Vonage VoIP and PIX 501

I have a SOHO currently using cable modem connected to the outside interface of a PIX 501. The inside interface of the PIX connects to a hub with 8 ports.I have 2 PC's and a LinkSys AP plugged into the hub. I have been looking at using Vonage VoIP. My questions are:
1) Is it possible?
2) Do I need to use a special fixup protocol or config?
3) Has anyone used Vonage VoIP and how is it working?
Thanks,
Paul Lane

Paul,
I have been using Vonage succesfully with a very similar configuration. You don't neet any fixups or special configurations to make this work.
My only suggestion is to connect your ATA to a switch port behind the PIX, as opposed to the hub.
Have fun!
Fernando Macias

Similar Messages

  • Problem with VPN by ASA 5505 and PIX 501

    Hi
    I have this scenario: Firewall ASA 5505, Firewall Pix 501 (with CatOS 6.3(5) ).
    I have configured this appliance for Easy VPN (server is ASA) and PIX, and remote Access with Cisco client vpn (for internal lan ASA).
    When i configure the ASA i have this problem, when i configure nat for easy vpn.
    This is my nat configuration:
    nat (inside) 0 access-list 100
    nat (inside) 1 192.168.1.0 255.255.255.0
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (inside) 0 0.0.0.0 0.0.0.0 outside
    when i put this command:
    nat (inside) 0 access-list no-nat
    this command is necessary for configuration of easy vpn, but the previous nat:
    nat (inside) 0 access-list 100
    is replace with the latest command.

    To identify addresses on one interface that are translated to mapped addresses on another interface, use the nat command in global configuration mode. This command configures dynamic NAT or PAT, where an address is translated to one of a pool of mapped addresses. To remove the nat command, use the no form of this command.
    For regular dynamic NAT:
    nat (real_ifc) nat_id real_ip [mask [dns] [outside] [udp udp_max_conns] [norandomseq]]
    no nat (real_ifc) nat_id real_ip [mask [dns] [outside] [udp udp_max_conns] [norandomseq]]
    For policy dynamic NAT and NAT exemption:
    nat (real_ifc) nat_id access-list access_list_name [dns] [outside] [udp udp_max_conns] [norandomseq]
    no nat (real_ifc) nat_id access-list access_list_name [dns] [outside] [udp udp_max_conns] [norandomseq]

  • Redhat EL 4 and pix 501

    I have recently configured pix 501 to work with 3 server. two server is on windows and one is on redhat el 4.
    The firewall policy is very simple.
    Only 3 static ip apply with this three server. No nat or pat for group of ips.
    All this three server have some services allowed for external internet users.
    The problem is both windows server is working fine, only redhat el 4 is not working. RH4 server cannot ping or goto internet any ware. Both windows server can ping or can go to internet. External users can get both windows server except RH4. my access policy is same for all this three server. Also for troubleshooting i enable full access in and out to all. Same result happens, both windows server can go out, external users can access everything on this two windows server except linux. is there any particular problem with Linux RH4 with pix?

    can you post your config, it will help in troubleshooting

  • Android and pix 501

    Has anyone successfully configured a Pix 501 to communicate to a LG Pheonix (I'm assuming android OS) via a L2TP/IPSEC vpn?

    Our current working config relevent to L2TP:
    access-list NO_NAT extended permit ip 10.10.1.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list REMOTE_RA extended permit ip any 192.168.100.0 255.255.255.0
    nat (Inside) 0 access-list NO_NAT
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set TRANS_ESP_3DES_SHA TRANS_ESP_3DES_MD5 TRANS_ESP_AES128_SHA TRANS_ESP_AES192_SHA ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map OUTSIDE_MAP 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map OUTSIDE_MAP interface Outside
    crypto isakmp enable Outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes
    hash sha
    group 1
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication pre-share
    encryption 3des
    hash sha
    group 1
    lifetime 86400
    crypto isakmp policy 50
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication pre-share
    encryption 3des
    hash md5
    group 1
    lifetime 86400
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 10.10.1.20 10.10.1.23
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    split-tunnel-network-list value REMOTE_RA
    default-domain value ******.com
    tunnel-group DefaultL2LGroup ipsec-attributes
    isakmp keepalive threshold 15 retry 2
    tunnel-group DefaultRAGroup general-attributes
    address-pool L2TP
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *****
    isakmp keepalive threshold 15 retry 2

  • Persistent VPN between PIX 501 and ASA 5505

    I am a networking newbie with 2 small retail stores. I would like to create a persistent VPN between the stores. I already have a PIX 501 firewall, and I am looking at getting an ASA 5505. Would I have any problems creating a persistent VPN between these two firewalls?

