PM you the ftp info.

  • VS Exp 2013: Unable to create the Web site ... The components for communicating with FTP servers are not installed.

    I have MS Visual Studio Express 2013 It has worked fine for many months and then suddenly (I have made no configuration changes or added new programs) when I try to publish I am getting the message:
    Unable to create the Web site 'ftp://ftp.xx.xx/xxx.org.uk/www/htdocs'. The components for communicating with FTP servers are not installed.
    (I have replaced actual name with x's).
    I had a similar problem some months ago and found that saving all files, closing VS 2013 and re-starting the program fixed the problem. This time it has not.
    I am at a loss to know how to take this forwards. I do not use IIS.
    Any help would be appreciated.
    Michael.

    Hi Michael,
    For web site development, so you use the VS2013 express for web, am I right? We have to make sure that it is not the VS version issue.
    As you said that it worked well before, did you install other add-ins or tools in your VS IDE like
    Xamarin or others?
    Maybe you could disable or remove all add-ins in your VS IDE, test it again.
    please also install the VS2013 update 4 in your side.
    Best Regards,
    Jack
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • Remote Site FTP log-in & password won't stick.

    Working on Vista Home Premium with Service Pack 1 and DW 8 (Installed from CS2 disk).
    McAfee Anti-virus (not my 1st choice but PC came with it)
    Site Definition Settings > Advanced > Remote Info >
    FTP
    log-in:
    password:
    Save enabled. Test verified.
    Uploads work as expected.
    Close DW.
    Re-open DW, remote site log-in and password fields are empty.
    Tried running as Administrator but makes no diff.
    Wha'Sup?  
    Nancy O.
    Alt-Web Design & Publishing
    Web | Graphics | Print | Media  Specialists
    http://alt-web.com/
    http://twitter.com/altweb
    http://alt-web.blogspot.com

    I thought my CS2 disk contained the update but maybe not.
    So after running the update from the link you provided, I get 3 out of 4 Site definitions to stick.
    Some progress made
    Thanks, John.
    Nancy O.
    Alt-Web Design & Publishing
    Web | Graphics | Print | Media  Specialists
    http://alt-web.com/
    http://twitter.com/altweb
    http://alt-web.blogspot.com

  • Can no longer access remote site in DW CS5

    I've recently upgraded to CS5, when I attempted to upload a PS file to my website in DW I foolishly denied the permissions for CS5.  This has changed my remote server somehow so I can no longer update the website.  Also I've lost all my folders on the remote site and there is now just an empty folder with the name "pub".  The following is the error msg I receive when trying to upload files:
    public_html/e-mail/ - error occurred - Unable to create server folder /public_html/e-mail/.  Access denied.  The file may not exist, or there could be a permission problem.   Make sure you have proper authorization on the server and the server is properly configured.
    public_html:e-mail:qxblast.html - user cancelled
    File activity incomplete. 1 file(s) or folder(s) were not completed.
    Files with errors: 1
    /public_html/e-mail/
    I've double checked the folders, ftp information, proxies and everything but nothing seems to change this site.
    Any advice or ideas of how to fix this would be greatly appreciated, thanks.

    Mac? Windows?
    Firewall?
    Also contact your host just to be safe because sometimes these end up being ownership issues which, in a shared hosting environment, cannot be changed by you.  You would only be able to change them if you are in a VPS/Dedicated environment.

  • Internet connexion problem for remote site in Site to site VPN asa 5505

    Hi all
    I'm configuring a site to site Ipsec VPN in 2 sites using ASA 5505 V 8.2, The VPN is working fine i can ping machine in the 2 sides but the problem is the remote site dont' have internet.
    The architecture is, we 2 site Site1 is the main site and Site2 is secondary site there will be Site3, ...
    The internet connection is based in Site1 and site2 and site 3 will have internet connection through Site1. Site1, Site2 and Site 3 is interconnected by Ipsec VPN.
    Here is my ASA 5505 Configuration :
    SITE 1:
    ASA Version 8.2(5)
    hostname test-malabo
    domain-name test.mg
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd ta.qizy4R//ChqQH encrypted
    names
    interface Ethernet0/0
     description "Sortie Internet"
     switchport access vlan 2
    interface Ethernet0/1
     description "Interconnexion"
     switchport access vlan 171
    interface Ethernet0/2
     description "management"
     switchport access vlan 10
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 41.79.49.42 255.255.255.192
    interface Vlan10
     nameif mgmt
     security-level 0
     ip address 10.12.1.100 255.255.0.0
    interface Vlan171
     nameif interco
     security-level 0
     ip address 10.22.19.254 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
     domain-name test.mg
    object-group network LAN-MALABO
     description LAN DE MALABO
     network-object 192.168.1.0 255.255.255.0
    object-group network LAN-BATA
     description LAN DE BATA
     network-object 192.168.2.0 255.255.255.0
    object-group network LAN-LUBA
     description LAN DE LUBA
     network-object 192.168.3.0 255.255.255.0
    access-list interco_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu mgmt 1500
    mtu interco 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    icmp permit any interco
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (interco) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 41.79.49.1 1
    route interco 192.168.3.0 255.255.255.0 10.22.19.5 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map interco_map0 1 match address interco_1_cryptomap
    crypto map interco_map0 1 set pfs group1
    crypto map interco_map0 1 set peer 10.22.19.5
    crypto map interco_map0 1 set transform-set ESP-3DES-SHA
    crypto map interco_map0 interface interco
    crypto ca trustpoint _SmartCallHome_ServerCA
     crl configure
    crypto isakmp enable interco
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet 192.168.1.0 255.255.255.0 inside
    telnet 10.12.0.0 255.255.0.0 mgmt
    telnet timeout 30
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 10.12.0.0 255.255.0.0 mgmt
    ssh timeout 30
    console timeout 0
    management-access interco
    dhcpd option 3 ip 192.168.1.1
    dhcpd address 192.168.1.100-192.168.1.254 inside
    dhcpd dns 41.79.48.66 8.8.8.8 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    username admin password eY/fQXw7Ure8Qrz7 encrypted privilege 15
    tunnel-group 10.22.19.5 type ipsec-l2l
    tunnel-group 10.22.19.5 ipsec-attributes
     pre-shared-key *****
     isakmp keepalive threshold 60 retry 5
    class-map inspection_default
     match default-inspection-traffic
    policy-map global_policy
     class inspection_default
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect snmp
      inspect icmp
    prompt hostname context
    call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:5aa0d27f15e49ea597c8097cfdb755b8
    : end
    SITE2:
    ASA Version 8.2(5)
    hostname test-luba
    domain-name test.eg
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
     description "Sortie Interco-Internet"
     switchport access vlan 2
    interface Ethernet0/1
     description "management"
     switchport access vlan 10
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.3.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 10.22.19.5 255.255.255.0
    interface Vlan10
     nameif mgmt
     security-level 0
     ip address 10.12.1.101 255.255.0.0
    ftp mode passive
    dns server-group DefaultDNS
     domain-name test.eg
    object-group network LAN-MALABO
     description LAN DE MALABO
     network-object 192.168.1.0 255.255.255.0
    object-group network LAN-BATA
     description LAN DE BATA
     network-object 192.168.2.0 255.255.255.0
    object-group network LAN-LUBA
     description LAN DE LUBA
     network-object 192.168.3.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu mgmt 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list inside_nat0_outbound
    route outside 0.0.0.0 0.0.0.0 10.22.19.254 1
    route outside 192.168.1.0 255.255.255.0 10.22.19.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map0 1 match address outside_1_cryptomap
    crypto map outside_map0 1 set pfs group1
    crypto map outside_map0 1 set peer 10.22.19.254
    crypto map outside_map0 1 set transform-set ESP-3DES-SHA
    crypto map outside_map0 interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
     crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet 10.12.0.0 255.255.0.0 mgmt
    telnet timeout 30
    ssh 192.168.3.0 255.255.255.0 inside
    ssh 10.12.0.0 255.255.0.0 mgmt
    ssh timeout 30
    console timeout 0
    management-access outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    username admin password eY/fQXw7Ure8Qrz7 encrypted privilege 15
    tunnel-group 10.22.19.254 type ipsec-l2l
    tunnel-group 10.22.19.254 ipsec-attributes
     pre-shared-key *****
     isakmp keepalive threshold 60 retry 5
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:185bd689118ba24f9a0ef2f7e80494f6
    Can anybody help why my remote site can't connect to Internet.
    REgards,
    Raitsarevo

