Unable to Ping AP

Hello,
I have a new setup I'm trying to build with a WLC2106 and 4 1142n's (currently just trying to get 1 working).  I have the WLC running 7.0.98.0.  I built a new VLAN on our core network (3560g) and have the ap-manager, management interfaces ip'ed in that vlan.  I also have the AP plugged into the PoE port on port 8 and it ip'ed in the same VLAN.  The AP associates to the WLC, i am able to configure it from the WLC, but i cannot ping it, from the WLC or from anywhere.  I cannot ping anything from console on the AP either.
My assumption is once, i get ip connectivity established, the AP will be able to communicate to our network DHCP server and issue out IP's.  I just can't figure out what is wrong with the network setup.  I have the trunk configured properly on the core switch from the WLC, i can ping other hosts on the other vlans that are allowed.
Interfaces on WLC:
Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
ap-manager                       1    5        10.108.5.3      Static  Yes    No  
management                       1    5        10.108.5.2      Static  No     No  
office-vlan-2                    1    2        10.108.111.96   Dynamic No     No  
virtual                          N/A  N/A      1.1.1.1         Static  No     No
AP Config:
infraspawap2#show capwap ip config
LWAPP Static IP Configuration
IP Address         10.108.5.5
IP netmask         255.255.255.240
Default Gateway    10.108.5.1
I've been staring at this for days and just can't figure it out (so it's probably just something simple i've missed).  Any help is greatly appreciated.
Thanks,
Ben

So i may have solved this, or at least provided a work-around.  I made the new Vlan for MGMT and AP interfaces native on the switch and changed the config on the WLC to untagged.  I also disabled DHCP proxy.  This allowed clients to retrieve DHCP from our network server and get connected to the LAN, however i was still unable to ping the AP.
I then moved everyhting into a different VLAN (already existing) and had the same results.  I then moved the AP off of the WLC and used a power brick to connect it directly to the backbone switch.  This rectified the issue.  I am now able to ping accross all vlans to/from the AP.  My only question really is why not from the switch on the WLC?  what was/ wasn't i doing that prevented this when directly connected to the WLC?

Similar Messages

  • Unable to ping from mz to virtual interface of asa

    Dear All,
    one of my SNMP server 10.242.103.42 sits in MZ zone,and ACE 4710 is connected to core switch,coreswitch is connected to firewall asa.
    Now iam trying to ping from MZ zone SNMP server to loadbalancer ip 10.242.105.1,iam unable to ping my LB interface to discover SLB on my SNMP server.
    plese help me
    srinivas

    Is your device seeing the mac-address of the ASA in order to send the packets? What do the logs show on the firewall itself? Can you see the ARP entry on the ASA firewall for that host?
    Mike

  • ASA5520 AnyConnect SSL VPN Connected but unable to ping my inside LAN

    Hi there, please forgive if I have missed any forum protocols as this is my first post.
    I am trying to configure Anyconnect SSL VPN. I am able to connect to the VPN on a laptop, witch is able to download the anyconnect client from the ASA. I am unable to ping any of my IP's that are on the inside of my ASA. Before posting here I have spent many hours on forums and watching videos on anyconnect SSL VPN creation and I am following it to the T but still no ping. Any help would be very much appreciated.
    Inside              192.168.1.254/24
    Outside           dhcp
    VPN Pool        192.168.250.1-50/24
    Inside LAN     192.168.1.0/24
    : Saved
    ASA Version 8.4(4)1
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/1
    nameif inside
    security-level 99
    ip address 192.168.1.254 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 99
    ip address 192.168.100.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dock.local
    same-security-traffic permit inter-interface
    object network inside-network-object
    subnet 192.168.1.0 255.255.255.0
    object network management-network-object
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.250.0_25
    subnet 192.168.250.0 255.255.255.128
    object-group network AllInside-networks
    network-object object inside-network-object
    network-object object management-network-object
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn_pool 192.168.250.1-192.168.250.100 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic AllInside-networks interface
    nat (inside,any) source static any any destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable 4433
    http 192.168.100.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.100.0 255.255.255.0 management
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_anyconnect internal
    group-policy GroupPolicy_anyconnect attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ssl-client ssl-clientless
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value dock.local
    username test password JAasdf434ey521ZCT encrypted privilege 15
    tunnel-group anyconnect type remote-access
    tunnel-group anyconnect general-attributes
    address-pool vpn_pool
    default-group-policy GroupPolicy_anyconnect
    tunnel-group anyconnect webvpn-attributes
    group-alias anyconnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:24bcba3c4124ab371297d52260135924
    : end :

    : Saved
    ASA Version 8.4(4)1
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/1
    nameif inside
    security-level 99
    ip address 192.168.1.254 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 99
    ip address 192.168.100.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dock.local
    same-security-traffic permit inter-interface
    object network inside-network-object
    subnet 192.168.1.0 255.255.255.0
    object network management-network-object
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.250.0_25
    subnet 192.168.250.0 255.255.255.0
    object-group network AllInside-networks
    network-object object inside-network-object
    network-object object management-network-object
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool Anyconnect-pool 192.168.250.1-192.168.250.100 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic AllInside-networks interface
    nat (inside,outside) source static inside-network-object inside-network-object destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25
    nat (inside,outside) source static management-network-object management-network-object destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.100.2 255.255.255.255 management
    http 192.168.100.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.100.0 255.255.255.0 management
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    management-access inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_Anyconnect_VPN internal
    group-policy GroupPolicy_Anyconnect_VPN attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value dock.local
    username sander password f/J.5nLef/EqyPfy encrypted
    username aveha password JA8X3IiqPvFFsZCT encrypted privilege 15
    tunnel-group Anyconnect_VPN type remote-access
    tunnel-group Anyconnect_VPN general-attributes
    address-pool Anyconnect-pool
    default-group-policy GroupPolicy_Anyconnect_VPN
    tunnel-group Anyconnect_VPN webvpn-attributes
    group-alias Anyconnect_VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4636fa566ffc11b0f7858b760d974dee
    : end:

  • Unable to PING VM Server after Install

    Hi Guys
    I am a typical WIndows guys, and new to Oracle /Linux etc.
    However I am trying to setup a VM server, and finally got my head around the setup part of it, i.e the pieces to make the puzzle and how they all fit.
    So I have just installed a fresh install of VM Server on raw iron ( blank server), and the installation has completed and said it was sucessful, however I set up my IP , DNS, host name etc manually, but after the installation I am unable to ping the VM Server, nor can I ping any pc in the network that its connected to.
    Does anyone have any suggestions? As I dont want to go ahead and try install a virtual Oracle Linux Enterprise edition on it, if I cant get the networking side of it to work yet.
    Anybody have any tips, suggestions? Learning I should have done before attempting this lol.
    Thanks

    That didnt work , any of those :(.
    I checked the anaconda log, and it said that in debugging it was ignoring the NIC's as it siad " unknown device driverless" so I have to assume it doesnt have the drivers for the network card, so have posted another post on how to install a kernal, so that I can build the drivers :S.

  • Unable to ping IP address from SG300 -10p switch

     i have two core switches, we have configured the vlan 70 in both core switch
    sh run int vlan 70 --ip address: 182.94.177.34/28
    configured the HSRP in both routers.
    we have configured port in vlan 77 in access switch 4507R-E , we are able to ping the ip address.
    again we have installed on Cisco SG300 10p switch case cading to Cisco 4507R-E access switch.
    we have give below commands
    switch manangement IP :
    switch38cbaf(config)int vlan1
    switch38cbaf(config-if)#ip address 124.4.67.47 255.255.255.0
    switch38cbaf(config)#vlan database
    switch38cbaf(config-if)vlan 70
    switch38cbaf(config)#int gigabitethernet1
    switch38cbaf(config-if)#switchport mode access
    switch38cbaf(config-if)#switch access vlan 77
    Trunk Configuration
    switch38cbaf(config)#int gigabitEthernet9
    switch38cbaf(config-if)#description << Trunk | connected to access switch 4507R-E | Fa4/1 >>
    switch38cbaf(config-if)#swtichport mode trunk
    switch38cbaf(config-if)#switchport trunk allowed vlan 77
    problem:
    i am assigned the ip address 182.94.177.44 to  our desktop and connected to port Gi1
    I am able to ping 182.94.177.33, 34 and 35 Ip Address but unable to ping 182.94.177.44

    Some things to check/verify -
    a) is there a typo in your configuration above ie. you have created vlan 70 according to your configuration but the actual vlan you are using is vlan 77
    b) does the trunk link between the access 4500 and the core switch allow vlan 77
    c) try pinging from the client and not to it as there may be a firewall on the PC.
    Jon

  • Unable to Ping IP when using route redistribution

    Hi Everyone,
    I have below setup
    R1 is running EIGRP and connected to R2 via EIGRP
    R2 is Running OSPF and connected to R3 via OSPF.
    R2 is doing the redistribution of eigrp to ospf and vice versa.
    R1 config
    interface FastEthernet1/0/1
    ip address 10.1.12.1 255.255.255.0
    R1# sh ip  eigrp nei
    EIGRP-IPv4 Neighbors for AS(100)
    H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                                (sec)         (ms)       Cnt Num
    0   10.1.12.2               Fa1/0/1           13 01:47:54  652  3912  0  14
    R2 config
    interface FastEthernet0/16
    ip address 10.1.12.2 255.255.255.0
    sh ip eigrp nei
    EIGRP-IPv4:(100) neighbors for process 100
    H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                                (sec)         (ms)       Cnt Num
    0   10.1.12.1               Fa0/16            12 01:49:44    1   200  0  36
    interface FastEthernet0/19
      ip address 10.1.23.2 255.255.255.0
    sh ip ospf 10  neighbor
    Neighbor ID     Pri   State           Dead Time   Address         Interface
    10.1.23.3         1   FULL/DR         00:00:38    10.1.23.3       FastEthernet0/19
    Redistribution config on R2
    router ospf 10
    router-id 10.1.23.2
    log-adjacency-changes
    redistribute eigrp 100 subnets
    network 10.1.23.0 0.0.0.255 area 10
    distribute-list 1 out
    router eigrp 100
    redistribute ospf 10 metric 100 100 100 100 100
    no auto-summary
    network 10.1.12.0 0.0.0.255
    R3 config
    interface FastEthernet0/16
      ip address 10.1.23.3 255.255.255.0
    Neighbor ID     Pri   State           Dead Time   Address         Interface
    10.1.23.2         1   FULL/BDR        00:00:36    10.1.23.2       FastEthernet0/16
    R1 Routing Table shows routes learned via ospf network of R1.
    R1#sh ip route eigrp 100
         10.0.0.0/8 is variably subnetted, 15 subnets, 2 masks
    D EX    10.1.10.1/32 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    D EX    10.1.11.1/32 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    D EX    10.1.8.1/32 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    D EX    10.1.9.1/32 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    D EX    10.1.13.1/32 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    D EX    10.1.7.1/32 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    D EX    10.1.23.0/24 [170/25628160] via 10.1.12.2, 01:17:03, FastEthernet1/0/1
    i am able to ping the IP of OSPF interface of R2 but not of R3 as shown below
    R1#                          ping 10.1.23.2
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.1.23.2, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
    R1#                          ping 10.1.23.3
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.1.23.3, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    R1#
    Need to know even the route is in routing table why i am umable to ping the IP 10.0.23.3?
    Also unable to ping the loopback IP of R3  below
    R1#                          ping 10.1.10.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.1.10.1, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    Regards
    Mahesh