    No problems whatsoever :-)
    There are loads of examples for the config on the Cisco website, and basically these boxes can run exactly the same software, so the config on each is virtually the same. Main difference is the ASA defines the interfaces in a different way. Even if you have different versions of software, say 6.3 on the PIX and 7.2 on the ASA they will still work fine for the VPN, just the configs will be a lot more different. Hope this helps to remove any worries you had?

  • PIX 501 speed and ipv6

    Hello,
    i have 20M/20M isp speed. Will pix 501 slow my network connection? On the Cisco website, it says 60Mbps, but elsewhere on the net you can here the speed is max 10Mbps.
    And the second question. Is ipv6 supported?
    Tnx.

    Hello,
    According to Cisco Performance docummentation you will be more than fine.
    Now regarding IPv6 being supported. For cisco Dedicated firewall appliances the support for IPv6 started on  version  7.0.1.
    Due to memory requirements I do not think ur firewall support that version hence IPv6 will not be supported.
    Regards,
    Jcarvaja

  • Pix 501 and H323

    Thank you in advanced.
    Is video teleconference supported on the PIX 501?
    I am trying to configure a static router from the inside to the outside using static routers and I can not do it.
    Please can some one send me config examples if Pix 501 supports VIdeo COnferencing using H323.
    Cristian

    Have a look here:
    http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a008017278b.html#wp1079378
    If connectivity still fails, a look at the pix log might help ('sh log').

  • PIX 501 and UPnP

    Does the PIX 501 support UPnP? According to an older post, "PIX is currently not UPnP aware." The eight-year old answer lead to a "Request for UPnP support in PIX": https://tools.cisco.com/bugsearch/bug/CSCdy26037. If it has been made "aware" where would I find a resource on enabling it? Thanks.

    Agree with Steven, most if not all of our recommendations to clients is to use the newer asa firewall products in a migration path, beside, not will the asa5505 provide you with up to 20 virtual interfaces with Sec plus license, but other numerous features pix code 6.3(5) does not come close to providing.
    Ultimatelly the pix 506 cannot go beyond code 6.3(5) and probably give you up to 2 vlans maximun, and from clients experience out there they end up in a dead lock when needing new features, you want to have a product in your network whether is small that would be able to move forward with 7.x/8.x codes.
    If the above is not of a concern at all, then what Andrew sugested would work.
    Rgds
    -Jorge

