Unable to telnet the cisco 2900

Hi,
I am trying to telnet to cisco 2900 switch. I believe there is a VTY password configured. When I give the pasword. I am getting the below error.
"Local flow control off"
"User Access Verification
Password: Connection closed by foreign host."
Appreciate you help help.
Thanks & Regards
Ranga

Thanks for response. We does have acces to only from one machine in the network. And I got the configuration that is in backup server. Here is the configuration of login access. I believe with the below configuration might be same problem when we console the switch.
Line-Line con 0
line con 0
session-timeout 15
password*****
no vacant-message
login
transport input none
stopbits 1
Line-Line vty 0 4
line vty 0 4
session-timeout 15
access-class XX in
exec-timeout 15 0
password*****
no vacant-message
login
Line-Line vty 5 15
line vty 5 15
access-class XX in
login

Similar Messages

Unable to telnet SLM224G2

hi.
i am able to ping my SLM224G2 switch but unable to telnet the switch.
pls. help me out.
Jitendra

I am not sure if the SLM224G2 if you can telnet the unit but if it does have that option usually you might have some enabled firewalls in the PC that is why you are unable telnet the unit. I tried to further look at either the user guide or datasheet for the SLM224G (anyway the SLM224G2 should belong to that family) and it doesn’t say that it has a telnet capability. I am honestly not familiar with this switch but I know the SRW series has telnet capabilities. I suggest try contacting CISCO tech support to report about this problem and seek their opinion about it.

Unable to Telnet / SSH to a particular cisco switch

Hello,
I have an unusual issue that I just can't seem to track down. We have a Windows Server 2008 R2 box that is unable to telnet or ssh to one switch in our network.
Server IP: 10.0.0.74
Cisco Switch IP: 10.1.0.7
I am able to access all other switches/routers on the 10.1.0.x network, but not this one. I ping and tracert by ip address and name.
We have a number other servers on our network and they all can access this switch
Example:
a. 10.0.0.73 can telnet/ssh to 10.1.0.7
b. 10.0.0.72 can telnet/ssh to 10.1.0.7
c. 10.0.0.50 can telnet/ssh to 10.1.0.7
d. My workstation (10.0.250.213) can telnet/ssh to 10.1.0.7
If anyone can help with troubleshooting further, I would greatly appreciate it.

Thanks for the reply Philippe! Here is the route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.2 10.0.0.74 266
10.0.0.0 255.255.0.0 On-link 10.0.0.74 266
10.0.0.74 255.255.255.255 On-link 10.0.0.74 266
10.0.255.255 255.255.255.255 On-link 10.0.0.74 266
10.10.0.0 255.255.0.0 On-link 10.0.0.74 266
10.10.0.74 255.255.255.255 On-link 10.0.0.74 266
10.10.255.255 255.255.255.255 On-link 10.0.0.74 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.0.74 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.0.74 266
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.0.0.2 Default
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
1 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
Firewall is disabled and there is no active antivirus. Im pretty sure port blocking is not the issue. I am able to ssh and telnet from this box to every other switch/router in our network.
This server has Solarwinds on it and tracks the health of our network (servers, routers, switches, ups, ect.). The only reason we noticed an issue is because it stopped backing up the config for this particular switch. All other switchs/routers
config is backed up to this server every morning at 2:00AM.
With solarwinds, this server is also able to communicate with this switch via snmp / icmp and ping.
Thanks again for the help!

Can I use the Cisco license transfer tool to rehost licenses from router 2900 to new router 2900? is not rma process

Can I use the Cisco license transfer tool to rehost licenses from router 2900 to new router 2900? is not rma process
thank you

Yes you can.
Alternatively, you can email [email protected]

Cisco 4507 Switch - Clients are unable to renew the IP Address

Hello .
i have cisco 4505 core switch with different DCHP pool bind with different Vlan
clients from one DHCP pool are unable to renew the ip address . while others DHCP pools configured on the same switch are working fine .
please Advice .