    Hi Alain,
    Yes R3 was getting the filtered EIGRP routes from R1 via R2.
    i removed the distribute list on R2 and ping worked fine now.
    I understood now why ping was not working earlier as R1 int IP 10.1.12.1 was dropped by the distribute list.
    Now i added this to ACL 1 on R2 which is used by distribute list on R2 and ping works fine now while using distribute list on R2.
    Best regards
    Mahesh

  • I have a Mac pro (10.7.5) and two PC's(windows 7). I am unable to ping either of PC through Mac. However Both PC's reply ping to each other and to Mac as well. Help me with this. Searched Internet. Cant resolve till now

    I have a MB pro (10.7.5) and two PC's(windows 7). I am unable to ping either of PC through Mac. However, Both PC's reply ping made to each other and to Mac as well. Help me with this. Searched Internet. Cant resolve till now
    Regards
    MacIts.

    Request timeout for icmp_seq 0
    Request timeout for icmp_seq 1
    Request timeout for icmp_seq 2
    Request timeout for icmp_seq 3
    Request timeout for icmp_seq 4
    Request timeout for icmp_seq 5
    Request timeout for icmp_seq 6
    is the reply m getting.

  • PPPoE Unable to ping

    I'm trying to configure PPPoE between two routers ...PPPoE is establishing , but unable to ping
    Server
    username R4 password 0 CISCO
    bba-group pppoe CISCO
    virtual-template 1
    interface Virtual-Template1
    ip address 19.19.34.3 255.255.255.0
    peer default ip address pool pool
    ppp authentication chap
    ip local pool pool 19.19.34.4
    interface FastEthernet0/1
    pppoe enable group global
    pppoe-client dial-pool-number 1
    interface Dialer1
    mtu 1492
    ip address negotiated
    encapsulation ppp
    dialer pool 1
    dialer idle-timeout 0
    dialer persistent
    ppp authentication chap callin
    ppp chap hostname R4
    ppp chap password 0 CISCO
    no cdp enable
    *Feb 10 18:32:04.595: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
    *Feb 10 18:32:04.599: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
    *Feb 10 18:32:04.599: Vi2 PPP: Sending cstate UP notification
    *Feb 10 18:32:04.599: Vi2 PPP: Processing CstateUp message
    *Feb 10 18:32:04.603: PPP: Alloc Context [49B191F8]
    *Feb 10 18:32:04.603: ppp13 PPP: Phase is ESTABLISHING
    *Feb 10 18:32:04.603: Vi2 PPP: Using dialer call direction
    *Feb 10 18:32:04.603: Vi2 PPP: Treating connection as a callout
    *Feb 10 18:32:04.603: Vi2 PPP: Session handle[DE00000E] Session id[13]
    *Feb 10 18:32:04.603: Vi2 LCP: Event[OPEN] State[Initial to Starting]
    *Feb 10 18:32:04.603: Vi2 PPP: No remote authentication for call-out
    *Feb 10 18:32:04.603: Vi2 LCP: O CONFREQ [Starting] id 1 len 14
    *Feb 10 18:32:04.603: Vi2 LCP:    MRU 1492 (0x010405D4)
    *Feb 10 18:32:04.603: Vi2 LCP:    MagicNumber 0x19869166 (0x050619869166)
    *Feb 10 18:32:04.603: Vi2 LCP: Event[UP] State[Starting to REQsent]
    R4#Feb 10 18:32:04.607: Vi2 LCP: I CONFREQ [REQsent] id 1 len 19
    *Feb 10 18:32:04.607: Vi2 LCP:    MRU 1492 (0x010405D4)
    *Feb 10 18:32:04.607: Vi2 LCP:    AuthProto CHAP (0x0305C22305)
    *Feb 10 18:32:04.607: Vi2 LCP:    MagicNumber 0x177669A8 (0x0506177669A8)
    *Feb 10 18:32:04.607: Vi2 LCP: O CONFACK [REQsent] id 1 len 19
    *Feb 10 18:32:04.607: Vi2 LCP:    MRU 1492 (0x010405D4)
    *Feb 10 18:32:04.607: Vi2 LCP:    AuthProto CHAP (0x0305C22305)
    *Feb 10 18:32:04.607: Vi2 LCP:    MagicNumber 0x177669A8 (0x0506177669A8)
    *Feb 10 18:32:04.607: Vi2 LCP: Event[Receive ConfReq+] State[REQsent to ACKsent]
    *Feb 10 18:32:04.607: Vi2 LCP: I CONFACK [ACKsent] id 1 len 14
    *Feb 10 18:32:04.607: Vi2 LCP:    MRU 1492 (0x010405D4)
    *Feb 10 18:32:04.607: Vi2 LCP:    MagicNumber 0x19869166 (0x050619869166)
    *Feb 10 18:32:04.607: Vi2 LCP: Event[Receive ConfAck] State[ACKsent to Open]
    *Feb 10 18:32:04.607: Vi2 PPP: Queue CHAP code[1] id[1]
    *Feb 10 18:32:04.619: Vi2 PPP: Phase is AUTHENTICATING, by the peer
    *Feb 10 18:32:04.619: Vi2 CHAP: Redirect packet to Vi2
    *Feb 10 18:32:04.619: Vi2 CHAP: I CHALLENGE id 1 len 23 from "R3"
    *Feb 10 18:32:04.619: Vi2 LCP: State is Open
    *Feb 10 18:32:04.619: Vi2 CHAP: Using hostname from interface CHAP
    *Feb 10 18:32:04.619: Vi2 CHAP: Using password from interface CHAP
    *Feb 10 18:32:04.619: Vi2 CHAP: O RESPONSE id 1 len 23 from "R4"
    *Feb 10 18:32:04.631: Vi2 CHAP: I SUCCESS id 1 len 4
    *Feb 10 18:32:04.631: Vi2 PPP: Phase is FORWARDING, Attempting Forward
    *Feb 10 18:32:04.631: Vi2 PPP: Queue IPCP code[1] id[1]
    *Feb 10 18:32:04.635: Vi2 PPP: Phase is ESTABLISHING, Finish LCP
    *Feb 10 18:32:04.635: Vi2 PPP: Phase is UP
    *Feb 10 18:32:04.635: Vi2 IPCP: Protocol configured, start CP. state[Initial]
    *Feb 10 18:32:04.635: Vi2 IPCP: Event[OPEN] State[Initial to Starting]
    *Feb 10 18:32:04.635: Vi2 IPCP: O CONFREQ [Starting] id 1 len 10
    *Feb 10 18:32:04.635: Vi2 IPCP:    Address 0.0.0.0 (0x030600000000)
    *Feb 10 18:32:04.635: Vi2 IPCP: Event[UP] State[Starting to REQsent]
    *Feb 10 18:32:04.635: Vi2 PPP: Process pending ncp packets
    *Feb 10 18:32:04.635: Vi2 IPCP: Redirect packet to Vi2
    *Feb 10 18:32:04.635: Vi2 IPCP: I CONFREQ [REQsent] id 1 len 10
    *Feb 10 18:32:04.635: Vi2 IPCP:    Address 19.19.34.3 (0x030613132203)
    *Feb 10 18:32:04.635: Vi2 IPCP: O CONFACK [REQsent] id 1 len 10
    *Feb 10 18:32:04.639: Vi2 IPCP:    Address 19.19.34.3 (0x030613132203)
    *Feb 10 18:32:04.639: Vi2 IPCP: Event[Receive ConfReq+] State[REQsent to ACKsent]
    *Feb 10 18:32:04.639: Vi2 IPCP: I CONFNAK [ACKsent] id 1 len 10
    *Feb 10 18:32:04.639: Vi2 IPCP:    Address 19.19.34.4 (0x030613132204)
    *Feb 10 18:32:04.639: Vi2 IPCP: O CONFREQ [ACKsent] id 2 len 10
    *Feb 10 18:32:04.639: Vi2 IPCP:    Address 19.19.34.4 (0x030613132204)
    *Feb 10 18:32:04.639: Vi2 IPCP: Event[Receive ConfNak/Rej] State[ACKsent to ACKsent]
    *Feb 10 18:32:04.639: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
    *Feb 10 18:32:04.643: Vi2 IPCP: I CONFACK [ACKsent] id 2 len 10
    *Feb 10 18:32:04.643: Vi2 IPCP:    Address 19.19.34.4 (0x030613132204)
    *Feb 10 18:32:04.643: Vi2 IPCP: Event[Receive ConfAck] State[ACKsent to Open]
    *Feb 10 18:32:04.651: Vi2 IPCP: State is Open
    *Feb 10 18:32:04.651: Di1 IPCP: Install negotiated IP interface address 19.19.34.4
    *Feb 10 18:32:04.655: Di1 Added to neighbor route AVL tree: topoid 0, address 19.19.34.3
    *Feb 10 18:32:04.655: Di1 IPCP: Route not installed to 19.19.34.3