  • Pix 501 IPSec VPN no LAN access and no ping

    Hello,
    I am attempting to setup an IPSec VPN in a basic small business  scenario. I am able to connect to my pix 501 via IPSec VPN and browse  the internet but I am unable to ping or connect to any devices in the  remote LAN. Here is my config
    show config:
    nterface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password xxxxx encrypted
    passwd xxxxxx encrypted
    hostname pixfirewall
    domain-name domain.local
    clock timezone CEST 1
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    name 195.7.x.x BLR-Quadria
    name 176.76.1.0 LAN-CEPIC
    name 176.76.1.40 ADMIN
    name 176.76.1.253 SRV-Linux
    name 212.234.98.224 ADSL-Quadria
    name 81.80.252.129 sylob
    name 176.76.1.33 poste-pcanywhere
    name 176.76.1.179 TEST
    name 10.1.1.0 VPN_CLIENT
    name 176.76.1.100 SRVSVG01
    name 176.76.1.116 SRV-ERP01
    name 176.76.1.50 SRV-ERP00
    object-group network WAN-Quadria
      network-object BLR-Quadria 255.255.255.248
      network-object ADSL-Quadria 255.255.255.248
    object-group network SRV-CEPIC
      network-object SRV-Linux 255.255.255.255
      network-object ADMIN 255.255.255.255
      network-object SRVSVG01 255.255.255.255
      network-object SRV-ERP00 255.255.255.255
      network-object SRV-ERP01 255.255.255.255
    object-group service TCP-Linux-Quadria tcp
      port-object eq 1812
      port-object eq 222
      port-object eq 10000
    object-group service TCP-TSE-Quadria tcp
      port-object eq 3389
    object-group service PCAnywhereUDP udp
      port-object range pcanywhere-status pcanywhere-status
    access-list outside_access_in permit tcp object-group WAN-Quadria host 195.7.x.x object-group TCP-Linux-Quadria
    access-list outside_access_in permit tcp object-group WAN-Quadria interface outside object-group TCP-TSE-Quadria
    access-list outside_access_in permit tcp any host 195.7.x.x eq pcanywhere-data
    access-list outside_access_in permit udp any host 195.7.x.x object-group PCAnywhereUDP
    access-list outside_access_in permit tcp any host 195.7.x.x eq smtp
    access-list inside_outbound_nat0_acl permit ip LAN-CEPIC 255.255.255.0 VPN_CLIENT 255.255.255.224
    access-list outside_cryptomap_dyn_20 permit ip any VPN_CLIENT 255.255.255.224
    access-list inside_access_in permit icmp LAN-CEPIC 255.255.255.0 any
    access-list inside_access_in permit ip VPN_CLIENT 255.255.255.0 any
    access-list CEPIC_VPN_CLIENT_splitTunnelAcl permit ip LAN-CEPIC 255.255.255.0 any
    access-list outside_cryptomap_dyn_40 permit ip any VPN_CLIENT 255.255.255.224
    pager lines 24
    logging on
    logging console debugging
    logging buffered debugging
    logging trap debugging
    mtu outside 1500
    mtu inside 1500
    ip address outside pppoe setroute
    ip address inside 176.76.1.254 255.255.255.0
    ip verify reverse-path interface outside
    ip verify reverse-path interface inside
    ip audit name attaque attack action alarm drop reset
    ip audit name info info action alarm drop reset
    ip audit interface outside info
    ip audit interface outside attaque
    ip audit interface inside info
    ip audit interface inside attaque
    ip audit info action alarm
    ip audit attack action alarm
    ip audit signature 2000 disable
    ip audit signature 2003 disable
    ip local pool VPN_POOL 10.1.1.10-10.1.1.20
    pdm location ADMIN 255.255.255.255 inside
    pdm location SRV-Linux 255.255.255.255 inside
    pdm location BLR-Quadria 255.255.255.248 outside
    pdm location ADSL-Quadria 255.255.255.248 outside
    pdm location LAN-CEPIC 255.255.255.0 inside
    pdm location poste-pcanywhere 255.255.255.255 inside
    pdm location sylob 255.255.255.255 outside
    pdm location TEST 255.255.255.255 inside
    pdm location 10.10.10.0 255.255.255.224 outside
    pdm location VPN_CLIENT 255.255.255.0 inside
    pdm location VPN_CLIENT 255.255.255.224 outside
    pdm location SRVSVG01 255.255.255.255 inside
    pdm location SRV-ERP00 255.255.255.255 inside
    pdm location SRV-ERP01 255.255.255.255 inside
    pdm group WAN-Quadria outside
    pdm group SRV-CEPIC inside
    pdm logging debugging 100
    pdm history enable
    arp timeout 14400
    global (outside) 10 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    nat (inside) 10 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) tcp 195.7.x.x 81 SRV-Linux www netmask 255.255.255.255 0 0
    static (inside,outside) tcp 195.7.x.x 222 SRV-Linux ssh netmask 255.255.255.255 0 0
    static (inside,outside) tcp 195.7.x.x 10000 SRV-Linux 10000 netmask 255.255.255.255 0 0
    static (inside,outside) tcp 195.7.x.x 1812 SRV-Linux 1812 netmask 255.255.255.255 0 0
    static (inside,outside) tcp 195.7.x.x 3389 ADMIN 3389 netmask 255.255.255.255 0 0
    static (inside,outside) tcp 195.7.x.x smtp SRV-Linux smtp netmask 255.255.255.255 0 0
    static (inside,outside) tcp 195.7.x.x pcanywhere-data poste-pcanywhere pcanywhere-data netmask 255.255.255.255 0 0
    static (inside,outside) udp 195.7.x.x pcanywhere-status poste-pcanywhere pcanywhere-status netmask 255.255.255.255 0 0
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authorization command LOCAL
    ntp server 193.55.130.2 source inside
    ntp server 80.67.179.98 source outside
    ntp server 194.2.0.28 source outside prefer
    http server enable
    http BLR-Quadria 255.255.255.248 outside
    http ADSL-Quadria 255.255.255.248 outside
    http ADMIN 255.255.255.255 inside
    http LAN-CEPIC 255.255.255.0 inside
    snmp-server host inside SRV-Linux
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt noproxyarp outside
    sysopt noproxyarp inside
    service resetinbound
    service resetoutside
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
    crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map client authentication LOCAL
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup CEPIC_VPN_CLIENT address-pool VPN_POOL
    vpngroup CEPIC_VPN_CLIENT dns-server 176.76.1.2 ADMIN
    vpngroup CEPIC_VPN_CLIENT wins-server ADMIN
    vpngroup CEPIC_VPN_CLIENT default-domain domain.local
    vpngroup CEPIC_VPN_CLIENT split-tunnel CEPIC_VPN_CLIENT_splitTunnelAcl
    vpngroup CEPIC_VPN_CLIENT idle-time 1800
    vpngroup CEPIC_VPN_CLIENT password ********
    telnet timeout 5
    ssh BLR-Quadria 255.255.255.248 outside
    ssh ADSL-Quadria 255.255.255.248 outside
    ssh LAN-CEPIC 255.255.255.0 inside
    ssh timeout 5
    management-access inside
    console timeout 0
    vpdn group pppoe_group request dialout pppoe
    vpdn group pppoe_group localname xxxxx
    vpdn group pppoe_group ppp authentication chap
    vpdn username xxxx password xxxxx store-local
    username vg_vpn password xxxxx encrypted privilege 3
    username test password xxxxxx encrypted privilege 3
    username quadria password xxxxx encrypted privilege 15
    username jml_vpn password xxxxx encrypted privilege 3
    username jr_vpn password xxxxx encrypted privilege 3
    username js_vpn password xxxxx encrypted privilege 3
    privilege show level 0 command version
    privilege show level 0 command curpriv
    privilege show level 3 command pdm
    privilege show level 3 command blocks
    privilege show level 3 command ssh
    privilege configure level 3 command who
    privilege show level 3 command isakmp
    privilege show level 3 command ipsec
    privilege show level 3 command vpdn
    privilege show level 3 command local-host
    privilege show level 3 command interface
    privilege show level 3 command ip
    privilege configure level 3 command ping
    privilege show level 3 command uauth
    privilege configure level 5 mode enable command configure
    privilege show level 5 command running-config
    privilege show level 5 command privilege
    privilege show level 5 command clock
    privilege show level 5 command ntp
    privilege show level 5 mode configure command logging
    privilege show level 5 command fragment
    terminal width 80
    Cryptochecksum:
    I know this is a basic question but I would really appreaciate the help!
    Thanks so much,