Hello Leo ,
Below are the requested info :
DA-V02#sh ip dhcp binding | begin 10.1.X
10.1.X.21      0184.2b2b.adfc.74       Infinite                Manual
10.1.X.22      0100.1ec9.7820.fd       Infinite                Manual
10.1.X.23      0100.1aa0.6f32.f7       Infinite                Manual
10.1.X.24      0100.1ec9.782d.b0       Infinite                Manual
10.1.X.26      01f0.4da2.25e7.b3       Infinite                Manual
10.1.X.27      0100.1aa0.7872.71       Infinite                Manual
10.1.X.30      0118.0373.2957.d4       Infinite                Manual
10.1.X.31      01b8.ac6f.a4d2.03       Infinite                Manual
10.1.X.32      0100.2170.407c.96       Infinite                Manual
10.1.X.33      0100.1ec9.6ba3.d5       Infinite                Manual
10.1.X.34      0100.2170.407b.c2       Infinite                Manual
10.1.X.35      0100.1ec9.782a.11       Infinite                Manual
10.1.X.36      0100.1ec9.6c31.32       Infinite                Manual
10.1.X.37      0100.26b9.c283.09       Infinite                Manual
10.1.X.38      0100.2170.407c.59       Infinite                Manual
10.1.X.39      0100.2170.407c.74       Infinite                Manual
10.1.X.40      0100.1ec9.6c33.2c       Infinite                Manual
10.1.X.41      0100.1aa0.6f1f.6d       Infinite                Manual
10.1.X.42      0100.1ec9.6b9e.d8       Infinite                Manual
10.1.X.43      0100.1ec9.6a8b.cf       Infinite                Manual
10.1.X.44      0100.1ec9.782c.f3       Infinite                Manual
10.1.X.45      0100.2170.4074.cf       Infinite                Manual
10.1.X.46      0100.1ec9.6c38.38       Infinite                Manual
10.1.X.47      0100.1ec9.782c.5b       Infinite                Manual
10.1.X.48      0100.2170.4077.06       Infinite                Manual
10.1.X.49      0184.2b2b.ae10.f0       Infinite                Manual
10.1.X.50      0100.2170.407c.e6       Infinite                Manual
10.1.X.51      0100.1e4f.4f31.14       Infinite                Manual
10.1.X.56      0100.1ec9.783e.b1       Infinite                Manual
10.1.X.57      01b8.ca3a.a2d3.b0       Infinite                Manual
10.1.X.59      019c.934e.1811.d8       Infinite                Manual
10.1.X.80      019c.934e.1810.cc       Infinite                Manual
10.1.X.87      0100.1ec9.6c1e.e3       Mar 17 2014 10:10 PM    Automatic
10.1.X.98      0014.38e1.c9a0          Infinite                Manual
10.1.X.114     01b8.ca3a.a31b.fe       Mar 18 2014 12:57 AM    Automatic
10.1.X.204     0100.1ec9.7829.5e       Mar 17 2014 10:10 PM    Automatic
10.1.X.205     0100.1ec9.77ea.a7       Mar 17 2014 11:46 PM    Automatic
10.1.X.206     0184.2b2b.adfc.c1       Mar 17 2014 10:47 PM    Automatic
10.1.X.207     01a4.badb.f89e.90       Mar 17 2014 11:39 PM    Automatic
10.1.X.208     0100.1aa0.6f31.6c       Mar 18 2014 01:01 AM    Automatic
10.1.X.242     0108.0037.8c00.ea       Infinite                Manual
10.1.X.243     0000.aac1.636f          Infinite                Manual
10.1.X.244     0800.379b.21f0          Infinite                Manual
10.1.H.205     0100.2584.1870.11       Mar 18 2014 10:23 AM    Automatic
10.1.H.206     0100.2584.186f.32       Mar 18 2014 10:29 AM    Automatic
ip dhcp excluded-address 10.1.X.1 10.1.X.63
ip dhcp excluded-address 10.1.X.240 10.1.X.254
ip dhcp excluded-address 10.1.X.242
ip dhcp excluded-address 10.1.X.243
ip dhcp excluded-address 10.1.X.244
ip dhcp excluded-address 10.1.X.130
ip dhcp pool floor2_users
   network 10.1.X.0 255.255.255.0
   default-router 10.1.X.1
   dns-server 10.9.57.21 10.8.57.22
   domain-name corp.ank.ad
   lease 0 12
interface VlanX
ip address 10.1.X.1 255.255.255.0

Cisco Network Setup Assistant Unable to install the certificate on Android KitKat

