Vlan subinterface nat and routing

hi,
i've a cisco 1800 with .248 pool public ip .The router is connected with dce on serial port to my isp and
is configured with first public ip of my subnet on fe0/0 .
I've to serve to vlan (1 and 20) with this router so i 've connected the router fe0/0 to switch trunk port
and created a subinterface fe0/0.20 with dot1q encryption and ip 192.168.40.1. I also created a dhcp pool for vlan20 interface.
Now i can go to internet trought fe/0.0 . configured vlan 20 device receive 192.168.40.0/24 ip so dhcp pool work.
vlan 20 device can ping 192.168.40.1 and 82.85.162.1 (fe0/0.20 and fe0/0) but not want to go to internet.
show ip nat traslation is empty.
this is my show ip route:
Gateway of last resort is 213.205.53.77 to network 0.0.0.0
     217.133.64.0/32 is subnetted, 1 subnets
C       217.133.64.49 is directly connected, Virtual-Access1
C    192.168.40.0/24 is directly connected, FastEthernet0/0.20
     82.0.0.0/26 is subnetted, 1 subnets
C       82.85.162.0 is directly connected, FastEthernet0/0
     213.205.53.0/32 is subnetted, 1 subnets
C       213.205.53.77 is directly connected, Virtual-Access1
S*   0.0.0.0/0 [1/0] via 213.205.53.77
this is my configuration:
Current configuration : 2586 bytes
version 12.4
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
hostname ##############
boot-start-marker
boot-end-marker
logging message-counter syslog
logging buffered 64000
no logging console
enable secret 5 ####################
aaa new-model
aaa session-id common
clock timezone GMT+1 1
clock summer-time GMT+2 recurring
no ip source-route
ip dhcp excluded-address 82.85.162.1
ip dhcp excluded-address 192.168.40.1
ip dhcp pool LAN_Roma_Eletronica
   network 82.85.162.0 255.255.255.192
   default-router 82.85.162.1
   dns-server 213.205.36.70 213.205.32.70
   lease 0 0 15
ip dhcp pool vlan20
   network 192.168.40.0 255.255.255.0
   default-router 192.168.40.1
   dns-server 8.8.8.8 8.8.4.4
   lease 0 0 15
ip cef
no ip domain lookup
ip name-server 213.205.32.70
ip name-server 213.205.36.70
multilink bundle-name authenticated
username ######### password 7 #########
archive
 log config
  hidekeys
interface FastEthernet0/0
 ip address 82.85.162.1 255.255.255.192
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 no keepalive
interface FastEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.40.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
interface Serial0/0/0
 bandwidth 2048
no ip address
 encapsulation frame-relay IETF
 no fair-queue
 frame-relay traffic-shaping
 hold-queue 4096 in
 hold-queue 4096 out
interface Serial0/0/0.100 point-to-point
 bandwidth 1600
 no cdp enable
 frame-relay interface-dlci 100 ppp Virtual-Template1
  class FR-1600
interface Virtual-Template1
 bandwidth 1600
 ip address negotiated
 ip tcp adjust-mss 1410
 keepalive 5
 ppp chap hostname #################
 ppp chap password 7 ################
 ppp pap sent-username ############## password 7 ##############
 ppp ipcp route default
ip forward-protocol nd
no ip http server
ip nat inside source list 110 interface FastEthernet0/0 overload
map-class frame-relay FR-1600
 frame-relay cir 1600000
 frame-relay bc 200000
 frame-relay mincir 1000000
access-list 1 permit 192.168.40.0 0.0.0.255
access-list 110 permit ip 192.168.40.0 0.0.0.255 any
control-plane
line con 0
 session-timeout 60
 exec-timeout 60 0
 privilege level 15
line aux 0
 privilege level 15
line vty 0 4
 session-timeout 60
 access-class 10 in
 exec-timeout 60 0
scheduler allocate 20000 1000
end

There's 2 problems:
1- your "ip nat outside" location is wrong, you must put it on virtual-template1.
2-change "ip nat inside source list 110 interface FastEthernet0/0 overload" to "ip nat inside source list 110 interface virtual-template1 overload"
HTH
Houtan

Similar Messages

  • NAT and Routed Network with Two ISP's on one router

    I'm sure this has been done covered many times, but I am not finding it.
    I have two ISP connections.
    With ISP-A I have a /30 between us and 200.100.100.0/24 is routed to me via the /30 for thsi example we will say the /30 is 1.1.1.1 on isp end and 1.1.1.2 on my end
    With ISP-B I have a 100.0.0.0/29 subnet. and the ISP gateway is on that subnet at 100.0.0.1
    On the inside of my network I have devices using both 200.100.100.x addresses and devices on 192.168.100.x that need to use NAT.
    I would like all of the devices on 200.100.100.x addresses to continue using ISP-A as their gateway.
    Everything on 192.168.100.x should use NAT and go out ISP-B
    I have tried
    ip nat inside source route-map ISP-A interface GigabitEthernet0/1 overload
    route-map ISP-B permit 10
     match ip address 101
     match interface GigabitEthernet0/1
     set ip next-hop 100.0.0.1
    route-map ISP-A permit 10
     match ip address 111
     match interface Multilink1
     set ip next-hop 1.1.1.1
    The problem comes when I have default routes to ISP-A in the router than none of the ISP-B traffic works, and vice versa.

    I think for this to work correctly and be able to split traffic between the 2 ISPs, you would need to use BGP, because default is going to use one ISP or the other.
    If you can use BGP, this link will help you in load shearing between multiple ISPs when you have one router.
    http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf4
    HTH