    Hi,
    You could try to change the Split Tunnel ACL to Standard ACL
    First removing it from the VPN configuration and then removing the ACL and creating it as Standard type ACL
    Current
    access-list CEPIC_VPN_CLIENT_splitTunnelAcl permit ip LAN-CEPIC 255.255.255.0 any
    New
    access-list CEPIC_VPN_CLIENT_splitTunnelAcl standard permit LAN-CEPIC 255.255.255.0
    You could also try adding
    fixup protocol icmp
    fixup protocol icmp error
    Have you monitored the logs while you are attempting to connect to the LAN network?
    - Jouni

  • PIX 501 and Java

    Hello,
    Trying to move some servers today and lo and behold this.... not good news...
    Does anyone have an easy workaround for the Java issue for a Cisco Pix 501? Is there an easy way to revert to older versions of Java without affecting everything else? Does QuickTime use Java? This is very frustrating.
    http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/productsfieldnotice09186a008046c805.shtml
    "Customers running these versions of PDM or IDM should either uninstall the newer Java Plug-Ins and re-install previous versions of the Java Plug-In, or upgrade their PDM and IDM images to the versions indicated in the following table."
    Thanks,
    Rich

    Rich,
    Welcome to the forums.
    This notice doesn't apply to using Java programs or applets.
    It specifically applies to computers that will need to access the PDM or IDM to make changes.
    "Impacted PDM and IDM versions will not load when launched from a browser"
    As long as you don't need to access the PDM or IDM from the browser, you don't need to worry about this advisory.
    If you do, my advice would be to upgrade the PIX, as that seems the most logical thing to do (especially as it's a fix that Cisco has already released).