Greetings,
I'm having issues with deploying the CA. Although the Cisco app fails, the user cert (but no CA) appears to install and is accessible during wifi setup. I am running the latest version of Cisco Network Setup Assistant 1.2.42. The phone is running Android KitKat 4.4.4, not rooted, running stock T-Mobile rom. I'm able to authenticate with the guest side, and get as far as Installing Certificates... Reference the screen shots attached.
Error message cisco Network Setup Assistant: "Unable to install the certificate. Exit the application and run it again to continue to the installation."
I have ran the application several times, it keeps returning to this same message.
After failure of the Cisco app, I noticed there is a certificate manager with CA cert and key, and than subsequently one new key continues to loop after until I cancel (also in screenshots).
I have tried decryption, removing all security, and clearing credentials, yet the problem persists. Any help is appreciated.

Greetings,
I'm having issues with deploying the CA. Although the Cisco app fails, the user cert (but no CA) appears to install and is accessible during wifi setup. I am running the latest version of Cisco Network Setup Assistant 1.2.42. The phone is running Android KitKat 4.4.4, not rooted, running stock T-Mobile rom. I'm able to authenticate with the guest side, and get as far as Installing Certificates... Reference the screen shots attached.
Error message cisco Network Setup Assistant: "Unable to install the certificate. Exit the application and run it again to continue to the installation."
I have ran the application several times, it keeps returning to this same message.
After failure of the Cisco app, I noticed there is a certificate manager with CA cert and key, and than subsequently one new key continues to loop after until I cancel (also in screenshots).
I have tried decryption, removing all security, and clearing credentials, yet the problem persists. Any help is appreciated.

Windows 8 Pro 64bit, Aladdin eToken Pro, CISCO VPN-Client 5.0.07.0440 - Responding : Reason 403: Unable to contact the security gateway...

Windows 8 Pro 64bit, eToken (Aladdin with newest Safenet etoken-Client V 8.2.85.0) Pro (V.with Cisco Systems VPN Client Version 5.0.07.0440 -> VPN Error-Log :
VPN-Client Responding : Reason 403: Unable to contact the security gateway...
(Detailled VPN-Error-Log see attached)
Thanks in advance for any ideas or solution, its getting urgent !!

First, try TheGreenBow's online troubleshooter. If that doesn't work, you can try their general support or simply contact them directly.

Cisco SSL VPN "The following error occurred while attempting the file operation: Unable to view the contents of the Domain/Workgroup. "

Hey People,
Ive set up an SSL Clientless VPN on the Cisco 2821. Ive set up WINS, and the NBNS entries in the VPN config. When i log onto the VPN , i can access the file servers by typing in their names in the network fi
le box, but when i click browse network and select the network name i get the following message
"The following error occurred while attempting the file operation:
Unable to view the contents of the Domain/Workgroup. "
Has anyone come accross this before?
Im using Windows Server 2008R2 for the DC, Windows Server 2003 R2 For WINS and File Sharing.
The connection goes WAN->BROADBANDROUTER>CISCO2821
Any helo would be much greatly appreciated.
Thanks in advance!

Please see old threads which discuss the same topic -- http://forums.oracle.com/forums/search.jspa?threadID=&q=An+error+occurred+while+attempting+to+establish+an+Applications+File+Server+connection+with+the+node&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
Thanks,
Hussein

Unable to enable HBA Card in the Cisco UCS c22 m3 server

Hi All,
I need your help desperately to setup the cisco ucs c22 m3 server in our environment. We have a C22 M3 server and I did the basic config of CIMC and we have a LSI megaraid controller connected to one of the PCIe and the other PCIe has a dual port 8gb HBA card. We installed the RAID and we can see the LSI Megaraid controller. But I cannot see the HBA card and there is noo light near the card. I hope I need to enable something so that the card should work. I tried enabling in the BIOS menu I can see the PCIe slot is enabled but I am unable to see the HBA functioning. Couldyou pleasehelp me to resolve this.