  • VRF-lite, NAT and route-leaking

    Hello, community. I'm trying to reproduce setup with two customers (R1 and R2), PE router (R3) and common services (R4).
    Here is configuration:
    R1:
    interface Loopback0
    ip address 10.10.1.1 255.255.255.255
    interface FastEthernet1/0
    ip address 192.168.15.1 255.255.255.0
    ip route 0.0.0.0 0.0.0.0 192.168.15.5
    R2:
    interface Loopback0
    ip address 10.10.2.2 255.255.255.255
    interface FastEthernet1/0
    ip address 192.168.16.1 255.255.255.192
    ip route 0.0.0.0 0.0.0.0 192.168.16.5
    R3:
    ip vrf VRF1
    rd 1:1
    route-target export 1:1
    route-target import 1:1
    ip vrf VRF2
    rd 2:2
    route-target export 2:2
    route-target import 2:2
    interface FastEthernet0/0
    description R1
    ip vrf forwarding VRF1
    ip address 192.168.15.5 255.255.255.192
    ip nat inside
    ip virtual-reassembly
    interface FastEthernet0/1
    description R2
    ip vrf forwarding VRF2
    ip address 192.168.16.5 255.255.255.192
    ip nat inside
    ip virtual-reassembly
    interface FastEthernet1/0
    description R4
    ip address 1.1.1.1 255.255.255.0
    ip nat outside
    ip virtual-reassembly
    ip route 0.0.0.0 0.0.0.0 1.1.1.2
    ip route vrf VRF1 0.0.0.0 0.0.0.0 FastEthernet1/0 1.1.1.2 global
    ip route vrf VRF1 10.10.0.0 255.255.0.0 192.168.15.1
    ip route vrf VRF2 0.0.0.0 0.0.0.0 FastEthernet1/0 1.1.1.2 global
    ip route vrf VRF2 10.10.0.0 255.255.0.0 192.168.16.1
    ip nat inside source list 15 interface FastEthernet1/0 vrf VRF1 overload
    ip nat inside source list 16 interface FastEthernet1/0 vrf VRF2 overload
    access-list 15 permit 192.0.0.0 0.255.255.255
    access-list 15 permit 10.10.0.0 0.0.255.255
    access-list 16 permit 192.0.0.0 0.255.255.255
    access-list 16 permit 10.10.0.0 0.0.255.255
    R4:
    interface Loopback0
    ip address 10.10.10.10 255.255.255.255
    interface FastEthernet0/0
    ip address 1.1.1.2 255.255.255.0
    ip route 0.0.0.0 0.0.0.0 1.1.1.1
    The configuration is not operational.
    r1#ping 192.168.15.5
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.15.5, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 68/89/116 ms
    r1#ping 192.168.15.5 source l0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.15.5, timeout is 2 seconds:
    Packet sent with a source address of 10.10.1.1
    Success rate is 100 percent (5/5), round-trip min/avg/max = 68/86/92 ms
    r1#ping 1.1.1.1 source l0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
    Packet sent with a source address of 10.10.1.1
    Success rate is 80 percent (4/5), round-trip min/avg/max = 292/357/400 ms
    r1#ping 1.1.1.2 source l0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.2, timeout is 2 seconds:
    Packet sent with a source address of 10.10.1.1
    Success rate is 80 percent (4/5), round-trip min/avg/max = 160/187/216 ms
    r1#ping 10.10.10.10 source l0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds:
    Packet sent with a source address of 10.10.1.1
    Success rate is 0 percent (0/5)
    I can't ping R4's loopback address ("shared resource" or also known as "common service")
    The same is with R2 ( second customer).
    But I can still ping R4's loopback from R3:
    R3#ping 10.10.10.10
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 40/88/116 ms
    This is routing table on R3:
    R3#sh ip route | begin Gateway
    Gateway of last resort is 1.1.1.2 to network 0.0.0.0
         1.0.0.0/24 is subnetted, 1 subnets
    C       1.1.1.0 is directly connected, FastEthernet1/0
    S*   0.0.0.0/0 [1/0] via 1.1.1.2
    R3#sh ip route vrf VRF1 | begin Gateway
    Gateway of last resort is 1.1.1.2 to network 0.0.0.0
         192.168.15.0/26 is subnetted, 1 subnets
    C       192.168.15.0 is directly connected, FastEthernet0/0
         10.0.0.0/16 is subnetted, 1 subnets
    S       10.10.0.0 [1/0] via 192.168.15.1
    S*   0.0.0.0/0 [1/0] via 1.1.1.2, FastEthernet1/0
    R3#sh ip route vrf VRF2 | begin Gateway
    Gateway of last resort is 1.1.1.2 to network 0.0.0.0
         10.0.0.0/16 is subnetted, 1 subnets
    S       10.10.0.0 [1/0] via 192.168.16.1
         192.168.16.0/26 is subnetted, 1 subnets
    C       192.168.16.0 is directly connected, FastEthernet0/1
    S*   0.0.0.0/0 [1/0] via 1.1.1.2, FastEthernet1/0
    So the question is what is the problem cause? How to troubleshoot? What is the troubleshooting steps?

    Hi Eugene Khabarov
    The problem here is that at the PE we have the static route for the Major Subnet 10.10.0.0/16 pointing back to the CEs of which the destination ping IP 10.10.10.10 is part of.
    We need to remove the Major X /16 route from PE and configure explicit X /32 route for the CE Loopback to make this work
    no ip route vrf VRF1 10.10.0.0 255.255.0.0 192.168.15.1
    ip route vrf VRF1 10.10.1.1 255.255.0.0 192.168.15.1
    no ip route vrf VRF2 10.10.0.0 255.255.0.0 192.168.16.1
    ip route vrf VRF2 10.10.2.2 255.255.0.0 192.168.16.1
    Hope this helps to answer your query.
    Regards
    Varma

