VPN Client and DNS settings

Hello,
here are few posts (quite some time ago) telling the same trouble:
The VPN Client does *NOT* restore the original DNS settings.
Upon BM3.8.2 Massimo told, that this is a bug in that version of the VPN
client. I face this issue with 3.8.16 and nwclient 4.91.4 with or without
the three currently available hotfixes [1]
Anybody else facing this trouble with the current VPN client release?
May be an older one works better, any experiences?
This trouble is fact even after clean disconnects. But it happens only now and then,
I might need to try it 50 times to see it once.
a followup in CMD boxes with ipconfig /all does show, that the times
to restore the original DNS settings vary from 2 to 30 seconds. Mostly about 5 seconds.
Massimo also told, that a "VPN-down" due to a Win-Shutdown can cause this: So is
there a possibility to trigger a "clean-VPN down" in the Win-shutdown sequence?
As a workaround I packed this line into all users "run" key:
netsh int ip set dns name="LAN-Verbindung" source=dhcp
so at least after a reboot it's corrected.
Any suggestions appreciated,
[1]
Novell Client 4.91 Post-SP2/3/4 NWSPOOL.DLL
Novell Client post-4.91 SP4 LGNCXW32.DLL
Novell Client 4.91 Post-SP4 NWGINA.DLL 1
IT-Beratung Rudolf Thilo
Schweinfurter Str. 131
97464 Niederwerrn
t: +49 (0)9721/6464840
f: +49 (0)9721/6464841
m: +49(0)171/685 9 685

Hello Craig,
thanks for your answer.
[VPN Client sometimes doesn't restore DNS settings after disconnecting]
e.g. TID 10096552 is telling such a trouble, that should be fixed with
BM VPN Client 3.8.10
> > Any suggestions appreciated,
> >
> This one seems to be so related to the design of the VPN client that
> you may need to open an incident to get it fixed, if that even would
> help.
>
> There used to be a utility designed to clean up after the VPN client,
> but I can't remember now what it was. I never tried it that I can
> remember.
Anybody else who knows about that tool?
After doing some "teachment" to these VPN users the incidents of this
trouble didn't show up as frequent as before. So I assume, that one
reason might be this:
Scenario
VPN connect
PCA connect to host in corporate LAN
PCA full screen *SHOULD* be activated (ALT+ENTER)
working, working, working
shutdown PC in corporate LAN
close VPN tunnel
shutdown local home office PC.
When it was missed to activate PCA fullscreen without noticing this,
then the "remote" start button is not visible.
So instead of shutting down the remote PC, the local PC is shut down.
By that, the local shutdown is killing (not cleanly disconnecting)
the VPN client. When this happened (and I 100% can reproduce this)
after the next boot of the home office PC the VPN connect will *ALWAYS*
fail. After another reboot the VPN connect will succeed again without
any problems.
Is this a known issue? (I cannot find that TID I found before telling
missbehaviour when VPN connects are not disconnected clean. IIRC this
was something fixed in a VPN client version /several/ subversions ago)
Home Office PC = XPSP2+Hotfixes, VPN Client BM 3.8.16, nici from that
one first, now taken from NWClient 4.91.4, no difference.
Regards, Rudi.
IT-Beratung Rudolf Thilo
Schweinfurter Str. 131
97464 Niederwerrn
t: +49 (0)9721/6464840
f: +49 (0)9721/6464841
m: +49(0)171/685 9 685

Similar Messages

  • RV220W, VPN client, and Full Tunnel vs Split Tunnel capabilities

    For an RV220W, which VPN client mode (of the three possibilities) supports which Tunnel mode? 
    This is mostly a question, and partly "in use" observations.
    Background: I have been able to get all three different VPN clients to work with an RV220W, but only one of the three works in "Full Tunnel"  mode (SSL VPN). And since I know one of the three -- the Cisco QuickVPN client -- will never with in that mode, do we know if an RV220W will with an IPSec client in Full Tunnel Mode? 
    If anyone answers yes, the next question will be vpn client and how did you configure it, client and RV220W, to make full tunnel work.
    Summary of VPN modes I've gotten to work with an RV220W:
    Client
    Split Tunnel Works?
    Full Tunnel Works?
    OS?
    Notes
    SSL VPN
    Yes
    Yes
    Win7/64
    IE10 or IE11
    QuickVPN
    Yes
    No
    Win7/64
    IPSec VPN
    Yes
    No
    Win7/64
    Shrew Soft VPN Client