Dear Manuel,
Thanks for replying me. See the answers for your queries.
What kind of HBA card are you trying to use?
If I am not wrong we are using "Qlogic QLE2562, 8Gb dual port Fibre Channel HBA".
How many CPUs do you have installed on your server?
I opened the box and saw only 1 CPU installed. But the solution is given by CISCO pre sales. We have 2 PCIe slots configured. One for LSI RAID controller and the other with dual port Fibre Channel HBA.
Awaiting your reply.
Thanks and Regards,
Jaffer Ali

IOS 7.1. Unable to join the network (Cisco Router)

I have an iPhone 5s (iOS 7.1. GM - Public). My phone and wifi connections worked fine until last week.
Now when I have tried connecting to my home wifi network (using CISCO router; other wifi connections are working normally), my phone is giving me the message "enter the password" and there is an username too. So, it is impossible to connect to wifi network - "unable to join the network".
I tried to Reset Network Settings on iPhone, and Restore an iPhone (over iTunes), reset cisco router to factory settings etc. without success.. any idea what could be wrong?

Hi kopacev!
You may need to make sure that your router settings conform to the suggested settings in the following article for best performance:
iOS and OS X: Recommended settings for Wi-Fi routers and access points
http://support.apple.com/kb/ht4199
Thanks for being a part of the Apple Support Communities!
Cheers,
Braden

Unable to Telnet...............

Posted by: vatsey.sharad - Engineer, HCL Comnet
Jun 6, 2008, 2:09am PST
Hi,
I have two IP's Configured on my Cisco 2800. 1.1.1.1 - Loopback and 2.2.2.2 on Fast Ethernet. Both IP's are pingable across the WAN. And telnet to loopback IP is working fine. However I am unable to telnet to Fast Ethernet IP. The error message while trying to telnet to Fast Ethernet IP is: "Could not open connection to the host, on port 23: Connect failed". I tried to debug telnet on the router. The Debug output for unsuccessful telnet is as follows:
Telnet194: recv SB NAWS 139 24
However for a successful telnet session, the output is:
Telnet195: 1 1 251 1
TCP195: Telnet sent WILL ECHO (1)
Telnet195: 2 2 251 3
TCP195: Telnet sent WILL SUPPRESS-GA (3)
Telnet195: 80000 80000 253 24
TCP195: Telnet sent DO TTY-TYPE (24)
Telnet195: 10000000 10000000 253 31
TCP195: Telnet sent DO WINDOW-SIZE (31)
TCP195: Telnet received DO ECHO (1)
TCP195: Telnet received DO SUPPRESS-GA (3)
TCP195: Telnet received WILL TTY-TYPE (24)
Telnet195: Sent SB 24 1
TCP195: Telnet received WILL WINDOW-SIZE (31)
Telnet195: recv SB NAWS 110 52
Telnet195: recv SB 24 0 ANSI
There are no ACL's or firewalls involved in the picture.

Sharad
How many forums did you post this question in? I have already found it in 2 other forums.
HTH
Rick

Unable to telnet and tftp to controller

hello experts!!!
5508 controller is at the headquarters which can be normally pinged, telnetted, http'd and tftp'ed....
at the remote site, controller can be pinged and http'ed but cannot be telnetted and tftp'ed.
there is a complete tracert from the remote site pc all the way to the controller.
from a switch at a remote site, the controller can be telnetted.
but from a pc on the remote site (which belongs to a remote site vlan), it is unable to telnet and tftp the controller.
all active components can be telnetted from the remote site, such as the core switches and routers at the headquearters, except the controller.
upgraded the controller code to 7.2.xxx in headquarters but still unable to telnet and tftp the controller from remote site.
is there any more settings on the controller for telnet and tftp?
what could be the problem why the controller is not available for telnet and tftp from the remote site?
thank you, experts, in advance for your replies!!!