  • Howto: Zones in private subnets using ipfilter's NAT and Port forwarding

    This setup supports the following features:
    * Requires 1 Network interface total.
    * Supports 1 or more public ips.
    * Allows Zone to Zone private network traffic.
    * Allows internet access from the global zones.
    * Allows direct (via ipfilter) internet access to ports in non-global zones.
    (change networks to suit your needs, the number of public and private ip was lowered to simplify this doc)
    Network setup:
    iprb0 65.38.103.1/24
    defaultrouter 65.38.103.254
    iprb0:1 192.168.1.1/24 (in global zone)
    Create a zone on iprb0 with an ip of 192.168.1.2
    ### Example /etc/ipf/ipnat.conf
    # forward from a public port to a private zone port
    rdr iprb0 65.38.103.1/32 port 2222 -> 192.168.1.2 port 22
    # force outbound zone traffic thru a certain ip address
    # required for mail servers because of reverse lookup
    map iprb0 192.168.1.2/32 -> 65.38.103.1/32 proxy port ftp ftp/tcp
    map iprb0 192.168.1.2/32 -> 65.38.103.1/32 portmap tcp/udp auto
    map iprb0 192.168.1.2/32 -> 65.38.103.1
    # allow any 192.168.1.x zone to use the internet
    map iprb0 192.168.1.0/24 -> 0/32 proxy port ftp ftp/tcp
    map iprb0 192.168.1.0/24 -> 0/32 portmap tcp/udp auto
    map iprb0 192.168.1.0/24 -> 0/32For testing purposes you can leave /etc/ipf/ipf.conf empty.
    Be aware the you must "svcadm disable ipfilter; svcadm enable ipfilter" to reload rules and the rules stay loaded if they are just disabled(bug).
    Zones can't modify their routes and inherit the default routes of the global zone. Because of this we have to trick the non-global zones into using a router that doesn't exist.
    Create /etc/init.d/zone_route_hack
    Link this file to /etc/rc3.d/S99zone_route_hack.
    #/bin/sh
    # based on information found at
    # http://blogs.sun.com/roller/page/edp?entry=using_branded_zones_on_a
    # http://forum.sun.com/jive/thread.jspa?threadID=75669&messageID=275741
    fake_router=192.168.1.254
    public_net=65.38.103.0
    router=`netstat -rn | grep default | grep -v " $fake_router " | nawk '{print $2}'`
    # send some data to the real network router so we look up it's arp address
    ping -sn $router 1 1 >/dev/null
    # record the arp address of the real router
    router_arp=`arp $router | nawk '{print $4}'`
    # delete any existing arp address entry for our fake private subnet router
    arp -d $fake_router >/dev/null
    # assign the real routers arp address to our fake private subnet router
    arp -s $fake_router $router_arp
    # route our private subnet through our fake private subnet router
    route add default $fake_router
    # Can't create this route until the zone/interface are loaded
    # Adjust this based on your hardware and number of zones
    sleep 300
    # Duplicate this line for every non-global zone with a private ip that
    # will have ipfilter rdr (redirects) pointing to it
    route add -net $public_net 192.168.1.2 -ifaceNow we have both public and private ip addresses on our one iprb0 interface. If we'd really like our private zone network to really be private we don't want any non-NAT'ed 192.168.1.x traffic leaving the interface. Since ipfilter can't block traffic between zones because they use loopbacks we can just block the 192.168.1.x traffic and the zones can still talk.
    The following /etc/ipf/ipf.conf defaults to deny.
    # ipf.conf
    # IP Filter rules to be loaded during startup
    # See ipf(4) manpage for more information on
    # IP Filter rules syntax.
    # INCOMING DEFAULT DENY
    block in all
    block return-rst in proto tcp all
    # two open ports one of which is redirected in ipnat.conf
    pass in quick on iprb0 proto tcp from any to any port = 22 flags S keep state keep frags
    pass in quick on iprb0 proto tcp from any to any port = 2222 flags S keep state keep frags
    # INCOMING PING
    pass in quick on iprb0 proto icmp from any to 65.38.103.0/24 icmp-type 8 keep state
    # INCOMING GLOBAL ZONE UNIX TRACEROUTE FIX PART 1
    #pass in quick on iprb0 proto udp from any to 65.38.103.0/24 keep state
    # OUTGOING RULES
    block out all
    # ALL INTERNAL TRAFFIC STAYS INTERNAL (Zones use non-filtered loopback)
    # remove/edit as needed to actually talk to local private physical networks
    block out quick from any to 192.168.0.0/16
    block out quick from any to 172.16.0.0/12
    block out quick from any to 10.0.0.0/8
    block out quick from any to 0.0.0.0/8
    block out quick from any to 127.0.0.0/8
    block out quick from any to 169.254.0.0/16
    block out quick from any to 192.0.2.0/24
    block out quick from any to 204.152.64.0/23
    block out quick from any to 224.0.0.0/3
    # Allow traffic out the public interface on the public address
    pass out quick on iprb0 from 65.38.103.1/32 to any flags S keep state keep frags
    # OUTGOING PING
    pass out quick on iprb0 proto icmp from 65.38.103.1/32 to any icmp-type 8 keep state
    # Allow traffic out the public interface on the private address (needs nat and router arp hack)
    pass out quick on iprb0 from 192.168.1.0/24 to any flags S keep state keep frags
    # OUTGOING PING
    pass out quick on iprb0 proto icmp from 192.168.1.0/24 to any icmp-type 8 keep state
    # INCOMING TRACEROUTE FIX PART 2
    #pass out quick on iprb0 proto icmp from 65.38.103.1/32 to any icmp-type 3 keep stateIf you want incoming and outgoing internet in your zones it is easier if you just give them public ips and setup a firewall in the global zone. If you have limited public ip address(I'm setting up a colocation 1u server) then you might take this approach. One of the best things about doing thing this way is that any software configured in the non-global zones will never be configured to listen on an ip address that might change if you change public ips.

    Instead of using the script as a legacy_run script, set it up in SMF.
    First create the file /var/svc/manifest/system/ip-route-hack.xml with
    the following
    ---Start---
    <?xml version="1.0"?>
    <!DOCTYPE service_bundle SYSTEM
    "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
    <!--
    ident "@(#)ip-route-hack.xml 1.0 09/21/06"
    -->
    <service_bundle type='manifest' name='NATtrans:ip-route-hack'>
    <service
    name='system/ip-route-hack'
    type='service'
    version='1'>
    <create_default_instance enabled='true' />
    <single_instance />
    <dependency
    name='physical'
    grouping='require_all'
    type='service'
    restart_on='none'>
    <service_fmri value='svc:/network/physical:default' />
    </dependency>
    <dependency
    name='loopback'
    grouping='require_all'
    type='service'
    restart_on='none'>
    <service_fmri value='svc:/network/loopback:default' />
    </dependency>
    <exec_method
    type='method'
    name='start'
    exec='/lib/svc/method/svc-ip-route-hack start'
    timeout_seconds='0' />
    <property_group name='startd' type='framework'>
    <propval name='duration' type='astring'
    value='transient' />
    </property_group>
    <stability value='Unstable' />
    <template>
    <common_name>
    <loctext xml:lang='C'>
    Hack to allow zone to NAT translate.
    </loctext>
    </common_name>
    <documentation>
    <manpage
    title='zones'
    section='1M'
    manpath='/usr/share/man' />
    </documentation>
    </template>
    </service>
    </service_bundle>
    ---End---
    then modify /var/svc/manfiest/system/zones.xml and add the following
    dependancy
    ---Start---
    <dependency
    name='inet-ip-route-hack'
    type='service'
    grouping='require_all'
    restart_on='none'>
    <service_fmri value='svc:/system/ip-route-hack' />
    </dependency>
    ---End---
    Finally create the file /lib/svc/method/svc-ip-route-hack with the
    contents of S99zone_route_hack, minus the sleep timer (perms 0755). Run
    'svccfg import /var/svc/manifest/system/ip-route-hack.xml' and 'svccfg
    import /var/svc/manifest/system/zones.xml'.
    This will guarantee that ip-route-hack is run before zones are started,
    but after the interfaces are brought on line. It is worth noting that
    zones.xml may get overwritten during a patch, so if it suddenly stops
    working, that could be why.

  • Static NAT and same IP address for two interfaces

    We have a Cisco ASA 5520 and in order to conserve public IP addresses and configuration (possibly) can we use the same public IP address for a static NAT with two different interfaces? Here is an example of what I'm refering too where 10.10.10.10 would be the same public IP address.
    static (inside,Outside) 10.10.10.10  access-list inside_nat_static_1
    static (production,Outside) 10.10.10.10  access-list production_nat_static_1
    Thanks for any help.
    Jeff

    Hi Jeff,
    Unfortunately this cannot be done, on the ASA packet classification is done on the basis of mac-address, destination nat and route, and here you are confusing the firewall, to which interface does the ip belong to. I haven't ever tried to do it, but it should cause you issues.
    Thanks,
    Varun Rao
    Security Team,
    Cisco TAC

  • Vlan subinterface on ASA and connection to internet

    Hi Everyone,
    Need to understand the network  here
    Say we have ASA  which has gi0/0 interface and we do subinterfaces of this and it has trunk connection to switch.
    gi0/0.1 outside  vlan 10
    gi0/0.2 visitor   vlan 20
    gi0/0.3 wi fi    vlan 30
    say we have 2 dhcp pools for interface visitor and wi fi.
    Say users on visitor dhcp pool has gateway of 192.168
    say users on wi fi dhcp pool has gateway of 172.x.x.x
    gi 0/0.1 has public ip  address and it has default route to edge router.
    ASA--------Switch 1------------switch2-------------edge eouter ---------ISP
    Switch2 is learning about vlans 10,20,30.
    But connection between switch2 and edge router carries only vlan40.
    Need to understand how users on vlan 20 and 30 reach the edge router and access the internet as  switch2 port connected to edge router carries only
    vlan10 as allowed traffic on trunk link?
    Thanks
    Mahesh