    Hi Carv,
    Thanks for your reply. i have done finally
    i used no crypto ipsec nat-transparency udp-encapsulation in my end router only.
    and in remote access VPN i have enabled UDP for client configuration. the most imprtant is i have given IP add of same LAN pool to VPN user,
    Regards,
    Satya.M

  • VPN Clients cannot access remote site

    Hey there,
    I am pretty new in configuring Cisco devices and now I need some help.
    I have 2 site here:
    site A
    Cisco 891
    external IP: 195.xxx.yyy.zzz
    VPN Gateway for Remote users
    local IP: VLAN10 10.133.10.0 /23
    site B
    Cisco 891
    external IP: 62.xxx.yyy.zzz
    local IP VLAN10 10.133.34.0 /23
    Those two sites are linked together with a Site-to-Site VPN. Accessing files or ressources from one site to the other is working fine while connected to the local LAN.
    I configured VPN connection with Radius auth. VPN clients can connect to Site A, get an IP adress from VPN Pool (172.16.100.2-100) and can access files and servers on site A. But for some reason they cannot access ressources on site B. I already added the site B network to the ACL and when connecting with VPN it shows secured routes to 10.133.10.0 and 10.133.34.0 in the statistics. Same thing for other VPN Tunnels to ERP system.
    What is missing here to make it possible to reach remote sites when connected through VPN? I had a look at the logs but could not find anything important.
    Here is the config of site A
    Building configuration...
    Current configuration : 24257 bytes
    version 15.2
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname Englerstrasse
    boot-start-marker
    boot config usbflash0:CVO-BOOT.CFG
    boot-end-marker
    aaa new-model
    aaa group server radius Radius-AD
    server 10.133.10.5 auth-port 1812 acct-port 1813
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_2 group Radius-AD local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    clock timezone Berlin 1 0
    clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
    crypto pki trustpoint TP-self-signed-27361994
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-27361994
    revocation-check none
    rsakeypair TP-self-signed-27361994
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki certificate chain TP-self-signed-27361994
    certificate self-signed 01
      30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 32373336 31393934 301E170D 31323038 32373038 30343238
      5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
      2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D323733 36313939
      3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B709
      64CE1874 BF812A9F 0B761522 892373B9 10F0BB52 6263DCDB F9877AA3 7BD34E53
      BCFDA45C 2A991777 4DDC7E6B 1FCEE36C B6E35679 C4A18771 9C0F871F 38310234
      2D89A4FF 37B616D8 362B3103 A8A319F2 10A72DC7 490A04AC 7955DF68 32EF9615
      9E1A3B31 2A1AB243 B3ED3E35 F4AAD029 CDB1F941 5E794300 5C5EF8AE 5C890203
      010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
      18301680 14D0F5E7 D3A9311D 1675AA8F 38F064FC 4D04465E F5301D06 03551D0E
      04160414 D0F5E7D3 A9311D16 75AA8F38 F064FC4D 04465EF5 300D0609 2A864886
      F70D0101 05050003 818100AB 2CD4363A E5ADBFB0 943A38CB AC820801 117B52CC
      20216093 79D1F777 2B3C0062 4301CF73 094B9CA5 805F585E 04CF3301 9B839DEB
      14A334A2 F5A5316F C65EEF21 0B0DF3B5 F4322440 F28B984B E769876D 6EF94895
      C3D5048A A4E2A180 12DF6652 176942F8 58187D7B D37B1F1A 4DDD7AE9 5189F9AF
      AF3EF676 26AD3F31 D368F5
          quit
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    no ip source-route
    ip auth-proxy max-login-attempts 5
    ip admission max-login-attempts 5
    no ip bootp server
    no ip domain lookup
    ip domain name yourdomain.com
    ip inspect log drop-pkt
    ip inspect name CCP_MEDIUM appfw CCP_MEDIUM
    ip inspect name CCP_MEDIUM ftp
    ip inspect name CCP_MEDIUM h323
    ip inspect name CCP_MEDIUM sip
    ip inspect name CCP_MEDIUM https
    ip inspect name CCP_MEDIUM icmp
    ip inspect name CCP_MEDIUM netshow
    ip inspect name CCP_MEDIUM rcmd
    ip inspect name CCP_MEDIUM realaudio
    ip inspect name CCP_MEDIUM rtsp
    ip inspect name CCP_MEDIUM sqlnet
    ip inspect name CCP_MEDIUM streamworks
    ip inspect name CCP_MEDIUM tftp
    ip inspect name CCP_MEDIUM udp
    ip inspect name CCP_MEDIUM vdolive
    ip inspect name CCP_MEDIUM imap reset
    ip inspect name CCP_MEDIUM smtp
    ip cef
    no ipv6 cef
    appfw policy-name CCP_MEDIUM
      application im aol
        service default action allow alarm
        service text-chat action allow alarm
        server permit name login.oscar.aol.com
        server permit name toc.oscar.aol.com
        server permit name oam-d09a.blue.aol.com
        audit-trail on
      application im msn
        service default action allow alarm
        service text-chat action allow alarm
        server permit name messenger.hotmail.com
        server permit name gateway.messenger.hotmail.com
        server permit name webmessenger.msn.com
        audit-trail on
      application http
        strict-http action allow alarm
        port-misuse im action reset alarm
        port-misuse p2p action reset alarm
        port-misuse tunneling action allow alarm
      application im yahoo
        service default action allow alarm
        service text-chat action allow alarm
        server permit name scs.msg.yahoo.com
        server permit name scsa.msg.yahoo.com
        server permit name scsb.msg.yahoo.com
        server permit name scsc.msg.yahoo.com
        server permit name scsd.msg.yahoo.com
        server permit name cs16.msg.dcn.yahoo.com
        server permit name cs19.msg.dcn.yahoo.com
        server permit name cs42.msg.dcn.yahoo.com
        server permit name cs53.msg.dcn.yahoo.com
        server permit name cs54.msg.dcn.yahoo.com
        server permit name ads1.vip.scd.yahoo.com
        server permit name radio1.launch.vip.dal.yahoo.com
        server permit name in1.msg.vip.re2.yahoo.com
        server permit name data1.my.vip.sc5.yahoo.com
        server permit name address1.pim.vip.mud.yahoo.com
        server permit name edit.messenger.yahoo.com
        server permit name messenger.yahoo.com
        server permit name http.pager.yahoo.com
        server permit name privacy.yahoo.com
        server permit name csa.yahoo.com
        server permit name csb.yahoo.com
        server permit name csc.yahoo.com
        audit-trail on
    parameter-map type inspect global
    log dropped-packets enable
    multilink bundle-name authenticated
    redundancy
    ip tcp synwait-time 10
    class-map match-any CCP-Transactional-1
    match dscp af21
    match dscp af22
    match dscp af23
    class-map match-any CCP-Voice-1
    match dscp ef
    class-map match-any sdm_p2p_kazaa
    match protocol fasttrack
    match protocol kazaa2
    class-map match-any CCP-Routing-1
    match dscp cs6
    class-map match-any sdm_p2p_edonkey
    match protocol edonkey
    class-map match-any CCP-Signaling-1
    match dscp cs3
    match dscp af31
    class-map match-any sdm_p2p_gnutella
    match protocol gnutella
    class-map match-any CCP-Management-1
    match dscp cs2
    class-map match-any sdm_p2p_bittorrent
    match protocol bittorrent
    policy-map sdm-qos-test-123
    class class-default
    policy-map sdmappfwp2p_CCP_MEDIUM
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    policy-map CCP-QoS-Policy-1
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    class CCP-Voice-1
      priority percent 33
    class CCP-Signaling-1
      bandwidth percent 5
    class CCP-Routing-1
      bandwidth percent 5
    class CCP-Management-1
      bandwidth percent 5
    class CCP-Transactional-1
      bandwidth percent 5
    class class-default
      fair-queue
      random-detect
    crypto ctcp port 10000
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key REMOVED address 62.20.xxx.yyy 
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 83.140.xxx.yyy  
    crypto isakmp client configuration group VPN_local
    key REMOVED
    dns 10.133.10.5 10.133.10.7
    wins 10.133.10.7
    domain domain.de
    pool SDM_POOL_2
    acl 115
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group VPN_local
       client authentication list ciscocp_vpn_xauth_ml_2
       isakmp authorization list ciscocp_vpn_group_ml_2
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA11 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA5 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA1 esp-des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA11
    set isakmp-profile ciscocp-ike-profile-1
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to62.20.xxx.xxx
    set peer 62.20.xxx.xxx
    set transform-set ESP-3DES-SHA
    match address 105
    crypto map SDM_CMAP_1 2 ipsec-isakmp
    description Tunnel to195.243.xxx.xxx
    set peer 195.243.xxx.xxx
    set transform-set ESP-3DES-SHA4
    match address 107
    crypto map SDM_CMAP_1 3 ipsec-isakmp
    description Tunnel to83.140.xxx.xxx
    set peer 83.140.xxx.xxx
    set transform-set ESP-DES-SHA1
    match address 118
    interface Loopback2
    ip address 192.168.10.1 255.255.254.0
    interface Null0
    no ip unreachables
    interface FastEthernet0
    switchport mode trunk
    no ip address
    spanning-tree portfast
    interface FastEthernet1
    no ip address
    spanning-tree portfast
    interface FastEthernet2
    no ip address
    spanning-tree portfast
    interface FastEthernet3
    no ip address
    spanning-tree portfast
    interface FastEthernet4
    description Internal LAN
    switchport access vlan 10
    switchport trunk native vlan 10
    no ip address
    spanning-tree portfast
    interface FastEthernet5
    no ip address
    spanning-tree portfast
    interface FastEthernet6
    no ip address
    spanning-tree portfast
    interface FastEthernet7
    no ip address
    spanning-tree portfast
    interface FastEthernet8
    description $FW_OUTSIDE$$ETH-WAN$
    ip address 62.153.xxx.xxx 255.255.255.248
    ip access-group 113 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip inspect CCP_MEDIUM out
    no ip virtual-reassembly in