    Please go through the link below may help you to configure the router
    http://www.dslreports.com/faq/10952

  • PIX 501 unable to ping vpnclient

    Hi,
    Here is the topology:
    vpnclient ------->Internet---->Broadband router (with port forwarding) -----> PIX-------->Internal network
    vpn client is able to establish VPN connection with PIX. VPN client can ping internal network machines (which i wasn't able to do until i used nat-treverse command). but PIX is unable to ping vpnclient's IP addresses or inside address of PIX.
    ++VPN Client getting this++
    Ethernet adapter Local Area Connection 2:
       Connection-specific DNS Suffix  . : abc.com
       Link-local IPv6 Address . . . . . : fe80::b940:3053:3f6f:a4c1%23
       IPv4 Address. . . . . . . . . . . : 10.10.10.10
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . :
    PIX> en
    Password: *****
    PIX# sh run
    : Saved
    PIX Version 6.3(5)
    interface ethernet0 100full
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 2KFQnbNIdI.2KYOU encrypted
    passwd 9jNfZuG3TC5tCVH0 encrypted
    hostname PIX
    domain-name cisco
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list in2out permit ip 172.16.0.0 255.255.255.0 10.10.10.0 255.255.255.0
    pager lines 24
    logging on
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside 172.16.0.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool clientpool 10.10.10.10-10.10.10.20 mask 255.255.255.0
    pdm location 172.16.0.26 255.255.255.255 inside
    pdm location 192.168.0.0 255.255.255.0 outside
    pdm location 172.16.0.27 255.255.255.255 inside
    pdm location 10.10.10.0 255.255.255.224 outside
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list in2out
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    aaa authentication ssh console LOCAL
    http server enable
    http 172.16.0.26 255.255.255.255 inside
    http 172.16.0.27 255.255.255.255 inside
    http 172.16.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    tftp-server outside 192.168.0.6 configpix
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set myset esp-aes-256 esp-sha-hmac
    crypto dynamic-map ipsec_map 1 set transform-set myset
    crypto map outside_map 10 ipsec-isakmp dynamic ipsec_map
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp identity address
    isakmp nat-traversal 20
    isakmp log 25
    isakmp policy 1 authentication pre-share
    isakmp policy 1 encryption aes-256
    isakmp policy 1 hash sha
    isakmp policy 1 group 2
    isakmp policy 1 lifetime 86400
    vpngroup remoteClient address-pool clientpool
    vpngroup remoteClient dns-server 172.16.0.1
    vpngroup remoteClient default-domain abc.com
    vpngroup remoteClient split-tunnel in2out
    vpngroup remoteClient split-dns abc.com
    vpngroup remoteClient idle-time 1800
    vpngroup remoteClient password ********
    telnet 0.0.0.0 0.0.0.0 outside
    telnet 172.16.0.0 255.255.255.0 inside
    telnet timeout 15
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 192.168.0.0 255.255.255.0 outside
    ssh timeout 60
    management-access outside
    console timeout 0
    dhcpd address 172.16.0.20-172.16.0.40 inside
    dhcpd dns 194.168.4.100 194.168.8.100
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd enable inside
    username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15