    Hi julio,
    Below is my understanding  ---
    Let me know if i am wrong anywhere---
    The switch 1 and switch 2 have vlan 20,30 where user connect ther PC and access the internet.
    Remember  switch  1 and 2 does not have SVI  vlan 20 and 30.So when user connect to access port vlan 20 or 30 on switch 1 or 2 PC  gets IP address from DHCP pool defined on ASA.
      and it has default gateway of ASA interface of gi0/0.2 or 0.3
    When user need to access the internet traffic goes to ASA interface gi0/0.2 as thats default gateway for user PC.
    Then ASA has default static route that  points to the ASA Edge Router.
    So traffic from say PC to switch 2 is untagged then from switch 2 to ASA  it goes tagged due to trunking.
    Then return traffic from ASA  to edge router is
    ASA  to SW1 -----------trunk tagged.
    Sw1 to sw2 ----trunk tagged
    Sw2 to edge router tagged with vlan 10.
    Edge router has 802.1q trunking for vlan 10
    sw2 to edge router  comes as tagged then edge router removes the vlan 10 tag.
    Regards
    MAhesh

  • VRF configuration on subinterface and VLAN subinterface

    Hi
    Can I configure VRFs on subinterface (physical and VLAN) basis in a normal BGP/MPLS VPN configuration.
    Thanks
    VK

    Hi Sultan,
    You are very welcomed, i'd be more than glade to help you out your confusion, below is the output of one of my lab PEs, and moreover i've in production customers running with this setup, i've never faced the issue you are describing, if you can regenerate the test you are describing we can elaborate on it:
    interface FastEthernet0/0
    no ip address
    interface FastEthernet0/0.1
    encapsulation dot1Q 101
    ip vrf forwarding a
    ip address 101.101.101.1 255.255.255.252
    interface FastEthernet0/0.2
    encapsulation dot1Q 202
    ip vrf forwarding b
    ip address 202.202.202.1 255.255.255.252
    This is a 7200VXR (NPE-300) running "c7200-p-mz.122-25.S14.bin".
    BR,
    Mohammed Mahmoud.

  • Branch office setup with L3 switch and router with IOS security

    Hello,
    I am in the process of putting together a small branch office network and I am in need of some design advise. The network will support about 10-15 workstations/phones, 3-4 printers, and 4-5 servers. In addition we will eventually have up to 25-30 remote users connecting to the servers via remote access VPN, and there will also be 2-3 site-to-site IPSec tunnels to reach other branches.
    I have a 2911 (security bundle) router and 3560 IP Base L3 switch to work with. I have attached a basic diagram of my topology. My initial design plan for the network was to setup separate VLANs for workstation, phone, printer, and server traffic. The 3560 would then be setup with SVIs to perform routing between VLANs. The port between the router and switch would be setup as a routed port, and static routes would be applied on the switch and router as necessary. The thought behind this was that I'd be utilizing the switch backplane for VLAN routing instead instead of doing router-on-a-stick.
    Since there is no firewall between the switch and router my plan was to setup IOS firewalling on the router. From what I am reading ZBF is my best option for this. What I was hoping for was a way to set custom policies for each VLAN, but it seems that zones are applied per interface. Since the interface between the router and switch is a routed interface, not a trunk/subinterface(s), it doesn't seem like there would be a way for me to use ZBF to control traffic on different VLANs. From what I am gathering I would have to group all of my internal network into one zone, or I would have to scrap L3 switching all together and do router-on-a-stick if I want to be able to set separate policies for each VLAN. Am I correct in my thinking here?
    I guess what I am getting at is that I really don't want to do router-on-a-stick if I have a nice switch backplane to do all of the internal routing. At the same time I obviously need some kind of firewalling done on the router, and since different VLANs have different security requirements the firewalling needs to be fairly granular.
    If I am indeed correct in the above thinking what would be the best solution for my scenario? That is, how can I setup this network so that I am utilizing the switch to do L3 routing while also leveraging the firewall capabilities of IOS security?
    Any input would be appreciated.
    Thanks,
    Austin

    Thanks for the input.
    1. I agree, since I have only three to four printers, they need not be in a separate VLAN. I simply was compartmentalizing VLANs by function when I initially came up with the design.
    2. Here's a little more info on the phone situation. The phones are VoIP. The IP PBX is on premise, but they are currently on a completely separate ISP/network. The goal in the future is to converge the data and voice networks and setup PBR/route maps to route voice traffic out the voice ISP and data traffic out the other ISP. This leads up to #3. 
    3. The reason a router was purchased over a firewall was that ASA's cannot handle routing and dual ISPs very well. PBR is not supported at all on an ASA, and dual ISPs can only be setup in an active/standby state. Also, an ASA Sec+ does not have near the VPN capabilities that the 2911 security does. The ASA Sec+ would support only 25 concurrent IPSec connections while the 2911 security is capable of doing an upwards of 200 IPSec connections.
    Your point about moving the SVI's to a firewall to perform filtering between VLANs makes sense, however, wouldn't this be the same thing as creating subinterfaces on a router? In both cases you are moving routing from the switch backplane to the firewall/routing device, which is what I am trying to avoid.  

  • CSM concurrent bridge and router mode

    Hi,
    Is it possible on the CSM to use bridge and router mode at the same time ? Or is it only router mode or only bridge mode ?
    E.g. in the example below, when using HTTPS entering the vlan 3 , it will be bridged to vlan 3....But when using HTTP entering vlan 3...it will be routed to vlan 4... Will that work ?
    Thanks
    vlan 3 client
    ip address 3.3.3.1 255.255.255.0
    vlan 3 server
    ip address 3.3.3.1 255.255.255.0
    vlan 4 server
    ip address 4.4.4.1 255.255.255.0
    vserver HTTPS
    vlan 3
    virtual 3.3.3.10 tcp https
    serverfarm HTTPS
    serverfarm HTTPS
    no nat server
    no nat client
    real 3.3.3.11
    inservice
    real 3.3.3.12
    inservice
    vserver HTTP
    vlan 3
    virtual 3.3.3.11 tcp http
    serverfarm HTTP
    serverfarm HTTP
    nat server
    no nat client
    real 4.4.4.10
    inservice
    real 4.4.4.11
    inservice

    HI Michel,
    first of all you can run bridged and routed mode at the same time but you can not define the same vlan as client and server. If you would change the above config from vlan 3 server to vlan 30 server and place the reals in vlan 30 it will work. A proper layer 2 configuration is for sure the prerequisit.
    Kind regards,
    Joerg