    I have to mark this as not a correct answer.
    Reason: 0.0.0.0 will not go into either of the fields listed above, message is "Invalid IP address Please enter a value between 1 - 223 at xxx.0.0.0.".
    To Michal Bruncko who posted this:
    1.) 0.0.0.0 will not work in my router nor in the RV220W online emulator here, (general emulator page here), am I missing something obvious?
    2.) Have you used these actual settings on your router, or did you answer in a theoretical, "this should work" way?

  • How to configure full tunnel with VPN client and router?

    I know the concept of split tunnel....Is it possibe to configure vpn client and router full tunnel or instead of router ASA? I know filter options in concentrators is teher options in ISR routers or ASA?

    I think it is possible. Following links may help you
    http://www.cisco.com/en/US/products/hw/routers/ps274/products_configuration_example09186a0080819289.shtml

  • Mavericks VPN dropouts with native VPN client and Cisco IPSec

    Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
    I am connecting via a WIFI router to a remote VPN server
    The conenction is good for a while but eventually it drops out.
    I had Zero issues in mountain lion and only have issues since the update to 10.9
    I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
    My thoughts are:
    1 -issue with mavericks  ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
    2- Issue with  cisco router compaitibility or timing with Cisco IPSEC
    3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
    Any thousuggestions?

    Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
    I am connecting via a WIFI router to a remote VPN server
    The conenction is good for a while but eventually it drops out.
    I had Zero issues in mountain lion and only have issues since the update to 10.9
    I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
    My thoughts are:
    1 -issue with mavericks  ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
    2- Issue with  cisco router compaitibility or timing with Cisco IPSEC
    3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
    Any thousuggestions?

  • Cisco ASA 5505, Cisco VPN Client and Novell Netware

    Hi,
    Our ISP have installed Cisco ASA 5505 firewall. We are trying to connect to our Novell 5.1 server using VPN client.
    I installed VPN client on a laptop that is using wireless connection. I connect using wireless signal from near by hotel and I am able to connect to my firewall usinging vpn client and also able to login in using Novell client for XP.
    When I use same vpn client and Novell client at home that is not using wireless connection, but DSL connection amd not able to login or find the tree.
    The only difference in two machine is laptop using wireless connection and my home machine is using wired connection using DSL.

    If your remote end of the services in question support IPsec IKEv1 as the VPN type then, yes - the 5505 can be a client for that service. At that point it looks like a regular LAN-LAN VPN which is documented in many Cisco and 3rd party how-to documents.

  • Boot camp with Cisco VPN client and smart card

    Looking at a Macbook or Macbook Air and the only reason I need to run windows is to be able to access my work network through the Cisco VPN client and my Smartcard then use remote desktop. From my understanding if I run Bootcamp it should work am I correct? Im going to an Apple store tomorrow hopefully they can help too.
    Thanks

    mrbacklash wrote:
    Ok with that being said will the MBA 11.6 1.4ghz have the guts to make it run mostly internet based programs over the VPN connection?
    I think if you are running apps over the Internet the bottleneck will be the Internet and your VPN bandwidth. Your computer can certainly execute faster than Internet communications.
    Besides, Internet or remote applications run on the remote server. All your local computer does is local processing of the data if necessary.
    Message was edited by: BobTheFisherman

  • Problem with Cisco VPN client and HP elitebook 2530p windows 7 64-bit

    Hi there
    I have a HP Elitebook 2530p which i upgraded to windows 7 64-bit. I installed the Cisco VPN client application (ver. 5.0.07.0290 and also 64-bit) and the HP connection manager to connect to the internet through a modem Qualcomm gobi 1000 (that is inside the laptop). When I connect to the VPN, it connects (I write the username and password) but there is no traffic inside de virtual adapter for my servers. When I connect to the internet through wire or wireless internet, I connect de VPN client and there is no problem to establish communication to my servers.
    I tried everything, also change the driver and an earlier version of the HP connection manager application. I also talked to HP and they told me that there was a report with this kind of problem and it was delivered to Cisco. I don’t know where is the problem.
    Could anyone help me?
    Thanks to all.