    Hi all,
    Thanks all for the valueable reply's.
    last time i have done modification with following commands to access cisco pix 515e from telnet from outside interface:
    access-list outside_access_in permit icmp any any
    access-list outside_access_in permit ip any any
    access-list inside_access_out permit ip any any
    access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.168.0 255.255.255.0
    access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.80.0 255.255.255.0
    access-list outside_cryptomap_30 permit ip 192.168.1.0 255.255.255.0 192.168.80.0 255.255.255.0
    access-list 100 permit tcp any eq telnet host PIX_inside eq telnet
    access-list 100 permit tcp any eq telnet host pix_outside eq telnet
    access-list 100 permit tcp any eq telnet host 182.73.110.160 eq telnet
    after adding the above commands i am facing this, my internet link is up and working fine, but not able to get ping reply from internet isp or dns server ip, i.e- 202.56.230.5.

  • Unable to ping to the internet

    if you do an nslookup then a server 8.8.8.8 what do you see?

    Hey guys,
    I have a weird issue. I am unable to ping out from the LAN. Pinging 8.8.8.8 goes nowhere and other sites as well.
    SonicWall shows all internal to external services are allowed.
    Internally everything is pingable.
    I am also unable to ping from within the SonicWall Diagnostics tool. It just says IP address not responding.
    NSA3500.
    This topic first appeared in the Spiceworks Community

  • 2950C Unable to ping destination port in monitor session

    I have 2 Pix firewalls and a web filtering server running Surfcontrol. In order for Surfcontrol to filter web usage it has to see the traffic being sent to the firewall's. I have created a monitor session and have used the firewall ports as the source with transmit and receive, and the web filter server as the destination. However when I do this I am not able to ping the web filter server. The web filter is unable to function ie block websites based on the rules that we have setup if the destination port is unable to send packets to internal workstations.
    Is there anything I can do to allow the destination port to be able to send packets to internal workstations ??

    Hi Frined,
    When you configure SPAN destination port , that port will just work as a monitoring port and will not work for general network traffic.
    If you do " sh int" you will see line protocol down (monitoring)
    Now if you want that port to monitor as well as take part into normal network also you have to enable ingress traffic on the destination port
    "monitor session session_number destination interface interface-id [ingress vlan vlan id]"
    Check this link for more details
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12119ea1/2950scg/swspan.htm#1218090
    HTH
    Ankur

  • OSPF unable to Ping

    Below is my Home Network layout.  I am having trouble pinging the 50.2.30.0 subnet.  I created OSPF routes and I am able to ping from HomeLAN router to BackUpHomeLAN router.  My problem is that I can not ping from my laptop connected on the 192.168.1.0 subnet to the 50.2.30.0 subnet.  Attached below is my current config for both routers. 
    HomeLAN
    HomeLAN-Rotuer#show run
    Building configuration...
    Current configuration : 1761 bytes
    ! Last configuration change at 07:27:14 UTC Wed Mar 26 2014
    version 15.1
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname HomeLAN-Rotuer
    boot-start-marker
    warm-reboot
    boot-end-marker
    no aaa new-model
    dot11 syslog
    ip source-route
    ip vrf A
    ip cef
    ip domain name jjkkcc.org
    ip name-server 68.105.28.16
    ip name-server 68.105.29.16
    ip name-server 8.8.8.8
    ip name-server 8.8.4.4
    ip name-server 192.168.1.252
    ip name-server 192.168.1.242
    no ipv6 cef
    multilink bundle-name authenticated
    voice-card 0
    crypto pki token default removal timeout 0
    license udi pid CISCO2801 sn FTX1019Y2S4
    username woodjl1650 privilege 15 password 0 henry999 secret
    redundancy
    interface FastEthernet0/0
     ip address 10.2.10.2 255.255.255.248
     ip nat outside
     ip virtual-reassembly in
     duplex auto
     speed auto
    interface FastEthernet0/1
     ip address 192.168.1.5 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
    interface Serial0/1/0
     ip address 10.0.10.1 255.255.255.224
    interface Serial0/2/0
     ip address 10.0.10.3 255.255.255.224
    router ospf 1
     network 10.2.10.0 0.0.0.7 area 1
     network 50.2.30.0 0.0.0.31 area 1
     network 192.168.1.0 0.0.0.255 area 1
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat inside source list NAT interface FastEthernet0/0 overload
    ip route 0.0.0.0 0.0.0.0 10.2.10.1
    ip access-list standard NAT
     permit 192.168.1.0 0.0.0.255
     permit 10.2.10.0 0.0.0.7
     permit 50.2.30.0 0.0.0.31
    logging esm config
    control-plane
    gatekeeper
     shutdown
    line con 0
    line aux 0
    line vty 0 4
     login local
     transport input ssh
    scheduler allocate 20000 1000
    end
    BackUpHomeLAN
    BackUpHomeLAN#show run
    Building configuration...
    Current configuration : 1695 bytes
    ! Last configuration change at 06:35:05 UTC Wed Mar 26 2014
    version 15.1
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname BackUpHomeLAN
    boot-start-marker
    warm-reboot
    boot-end-marker
    no aaa new-model
    dot11 syslog
    ip source-route
    ip vrf A
    ip cef
    ip domain name jjkkcc.com
    ip name-server 68.105.28.16
    ip name-server 68.105.29.16
    ip name-server 8.8.8.8
    ip name-server 8.8.4.4
    no ipv6 cef
    multilink bundle-name authenticated
    voice-card 0
    crypto pki token default removal timeout 0
    license udi pid CISCO2801 sn FTX1028W1PY
    username woodjl1650 privilege 15 password 0 henry999 secret
    redundancy
    interface Loopback100
     ip vrf forwarding A
     no ip address
    interface FastEthernet0/0
     ip address 10.2.10.3 255.255.255.248
     ip nat outside
     ip virtual-reassembly in
     duplex auto
     speed auto
    interface FastEthernet0/1
     ip address 50.2.30.1 255.255.255.224
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
    interface Serial0/1/0
     ip address 10.0.10.2 255.255.255.224
    router ospf 1
     network 10.2.10.0 0.0.0.7 area 1
     network 50.2.30.0 0.0.0.31 area 1
     network 192.168.1.0 0.0.0.255 area 1
    router ospf 3
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat inside source list NAT interface FastEthernet0/0 overload
    ip route 0.0.0.0 0.0.0.0 24.234.191.225
    ip access-list standard NAT
     permit 192.168.1.0 0.0.0.255
    permit 10.2.10.0 0.0.0.7
    permit 50.2.30.0 0.0.0.31
    logging esm config
    control-plane
    gatekeeper
     shutdown
    line con 0
    line aux 0
    line vty 0 4
     login local
     transport input ssh
    scheduler allocate 20000 1000
    end