    ip verify unicast reverse-path
    duplex auto
    speed auto
    crypto map SDM_CMAP_1
    service-policy input sdmappfwp2p_CCP_MEDIUM
    service-policy output CCP-QoS-Policy-1
    interface Virtual-Template1 type tunnel
    ip unnumbered FastEthernet8
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface GigabitEthernet0
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    no ip address
    interface Vlan10
    description $FW_INSIDE$
    ip address 10.133.10.1 255.255.254.0
    ip access-group 112 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat inside
    ip virtual-reassembly in
    interface Async1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    encapsulation slip
    ip local pool SDM_POOL_1 192.168.10.101 192.168.10.200
    ip local pool VPN_Pool 192.168.20.2 192.168.20.100
    ip local pool SDM_POOL_2 172.16.100.2 172.16.100.100
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip forward-protocol nd
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet8 overload
    ip route 0.0.0.0 0.0.0.0 62.153.xxx.xxx
    ip access-list extended VPN1
    remark VPN_Haberstrasse
    remark CCP_ACL Category=4
    permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    ip radius source-interface Vlan10
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 10.10.10.0 0.0.0.7
    access-list 23 remark CCP_ACL Category=17
    access-list 23 permit 195.243.xxx.xxx
    access-list 23 permit 10.133.10.0 0.0.1.255
    access-list 23 permit 10.10.10.0 0.0.0.7
    access-list 100 remark CCP_ACL Category=4
    access-list 100 permit ip 10.133.10.0 0.0.1.255 any
    access-list 101 remark CCP_ACL Category=16
    access-list 101 permit udp any eq bootps any eq bootpc
    access-list 101 deny   ip 10.10.10.0 0.0.0.255 any
    access-list 101 permit icmp any any echo-reply
    access-list 101 permit icmp any any time-exceeded
    access-list 101 permit icmp any any unreachable
    access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 101 deny   ip host 255.255.255.255 any
    access-list 101 deny   ip any any
    access-list 102 remark auto generated by CCP firewall configuration
    access-list 102 remark CCP_ACL Category=1
    access-list 102 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 102 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 102 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 102 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 102 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 102 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 102 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 102 deny   ip host 255.255.255.255 any
    access-list 102 deny   ip host 0.0.0.0 any
    access-list 102 deny   ip any any log
    access-list 103 remark auto generated by CCP firewall configuration
    access-list 103 remark CCP_ACL Category=1
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp any host 62.153.xxx.xxx
    access-list 103 permit ahp any host 62.153.xxx.xxx
    access-list 103 permit udp host 194.25.0.60 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 103 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 103 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 103 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 103 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 103 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 103 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 103 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 103 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 103 deny   ip host 255.255.255.255 any
    access-list 103 deny   ip host 0.0.0.0 any
    access-list 103 deny   ip any any log
    access-list 104 remark CCP_ACL Category=4
    access-list 104 permit ip 10.133.10.0 0.0.1.255 any
    access-list 105 remark CCP_ACL Category=4
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 remark CCP_ACL Category=2
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 permit ip 10.10.10.0 0.0.0.7 any
    access-list 106 permit ip 10.133.10.0 0.0.1.255 any
    access-list 107 remark CCP_ACL Category=4
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 108 remark Auto generated by SDM Management Access feature
    access-list 108 remark CCP_ACL Category=1
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq telnet
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 22
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq www
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 443
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq cmd
    access-list 108 deny   tcp any host 10.133.10.1 eq telnet
    access-list 108 deny   tcp any host 10.133.10.1 eq 22
    access-list 108 deny   tcp any host 10.133.10.1 eq www
    access-list 108 deny   tcp any host 10.133.10.1 eq 443
    access-list 108 deny   tcp any host 10.133.10.1 eq cmd
    access-list 108 deny   udp any host 10.133.10.1 eq snmp
    access-list 108 permit ip any any
    access-list 109 remark CCP_ACL Category=1
    access-list 109 permit ip 10.133.10.0 0.0.1.255 any
    access-list 109 permit ip 10.10.10.0 0.0.0.7 any
    access-list 109 permit ip 192.168.10.0 0.0.1.255 any
    access-list 110 remark CCP_ACL Category=1
    access-list 110 permit ip host 195.243.xxx.xxx any
    access-list 110 permit ip host 84.44.xxx.xxx any
    access-list 110 permit ip 10.133.10.0 0.0.1.255 any
    access-list 110 permit ip 10.10.10.0 0.0.0.7 any
    access-list 110 permit ip 192.168.10.0 0.0.1.255 any
    access-list 111 remark CCP_ACL Category=4
    access-list 111 permit ip 10.133.10.0 0.0.1.255 any
    access-list 112 remark CCP_ACL Category=1
    access-list 112 permit udp host 10.133.10.5 eq 1812 any
    access-list 112 permit udp host 10.133.10.5 eq 1813 any
    access-list 112 permit udp any host 10.133.10.1 eq non500-isakmp
    access-list 112 permit udp any host 10.133.10.1 eq isakmp
    access-list 112 permit esp any host 10.133.10.1
    access-list 112 permit ahp any host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1645 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1646 host 10.133.10.1
    access-list 112 remark auto generated by CCP firewall configuration
    access-list 112 permit udp host 10.133.10.5 eq 1812 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1813 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.7 eq domain any
    access-list 112 permit udp host 10.133.10.5 eq domain any
    access-list 112 deny   ip 62.153.xxx.xxx 0.0.0.7 any
    access-list 112 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 112 deny   ip host 255.255.255.255 any
    access-list 112 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 112 permit ip any any
    access-list 113 remark CCP_ACL Category=1
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ahp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ip host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit ip host 84.44.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark auto generated by CCP firewall configuration
    access-list 113 permit udp host 194.25.0.60 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp host 194.25.0.60 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp any host 62.153.xxx.xxx
    access-list 113 permit ahp any host 62.153.xxx.xxx
    access-list 113 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 remark Pop3
    access-list 113 permit tcp host 82.127.xxx.xxx eq 8080 host 62.153.xxx.xxx
    access-list 113 remark Pop3
    access-list 113 permit tcp any eq pop3 host 62.153.xxx.xxx
    access-list 113 remark SMTP
    access-list 113 permit tcp any eq 465 host 62.153.xxx.xxx
    access-list 113 remark IMAP
    access-list 113 permit tcp any eq 587 host 62.153.xxx.xxx
    access-list 113 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 113 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 113 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 113 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 113 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 113 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 113 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 113 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 113 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 113 deny   ip host 255.255.255.255 any
    access-list 113 deny   ip host 0.0.0.0 any
    access-list 113 deny   ip any any log
    access-list 114 remark auto generated by CCP firewall configuration
    access-list 114 remark CCP_ACL Category=1
    access-list 114 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 114 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 114 permit icmp any any echo-reply
    access-list 114 permit icmp any any time-exceeded
    access-list 114 permit icmp any any unreachable
    access-list 114 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 114 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 114 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 114 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 114 deny   ip host 255.255.255.255 any
    access-list 114 deny   ip host 0.0.0.0 any
    access-list 114 deny   ip any any log
    access-list 115 remark VPN_Sub
    access-list 115 remark CCP_ACL Category=5
    access-list 115 permit ip 10.133.10.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.34.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.20.0 0.0.0.255 any
    access-list 116 remark CCP_ACL Category=4
    access-list 116 remark IPSec Rule
    access-list 116 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 117 remark CCP_ACL Category=4
    access-list 117 remark IPSec Rule
    access-list 117 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark CCP_ACL Category=4
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    no cdp run
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    control-plane
    mgcp profile default
    line con 0
    transport output telnet
    line 1
    modem InOut
    speed 115200
    flowcontrol hardware
    line aux 0
    transport output telnet
    line vty 0 4
    session-timeout 45
    access-class 110 in
    transport input telnet ssh
    line vty 5 15
    access-class 109 in
    transport input telnet ssh
    scheduler interval 500
    end