  • Site-to-Site VPN btw Pix535 and Router 2811, can't get it work

    Hi, every one,  I spent couple of days trying to make  a site-to-site VPN between PIX535 and router 2811 work but come up empty handed, I followed instructions here:
    http://www.cisco.com/en/US/products/ps9422/products_configuration_example09186a0080b4ae61.shtml
    #1: PIX config:
    : Saved
    : Written by enable_15 at 18:05:33.678 EDT Sat Oct 20 2012
    PIX Version 8.0(4)
    hostname pix535
    interface GigabitEthernet0
    description to-cable-modem
    nameif outside
    security-level 0
    ip address X.X.138.132 255.255.255.0
    ospf cost 10
    interface GigabitEthernet1
    description inside  10/16
    nameif inside
    security-level 100
    ip address 10.1.1.254 255.255.0.0
    ospf cost 10
    access-list outside_access_in extended permit ip any any
    access-list inside_nat0_outbound extended permit ip 10.1.0.0 255.255.0.0 10.20.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip any 10.1.1.192 255.255.255.248
    access-list outside_cryptomap_dyn_60 extended permit ip any 10.1.1.192 255.255.255.248
    access-list outside_1_cryptomap extended permit ip 10.1.0.0 255.255.0.0 10.20.0.0 255.255.0.0
    pager lines 24
    ip local pool cnf-8-ip 10.1.1.192-10.1.1.199 mask 255.255.0.0
    global (outside) 10 interface
    global (outside) 15 1.2.4.5
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 15 10.1.0.0 255.255.0.0
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 X.X.138.1 1
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-MD5
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 40 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 40 set security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 60 match address outside_cryptomap_dyn_60
    crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-MD5 ESP-3DES-SHA ESP-DES-MD5 ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 60 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 60 set security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer X.X.21.29
    crypto map outside_map 1 set transform-set ESP-DES-SHA
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65534 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp identity hostname
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 1
    lifetime 86400
    crypto isakmp policy 20
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal 3600
    group-policy GroupPolicy1 internal
    group-policy cnf-vpn-cls internal
    group-policy cnf-vpn-cls attributes
    wins-server value 10.1.1.7
    dns-server value 10.1.1.7 10.1.1.205
    vpn-tunnel-protocol IPSec l2tp-ipsec
    default-domain value x.com
    username sean password U/h5bFVjXlIDx8BtqPFrQw== nt-encrypted
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key secret1
    radius-sdi-xauth
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    tunnel-group cnf-vpn-cls type remote-access
    tunnel-group cnf-vpn-cls general-attributes
    address-pool cnf-8-ip
    default-group-policy cnf-vpn-cls
    tunnel-group cnf-vpn-cls ipsec-attributes
    pre-shared-key secret2
    isakmp ikev1-user-authentication none
    tunnel-group cnf-vpn-cls ppp-attributes
    authentication ms-chap-v2
    tunnel-group X.X.21.29 type ipsec-l2l
    tunnel-group X.X.21.29 ipsec-attributes
    pre-shared-key SECRET
    class-map inspection_default
    match default-inspection-traffic
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:9780edb09bc7debe147db1e7d52ec39c
    : end
    #2:  Router 2811 config:
    ! Last configuration change at 09:15:32 PST Fri Oct 19 2012 by cnfla
    ! NVRAM config last updated at 13:45:03 PST Tue Oct 16 2012
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname LA-2800
    crypto pki trustpoint TP-self-signed-1411740556
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1411740556
    revocation-check none
    rsakeypair TP-self-signed-1411740556
    crypto pki certificate chain TP-self-signed-1411740556
    certificate self-signed 01
      3082023F 308201A8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31343131 37343035 3536301E 170D3132 31303136 32303435
      30335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34313137
      34303535 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100F75F F1BDAD9B DE9381FD 165B5188 7EAF9685 CF15A317 1B424825 9C66AA28
      C990B2D3 D69A2F0F D745DB0E 2BB4995D 73415AC4 F01B2019 84373199 C4BCF9E0
      E599B86C 17DBDCE6 47EBE0E3 8DBC90B2 9B4E217A 87F04BF7 A182501E 24381019
      A61D2C05 5404DE88 DA2A1ADC A81B7F65 C318B697 7ED69DF1 2769E4C8 F3449B33
      35AF0203 010001A3 67306530 0F060355 1D130101 FF040530 030101FF 30120603
      551D1104 0B300982 074C412D 32383030 301F0603 551D2304 18301680 14B56EEB
      88054CCA BB8CF8E8 F44BFE2C B77954E1 52301D06 03551D0E 04160414 B56EEB88
      054CCABB 8CF8E8F4 4BFE2CB7 7954E152 300D0609 2A864886 F70D0101 04050003
      81810056 58755C56 331294F8 BEC4FEBC 54879FF5 0FCC73D4 B964BA7A 07D20452
      E7F40F42 8B355015 77156C9F AAA45F9F 59CDD27F 89FE7560 F08D953B FC19FD2D
      310DA96E A5F3E83B 52D515F8 7B4C99CF 4CECC3F7 1A0D4909 BD08C373 50BB53CC
      659C4246 2CB7B79F 43D94D96 586F9103 9B4659B6 5C8DDE4F 7CC5FC68 C4AD197A 4EC322
                quit
    crypto isakmp policy 1
    authentication pre-share
    crypto isakmp key SECRET address X.X.138.132 no-xauth
    crypto ipsec transform-set la-2800-trans-set esp-des esp-sha-hmac
    crypto map la-2800-ipsec-policy 1 ipsec-isakmp
    description vpn ipsec policy
    set peer X.X.138.132
    set transform-set la-2800-trans-set
    match address 101
    interface FastEthernet0/0
    description WAN Side
    ip address X.X.216.29 255.255.255.248
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    no cdp enable
    no mop enabled
    crypto map la-2800-ipsec-policy
    interface FastEthernet0/1
    description LAN Side
    ip address 10.20.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex full
    speed auto
    no mop enabled
    ip nat inside source route-map nonat interface FastEthernet0/0 overload
    access-list 10 permit X.X.138.132
    access-list 99 permit 64.236.96.53
    access-list 99 permit 98.82.1.202
    access-list 101 remark vpn tunnerl acl
    access-list 101 remark SDM_ACL Category=4
    access-list 101 remark tunnel policy
    access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255
    access-list 110 deny   ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255
    access-list 110 permit ip 10.20.0.0 0.0.0.255 any
    snmp-server community public RO
    route-map nonat permit 10
    match ip address 110
    webvpn gateway gateway_1
    ip address X.X.216.29 port 443
    ssl trustpoint TP-self-signed-1411740556
    inservice
    webvpn install svc flash:/webvpn/svc.pkg
    webvpn context gateway-1
    title "b"
    secondary-color white
    title-color #CCCC66
    text-color black
    ssl authenticate verify all
    policy group policy_1
       functions svc-enabled
       svc address-pool "WebVPN-Pool"
       svc keep-client-installed
       svc split include 10.20.0.0 255.255.0.0
    default-group-policy policy_1
    gateway gateway_1
    inservice
    end
    #3:  Test from Pix to router:
    Active SA:    1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: X.X.21.29
        Type    : user            Role    : initiator
        Rekey   : no              State   : MM_WAIT_MSG2
    >>DEBUG:
    Oct 22 12:07:14 pix535:Oct 22 12:20:28 EDT: %PIX-vpn-3-713902: IP = X.X.21.29, Removing peer from peer table failed, no match!
    Oct 22 12:07:14 pix535 :Oct 22 12:20:28 EDT: %PIX-vpn-4-713903: IP = X.X.21.29, Error: Unable to remove PeerTblEntry
    #4:  test from router to pix:
    LA-2800#sh  crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id slot status
    X.X.138.132  X.X.216.29  MM_KEY_EXCH       1017    0 ACTIVE
    >>debug
    LA-2800#ping 10.1.1.7 source 10.20.1.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.1.1.7, timeout is 2 seconds:
    Packet sent with a source address of 10.20.1.1
    Oct 22 16:24:33.945: ISAKMP:(0): SA request profile is (NULL)
    Oct 22 16:24:33.945: ISAKMP: Created a peer struct for X.X.138.132, peer port 500
    Oct 22 16:24:33.945: ISAKMP: New peer created peer = 0x488B25C8 peer_handle = 0x80000013
    Oct 22 16:24:33.945: ISAKMP: Locking peer struct 0x488B25C8, refcount 1 for isakmp_initiator
    Oct 22 16:24:33.945: ISAKMP: local port 500, remote port 500
    Oct 22 16:24:33.945: ISAKMP: set new node 0 to QM_IDLE     
    Oct 22 16:24:33.945: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 487720A0
    Oct 22 16:24:33.945: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    Oct 22 16:24:33.945: ISAKMP:(0):found peer pre-shared key matching 70.169.138.132
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-07 ID
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-03 ID
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-02 ID
    Oct 22 16:24:33.945: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    Oct 22 16:24:33.945: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    Oct 22 16:24:33.945: ISAKMP:(0): beginning Main Mode exchange
    Oct 22 16:24:33.945: ISAKMP:(0): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_NO_STATE