Hello, Leo!
See output of the command:
(Cisco Controller) >show network summary
RF-Network Name............................. GID2012
Web Mode.................................... Enable
Secure Web Mode............................. Enable
Secure Web Mode Cipher-Option High.......... Disable
Secure Web Mode Cipher-Option SSLv2......... Enable
OCSP........................................ Disabled
OCSP responder URL..........................
Secure Shell (ssh).......................... Enable
Telnet...................................... Enable
Ethernet Multicast Forwarding............... Disable
Ethernet Broadcast Forwarding............... Disable
AP Multicast/Broadcast Mode................. Unicast
IGMP snooping............................... Disabled
IGMP timeout................................ 60 seconds
IGMP Query Interval......................... 20 seconds
MLD snooping................................ Disabled
MLD timeout................................. 60 seconds
MLD query interval.......................... 20 seconds
User Idle Timeout........................... 28800 seconds
ARP Idle Timeout............................ 300 seconds
Cisco AP Default Master..................... Enabled
--More-- or (q)uit
AP Join Priority............................ Disable
Mgmt Via Wireless Interface................. Enable
Mgmt Via Dynamic Interface.................. Enable
Bridge MAC filter Config.................... Enable
Bridge Security Mode........................ EAP
Mesh Full Sector DFS........................ Enable
AP Fallback ................................ Enable
Web Auth Redirect Ports .................... 80
Web Auth Proxy Redirect ................... Disable
Web Auth Captive-Bypass .................. Disable
Web Auth Secure Web ....................... Enable
Fast SSID Change ........................... Disabled
AP Discovery - NAT IP Only ................. Enabled
IP/MAC Addr Binding Check .................. Enabled
CCX-lite status ............................ Disable
oeap-600 dual-rlan-ports ................... Disable
oeap-600 local-network ..................... Enable

CSS11501 - Unable to Telnet to VRRP backup interface IP

Hi,
I have 2 units of Cisco CSS11501 which configured running on VRRP active/standby on 2 different VLAN (Circuit). When unit 1 is master unit, I am able to telnet to its circuit IP address, but unable to telnet to any circuit IP of backup unit.
Active unit configuration:
!************************** CIRCUIT **************************
circuit VLAN145
ip address 172.19.145.182 255.255.255.0
    ip virtual-router 1 priority 101
    ip redundant-vip 1 172.19.145.184
    ip redundant-interface 1 172.19.145.183
circuit VLAN550
ip address 192.168.50.18 255.255.255.0
    ip virtual-router 2 priority 101
    ip redundant-vip 2 192.168.50.20
    ip redundant-interface 2 192.168.50.19
!*************************** OWNER ***************************
owner ***
content ***
    vip address 172.19.145.184
    port 80
    protocol tcp
    add service ***
    active
!*************************** GROUP ***************************
group ***
vip address 192.168.50.20
active
Backup unit configuration:
!************************** CIRCUIT **************************
circuit VLAN145
ip address 172.19.145.183 255.255.255.0
    ip virtual-router 1 priority 90
    ip redundant-interface 1 172.19.145.182
    ip redundant-vip 1 172.19.145.184
circuit VLAN550
ip address 192.168.50.19 255.255.255.0
    ip virtual-router 2 priority 90
    ip redundant-vip 2 192.168.50.20
    ip redundant-interface 2 192.168.50.18
!*************************** OWNER ***************************
owner ***
content ***
    vip address 172.19.145.184
    port 80
    protocol tcp
    add service ***
    active
!*************************** GROUP ***************************
group ***
vip address 192.168.50.20
active
Please help!!
Regards,
Danny Lim

Hi Marko,
That means I could not to configure redundant-interface as I have redundant-vip configured already?
Actually the topology is:
VLAN550 is connecting to server farm
VLAN145 is where user sitting
my current config :
circuit VLAN145
ip address 172.19.145.182 255.255.255.0
    ip virtual-router 1 priority 101
    ip redundant-vip 1 172.19.145.184
    ip redundant-interface 1 172.19.145.183
    ip critical-service 1 PING_DEFAULT_GATEWAY
circuit VLAN550
ip address 192.168.50.18 255.255.255.0
    ip virtual-router 2 priority 101
    ip redundant-vip 2 192.168.50.20
    ip redundant-interface 2 192.168.50.19
    ip critical-service 2 PING_DEFAULT_GATEWAY
!*************************** OWNER ***************************
owner HLRLDAP
content VIP_LDAP_16611
    vip address 172.19.145.184
    port 16611
    protocol tcp
    add service KPG-HV30-3
    add service KPG-HV30-6
    active
!*************************** GROUP ***************************
group Redundant_Server
vip address 192.168.50.20
active
So, I should have change my config like this:
CSS1
circuit VLAN145
ip address 172.19.145.182 255.255.255.0
    ip virtual-router 1 priority 101
    ip redundant-vip 1 172.19.145.184
    ip redundant-interface 1 172.19.145.181
    ip critical-service 1 PING_DEFAULT_GATEWAY
circuit VLAN550
ip address 192.168.50.18 255.255.255.0
    ip virtual-router 2 priority 101
    ip redundant-interface 2 192.168.50.20
    ip critical-service 2 PING_DEFAULT_GATEWAY
CSS2
!************************** CIRCUIT **************************
circuit VLAN145
ip address 172.19.145.183 255.255.255.0
    ip virtual-router 1 priority 90
    ip redundant-interface 1 172.19.145.181
    ip redundant-vip 1 172.19.145.184
    ip critical-service 1 PING_DEFAULT_GATEWAY
circuit VLAN550
ip address 192.168.50.19 255.255.255.0
    ip virtual-router 2 priority 90
    ip redundant-interface 2 192.168.50.20
    ip critical-service 2 PING_DEFAULT_GATEWAY