    The crypto ACL for the site to site vpn should also include the vpn client pool, otherwise, traffic from the vpn client does not match the interesting traffic for the site to site vpn.
    On Site A:
    should include "access-list 107 permit ip 172.16.100.0 0.0.0.255 10.133.34.0 0.0.1.255"
    You should also remove the following line as the pool is incorrect:
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    On Site B:
    should include: permit ip 10.133.34.0 0.0.1.255 172.16.100.0 0.0.0.255"
    NAT exemption on site B should also be configured with deny on the above ACL.

  • Cisco ASA 5505 IPSec tunnel won't establish until remote site attempts to connect

    I have a site to site IPSec tunnel setup and operational but periodically the remote site goes down, because of a somewhat reliable internet connection. The only way to get the tunnel to re-establish is to go to the remote site and simply issue a ping from a workstation on the remote network. We were having this same issue with a Cisco PIX 506E but decided to upgrade the hardware and see if that resolve the issue. It ran for well over a year and our assumtions was that the issue was resolved. I was looking in the direction of the security-association lifetime but if we power cycle the unit, I would expect that it would kill the SA but even after power cycling, the VPN does not come up automatically.
    Any assistance would be appreciated.
    ASA Version 8.2(1)
    hostname KRPS-FW
    domain-name lottonline.org
    enable password uniQue
    passwd uniQue
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.20.30.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address xxx.xxx.xxx.xxx 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    description Inside Network on VLAN1
    interface Ethernet0/2
    shutdown
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    description Inside Network on VLAN1
    ftp mode passive
    dns server-group DefaultDNS
    domain-name lottonline.org
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group OUTSIDE_ACCESS_IN in interface outside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.20.30.0 255.255.255.0 inside
    http 10.20.20.0 255.255.255.0 inside
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map DYNMAP 65535 set transform-set ESP-AES-256-SHA
    crypto map VPNMAP 1 match address KWPS-BITP
    crypto map VPNMAP 1 set peer xxx.xxx.xxx.001
    crypto map VPNMAP 1 set transform-set ESP-AES-256-SHA
    crypto map VPNMAP 65535 ipsec-isakmp dynamic DYNMAP
    crypto map VPNMAP interface outside
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    ssh timeout 5
    console timeout 0
    management-access inside
    tunnel-group xxx.xxx.xxx.001 type ipsec-l2l
    tunnel-group xxx.xxx.xxx.001 ipsec-attributes
    pre-shared-key somekey

    Hi there,
    I had same issue with PIX 506E and it was not even a circuit issue and I got ride of it and problem got fixed with PIX515E
    I don't know, the device is too old to stay alive.
    thanks