    Oct 22 16:24:33.945: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Oct 22 16:24:34.049: ISAKMP (0:0): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_NO_STATE
    Oct 22 16:24:34.049: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Oct 22 16:24:34.049: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    Oct 22 16:24:34.049: ISAKMP:(0): processing SA payload. message ID = 0
    Oct 22 16:24:34.049: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.049: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Oct 22 16:24:34.049: ISAKMP:(0): vendor ID is NAT-T v2
    Oct 22 16:24:34.049: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.049: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
    Oct 22 16:24:34.053: ISAKMP:(0):found peer pre-shared key matching 70.169.138.132
    Oct 22 16:24:34.053: ISAKMP:(0): local preshared key found
    Oct 22 16:24:34.053: ISAKMP : Scanning profiles for xauth ...
    Oct 22 16:24:34.053: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    Oct 22 16:24:34.053: ISAKMP:      encryption DES-CBC
    Oct 22 16:24:34.053: ISAKMP:      hash SHA
    Oct 22 16:24:34.053: ISAKMP:      default group 1
    Oct 22 16:24:34.053: ISAKMP:      auth pre-share
    Oct 22 16:24:34.053: ISAKMP:      life type in seconds
    Oct 22 16:24:34.053: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    Oct 22 16:24:34.053: ISAKMP:(0):atts are acceptable. Next payload is 0
    Oct 22 16:24:34.053: ISAKMP:(0):Acceptable atts:actual life: 0
    Oct 22 16:24:34.053: ISAKMP:(0):Acceptable atts:life: 0
    Oct 22 16:24:34.053: ISAKMP:(0):Fill atts in sa vpi_length:4
    Oct 22 16:24:34.053: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    Oct 22 16:24:34.053: ISAKMP:(0):Returning Actual lifetime: 86400
    Oct 22 16:24:34.053: ISAKMP:(0)::Started lifetime timer: 86400.
    Oct 22 16:24:34.053: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.053: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Oct 22 16:24:34.053: ISAKMP:(0): vendor ID is NAT-T v2
    Oct 22 16:24:34.053: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.053: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
    Oct 22 16:24:34.053: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Oct 22 16:24:34.053: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Oct 22 16:24:34.057: ISAKMP:(0): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_SA_SETUP
    Oct 22 16:24:34.057: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Oct 22 16:24:34.057: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Oct 22 16:24:34.057: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Oct 22 16:24:34.181: ISAKMP (0:0): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_SA_SETUP
    Oct 22 16:24:34.181: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Oct 22 16:24:34.181: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Oct 22 16:24:34.181: ISAKMP:(0): processing KE payload. message ID = 0
    Oct 22 16:24:34.217: ISAKMP:(0): processing NONCE payload. message ID = 0
    Oct 22 16:24:34.217: ISAKMP:(0):found peer pre-shared key matching X.X.138.132
    Oct 22 16:24:34.217: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.217: ISAKMP:(1018): vendor ID is Unity
    Oct 22 16:24:34.217: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.217: ISAKMP:(1018): vendor ID seems Unity/DPD but major 55 mismatch
    Oct 22 16:24:34.217: ISAKMP:(1018): vendor ID is XAUTH
    Oct 22 16:24:34.217: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.217: ISAKMP:(1018): speaking to another IOS box!
    Oct 22 16:24:34.221: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.221: ISAKMP:(1018):vendor ID seems Unity/DPD but hash mismatch
    Oct 22 16:24:34.221: ISAKMP:received payload type 20
    Oct 22 16:24:34.221: ISAKMP:received payload type 20
    Oct 22 16:24:34.221: ISAKMP:(1018):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Oct 22 16:24:34.221: ISAKMP:(1018):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Oct 22 16:24:34.221: ISAKMP:(1018):Send initial contact
    Oct 22 16:24:34.221: ISAKMP:(1018):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    Oct 22 16:24:34.221: ISAKMP (0:1018): ID payload
    next-payload : 8
    type         : 1
    address      : X.X.216.29
    protocol     : 17
    port         : 500
    length       : 12
    Oct 22 16:24:34.221: ISAKMP:(1018):Total payload length: 12
    Oct 22 16:24:34.221: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:24:34.221: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:24:34.225: ISAKMP:(1018):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Oct 22 16:24:34.225: ISAKMP:(1018):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Oct 22 16:24:38.849: ISAKMP:(1017):purging node 198554740
    Oct 22 16:24:38.849: ISAKMP:(1017):purging node 812380002
    Oct 22 16:24:38.849: ISAKMP:(1017):purging node 773209335..
    Success rate is 0 percent (0/5)
    LA-2800#
    Oct 22 16:24:44.221: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:24:44.221: ISAKMP (0:1018): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    Oct 22 16:24:44.221: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:24:44.221: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:24:44.221: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:24:44.317: ISAKMP (0:1018): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_KEY_EXCH
    Oct 22 16:24:44.317: ISAKMP:(1018): phase 1 packet is a duplicate of a previous packet.
    Oct 22 16:24:44.321: ISAKMP:(1018): retransmission skipped for phase 1 (time since last transmission 96)
    Oct 22 16:24:48.849: ISAKMP:(1017):purging SA., sa=469BAD60, delme=469BAD60
    Oct 22 16:24:52.313: ISAKMP (0:1018): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_KEY_EXCH
    Oct 22 16:24:52.313: ISAKMP:(1018): phase 1 packet is a duplicate of a previous packet.
    Oct 22 16:24:52.313: ISAKMP:(1018): retransmitting due to retransmit phase 1
    Oct 22 16:24:52.813: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:24:52.813: ISAKMP (0:1018): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
    Oct 22 16:24:52.813: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:24:52.813: ISAKMP:(1018): sending packet to X.X138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:24:52.813: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:24:52.913: ISAKMP:(1018): phase 1 packet is a duplicate of a previous packet.
    Oct 22 16:24:52.913: ISAKMP:(1018): retransmission skipped for phase 1 (time since last transmission 100)
    Oct 22 16:25:00.905: ISAKMP (0:1018): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_KEY_EXCH
    Oct 22 16:25:00.905: ISAKMP: set new node 422447177 to QM_IDLE     
    Oct 22 16:25:03.941: ISAKMP:(1018):SA is still budding. Attached new ipsec request to it. (local 1X.X.216.29, remote X.X.138.132)
    Oct 22 16:25:03.941: ISAKMP: Error while processing SA request: Failed to initialize SA
    Oct 22 16:25:03.941: ISAKMP: Error while processing KMI message 0, error 2.
    Oct 22 16:25:12.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:25:12.814: ISAKMP (0:1018): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
    Oct 22 16:25:12.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:25:12.814: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:25:12.814: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:25:22.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:25:22.814: ISAKMP (0:1018): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
    Oct 22 16:25:22.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:25:22.814: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:25:22.814: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:25:32.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:25:32.814: ISAKMP:(1018):peer does not do paranoid keepalives.
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting SA reason "Death by retransmission P1" state (I) MM_KEY_EXCH (peer 70.169.138.132)
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting SA reason "Death by retransmission P1" state (I) MM_KEY_EXCH (peer 70.169.138.132)
    Oct 22 16:25:32.814: ISAKMP: Unlocking peer struct 0x488B25C8 for isadb_mark_sa_deleted(), count 0
    Oct 22 16:25:32.814: ISAKMP: Deleting peer node by peer_reap for X.X.138.132: 488B25C8
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting node 1112432180 error FALSE reason "IKE deleted"
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting node 422447177 error FALSE reason "IKE deleted"
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting node -278980615 error FALSE reason "IKE deleted"
    Oct 22 16:25:32.814: ISAKMP:(1018):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    Oct 22 16:25:32.814: ISAKMP:(1018):Old State = IKE_I_MM5  New State = IKE_DEST_SA
    Oct 22 16:26:22.816: ISAKMP:(1018):purging node 1112432180
    Oct 22 16:26:22.816: ISAKMP:(1018):purging node 422447177
    Oct 22 16:26:22.816: ISAKMP:(1018):purging node -278980615
    Oct 22 16:26:32.816: ISAKMP:(1018):purging SA., sa=487720A0, delme=487720A0
    ****** The PIX is also used    VPN client access  , such as  Cicso VPN client  5.0, working fine ; Router is  used as  SSL VPN server, working too
    I know there are lots of data here, hopefully these data may be useful for   diagnosis purpose.
    Any suggestions and advices are greatly appreciated.
    Sean