    You can try to update Deterministic Network Enhancer to the below listed release which supports
    WWAN Drivers.
    http://www.citrix.com/lang/English/lp/lp_1680845.asp.
    DNE now supports WWAN devices in Win7.  Before downloading the latest version of DNEUpdate from the links below,  be sure you have the latest
    drivers for your network adapters by downloading them from the vendors’ websites.
    For 64-bit: ftp://files.citrix.com/dneupdate64.msi
    Hope that helps.

  • Strange issue with 3.6.3 VPN Client and IOS firewall

    I'm able to establish a VPN connection from the VPN Client to the e0/0 interface of the IOS FW/VPN router and pass encrypted traffic.
    Whenever I initiate a connection to something on the "Internet" from the LAN (e0/1) of the router, a temporary ACL entry is added to ACL 103 as it should be and I'm able to get out on the Internet from the internal LAN; however, I immediately lose my VPN connection from my PC Client when IOS FW adds those temporary "return entries".
    Router is running 12.2(13)T.
    Anyone else having issues like that? I've looked everywhere on cisco.com and elsewhere but I don't see anyone having a similar issue.
    You Cisco gurus have any thoughts?
    Thanks,
    Jamey
    Config below:
    jamey#wr t
    Building configuration...
    Current configuration : 3947 bytes
    ! Last configuration change at 16:27:03 GMT Wed Jan 22 2003 by jdepp
    ! NVRAM config last updated at 00:14:38 GMT Wed Jan 22 2003 by jdepp
    version 12.2
    service timestamps debug datetime msec
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    hostname "jamey"
    no logging buffered
    no logging console
    username XXXX password 7 XXXXX
    clock timezone GMT 0
    aaa new-model
    aaa authentication login tac local
    aaa session-id common
    ip subnet-zero
    no ip domain lookup
    ip inspect name myfw ftp
    ip inspect name myfw realaudio
    ip inspect name myfw smtp
    ip inspect name myfw streamworks
    ip inspect name myfw vdolive
    ip inspect name myfw tftp
    ip inspect name myfw rcmd
    ip inspect name myfw tcp
    ip inspect name myfw udp
    ip inspect name firewall http java-list 3
    ip audit notify log
    ip audit po max-events 100
    crypto isakmp policy 3
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp nat keepalive 20
    crypto isakmp client configuration group XXXX
    key XXXXXXX
    dns x.x.x.x
    domain xxx.com
    pool ipsec-pool
    acl 191
    crypto ipsec security-association lifetime kilobytes 536870911
    crypto ipsec security-association lifetime seconds 86400
    crypto ipsec transform-set foxset esp-3des esp-md5-hmac
    crypto dynamic-map dynmap 10
    set transform-set foxset
    crypto map clientmap client authentication list tac
    crypto map clientmap isakmp authorization list XXXXX
    crypto map clientmap client configuration address respond
    crypto map clientmap 10 ipsec-isakmp dynamic dynmap
    interface Loopback10
    description just for test purposes
    ip address 172.16.45.1 255.255.255.0
    interface Ethernet0/0
    description "Internet"
    ip address x.x.x.x 255.255.255.224
    ip access-group 103 in
    ip inspect myfw out
    no ip route-cache
    no ip mroute-cache
    half-duplex
    crypto map clientmap
    interface Ethernet0/1
    description "LAN"
    ip address 192.168.45.89 255.255.255.0
    no ip route-cache
    no ip mroute-cache
    half-duplex
    ip local pool ipsec-pool 192.168.100.1 192.168.100.254
    ip classless
    ip route 0.0.0.0 0.0.0.0 Ethernet0/0
    no logging trap
    access-list 3 permit any
    access-list 103 permit ip 192.168.100.0 0.0.0.255 any log
    access-list 103 permit icmp any any log
    access-list 103 permit udp any eq isakmp any log
    access-list 103 permit esp any any log
    access-list 103 permit ahp any any log
    access-list 103 permit udp any any eq non500-isakmp log
    access-list 103 permit tcp any any eq 1723 log
    access-list 103 permit udp any any eq 1723 log
    access-list 103 deny tcp any any log
    access-list 103 deny udp any any log