  • Remote site to site VPN user cannot access LAN resources

    Users in remote site can get ping response but no http service from local web server where the local web server also has NAT rule allowing access from WAN. In the below config, users in remote 10.10.10.160/27 can ping 10.10.10.30 and 10.10.10.95, but http packets are not returned.
    What do I need to do to fix this?
    version 15.1
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname SFGallery
    boot-start-marker
    boot-end-marker
    no logging buffered
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authentication login ciscocp_vpn_xauth_ml_2 local
    aaa authentication login ciscocp_vpn_xauth_ml_3 group radius local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    clock timezone PCTime -7 0
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    no ipv6 cef
    ip source-route
    ip cef
    ip dhcp excluded-address 172.16.0.1 172.16.3.99
    ip dhcp excluded-address 172.16.3.200 172.16.3.254
    ip dhcp pool SFGallery172
    import all
    network 172.16.0.0 255.255.252.0
    domain-name xxxxxxxxxxxx
    dns-server 10.10.10.10
    default-router 10.10.10.94
    netbios-name-server 10.10.10.10
    ip domain name gpgallery.com
    ip name-server 10.10.10.10
    ip name-server 8.8.8.8
    ip name-server 8.8.4.4
    ip name-server 10.10.10.80
    multilink bundle-name authenticated
    crypto pki token default removal timeout 0
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki trustpoint SFGallery_Certificate
    enrollment selfsigned
    serial-number none
    ip-address none
    revocation-check crl
    rsakeypair SFGallery_Certificate_RSAKey 512
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    crypto pki certificate chain SFGallery_Certificate
    certificate self-signed 01
    xxxxxx
    quit
    license udi pid CISCO2911/K9 sn FTX1542AKJ3
    license boot module c2900 technology-package securityk9
    license boot module c2900 technology-package datak9
    hw-module sm 1
    object-group network Corp
    172.16.4.0 255.255.252.0
    10.10.10.128 255.255.255.224
    object-group network SFGallery
    172.16.0.0 255.255.252.0
    10.10.10.0 255.255.255.128
    object-group network NY
    10.10.10.160 255.255.255.224
    172.16.16.0 255.255.252.0
    object-group network GPAll
    group-object SFGallery
    group-object NY
    group-object Corp
    username xxx
    username xxx
    username xxx
    username xxx
    redundancy
    no ip ftp passive
    ip ssh version 1
    class-map type inspect match-all CCP_SSLVPN
    match access-group name CCP_IP
    policy-map type inspect ccp-sslvpn-pol
    class type inspect CCP_SSLVPN
    pass
    zone security sslvpn-zone
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key TempVPN1# address xx.xx.xx.xx
    crypto isakmp client configuration group SFGallery
    key Peters2011
    dns 10.10.10.10 10.10.10.80
    wins 10.10.10.10 10.10.10.80
    domain gpgallery.com
    pool SDM_POOL_1
    acl 111
    save-password
    split-dns gpgallery.com
    max-users 25
    max-logins 3
    netmask 255.255.252.0
    banner ^CYou are now connected to the Santa Fe Gallery and Corp. ^C
    crypto isakmp profile ciscocp-ike-profile-1
    match identity group SFGallery
    client authentication list ciscocp_vpn_xauth_ml_3
    isakmp authorization list ciscocp_vpn_group_ml_2
    client configuration address respond
    virtual-template 3
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set security-association idle-time 43200
    set transform-set ESP-3DES-SHA3
    set isakmp-profile ciscocp-ike-profile-1
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel toxx.xx.xx.xx
    set peer xx.xx.xx.xx
    set transform-set ESP-3DES-SHA1
    match address 107
    reverse-route
    interface Loopback1
    ip address 192.168.5.1 255.255.255.0
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    description T1 Cybermesa$ETH-WAN$
    ip address xx.xx.xx.xx 255.255.255.240
    ip access-group 105 in
    ip nat outside
    ip virtual-reassembly in
    duplex auto
    speed auto
    crypto map SDM_CMAP_1
    interface GigabitEthernet0/1
    description LANOverloadNet$ETH-WAN$
    no ip address
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    interface GigabitEthernet0/2
    description LAN$ETH-LAN$
    ip address 10.10.10.2 255.255.255.128
    ip access-group 100 in
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    interface FastEthernet0/0/0
    ip address 192.168.100.1 255.255.255.0
    ip access-group ReplicationIN out
    duplex auto
    speed auto
    interface GigabitEthernet1/0
    description $ETH-LAN$
    ip address 172.16.0.1 255.255.252.0
    ip nat inside
    ip virtual-reassembly in
    interface GigabitEthernet1/1
    description Internal switch interface connected to EtherSwitch Service Module
    no ip address
    interface Virtual-Template1 type tunnel
    ip unnumbered Loopback1
    interface Virtual-Template2
    ip unnumbered Loopback1
    zone-member security sslvpn-zone
    interface Virtual-Template3 type tunnel
    ip unnumbered GigabitEthernet0/0
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface Vlan1
    no ip address
    ip local pool SDM_POOL_1 172.16.3.200 172.16.3.254
    ip forward-protocol nd
    ip http server
    ip http access-class 1
    ip http authentication local
    no ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip flow-top-talkers
    top 10
    sort-by bytes
    cache-timeout 60000
    ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload
    ip nat inside source route-map SDM_RMAP_4 interface GigabitEthernet0/0 overload
    ip nat inside source static tcp 10.10.10.95 22 xx.xx.xx.xx extendable
    ip nat inside source static udp 10.10.10.95 22 xx.xx.xx.xx extendable
    ip nat inside source static tcp 10.10.10.95 25 xx.xx.xx.xx extendable
    ip nat inside source static udp 10.10.10.95 25 xx.xx.xx.xx 25 extendable
    ip nat inside source static tcp 10.10.10.95 80 xx.xx.xx.xx 80 extendable
    ip nat inside source static udp 10.10.10.95 80 xx.xx.xx.xx 80 extendable
    ip nat inside source static tcp 10.10.10.95 443 xx.xx.xx.xx 443 extendable
    ip nat inside source static udp 10.10.10.95 443 xx.xx.xx.xx 443 extendable
    ip nat inside source static tcp 10.10.10.30 80 xx.xx.xx.xx 80 extendable
    ip nat inside source static tcp 10.10.10.104 80 xx.xx.xx.xx 80 extendable
    ip nat inside source static tcp 10.10.10.37 26 xx.xx.xx.xx 25 extendable
    ip nat inside source static udp 10.10.10.37 26 xx.xx.xx.xx 25 extendable
    ip nat inside source static tcp 10.10.10.115 80 xx.xx.xx.xx 80 extendable
    ip nat inside source static tcp 10.10.10.115 443 xx.xx.xx.xx 443 extendable
    ip nat inside source static tcp 10.10.10.80 443 xx.xx.xx.xx 443 extendable
    ip nat inside source static tcp 10.10.10.47 26 xx.xx.xx.xx 25 extendable
    ip nat inside source static udp 10.10.10.47 26 xx.xx.xx.xx 25 extendable
    ip route 0.0.0.0 0.0.0.0 xx.xx.xx.xx permanent
    ip route 10.10.10.0 255.255.255.128 GigabitEthernet0/2 10 permanent
    ip route 10.10.10.44 255.255.255.255 10.10.10.1 permanent
    ip route 10.10.10.128 255.255.255.224 10.10.10.126 permanent
    ip route 10.10.10.172 255.255.255.255 10.10.10.3 permanent
    ip route 10.10.10.175 255.255.255.255 10.10.10.3 permanent
    ip route 10.10.10.177 255.255.255.255 10.10.10.3 permanent
    ip route 172.16.4.0 255.255.252.0 10.10.10.126 permanent
    ip route 192.168.100.0 255.255.255.0 FastEthernet0/0/0 permanent
    ip route 192.168.101.0 255.255.255.0 10.10.10.126 permanent
    ip access-list extended CCP_IP
    remark CCP_ACL Category=128
    permit ip any any
    ip access-list extended ReplicationIN
    remark CCP_ACL Category=1
    permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    deny   ip any any
    ip access-list extended ReplicationOUT
    remark CCP_ACL Category=1
    deny   ip any any
    no logging trap
    logging 10.10.10.107
    access-list 1 permit 192.168.1.2
    access-list 1 remark CCP_ACL Category=1
    access-list 1 permit 72.216.51.56 0.0.0.7
    access-list 1 permit 172.16.0.0 0.0.3.255
    access-list 1 permit 172.16.4.0 0.0.3.255
    access-list 1 permit 10.10.10.128 0.0.0.31
    access-list 1 remark Auto generated by SDM Management Access feature
    access-list 1 permit xx.xx.xx.xx 0.0.0.15
    access-list 1 permit 10.10.10.0 0.0.0.127
    access-list 100 remark Auto generated by SDM Management Access feature
    access-list 100 remark CCP_ACL Category=1
    access-list 100 permit tcp object-group GPAll object-group NY eq www
    access-list 100 permit udp host 10.10.10.10 eq 1645 host 10.10.10.2
    access-list 100 permit udp host 10.10.10.10 eq 1646 host 10.10.10.2
    access-list 100 permit ip any host 10.10.10.2
    access-list 100 permit tcp object-group GPAll host 10.10.10.2 eq telnet
    access-list 100 permit tcp 172.16.4.0 0.0.3.255 host 10.10.10.2 eq telnet
    access-list 100 permit tcp 10.10.10.128 0.0.0.31 host 10.10.10.2 eq telnet
    access-list 100 permit tcp 10.10.10.0 0.0.0.127 host 10.10.10.2 eq telnet
    access-list 100 permit tcp object-group GPAll host 10.10.10.2 eq 22
    access-list 100 permit tcp 172.16.4.0 0.0.3.255 host 10.10.10.2 eq 22
    access-list 100 permit tcp 10.10.10.128 0.0.0.31 host 10.10.10.2 eq 22
    access-list 100 permit tcp 10.10.10.0 0.0.0.127 host 10.10.10.2 eq 22
    access-list 100 permit tcp object-group GPAll host 10.10.10.2 eq www
    access-list 100 permit tcp 172.16.4.0 0.0.3.255 host 10.10.10.2 eq www
    access-list 100 permit tcp 10.10.10.128 0.0.0.31 host 10.10.10.2 eq www
    access-list 100 permit tcp 10.10.10.0 0.0.0.127 host 10.10.10.2 eq www
    access-list 100 permit tcp object-group GPAll host 10.10.10.2 eq 443
    access-list 100 permit tcp 172.16.4.0 0.0.3.255 host 10.10.10.2 eq 443
    access-list 100 permit tcp 10.10.10.128 0.0.0.31 host 10.10.10.2 eq 443
    access-list 100 permit tcp 10.10.10.0 0.0.0.127 host 10.10.10.2 eq 443
    access-list 100 permit tcp object-group GPAll host 10.10.10.2 eq cmd
    access-list 100 permit tcp 172.16.4.0 0.0.3.255 host 10.10.10.2 eq cmd
    access-list 100 permit tcp 10.10.10.128 0.0.0.31 host 10.10.10.2 eq cmd
    access-list 100 permit tcp 10.10.10.0 0.0.0.127 host 10.10.10.2 eq cmd
    access-list 100 deny   tcp any host 10.10.10.2 eq telnet
    access-list 100 deny   tcp any host 10.10.10.2 eq 22
    access-list 100 deny   tcp any host 10.10.10.2 eq www
    access-list 100 deny   tcp any host 10.10.10.2 eq 443
    access-list 100 deny   tcp any host 10.10.10.2 eq cmd
    access-list 100 deny   udp any host 10.10.10.2 eq snmp
    access-list 100 permit udp any eq domain host 10.10.10.2
    access-list 100 permit udp host 10.10.10.80 eq domain any
    access-list 100 permit udp host 10.10.10.10 eq domain any
    access-list 100 permit ip any any
    access-list 101 remark Auto generated by SDM Management Access feature
    access-list 101 remark CCP_ACL Category=1
    access-list 101 permit ip 72.216.51.56 0.0.0.7 any
    access-list 101 permit ip 172.16.0.0 0.0.3.255 any
    access-list 101 permit ip 172.16.4.0 0.0.3.255 any
    access-list 101 permit ip 10.10.10.128 0.0.0.31 any
    access-list 101 permit ip xx.xx.xx.xx 0.0.0.15 any
    access-list 101 permit ip host 192.168.1.2 any
    access-list 101 permit ip 10.10.10.0 0.0.0.127 any
    access-list 102 remark Auto generated by SDM Management Access feature
    access-list 102 remark CCP_ACL Category=1
    access-list 102 permit ip 72.216.51.56 0.0.0.7 any
    access-list 102 permit ip 172.16.0.0 0.0.3.255 any