    Duplicate posts.  
    Go here:  http://supportforums.cisco.com/discussion/12154051/ospf-unable-ping

  • AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside network

    My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.
    I have seen other people that appeared to have similar posts but none of those solutions have worked for me.  I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly.  I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.
    My configuration is included below.
    Thank you in advance for your assistance.
    Jerry
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password (removed)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f2c7362097b71bcada023c6bbfc45121
    : end

    Hi,
    Yes, I have saved the config and did a write erase and reloaded the config, no difference. I rebuilt it once a couple of weeks ago, but that was before I had gotten this far with your assistance.  I'll include my ASA and switches configs after this. Here is a little background (took it form the Firewall section issue just because it gives a little insight for the network). I have 2 3560s, one as a L3 switch the other L2 with an etherchannel between them (one of the cables was bad so I am waiting on the replacement to have 2 - Gigabit channels between the switches).
    I think our issue with the VPN not getting to the Inside is posibly related to my DMZ issue not getting to the internet.
    I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.
    I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.
    The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet.  I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.
    E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).
    So for a simple diagram:
    PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)
    I will be back at this tomorrow morning - I've been up since 4pm yesterday and it is almost 3pm.
    Thank you for all of your assistance.
    Jerry
    Current ASA Config:
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password $$$$$$$$$$$$$$$ encrypted
    passwd $$$$$$$$$$$$$$$$ encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    switchport access vlan 20
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    object network INSIDE
    subnet 10.0.1.0 255.255.255.0
    access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222
    access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22
    access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222
    access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231
    access-list capvpn extended permit icmp host 192.168.60.20 host 10.1.10.23
    access-list capvpn extended permit icmp host 10.1.10.23 host 192.168.60.20
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0
    access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0
    access-list capins extended permit icmp host 10.1.10.23 host 10.0.1.1
    access-list capins extended permit icmp host 10.0.1.1 host 10.1.10.23
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) after-auto source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f6d9bbacca2a5c8b5af946a8ddc12550
    : end
    L3 3560 connects to ASA via port f0/3 routed port 10.0.1.0/24 network
    Connects to second 3560 via G0/3 & G0/4
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560a
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    authentication mac-move permit
    ip subnet-zero
    ip routing
    ip dhcp excluded-address 10.1.10.1 10.1.10.20
    ip dhcp excluded-address 10.1.12.1 10.1.12.20
    ip dhcp excluded-address 10.1.14.1 10.1.14.20
    ip dhcp excluded-address 10.1.16.1 10.1.16.20
    ip dhcp excluded-address 10.1.30.1 10.1.30.20
    ip dhcp excluded-address 10.1.35.1 10.1.35.20
    ip dhcp excluded-address 10.1.50.1 10.1.50.20
    ip dhcp excluded-address 10.1.80.1 10.1.80.20
    ip dhcp excluded-address 10.1.90.1 10.1.90.20
    ip dhcp excluded-address 10.1.100.1 10.1.100.20
    ip dhcp excluded-address 10.1.101.1 10.1.101.20
    ip dhcp pool VLAN10
       network 10.1.10.0 255.255.255.0
       default-router 10.1.10.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN12
       network 10.1.12.0 255.255.255.0
       default-router 10.1.12.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN14
       network 10.1.14.0 255.255.255.0
       default-router 10.1.14.1
       option 150 ip 10.1.13.1
    ip dhcp pool VLAN16
       network 10.1.16.0 255.255.255.0
       default-router 10.1.16.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN30
       network 10.1.30.0 255.255.255.0
       default-router 10.1.30.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN35
       network 10.1.35.0 255.255.255.0
       default-router 10.1.35.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN50
       network 10.1.50.0 255.255.255.0
       default-router 10.1.50.1
       option 43 hex f104.0a01.6564
    ip dhcp pool VLAN80
       network 10.1.80.0 255.255.255.0
       default-router 10.1.80.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN90
       network 10.1.90.0 255.255.255.0
       default-router 10.1.90.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN100
       network 10.1.100.0 255.255.255.0
       default-router 10.1.100.1
    ip dhcp pool VLAN101
       network 10.1.101.0 255.255.255.0
       default-router 10.1.101.1
    ip dhcp pool VLAN40
       dns-server 208.67.222.222 208.67.220.220
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree etherchannel guard misconfig
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    link state group 1 downstream
    interface FastEthernet0/1
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 100
    switchport mode trunk
    power inline never
    interface FastEthernet0/2
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/3
    description Interface to MXFW E0/1
    no switchport
    ip address 10.0.1.2 255.255.255.0
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/6
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    power inline never
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/11
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/18
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/19
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/22
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/24
    switchport access vlan 35
    switchport mode access
    power inline never
    interface FastEthernet0/25
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/26
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/27
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/34
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/35
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/38
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/42
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/43