    access-list 191 permit ip 192.168.45.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list 191 permit ip 172.16.45.0 0.0.0.255 192.168.100.0 0.0.0.255
    radius-server authorization permit missing Service-Type
    call rsvp-sync
    line con 0
    line aux 0
    line vty 0 4
    exec-timeout 0 0
    password XXXXXX
    line vty 5 15
    end
    Some debugging info:
    At this point, my VPN PC is successfully connected to the e0/0 VPN router and assigned IP of 192.168.100.2. It is running constant pings to 192.168.45.67 and 172.16.45.1 (172.16.45.1 is a loopback on the router for testing), 192.168.45.67 is a host on the internal network.
    .Jan 22 01:27:38.284: ICMP type=8, code=0
    .Jan 22 01:27:38.288: IP: s=192.168.45.67 (Ethernet0/1), d=192.168.100.2 (Ethern
    et0/0), g=192.168.100.2, len 60, forward
    .Jan 22 01:27:38.288: ICMP type=0, code=0
    .Jan 22 01:27:38.637: IP: s=192.168.45.145 (Ethernet0/0), d=255.255.255.255, len
    40, access denied
    .Jan 22 01:27:38.637: UDP src=2301, dst=2301
    .Jan 22 01:27:38.641: IP: s=192.168.45.145 (Ethernet0/1), d=255.255.255.255, len
    40, rcvd 2
    .Jan 22 01:27:38.641: UDP src=2301, dst=2301
    .Jan 22 01:27:38.761: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:38.765: IP: s=192.168.100.2 (Ethernet0/0), d=172.16.45.1, len 60,
    rcvd 4
    .Jan 22 01:27:38.765: ICMP type=8, code=0
    .Jan 22 01:27:38.765: IP: s=172.16.45.1 (local), d=192.168.100.2 (Ethernet0/0),
    len 60, sending
    .Jan 22 01:27:38.765: ICMP type=0, code=0
    .Jan 22 01:27:39.282: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:39.286: IP: s=192.168.100.2 (Ethernet0/0), d=192.168.45.67 (Ethern
    et0/1), g=192.168.45.67, len 60, forward
    .Jan 22 01:27:39.286: ICMP type=8, code=0
    .Jan 22 01:27:39.286: IP: s=192.168.45.67 (Ethernet0/1), d=192.168.100.2 (Ethern
    et0/0), g=192.168.100.2, len 60, forward
    .Jan 22 01:27:39.290: ICMP type=0, code=0
    .Jan 22 01:27:39.763: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:39.767: IP: s=192.168.100.2 (Ethernet0/0), d=172.16.45.1, len 60,
    rcvd 4
    .Jan 22 01:27:39.767: ICMP type=8, code=0
    .Jan 22 01:27:39.767: IP: s=172.16.45.1 (local), d=192.168.100.2 (Ethernet0/0),
    len 60, sending
    .Jan 22 01:27:39.767: ICMP type=0, code=0
    .Jan 22 01:27:40.283: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:40.287: IP: s=192.168.100.2 (Ethernet0/0), d=192.168.45.67 (Ethern
    et0/1), g=192.168.45.67, len 60, forward
    .Jan 22 01:27:40.287: ICMP type=8, code=0
    .Jan 22 01:27:40.287: IP: s=192.168.45.67 (Ethernet0/1), d=192.168.100.2 (Ethern
    et0/0), g=192.168.100.2, len 60, forward
    .Jan 22 01:27:40.291: ICMP type=0, code=0
    .Jan 22 01:27:40.596 GMT: %SEC-6-IPACCESSLOGNP: list 103 permitted 50 216.16.193
    .52 -> <VPN ROUTER E0/0 INTERFACE>, 222 packets
    .Jan 22 01:27:40.596 GMT: %SEC-6-IPACCESSLOGP: list 103 permitted udp 216.16.193
    .52(500) -> <VPN ROUTER E0/0 INTERFACE>(500), 16 packets
    here is where I initiate a telnet connection to a host 2.2.2.2 (a dummy host on the "Internet")
    from a host on the internal side (LAN) (192.168.45.1)
    .Jan 22 01:27:40.600: IP: s=192.168.45.1 (Ethernet0/1), d=2.2.2.2 (Ethernet0/0),
    g=2.2.2.2, len 44, forward
    .Jan 22 01:27:40.600: TCP src=38471, dst=23, seq=953962328, ack=0, win=4128
    SYN
    .Jan 22 01:27:40.764: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    here is where by VPN connection breaks
    .Jan 22 01:27:40.768: IPSEC(epa_des_crypt): decrypted packet failed SA identity
    check
    .Jan 22 01:27:41.285: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:41.285: IPSEC(epa_des_crypt): decrypted packet failed SA identity
    check
    .Jan 22 01:27:45.773: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:45.777: IPSEC(epa_des_crypt): decrypted packet failed SA identity
    check
    .Jan 22 01:27:46.774: IP: s=<VPN PC CLIENT> (Ethernet0/0), d=<VPN ROUTER E0/0 INTERFACE> (Ethern
    et0/0), len 112, rcvd 3, proto=50
    .Jan 22 01:27:46.774: IPSEC(epa_des_crypt): decrypted packet failed SA identity
    check