    access-list 102 permit ip 172.16.4.0 0.0.3.255 any
    access-list 102 permit ip 10.10.10.128 0.0.0.31 any
    access-list 102 permit ip xx.xx.xx.xx 0.0.0.15 any
    access-list 102 permit ip host 192.168.1.2 any
    access-list 102 permit ip 10.10.10.0 0.0.0.127 any
    access-list 103 remark Auto generated by SDM Management Access feature
    access-list 103 remark CCP_ACL Category=1
    access-list 103 permit tcp host 192.168.1.2 host 172.16.0.1 eq telnet
    access-list 103 permit tcp host 192.168.1.2 host 172.16.0.1 eq 22
    access-list 103 permit tcp host 192.168.1.2 host 172.16.0.1 eq www
    access-list 103 permit tcp host 192.168.1.2 host 172.16.0.1 eq 443
    access-list 103 permit tcp host 192.168.1.2 host 172.16.0.1 eq cmd
    access-list 103 deny   tcp any host 172.16.0.1 eq telnet
    access-list 103 deny   tcp any host 172.16.0.1 eq 22
    access-list 103 deny   tcp any host 172.16.0.1 eq www
    access-list 103 deny   tcp any host 172.16.0.1 eq 443
    access-list 103 deny   tcp any host 172.16.0.1 eq cmd
    access-list 103 deny   udp any host 172.16.0.1 eq snmp
    access-list 103 permit ip any any
    access-list 104 remark CCP_ACL Category=4
    access-list 104 remark IPSec Rule
    access-list 104 permit ip 10.10.10.0 0.0.0.255 10.10.10.0 0.0.0.255
    access-list 104 permit ip 10.10.10.0 0.0.0.255 10.10.10.160 0.0.0.31
    access-list 105 remark Auto generated by SDM Management Access feature
    access-list 105 remark CCP_ACL Category=1
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.10.10.160 0.0.0.31 10.10.10.128 0.0.0.31
    access-list 105 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.10.10.160 0.0.0.31 172.16.0.0 0.0.255.255
    access-list 105 permit ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
    access-list 105 permit ip 10.10.10.0 0.0.0.255 172.16.0.0 0.0.255.255
    access-list 105 permit ip 172.16.0.0 0.0.255.255 10.10.10.0 0.0.0.255
    access-list 105 permit tcp 72.216.51.56 0.0.0.7 host xx.xx.xx.xx eq telnet
    access-list 105 permit tcp 172.16.0.0 0.0.3.255 host xx.xx.xx.xx eq telnet
    access-list 105 permit tcp xx.xx.xx.xx 0.0.0.15 host xx.xx.xx.xx eq telnet
    access-list 105 permit tcp 72.216.51.56 0.0.0.7 host xx.xx.xx.xx eq 22
    access-list 105 permit tcp 172.16.0.0 0.0.3.255 host xx.xx.xx.xx eq 22
    access-list 105 permit tcp xx.xx.xx.xx 0.0.0.15 host xx.xx.xx.xx eq 22
    access-list 105 permit tcp 72.216.51.56 0.0.0.7 host xx.xx.xx.xx eq www
    access-list 105 permit tcp 172.16.0.0 0.0.3.255 host xx.xx.xx.xx eq www
    access-list 105 permit tcp xx.xx.xx.xx 0.0.0.15 host xx.xx.xx.xx eq www
    access-list 105 permit tcp 72.216.51.56 0.0.0.7 host xx.xx.xx.xx eq 443
    access-list 105 permit tcp 172.16.0.0 0.0.3.255 host xx.xx.xx.xx eq 443
    access-list 105 permit tcp xx.xx.xx.xx 0.0.0.15 host xx.xx.xx.xx eq 443
    access-list 105 permit tcp 72.216.51.56 0.0.0.7 host xx.xx.xx.xx eq cmd
    access-list 105 permit tcp 172.16.0.0 0.0.3.255 host xx.xx.xx.xx eq cmd
    access-list 105 permit tcp xx.xx.xx.xx 0.0.0.15 host xx.xx.xx.xx eq cmd
    access-list 105 deny   tcp any host xx.xx.xx.xx eq telnet
    access-list 105 deny   tcp any host xx.xx.xx.xx eq 22
    access-list 105 deny   tcp any host xx.xx.xx.xx eq www
    access-list 105 deny   tcp any host xx.xx.xx.xx eq 443
    access-list 105 deny   tcp any host xx.xx.xx.xx eq cmd
    access-list 105 deny   udp any host xx.xx.xx.xx eq snmp
    access-list 105 permit tcp any host xx.xx.xx.xx eq 443
    access-list 105 permit ip 10.10.10.160 0.0.0.31 10.10.10.0 0.0.0.127
    access-list 105 permit udp any eq domain host xx.xx.xx.xx
    access-list 105 permit ahp host 209.101.19.226 host xx.xx.xx.xx
    access-list 105 permit esp host 209.101.19.226 host xx.xx.xx.xx
    access-list 105 permit udp host 209.101.19.226 host xx.xx.xx.xx eq isakmp
    access-list 105 permit udp host 209.101.19.226 host xx.xx.xx.xx eq non500-isakmp
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.10.10.0 0.0.0.127 10.10.10.0 0.0.0.127
    access-list 105 permit ip any any
    access-list 106 remark CCP_ACL Category=2
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.10.10.128 0.0.0.31 10.10.10.160 0.0.0.31
    access-list 106 deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 172.16.0.0 0.0.255.255 10.10.10.160 0.0.0.31
    access-list 106 deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
    access-list 106 deny   ip 172.16.0.0 0.0.255.255 10.10.10.0 0.0.0.255
    access-list 106 deny   ip 10.10.10.0 0.0.0.255 172.16.0.0 0.0.255.255
    access-list 106 deny   ip 10.10.10.0 0.0.0.127 10.10.10.160 0.0.0.31
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.10.10.0 0.0.0.127 10.10.10.0 0.0.0.127
    access-list 106 permit ip 10.10.10.0 0.0.0.255 any
    access-list 107 remark CCP_ACL Category=4
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 10.10.10.0 0.0.0.127 10.10.10.160 0.0.0.31
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 10.10.10.128 0.0.0.31 10.10.10.160 0.0.0.31
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 172.16.0.0 0.0.255.255 10.10.10.160 0.0.0.31
    access-list 107 permit ip 10.10.10.0 0.0.0.255 172.16.0.0 0.0.255.255
    access-list 107 permit ip 172.16.0.0 0.0.255.255 10.10.10.0 0.0.0.255
    access-list 107 permit ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
    access-list 107 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    access-list 107 remark IPSec Rule
    access-list 107 deny   ip 172.16.0.0 0.0.255.255 host 10.10.10.177
    access-list 108 remark CCP_ACL Category=2
    access-list 108 remark IPSec Rule
    access-list 108 deny   ip 10.10.10.0 0.0.0.255 10.10.10.160 0.0.0.31
    access-list 108 permit ip 70.56.215.0 0.0.0.255 any
    access-list 109 remark CCP_ACL Category=2
    access-list 109 remark IPSec Rule
    access-list 109 deny   ip 10.10.10.128 0.0.0.31 10.10.10.160 0.0.0.31
    access-list 109 remark IPSec Rule
    access-list 109 deny   ip 10.10.10.0 0.0.0.127 10.10.10.160 0.0.0.31
    access-list 109 deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    access-list 109 remark IPSec Rule
    access-list 109 deny   ip 172.16.0.0 0.0.255.255 10.10.10.160 0.0.0.31
    access-list 109 deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
    access-list 109 deny   ip 172.16.0.0 0.0.255.255 10.10.10.0 0.0.0.255
    access-list 109 deny   ip 10.10.10.0 0.0.0.255 172.16.0.0 0.0.255.255
    access-list 109 permit ip 172.16.0.0 0.0.255.255 any
    access-list 111 remark CCP_ACL Category=4
    access-list 111 permit ip 10.10.10.0 0.0.0.127 any
    access-list 111 permit ip 10.10.10.128 0.0.0.31 any
    access-list 111 permit ip 172.16.0.0 0.0.3.255 any
    access-list 111 permit ip 172.16.4.0 0.0.3.255 any
    access-list 111 permit ip 10.10.10.160 0.0.0.31 any
    route-map SDM_RMAP_4 permit 1
    match ip address 109
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    route-map SDM_RMAP_2 permit 1
    match ip address 108
    snmp-server community public RO
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps vrrp
    snmp-server enable traps transceiver all
    snmp-server enable traps ds1
    snmp-server enable traps call-home message-send-fail server-fail
    snmp-server enable traps tty
    snmp-server enable traps eigrp
    snmp-server enable traps ospf state-change
    snmp-server enable traps ospf errors
    snmp-server enable traps ospf retransmit
    snmp-server enable traps ospf lsa
    snmp-server enable traps ospf cisco-specific state-change nssa-trans-change
    snmp-server enable traps ospf cisco-specific state-change shamlink interface
    snmp-server enable traps ospf cisco-specific state-change shamlink neighbor
    snmp-server enable traps ospf cisco-specific errors
    snmp-server enable traps ospf cisco-specific retransmit
    snmp-server enable traps ospf cisco-specific lsa
    snmp-server enable traps license
    snmp-server enable traps envmon
    snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config
    snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up
    snmp-server enable traps flash insertion removal
    snmp-server enable traps c3g
    snmp-server enable traps ds3
    snmp-server enable traps adslline
    snmp-server enable traps vdsl2line
    snmp-server enable traps icsudsu
    snmp-server enable traps isdn call-information
    snmp-server enable traps isdn layer2
    snmp-server enable traps isdn chan-not-avail
    snmp-server enable traps isdn ietf
    snmp-server enable traps ds0-busyout
    snmp-server enable traps ds1-loopback
    snmp-server enable traps energywise
    snmp-server enable traps vstack
    snmp-server enable traps mac-notification
    snmp-server enable traps bgp
    snmp-server enable traps isis
    snmp-server enable traps rf
    snmp-server enable traps aaa_server
    snmp-server enable traps atm subif
    snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-change inconsistency
    snmp-server enable traps memory bufferpeak
    snmp-server enable traps cnpd
    snmp-server enable traps config-copy
    snmp-server enable traps config
    snmp-server enable traps config-ctid
    snmp-server enable traps entity
    snmp-server enable traps fru-ctrl
    snmp-server enable traps resource-policy
    snmp-server enable traps event-manager
    snmp-server enable traps frame-relay multilink bundle-mismatch
    snmp-server enable traps frame-relay
    snmp-server enable traps frame-relay subif
    snmp-server enable traps hsrp
    snmp-server enable traps ipmulticast
    snmp-server enable traps msdp
    snmp-server enable traps mvpn
    snmp-server enable traps nhrp nhs
    snmp-server enable traps nhrp nhc
    snmp-server enable traps nhrp nhp
    snmp-server enable traps nhrp quota-exceeded
    snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
    snmp-server enable traps pppoe
    snmp-server enable traps cpu threshold
    snmp-server enable traps rsvp
    snmp-server enable traps syslog
    snmp-server enable traps l2tun session
    snmp-server enable traps l2tun pseudowire status
    snmp-server enable traps vtp
    snmp-server enable traps ipsla
    snmp-server enable traps bfd
    snmp-server enable traps firewall serverstatus
    snmp-server enable traps isakmp policy add
    snmp-server enable traps isakmp policy delete
    snmp-server enable traps isakmp tunnel start
    snmp-server enable traps isakmp tunnel stop
    snmp-server enable traps ipsec cryptomap add
    snmp-server enable traps ipsec cryptomap delete
    snmp-server enable traps ipsec cryptomap attach
    snmp-server enable traps ipsec cryptomap detach
    snmp-server enable traps ipsec tunnel start
    snmp-server enable traps ipsec tunnel stop
    snmp-server enable traps ipsec too-many-sas
    snmp-server enable traps vrfmib vrf-up vrf-down vnet-trunk-up vnet-trunk-down
    snmp-server host 10.10.10.107 public
    radius-server host 10.10.10.10 key HelloSFGal1#
    control-plane
    banner login ^CCCWelcome to Santa Fe Gallery Cisco 2911 router 10.10.10.1.^C
    line con 0
    line aux 0
    line 2
    no activation-character
    no exec
    transport preferred none
    transport input all
    transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
    stopbits 1
    line 67
    no activation-character
    no exec
    transport preferred none
    transport input all
    transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
    stopbits 1
    flowcontrol software
    line vty 0 4
    access-class 102 in
    transport input telnet
    line vty 5 15
    access-class 101 in
    transport input telnet
    scheduler allocate 20000 1000
    end