One more solution for Silent Monitoring Windows 7 64-Bit - ERROR VOIP2037 Unable to open the NIC adapter for sniffing.

Hi,
we are using UCCX 8.5 SU3.
After replacing the actual agent workstations with Windows 7 64-bit we had to face problems with the silent monitoring. (no sound at all and in the CSD the usual error popup "Silent Monitor-Session failed...").
In the CAD logfile I found the errorcode. "ERROR VOIP2037 Unable to open the NIC adapter for sniffing. Please reconfigure the installation."
After investigating the logfiles, starting postinstall.exe a hundred times and reading the Configuring and Troubleshooting VoIP Monitoring Guide.
I just learnt about the wonderful tool nicq.exe.
And so i found out that the driver spcd.sys wasn't installed.
Check in the registry for "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SPCD"
It seems to me that the "Cisco Supervisor Desktop.msi" never installs the driver one a Windows 7 64-bit.
After starting the NICQ.EXE as administrator the driver is being installed.
Test 1: Check Driver Status
Driver not installed. Attempting to install it...
Driver has now been successfully installed.
SPCD Driver service is not running. Attempting to start it...
SPCD Driver service is now running.
Test 1: SUCCESS
And after that the silent monitoring works again like a charm.
Maybe that info help someone.
kind regards, sebastian

Excellent information, this has been driving me crazy for a while now. Once i saw this info I was able to get it resolved rather quickly.
+5 for you, (I tried to click it above but it would not let me.)