    Hi Sean,
    Current configuration:
    On the PIX:
    crypto isakmp policy 5
          authentication pre-share
          encryption 3des
          hash sha
          group 2
          lifetime 86400
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer X.X.21.29
    crypto map outside_map 1 set transform-set ESP-DES-SHA
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    access-list outside_1_cryptomap extended permit ip 10.1.0.0 255.255.0.0 10.20.0.0 255.255.0.0
    tunnel-group X.X.21.29 type ipsec-l2l
    tunnel-group X.X.21.29 ipsec-attributes
         pre-shared-key SECRET
    On the Router:
    crypto isakmp policy 1
          authentication pre-share
    crypto map la-2800-ipsec-policy 1 ipsec-isakmp
          description vpn ipsec policy    
          set peer X.X.138.132
          set transform-set la-2800-trans-set
          match address 101
    access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255
    crypto ipsec transform-set la-2800-trans-set esp-des esp-sha-hmac
    crypto isakmp key SECRET address X.X.138.132 no-xauth
    Portu.
    Please rate any helpful posts
    Message was edited by: Javier Portuguez

  • I want to use Back to my mac. When I try to turn it on, it says "Back to My Mac may be slow because more than one device on your network is providing network services.   Turn off NAT and DHCP on one of the devices and try again." How do I fix this?

    Not sure if I am doing this right. This is my first time in the support community.
    I imagine what I put in my heading was supposed to go in here.
    I want to use Back to my mac. When I try to turn it on, it says "Back to my mac may be slow because more than one device on your network is providing network services. Turn off NAT and DHCP on one of the devices and try again. See the documentation that came with your device for information about turning off network services"
    Does anyone know how I do this? I contacted my ISP (Telus in Canada) and they did not know anything (not that they usually do).

    Why do ISPs insist upon making things so difficult for their customers?
    If you cannot get them to understand that you would prefer to use your own router over their piece of cheap junk, perhaps the information in the following will be useful:
    http://keithbalomben.wordpress.com/2012/03/29/telus-actiontec-v1000h-hacks-and-i nformation/
    Scroll down to DHCP Settings
    You will need to log in with proper "technician" credentials. They are provided in the above link as
    Username: tech
    Password: t3lu5tv
    ... but these may or may not work. Try it, and if you cannot get anywhere at least now you know what to ask Telus to do in return for your business.

  • How to set up VLAN for DATA and VOIP on SRW248G4P switch?

    Hi guys,
    I am totally new and was given this task to complete. I  really really need help.
    We are using one network 192.168.1.0
    Shared  with data and voip.
    CISCO C870, 5 switches LINKSYS SRW248G4P .
    The  email wrote:-
    On the Linksys switch;
    - create two  different VLANs one for voice and one for data.
    - put a firewall  between the two VLANs (between voice and data) and only enable certain  ports to flow to voice network (inbound tcp 8443 and ssh )
    What  should i do guys? I really need a dumb guide now.
    I know its simple for  you guys but i am not a smart IT fella. Whats the  step by step?