    Thanks so much, Herbert.
    As an alternative to what you suggest, what do you think of this? I got it from Cisco's support document, http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094634.shtml
    I would delete these lines:
    no ip nat inside source static tcp 10.10.10.95 80 [outside IP) 80 extendable
    no ip nat inside source static udp 10.10.10.95 80 [outside IP) 80 extendable
    no ip nat inside source static tcp 10.10.10.95 443 [outside IP) 443 extendable
    no ip nat inside source static udp 10.10.10.95 443 [outside IP) 443 extendable
    no ip nat inside source static tcp 10.10.10.30 80 [outside IP) 80 extendable
    and replace with these
    ip nat inside source static tcp 10.10.10.95 80 [outside IP) 80 route-map nonat extendable
    ip nat inside source static udp 10.10.10.95 80 [outside IP) 80 route-map nonat extendable
    ip nat inside source static tcp 10.10.10.95 443 [outside IP) 443 route-map nonat extendable
    ip nat inside source static udp 10.10.10.95 443 [outside IP) 443 route-map nonat extendable
    ip nat inside source static tcp 10.10.10.30 80 [outside IP) 80 route-map nonat extendable
    Then add:
    access-list 150 deny   ip host 10.10.10.95 10.10.10.160 0.0.0.31
    access-list 150 deny   ip host 10.10.10.95 172.16.8.0 0.0.3.255
    access-list 150 deny   ip host 10.10.10.130 10.10.10.160 0.0.0.31
    access-list 150 deny   ip host 10.10.10.130 172.16.8.0 0.0.3.255
    access-list 150 permit ip host 10.10.10.95 any
    access-list 150 permit ip host 10.10.10.130 any
    route-map nonat permit 10
    match ip address 150

  • What is a remote site???