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport mode access
    shutdown
    power inline never
    interface GigabitEthernet0/1
    description Interface to MXC2911 Port G0/0
    no switchport
    ip address 10.1.13.2 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    shutdown
    interface Vlan10
    ip address 10.1.10.1 255.255.255.0
    interface Vlan12
    ip address 10.1.12.1 255.255.255.0
    interface Vlan14
    ip address 10.1.14.1 255.255.255.0
    interface Vlan16
    ip address 10.1.16.1 255.255.255.0
    interface Vlan20
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    ip address 172.26.22.1 255.255.255.0
    interface Vlan30
    ip address 10.1.30.1 255.255.255.0
    interface Vlan35
    ip address 10.1.35.1 255.255.255.0
    interface Vlan40
    ip address 10.1.40.1 255.255.255.0
    interface Vlan50
    ip address 10.1.50.1 255.255.255.0
    interface Vlan80
    ip address 172.16.80.1 255.255.255.0
    interface Vlan86
    no ip address
    shutdown
    interface Vlan90
    ip address 10.1.90.1 255.255.255.0
    interface Vlan100
    ip address 10.1.100.1 255.255.255.0
    interface Vlan101
    ip address 10.1.101.1 255.255.255.0
    router eigrp 1
    network 10.0.0.0
    network 10.1.13.0 0.0.0.255
    network 10.1.14.0 0.0.0.255
    passive-interface default
    no passive-interface GigabitEthernet0/1
    ip classless
    ip route 0.0.0.0 0.0.0.0 FastEthernet0/3 10.0.1.1
    ip route 192.168.60.0 255.255.255.0 FastEthernet0/3 10.0.1.1 2
    ip http server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end
    L3 3560 Route Table (I added 192.168.60.0/24 instead of just using the default route just in case it wasn't routing for some reason - no change)
    mx3560a#sho ip route
    Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route
    Gateway of last resort is 10.0.1.1 to network 0.0.0.0
    S    192.168.60.0/24 [2/0] via 10.0.1.1, FastEthernet0/3
         172.16.0.0/24 is subnetted, 1 subnets
    C       172.16.80.0 is directly connected, Vlan80
         172.26.0.0/24 is subnetted, 2 subnets
    C       172.26.22.0 is directly connected, Vlan22
    C       172.26.20.0 is directly connected, Vlan20
         10.0.0.0/8 is variably subnetted, 14 subnets, 2 masks
    C       10.1.10.0/24 is directly connected, Vlan10
    D       10.1.13.5/32 [90/3072] via 10.1.13.1, 4d02h, GigabitEthernet0/1
    C       10.1.14.0/24 is directly connected, Vlan14
    C       10.1.13.0/24 is directly connected, GigabitEthernet0/1
    C       10.1.12.0/24 is directly connected, Vlan12
    C       10.0.1.0/24 is directly connected, FastEthernet0/3
    C       10.1.30.0/24 is directly connected, Vlan30
    C       10.1.16.0/24 is directly connected, Vlan16
    C       10.1.40.0/24 is directly connected, Vlan40
    C       10.1.35.0/24 is directly connected, Vlan35
    C       10.1.50.0/24 is directly connected, Vlan50
    C       10.1.90.0/24 is directly connected, Vlan90
    C       10.1.101.0/24 is directly connected, Vlan101
    C       10.1.100.0/24 is directly connected, Vlan100
    S*   0.0.0.0/0 [1/0] via 10.0.1.1, FastEthernet0/3
    I have a C2911 for CME on G0/1 - using it only for that purpose at this time.
    L2 3560 Config it connects to the ASA as a trunk on e0/5 of the ASA and port f0/3 of the switch - I am using L2 switching for the DMZ networks from the switches to the ASA and allowing the ASA to provide the DHCP and routing out of the network. DMZ networks: 172.26.20.0/24 and 172.26.22.0/24.
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560b
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    crypto pki trustpoint TP-self-signed-3877365632
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3877365632
    revocation-check none
    rsakeypair TP-self-signed-3877365632
    crypto pki certificate chain TP-self-signed-3877365632
    certificate self-signed 01
      30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 33383737 33363536 3332301E 170D3933 30333031 30303031
      30395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 38373733
      36353633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100DF81 DA515E0B 7FC760CF 2CC98400 42DCA007 215E4DDE D0C3FBF2 D974CE85
      C46A8700 6AE44C2C 79D9BD2A A9297FA0 2D9C2BE4 B3941A2F 435AC4EA 17E89DFE
      34EC8E93 63BD4CDF 784E91D7 2EE0093F 06CC97FD 83CB818B 1ED624E6 F0F5DA51
      1DE4B8A7 169EED2B 40575B81 BADDE052 85BA9D19 4C206DCB 00878FF3 89E74028
      B3F30203 010001A3 68306630 0F060355 1D130101 FF040530 030101FF 30130603
      551D1104 0C300A82 086D7833 35363062 2E301F06 03551D23 04183016 80147125
      78CE8540 DB95D852 3C0BD975 5D9C6EB7 58FC301D 0603551D 0E041604 14712578
      CE8540DB 95D8523C 0BD9755D 9C6EB758 FC300D06 092A8648 86F70D01 01040500
      03818100 94B98410 2D9CD602 4BD16181 BCB7C515 77C8F947 7C4AF5B8 281E3131
      59298655 B12FAB1D A6AAA958 8473483C E993D896 5251770B 557803C0 531DEB62
      A349C057 CB473F86 DCEBF8B8 7DDE5728 048A49D0 AB18CE8C 8257C00A C2E06A63
      B91F872C 5F169FF9 77DC523B AB1E3965 C6B67FCC 84AE11E9 02DD10F0 C45EAFEA 41D7FA6C
      quit
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    interface FastEthernet0/1
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/2
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/3
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    shutdown
    power inline never
    interface FastEthernet0/6
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/11
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/18
    shutdown
    power inline never
    interface FastEthernet0/19
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    shutdown
    power inline never
    interface FastEthernet0/22
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/24
    shutdown
    power inline never
    interface FastEthernet0/25
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/26
    shutdown
    power inline never
    interface FastEthernet0/27
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/34
    shutdown
    power inline never
    interface FastEthernet0/35
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport mode access
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    shutdown
    power inline never
    interface FastEthernet0/38
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    shutdown
    power inline never
    interface FastEthernet0/42
    shutdown
    power inline never
    interface FastEthernet0/43
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport access vlan 40
    switchport mode access
    shutdown
    interface GigabitEthernet0/1
    shutdown
    interface GigabitEthernet0/2
    switchport access vlan 40
    switchport mode access
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    ip classless
    ip http server
    ip http secure-server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end