    If the switch is new or you have support on this, then you might try calling the support center.  Here is a link:
    https://www.myciscocommunity.com/community/smallbizsupport
    On the right hand side you can find links to the support center.
    Here is a link to the guide:
    http://www.cisco.com/en/US/products/ps9967/prod_maintenance_guides_list.html
    @ the bottom of this link you can find your switch model, you want the larger of the two.  In this guide it shows you how to create a second vlan.
    Will your router be the firewall between the two?
    Kindest regards,
    Andrew Lissitz

  • Using modem Sagem f@st 3464 (Scarlet One : vdsl   tv   VoIP   wi-fi) : impossible to create a new Wi-Fi network (2.4 or 5 GHz) ? Conflict with DHCP / NAT and so on. No answer from the Apple help desk, Air Port Utility 6.1 unusable (configuration = Win 7)

    Good afternoon,
    My internet connection is delivered by a modem Sagem f@st 3464 (Scarlet One : vdsl   tv   VoIP   wi-fi), it's almost the same than a BBox-2 from Belgacom (software and configuration).
    This modem has 4 ethernet port, 2 for TV, 2 for LAN, the WAN port is RJ-11 and the connection is a PPPoE (in fact, it's the Belgacom network). I also got a Wi-Fi 802.11g on it.
    The main raison why I bought a TC is the dual Wi-Fi 2.4 GHz and 5 GHz (for 802.11n), especially for my MacBook Pro and my iPad 3.
    First of all, can I do the following with my TC :
    1) connecting the TC using a ethernet cable from one of the two modem's LAN ports to the TC's WAN port
    2) create a new Wi-Fi network using the TC ?
    Up to now, after 2 man days of configuration, my TC is connected to my existing LAN network, as a bridge, but there is no new Wi-Fi network.
    The Airport Utility 6.1 "Wizard" is just un-usable and I need to use a Win 7 laptop in order to get access to all the configuration !
    The standard manual is very poor.
    Does someone already create a new Wi-Fi network using its TC connected by Ethernet on a modem/router device ? How do you set up the DHCP (and NAT) ? Which range did you use ?
    Sincerely yours,
    AVDB

    1) connecting the TC using a ethernet cable from one of the two modem's LAN ports to the TC's WAN port
    2) create a new Wi-Fi network using the TC ?
    Does someone already create a new Wi-Fi network using its TC connected by Ethernet on a modem/router device ? How do you set up the DHCP (and NAT) ? Which range did you use ?
    This is easy enough to do..
    Plug the TC directly into a computer.. without other connections to do the setup.
    Using the newly installed 5.6 utility.
    Bridge the TC.
    Create a wireless network.
    This is an older screen shot and I would set security to WPA2 Personal only not WPA/WPA2 Personal as shown above.
    I do recommend you use wireless names that are short, no spaces, pure alphanumeric.
    Update the TC..
    Now plug it into the modem router.. it will be a part of the network without doing NAT and DHCP itself.. which you do not want.. that leads to double NAT issues.. but it is a WAP that provides access to devices on both 2.4ghz and 5ghz bands directly to the main router.

  • I have a 2T apple time capsule and router. I bought a Hauppauge WinTV extender which allows regular TV to be broadcasted on a PC. The program allows streaming to a Mac or iPad, iPhone, etc. I need to open a port on the router to allow this to work.

    I have a 2T apple time capsule and router. I bought a Hauppauge Win TV extender which allows TV to be broadcasted on a PC. The program allows for the TV to be streamed on a Mac, Iphone, Ipad. I need to access the router set up options to open a port on the router to allow this program to stream the TV to the Mac and Iphone. I do not know how to access the apple time capsule router to change the settings to open a port on the router. help please.

    Firstly you do not need to open ports to stream locally.. there is no port block in local LAN.. only WAN to LAN. So there is a good chance it is not needed at all..
    Opening ports on the TC I strongly recommend a v5 airport utility.. you can download one for windows if you don't have a Mac.. iOS version of the utility I am not sure but it will not work to do complex things.
    In the v5 utility go to the NAT area, and click on port mappings.
    Sorry I don't have a screen shot at the moment of the actual mapping page.. but simply put the IP of the device you want opened and the port.
    There are plenty of posts with this info if you google.
    But as noted.. this is purely WAN to LAN.. nothing else.

  • Airport Extreme best practice configuration for Sleep Proxy, DHCP/NAT and PPPOE

    Hi
    I have recently bought a Airport Extreme and it is working well.  One of the reasons I bought is to take advantage of the Bonjour Sleep Proxy on it so I can wake my MAC up remotely from my iPad using the REMOTE app to stream things like iTunes etc...  I followed the set up instructions and basically let it configure itself.  I have an ISP router / modem which currently is providing DHCP services, NAT and PPPOE.
    The Airport detected all of this and set itself up as bridge only.  The speed of the network outo to the internet is fine (more or less what it was before).  However, in doing a bit of research, I have found out that if I want the Airport to act as a sleep proxy, I need it to "host" the network.  I am not an expert in networking but from what I understand I need the Airport to be moved from "Bridge Only" to at least be providing DHCP to my internal network clients.
    This has prompted me to ask what is "Best practice" when it comes to configuring the Airport given I want to have Sleep Proxy enabled.  I think the two options I have are as follows but would really welcome feedback on which is the best option to go for or if there are other options I should be thinking of
    (1)  Have the Airport perform DHCP for my internal clients and leave the ISP router/modem doing NAT
    (2)  Have the Airport perform DHCP and NAT.  I think to do this I need to turn the ISP router / modem into Bridge mode only.  (I've looked and I seem to have this option on the device.  It's an Irish ISP branded device but I think it is a Zyxel)
    I have no reason to believe the ISP router / model is doing a bad job but given I understand the Airport Extreme is a reasonably high-end device (I think?) I am wondering if option 2 is the way to go.
    In addition, during my research, I have also discovered that many people seem to have their Airport Extreme also handle PPPOE.  This is currently being done by my ISP router/modem.  I am  inclined to leave it this way (following the mantra if it isn't broken, don't fix it) but if there was a good reason to have the Aiport do this, perhaps I should make the switch?  Having said this, I have seen on this forum and others, some posts about problems with Internet connection drops when the Airport is handling PPPOE.
    So, a bit of a long post, but if anyone has any information or perspective on this, I'd very much appreciate it. 
    Thanks
    Dave

    I forgot to thank you, John Galt. Yap, it solve my problem by restoring back the original firmware to 7.6.1. My unit is Airport Extreme 2012. I am still using double NAT because I cannot figure it out on how to set DHCP only in the Network tab.
    My goal it to use the airport extreme to the internet and to share the internet to all my devices in the house. Just like my previous Accesspoints. Before I use AP+router Linksy$ WRT54G and D-l!nk DIR-655 without activating the NAT to share my internet connection and they work.
    My problem is that when I set it to DHCP in the internet tab and DHCP in the Network tab in Airport Utility inorder to solve the double NAT situation, only one of all my devices (wired or wireless) can connect to the internet. Each time I connect the other device(s) to the internet my subscriber will verify my subscription (web browser based verification) in which I have to manually enter my account number, etc to validate my subscription.
    So I stick to double NAT so that I can share the internet
    Our broadband provider uses DHCP to link us to the internet. If I change the settings to Static in the Internet Tab, my broadband provider will not let me connect to the internet. In the Airport Utility if I set to static in the Internet Tab inorder to set it to solve the double NAT, a message box appear informing me that I have invalid beginning IP address in the DCHP range in the Network Tab when it appears that only the last 3 digits of the DHCP range is editable.
    Is there any way of configuring the Airport Utility's Internet TAB to DHCP and Network TAB to DHCP to connect to the internet with all my devices without the double NAT and without the aid of another device such as AP or router or switch connected to the Airport or vice versa?

Maybe you are looking for