    I am really having trouble setting up a website, all I want
    is to be able to customize my ebay page. I went throught the
    tutorial twice and I can't figure out what a remote site is, is
    www.godaddy.com a remote site, if so what product of theirs do I
    purchase to make my dreamweaver page work???
    thanks,
    N. McGillis

    Remote Site is the FTP connection to a website on the www.
    That wouldn't be possible with an ebay page.
    "nickcole" <[email protected]> wrote in
    message
    news:e9oqs3$a5t$[email protected]..
    >I am really having trouble setting up a website, all I
    want is to be able
    >to
    > customize my ebay page. I went throught the tutorial
    twice and I can't
    > figure
    > out what a remote site is, is www.godaddy.com a remote
    site, if so what
    > product
    > of theirs do I purchase to make my dreamweaver page
    work???
    > thanks,
    > N. McGillis
    >

  • SharePoint Online - "Unable to connect to remote server"

    Hi,
    I have a Provider Hosted App which gets the data from a different site collection. Now, when i try to connect to a different site collection, the TokenHelper
    class gives me an error -  "Unable to connect to remote server". 
    The error is thrown in the below line:
    acsMetadata = webClient.DownloadData(acsMetadataEndpointUrlWithRealm);
    The above error is not thrown always. It throws occasionally. I am not getting the reason for this. Could anybody explain what is the problem, please? 

    Hi,
    According to your description, my understanding is that the error "Unable to connect to remote server" occurs in the WebClient.DownloadData Function.
    As this error throws occasionally, it should be related to the network issue, for a better troubleshooting, I suggest you can check the detailed error message using Fiddler.
    Fiddler
    Thanks
    Best Regards
    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
    [email protected]

  • Login wizard - CF9 server - "Coldfusion not is not running on the remote site" - YES it is!

    I use Dreamweaver to upkeep sites for several friends and clients. When I use the login wizzard on a server with CF8, it works fine. If I use it on a server with CF9, I can't get past the *Coldfusion not is not running on the remote site* error. Yes it is running.  I've tried connecting using FTP, RDS, directly over the network - you name it.  Same error.
    Any suggestions?
    Thanks
    Rick

    Hi Rick
    If you are trying to RDS log in to a remote server the host may have disabled this service... Most do, and should. Allowing remote RDS is a potential security risk.  Check with your host to see if this is the case.  If it is, it is always better to duplicate your host environment locally, that is be running CF9, and the database, be that MySQL, SQL Server, Access, or whatever locally and do all you development and testing there, then just upload the files when ready.
    Hope this helps.
    Lawrence Cramer - *Adobe Community Professional*
    http://www.Cartweaver.com
    Shopping Cart for Adobe Dreamweaver
    available in PHP, ColdFusion, and ASP
    Stay updated - http://blog.cartweaver.com

  • Deploying multiple WLANs at a remote site

    At Site-A where the WLC4200 & DHCP server reside, we have the following subnets:
    - (vlan10) 10.10.10.0
    - (vlan11) 10.10.11.0
    Each VLAN corresponds to a dynamic interface on the WLC ("Int-10" & "Int-11") which is assigned to their own respective WLAN. Works fine.
    At remote Site-B where we have a 1242 (HREAP), we have the following subnets:
    (vlan100) 10.20.14.0
    (vlan101) 10.20.15.0
    If I want to assign vlan100 & vlan101 to their own respective local WLANs, will I need to create vlans 100 & 101 (define subnets 20.14 & 20.15 on my Site-A layer-3 switch) at Site-A?
    I ultimately want to create 2 WLANs at the remote site, one for voice (w/ QOS enabled) and one for data. The problem I keep running into is, the remote wireless clients authenticate but are unable to get a DHCP address.

    You need not create sepearate VLANs 100 and 101 on the site-A. Make sure the DHCP server is reachable. Ensure that IP helper pointing to your DHCP server is configured on the router at the remote site so that DHCP broadcast is from your client is forwarded to DHCP server. Refer http://www.cisco.com/en/US/docs/wireless/controller/4.0/configuration/guide/c40hreap.html for more information.

  • WVC80N software "unable to set up remote viewing" with TZO

    I've researched this all night and I'm now begging for help.
    I've got the camera all set up and I can view it while on the local network.  The problem comes in when I try to sign up for the 90-day free TZO trial that comes with the camera to try to get remote viewing on my iPhone.  I progress through the Linksys setup software (as is detailed here: http://www.tzo.com/MainPageSupport/HowToPage/LinksysHomeMonitoringNCameraTutorial.html) and between steps 7 and 8, I get a screen that says "Unable to set up remote viewing" with my network, click this link to learn how to remotely view your camera.  The link takes me to a page on the TZO site that says "Oops, there was an unknown error with setting up you camern for remote access" and nothing else.  It seems to die on the "Configuring Internet Server" step.
    Within the camera's setup page, there's a link to the TZO website that tells me that because I have a WVC80N, I have to use the setup CD to set up the 90-day free trial, which fails as described above.
    I've set the camera to have a fixed IP of 192.168.1.200
    I've set the Alternative Web Access Port to 1024
    In Port Range Forwarding in the router, I've set 1024 to 1024 to forward to 192.168.1.200 (not sure exactly what this does)
    The router is a WRT160N
    Any ideas?

    Have you tried getting in touch with TZO and set the DDNS up the old fashioned way?  I also know that TZO has a beta going on of a new IP camera application for remote viewing and this may also help.  Not sure why the setup is failing though, but oook is probably right, something wacky with the router, IP or ISP that the setup software just doesn't like.
    http://www.MyHomeServer.com
    Linksys IP camera reviews, Tutorials and How-To's on Web & Mobile Streaming

  • Help with uploading files to remote site

    I am trying to upload files onto a remote site, but it keeps
    timing out. Also, on my new website that i'm making for a client,
    when i Put the files onto the remote site it says Started:
    5/30/06 7:57 PM
    index.html - error occurred - An FTP error occurred - cannot
    put index.html. Access Denied. The file may not exist, or there
    could be a permission problem.
    File activity incomplete. 1 file(s) or folder(s) were not
    completed.
    Files with errors: 1
    index.html
    Finished: 5/30/06 7:57 PM
    What does this mean? why are the file incomplete?
    Mike S

    Have you successfully uploaded to this site before?
    Is your site definition configured to upload to the proper
    remote folder?
    The error message is simply telling you the transfer did not
    succeed
    "mikesilverman22" <[email protected]> wrote
    in message
    news:e5im76$r17$[email protected]..
    >I am trying to upload files onto a remote site, but it
    keeps timing out.
    >Also,
    > on my new website that i'm making for a client, when i
    Put the files onto
    > the
    > remote site it says Started:
    >
    > 5/30/06 7:57 PM
    >
    > index.html - error occurred - An FTP error occurred -
    cannot put
    > index.html.
    > Access Denied. The file may not exist, or there could be
    a permission
    > problem.
    >
    > File activity incomplete. 1 file(s) or folder(s) were
    not completed.
    >
    > Files with errors: 1
    > index.html
    >
    > Finished: 5/30/06 7:57 PM
    >
    > What does this mean? why are the file incomplete?
    >
    > Mike S
    >

Maybe you are looking for