  • Unable to ping ESXI host

    I have an out of state Esxi 4.1 host that is working fine with 12 virtual servers on it. The problem is I cannot ping (IP or name) or connect to it using vSphere from my current location. The only machines which see the host are the VMs it is hosting. So to connect I have to remote desktop to one of the VMs and run vSphere from there. Any idea why I can't connect from other PCs on the network?

    Welcome to the Community,
    that's interesting. From what you say, the Management Network on the host seems to be working fine. Can you please provide some information about the host's virtual network configuration as well as the physical switch port(s) configuration?
    What's the result of running "Test Management Network" from the host's DCUI? Maby restarting the Management Network will help!?
    André

  • ASA 5505: unable to ping external hosts

    Hi,
    I have a LAN behind ASA 5505, interface NAT/PAT is configured.
    External interface is configured for PPPoE.
    Everything works fine except I cannot ping from a LAN PC external hosts. I can however ping external hosts from ASA itself. ICMP is allowed:
    icmp permit any inside
    icmp permit any outside
    access-list outside_access_in extended permit icmp any any
    Protocol inspections and fixups are default.
    When I ping an external host 61.95.50.185 from the LAN host 10.2.32.68 I am getting the following in the log:
    302020 61.95.50.185 10.2.32.68 Built ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 10.2.32.68/512
    302020 61.95.50.185 202.xx.yy.zz Built ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 202.xx.yy.zz/1
    313004 Denied ICMP type=0, from laddr 61.95.50.185 on interface outside to 202.xx.yy.zz: no matching session
    313001 61.95.50.185 Denied ICMP type=0, code=0 from 61.95.50.185 on interface outside
    302021 61.95.50.185 202.xx.yy.zz Teardown ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 202.xx.yy.zz/1
    302021 61.95.50.185 10.2.32.68 Teardown ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 10.2.32.68/512
    Where 202.xx.yy.zz is IP of external interface of ASA.
    This is a very simple setup that runs on a number of othe PIXes/ASAs and pings to external IP normally work just fine. I can't understand why ping replies are getting dropped on the interface?
    Any help will be highly appreciated.
    Thank you.
    Alex

    Alex / Kerry, you have couple of options for handling icmp outbound, either acl or icmp inspection :
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended permit icmp any any source-quench
    access-list outside_access_in extended permit icmp any any unreachable
    access-list outside_access_in extended permit icmp any any time-exceeded
    access-group outside_access_in in interface outside
    or icmp inspection instead of acl.
    policy-map global_policy
    class inspection_default
    inspect icmp
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
    HTH
    Jorge

Maybe you are looking for

  • PS CS4 menu bar sometimes disappears (parts of it)

    Now and then, part of my menu bar disappears - the section just to the right of "help" - I think the first icon for this particular bar is to open Bridge. I've included a screen shot of my issue - notice that area seems to show my desktop (or whateve

  • Oracle 10g Client and ODAC Side-By-Side

    Hi there, I was unable to find an answer to my query by using search, but apologies if this is a double-post. I'm having some issues with a ASP.NET application running on a Windows XP Pro machine. The machine has Oracle 10g client installed (oraClien

  • Multiple dn's in certificate

    Can I use a certificate that contains multiple DN's with Oracle Wallet Manager? When I speak of multiple DN's I mean the certificate knows about more than one DN (i.e. www.myplace1.com and www.myplace2.com)...

  • Status of elements not appearing in Management Cockpit

    The Problem is as follows:                                                 when you look into the management cockpit and ask to display data from, for example, December 2004, the cockpit shows all the four walls with elements without status, when, in

  • Dashbord and Live authentication ISE 1.1.3.124 p1

    Hello all, not long time ago, i lost all data in the HOME pannel, all sub windows says: no data avalable no nothing the only number i have there is the number of endpoints And now, in the live authentication, i dont any results, no pass, failed etc..