  • PIX 501 and Linksys VPN Router (WRV200)

    I have inherited a job where we have a Cisco PIX 501 firewall at one site, and Linksys WRV200 VPN Router on two other
    sites. I have been asked to connect these Linksys routers to the PIX firewall via VPN.
    I believe the Linksys vpn routers can only connect via IPSec VPN, so i am looking for help on configuring the PIX 501 to allow the linksys to connect with the following parameters, if possible.
    Key Exchange Method: Auto (IKE)
    Encryption: Auto, 3DES, AES128, AES192, AES256
    Authentication: MD5
    Pre-Shared Key: xxx
    PFS: Enabled/Disabled
    ISAKMP Key Lifetime: 28800
    IPSec Key Lifetime: 3600
    On the PIX i have the PDM installed and i have tried using the VPN Wizard to no avail.
    I chose the following settings when doing the VPN Wizard:
    Type of VPN: Remote Access VPN
    Interface: Outside
    Type of VPN Client Device used: Cisco VPN Client
    (can choose Cisco VPN 3000 Client, MS Windows Client using PPTP, MS Windows client using L2TP)
    VPN Client Group
    Group Name: RabyEstates
    Pre Shared Key: rabytest
    Extended Client Authentication: Disabled
    Address Pool
    Pool Name: VPN-LAN
    Range Start: 192.168.2.200
    Range End: 192.168.2.250
    DNS/WINS/Default Domain: None
    IKE Policy
    Encryption: 3DES
    Authentication: MD5
    DH Group: Group 2 (1024-bit)
    Transform Set
    Encryption: 3DES
    Authentication: MD5
    I have attached the VPN log from the Linksys VPN Router.
    This is the first time i've ever worked with PIX so i'm still trying to figure the thing out, but i'm confident with CCNA level networking.
    Thanks for your help!

    Hi again,
    I believe the pix has a 3des license because of the following parts of the "show version"
    Licensed Features:
    Failover: Disabled
    VPN-DES: Enabled
    VPN-3DES-AES: Enabled
    This PIX has a Restricted (R) license.
    I've tried reconnecting the VPN tunnel with debugging on the PIX and get the output as shown in the attached file "vpndebug.txt"
    As for the other show commands they give:
    pixfirewall# show crypto isakmp sa
    Total : 0
    Embryonic : 0
    dst src state pending created
    pixfirewall# show crypto ipsec sa
    interface: outside
    Crypto map tag: transam, local addr. 10.0.0.1
    local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (192.168.101.0/255.255.255.0/0/0)
    current_peer: 10.0.0.2:0
    PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
    local crypto endpt.: 10.0.0.1, remote crypto endpt.: 10.0.0.2
    path mtu 1500, ipsec overhead 0, media mtu 1500
    current outbound spi: 0
    inbound esp sas:
    inbound ah sas:
    inbound pcp sas:
    outbound esp sas:
    outbound ah sas:
    outbound pcp sas:
    pixfirewall#
    Thanks again Daniel, i really appreciate your help on this matter.

  • BT Infinity, Home Hub 5 and Vonage VoIP not compat...

    Hi
    I have just (last Wednesday) switched from Sky Broadband to BT Infinity. I have a HH5 to which I wirelessly connect a TP-Link W8968 in wireless router only mode.  I have all this set up and it all works, but I cannot get a dial tone from my Vonage VoIP phone line.
    It did come online for about 12 hours on Friday evening but has dropped off again.  It was plugged into the TP-Link router.
    I have now plugged it directly into the HH5 to try to get a signal.
    I have spent 4 hours on the phone with Vonage who have now told me (4th different person to speak to) after countless 'unplug it' and 'reset it' that the only way a Vonage line can operate with the HH4 and the HH5 is for all BT parental controls from within mybt.com to be deleted.  I have now done this but must now wait 2 hours to plug the Vonage box back in.
    But, I need the parental controls for the children's internet use and do not want to have to delete them.
    Surely there is another way for the Vonage box to work with an HH5?  It worked perfectly through my TP-Link with Sky Broadband.
    Any help gratefully received.
    Thanks in advance.
    Martin

    Giving the VOIP device a static LAN IP address, outside of the DHCP range is best, as the home hubs will quite often issue different addresses via DHCP, and tend to ignore lease times. The fact that it worked for a while would suggest that maybe the LAN IP had changed.
    This page should help with the settings.
    Using static IP addresses on your home network
    There are some useful help pages here, for BT Broadband customers only, on my personal website.
    BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

  • IPSEC Tunnel between JUNIPER (SSG 20) and CISCO PIX 501

    I have successfully established the IPSEC tunnel with juniper firewall by using cisco Pix 501 (6.3 version). The problem I am facing, I have network layer connectivity but after time interval I am not able to send the traffic on destination IP address on specific port, but can successfully PING the destination IP. On both firewalls the IPs are permitted for all ports.

    Dear Mr.
    The same problem has occured with me.