UNABLE TO ACCESS THE INTERNET FROM LOCAL PROVIDER ON A SITE-TO-SITE VPN CONNECTION

Dear All,
I have a site-to-site connection from point A to point B. From point B i am unable to access the internet from local internet provider.
I am trying to ping from 192.168.20.1 the dns 8.8.8.8 but i receive the message "destination net unreachable".
When i run "show ip nat translation" i receive nothing.
The vpn connection is working properly, i can ping the other side 192.168.10/24
Below is the configuration of the cisco router on point B.
dot11 syslog
ip source-route
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.21.254
ip dhcp pool voice
network 192.168.21.0 255.255.255.0
default-router 192.168.21.254
option 150 ip 192.168.5.10
ip cef
ip domain name neocleous.ru
ip inspect name IOS_FIREWALL tcp
ip inspect name IOS_FIREWALL udp
ip inspect name IOS_FIREWALL icmp
ip inspect name IOS_FIREWALL h323
ip inspect name IOS_FIREWALL http
ip inspect name IOS_FIREWALL https
ip inspect name IOS_FIREWALL skinny
ip inspect name IOS_FIREWALL sip
no ipv6 cef
multilink bundle-name authenticated
vty-async
isdn switch-type primary-net5
redundancy
crypto isakmp policy 5
hash md5
authentication pre-share
group 2
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 28800
crypto isakmp policy 50
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key Pb85heuvMde9Wdac5Qohha7lziIf142u address [ip address]
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10
crypto ipsec transform-set TRANSET esp-aes esp-sha-hmac
crypto ipsec transform-set TRANSET2 esp-des esp-md5-hmac
crypto ipsec df-bit clear
crypto map CryptoMAP1 ipsec-isakmp
set peer [ip address]
set transform-set TRANSET
match address CryptoACL
interface FastEthernet0/0
description Primary Provider
ip address [PUBLIC IP MAIN PROVIDER] 255.255.255.252
ip access-group outside_acl in
ip mtu 1390
ip nat outside
ip virtual-reassembly in
load-interval 30
duplex auto
speed auto
crypto map CryptoCY
crypto ipsec df-bit clear
interface FastEthernet0/1
description TO LAN
no ip address
load-interval 30
speed 100
full-duplex
interface FastEthernet0/1.1
description DATA VLAN
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip access-group inside_acl in
ip nat inside
ip inspect IOS_FIREWALL in
ip virtual-reassembly in
ip tcp adjust-mss 1379
interface FastEthernet0/1.2
description VOICE VLAN
encapsulation dot1Q 21
ip address 192.168.21.254 255.255.255.0
interface Serial0/2/0:15
no ip address
encapsulation hdlc
isdn switch-type primary-net5
isdn incoming-voice voice
no cdp enable
interface FastEthernet0/3/0
no ip address
ip access-group outside_acl in
ip nat outside
ip virtual-reassembly in
shutdown
duplex auto
speed auto
crypto map CryptoCY
ip local pool VPNPool 192.168.23.2 192.168.23.10
ip forward-protocol nd
ip http server
no ip http secure-server
ip nat inside source list nat_list interface FastEthernet0/3/0 overload
ip route 0.0.0.0 0.0.0.0 [default gateway ip]
ip access-list standard VTY
permit 192.168.20.0 0.0.0.255
ip access-list extended CryptoACL
permit ip 192.168.20.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip 192.168.21.0 0.0.0.255 192.168.5.0 0.0.0.255
permit ip 192.168.21.0 0.0.0.255 192.168.6.0 0.0.0.255
permit ip 192.168.21.0 0.0.0.255 192.168.12.0 0.0.0.255
permit ip 192.168.21.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip host 192.168.22.1 192.168.5.0 0.0.0.255
permit ip host 192.168.20.1 192.168.5.0 0.0.0.255
permit ip host 192.168.22.1 192.168.6.0 0.0.0.255
ip access-list extended DFBIT_acl
permit tcp any any
ip access-list extended inside_acl
permit ip 192.168.20.0 0.0.0.255 host 192.168.3.35
permit ip 192.168.20.0 0.0.0.255 host 192.168.3.39
permit ip 192.168.20.0 0.0.0.255 host 192.168.3.23
permit ip 192.168.20.0 0.0.0.255 host 192.168.3.18
permit ip 192.168.20.0 0.0.0.255 host 192.168.3.55
permit ip 192.168.20.0 0.0.0.255 host 192.168.10.144
permit ip 192.168.20.0 0.0.0.255 host 192.168.10.146
permit ip 192.168.20.0 0.0.0.255 host 192.168.10.141
permit ip host 192.168.20.253 host 192.168.3.21
permit ip host 192.168.20.254 host 192.168.3.21
permit ip 192.168.20.0 0.0.0.255 host 192.168.3.10
permit ip 192.168.20.0 0.0.0.255 host 192.168.20.254
ip access-list extended nat_list
deny ip host 192.168.20.254 192.168.10.0 0.0.0.255
deny ip host 192.168.20.254 192.168.3.0 0.0.0.255
deny ip host 192.168.20.1 192.168.3.0 0.0.0.255
deny ip host 192.168.20.1 192.168.10.0 0.0.0.255
deny ip host 192.168.20.2 192.168.3.0 0.0.0.255
deny ip host 192.168.20.2 192.168.10.0 0.0.0.255
permit ip host 192.168.20.1 any
permit ip host 192.168.20.2 any
permit ip host 192.168.20.254 any
ip access-list extended outside_acl
permit gre any host [ip address]
permit esp any host [ip address]
deny ip any any
ip sla 2
icmp-echo 192.168.10.254 source-interface FastEthernet0/1.1
frequency 180
timeout 500
ip sla schedule 2 life forever start-time now
logging 192.168.3.21
route-map DFBIT_routemap permit 10
match ip address DFBIT_acl
set ip df 0
route-map ISP2 permit 10
match ip address nat_list
match interface FastEthernet0/3/0
route-map nonat permit 10
match ip address nonat_acl
route-map ISP1 permit 10
match ip address nat_list
match interface FastEthernet0/0

You cannot access internet, because all traffic is tunneled for VPN !!!!
Please see cisco tech documentation and bypass traffic for internet.
eg. if lan traffic is going from site a to site b then through vpn
else
lan traffic to internet (any) should be out thorugh the vpn .

Unable to telnet the cisco 2900

Similar Messages

Maybe you are looking for