  • Can't Connect to Pix 501 VPN on Network

    Hi All,
    I have a software VPN client that connects just fine to the PIX 501 VPN, but I cannot ping or telnet to any services on the LAN. Below is my config and results of show cry ipsec sa. I would appreciate any suggestions to fix this.
    It's been a while since I have done this. When I check the DHCP address received from the VPN, the default gateway is missing. IIRC, that is normal. What is strange is that when I ping, Windows does not show any sent packets.
    Thanks,
    --Drichards38
    PIX Version 6.3(3)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password bgVy005CZTsaMOwR encrypted
    passwd bgVy005CZTsaMOwR encrypted
    hostname cisco
    domain-name xxxxxx.biz
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol ftp 1024-2048
    fixup protocol ftp 49152-65534
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list acl-out permit tcp any interface outside eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq telnet
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 60990
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq echo
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any interface inside eq www
    access-list acl_out permit tcp any interface inside eq ftp
    access-list acl_out permit tcp any interface inside eq 3389
    access-list acl_out permit tcp any interface inside eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 902
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list outside_cryptomap_dyn_20 permit ip any 10.0.0.0 255.0.0.0
    access-list split_tunnel_acl permit ip 10.0.0.0 255.0.0.0 any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside aa.bb.cc.dd 255.255.255.240
    ip address inside 192.168.93.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool low_vpn_pool 10.0.1.205-10.0.1.210
    pdm location 172.16.0.0 255.255.0.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.93.0 255.255.255.0 0 0
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.67 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.68 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.69 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.70 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.71 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.72 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.73 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.74 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.75 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.76 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.77 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.78 netmask 255.255.255.255 0 0
    access-group acl_out in interface outside
    rip inside default version 1
    route outside 0.0.0.0 0.0.0.0 aa.bb.cc.dd 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa authorization command LOCAL
    http server enable
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map client authentication LOCAL
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp nat-traversal 20
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup MY_VPN address-pool low_vpn_pool
    vpngroup MY_VPN dns-server 4.2.2.1
    vpngroup MY_VPN default-domain xxxxx.biz
    vpngroup MY_VPN split-tunnel split_tunnel_acl
    vpngroup MY_VPN idle-time 1800
    vpngroup MY_VPN password ********
    telnet 0.0.0.0 255.255.255.255 outside
    telnet 192.168.93.0 255.255.255.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 60
    console timeout 0
    dhcpd address 192.168.93.230-192.168.93.240 inside
    dhcpd dns ff.gg.hh.ii ff.gg.hh.ii
    dhcpd lease 65536
    dhcpd ping_timeout 750
    dhcpd domain xxxxxx.biz
    dhcpd auto_config outside
    dhcpd enable inside
    username xxxx password xxxxxxx encrypted privilege 15
    cisco(config)# show cry ipsec sa
    interface: outside
        Crypto map tag: outside_map, local addr. aa.bb.cc.dd
       local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
       remote ident (addr/mask/prot/port): (10.0.1.205/255.255.255.255/0/0)
       current_peer: jj.kk.ll.mm:1265
       dynamic allocated peer ip: 10.0.1.205
         PERMIT, flags={transport_parent,}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
        #pkts decaps: 38, #pkts decrypt: 38, #pkts verify 38
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: aa.bb.cc.dd, remote crypto endpt.: 97.93.95.133
         path mtu 1500, ipsec overhead 64, media mtu 1500
         current outbound spi: 3a898e67
         inbound esp sas:
          spi: 0xeeb64931(4004923697)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            slot: 0, conn id: 1, crypto map: outside_map
            sa timing: remaining key lifetime (k/sec): (4607993/28610)
            IV size: 8 bytes
            replay detection support: Y
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0x3a898e67(982093415)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            slot: 0, conn id: 2, crypto map: outside_map
            sa timing: remaining key lifetime (k/sec): (4608000/28574)
            IV size: 8 bytes
            replay detection support: Y
         outbound ah sas:
         outbound pcp sas:

    I just set the logging to high on all areas of the Cisco VPN client. Below is the resulting log. Everything looks ok from here:
    Cisco Systems VPN Client Version 5.0.03.0530
    Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved.
    Client Type(s): Windows, WinNT
    Running on: 5.1.2600 Service Pack 3
    29     09:57:02.887  09/03/12  Sev=Info/4    CM/0x63100002
    Begin connection process
    30     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100004
    Establish secure connection
    31     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100024
    Attempt connection with server "a.b.c.d"
    32     09:57:02.907  09/03/12  Sev=Info/6    IKE/0x6300003B
    Attempting to establish a connection with a.b.c.d.
    33     09:57:02.917  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to a.b.c.d
    34     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700008
    IPSec driver successfully started
    35     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    36     09:57:03.228  09/03/12  Sev=Info/6    IPSEC/0x6370002C
    Sent 47 packets, 0 were fragmented.
    37     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    38     09:57:03.979  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK AG (SA, VID(Xauth), VID(dpd), VID(Unity), VID(?), KE, ID, NON, VID(?), VID(Nat-T), NAT-D, NAT-D, HASH) from a.b.c.d
    39     09:57:04.039  09/03/12  Sev=Info/6    GUI/0x63B00012
    Authentication request attributes is 6h.
    40     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports XAUTH
    41     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports DPD
    42     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer is a Cisco-Unity compliant peer
    43     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000082
    Received IOS Vendor ID with unknown capabilities flag 0x000000A5
    44     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports NAT-T
    45     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000001
    IOS Vendor ID Contruction successful
    46     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to a.b.c.d
    47     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    48     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000083
    IKE Port in use - Local Port =  0x0421, Remote Port = 0x1194
    49     09:57:03.999  09/03/12  Sev=Info/5    IKE/0x63000072
    Automatic NAT Detection Status:
       Remote end is NOT behind a NAT device
       This   end IS behind a NAT device
    50     09:57:03.999  09/03/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
    51     09:57:04.029  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    52     09:57:04.029  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) from a.b.c.d
    53     09:57:04.029  09/03/12  Sev=Warning/2    IKE/0xA3000067
    Received Unexpected InitialContact Notify (PLMgrNotify:886)
    54     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    55     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d
    56     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 86400 seconds
    57     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000047
    This SA has already been alive for 2 seconds, setting expiry to 86398 seconds from now
    58     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    59     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    60     09:57:04.039  09/03/12  Sev=Info/4    CM/0x63100015
    Launch xAuth application
    61     09:57:09.327  09/03/12  Sev=Info/4    CM/0x63100017
    xAuth application returned
    62     09:57:09.327  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    63     09:57:09.367  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    64     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    65     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    66     09:57:09.367  09/03/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system
    67     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005E
    Client sending a firewall request to concentrator
    68     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005D
    Firewall Policy: Product=Cisco Systems Integrated Client Firewall, Capability= (Centralized Protection Policy).
    69     09:57:09.387  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    70     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    71     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    72     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.0.1.205
    73     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 4.2.2.1
    74     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = xxxx.biz
    75     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001
    76     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000F
    SPLIT_NET #1
        subnet = 10.0.0.0
        mask = 255.0.0.0
        protocol = 0
        src port = 0
        dest port=0
    77     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
    78     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
    79     09:57:09.427  09/03/12  Sev=Info/4    CM/0x63100019
    Mode Config data received
    80     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000056
    Received a key request from Driver: Local IP = 10.0.1.205, GW IP = a.b.c.d, Remote IP = 0.0.0.0
    81     09:57:09.437  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to a.b.c.d
    82     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    83     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d
    84     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 28800 seconds
    85     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000046
    RESPONDER-LIFETIME notify has value of 4608000 kb
    86     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH) to a.b.c.d
    87     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000059
    Loading IPsec SA (MsgID=D70550E6 OUTBOUND SPI = 0xB335C6DA INBOUND SPI = 0xE99E1A59)
    88     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000025
    Loaded OUTBOUND ESP SPI: 0xB335C6DA
    89     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000026
    Loaded INBOUND ESP SPI: 0xE99E1A59
    90     09:57:09.527  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255       172.16.0.11           0.0.0.0        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    91     09:57:10.448  09/03/12  Sev=Info/4    CM/0x63100034
    The Virtual Adapter was enabled:
        IP=10.0.1.205/255.0.0.0
        DNS=4.2.2.1,0.0.0.0
        WINS=0.0.0.0,0.0.0.0
        Domain=xxxx.biz
        Split DNS Names=
    92     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
           10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205       25
         10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25
    10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1
    255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    93     09:57:10.458  09/03/12  Sev=Info/4    CM/0x63100038
    Successfully saved route changes to file.
    94     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
           10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205        1
         10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25
    10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25
      a.b.c.d   255.255.255.255        172.16.0.1       172.16.0.11        1
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
         172.16.0.1   255.255.255.255       172.16.0.11       172.16.0.11        1
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1
    255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    95     09:57:10.458  09/03/12  Sev=Info/6    CM/0x63100036
    The routing table was updated for the Virtual Adapter
    96     09:57:10.508  09/03/12  Sev=Info/4    CM/0x6310001A
    One secure connection established
    97     09:57:10.618  09/03/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 172.16.0.11.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.
    98     09:57:10.638  09/03/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 10.0.1.205.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.
    99     09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    100    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    101    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0xdac635b3 into key list
    102    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    103    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0x591a9ee9 into key list
    104    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370002F
    Assigned VA private interface addr 10.0.1.205
    105    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700037
    Configure public interface: 172.16.0.11. SG: a.b.c.d
    106    09:57:10.638  09/03/12  Sev=Info/6    CM/0x63100046
    Set tunnel established flag in registry to 1.
    107    09:57:19.741  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    108    09:57:19.741  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445672
    109    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    110    09:57:19.772  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    111    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445672, seq# expected = 3951445672
    112    09:57:30.257  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    113    09:57:30.257  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445673
    114    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    115    09:57:30.297  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    116    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445673, seq# expected = 3951445673
    117    09:57:40.772  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    118    09:57:40.772  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445674
    119    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    120    09:57:40.802  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    121    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445674, seq# expected = 3951445674
    122    09:57:54.291  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    123    09:58:04.306  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    124    09:58:14.320  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    125    09:58:24.334  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    126    09:58:34.349  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    127    09:58:41.359  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    128    09:58:41.359  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445675
    129    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    130    09:58:41.389  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    131    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445675, seq# expected = 3951445675
    132    09:58:54.378  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    133    09:59:04.392  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    134    09:59:14.406  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    135    09:59:24.421  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    136    09:59:34.435  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    137    09:59:41.946  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    138    09:59:41.946  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445676
    139    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    140    09:59:41.976  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    141    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445676, seq# expected = 3951445676
    142    09:59:54.464  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA

  • Remote access VPN issues using Pix 501

    We have taken over a network where there was little to no documentation. I have a remote access VPN terminated on a Pix 501 that is having a connectivity issue. I can connect using Cisco VPN Client. There is a server on the inside network that is used for mail etc. It has an IP of 192.168.0.4. I cannot ping it from my VPN session but from the Pix itself, I can ping it. There are different source IP's as the IP pool for the VPN session is 172.16.x.x and the inside network is 192.168.x.x. I can ping other hosts on the same inside network that are in the ARP table of the Pix. I have attached the configuration of the Pix 501. After researching, I cannot figure out what the issue is. I was assuming it was the route inside 172.16.x.x was set incorrectly but I can ping some hosts on the 192.168.x.x network. Thanks

    Aru,
    Hi. Thanks for responding. I did try and remove that route inside command and I still could not ping the server. I also tried removing those static translations and did a clear xlate but still no luck. This one has me puzzled. Especially since I can ping other hosts on that network and also ping the server but only from the Pix. The source on the Pix would be different 192.168.0.x than when I am connected using the VPN 172.16.1.x. That is the biggest difference. If it was routing, I would assume I could not ping any host on the 192.168.0.x network from the VPN session. I did remove that route inside as all of the other config examples did not have a specific route statement for the local pool even though it is not on the inside network. I have limited knowledge of their network as we just were told to manage it. Thanks again.

Maybe you are looking for

  • Security Error when starting the server - WPLS 7.0

    Security Error when starting the server - WPLS 7.0 what may be the reason ... console : BUILD SUCCESSFUL Total time: 3 seconds Starting WebLogic Server... <May 30, 2005 4:22:15 PM IST> <Notice> <Management> <140005> <Loading configuration C:\cpDomain

  • Baggage files will not display/open

    Using Robohelp 9, Baggage files have been added to project and links created to them but linked baggage files will not open when project is generated.  Using local drive and have attempted display in IE10, IE10 (compatability mode), IE9, IE8 but get

  • Can't open the Zipped file

    Hi I am making a zip file using GZIPOutputStream. But I am not able to open the zip file that is created using win zip.The size of the zipped file is 81 KB and the input file is 3,245 KB.I have closed all the streams still I am not able to figure out

  • Getting hierarchy of books and pages in portal - sitemap

    Hi, I am using BEA Portal 8.1 SP5. I want to get a list of all the books and pages (up to the lowest level as one book can contain multiple books) contained in the portal. I am using BookPresentationContext.getEntitledPagePresentationContexts functio

  • Problem with installing adobe reader 11 win7 32

    after downloading set up file when i ran it, after 38 % of downloading , it crashes repeatedly. now what to do ?????