    Ok..I found the bug ID for this:
    CSCdz46552
    the workaround says to configure an ACL on the dynamic ACL.
    I don't understand what that means.
    I found this link:
    http://www.cisco.com/en/US/products/sw/secursw/ps2138/products_maintenance_guide_chapter09186a008007da4d.html#96393
    and they talk about it, but I'm having a hard time decoding what this means:
    "To specify an extended access list for a crypto map entry, enter the match address crypto map configuration command. This access list determines which traffic should be protected by IPSec and which traffic should not be protected by IPSec. If this is configured, the data flow identity proposed by the IPSec peer must fall within a permit statement for this crypto access list. If this is not configured, the router will accept any data flow identity proposed by the IPSec peer. However, if this is configured but the specified access list does not exist or is empty, the router will drop all packets."

  • Apple built-in vpn client and dhcp hostnames

    We have a number of Mac clients in our office which uses MS for dhcp and dns.
    I've noticed that the mac clients when wired directly into the office network successfully get a dhcp lease and report their hostnames accurately to the dhcp server. However when these same clients connect to the office network via VPN (using the built-in vpn utility with Cisco IPSEC) they get a dhcp lease as expected, but do not register a hostname with the lease on the dhcp server. The lease is assigned to a blank hostname.
    I assume this is a pretty common issue. Has anyone found a way to configure the vpn client to send the hostname along with the connection, either via the client config or through some other method?
    Thanks.

    The VPN server is a Cisco 3030, however only the Mac clients have this issue. Windows and linux clients report their hostnames to dhcp properly even when VPN connected.

  • WRV200 - Problems with VPN Client and Internal network access

    I have a WRV200 router and want to access the internal (Private Network) connected on the inside. I have successfully conected to the router with the Linksys VPN Client, but it does not appear to allow access to the internal network.
    How do I enable NAT Transversal or Passthru? I have already selected all of the PPTP, L2TP and IPSEC Pass Through.
    Has anyone gotten this to work?

    I have actually gotten this to work. Issues surround this include the ability to get to the VPN if the main DNS is down (it does not fail over to the next DNS in the list).
    If you unselect all of the boxes in the firewall General configuration, you can connect, but if you need to have all of this unchecked, what's the sense of having it?
    Anyway, you can use the DoS Prevention, this is not interfering.
    HTH.

  • Inbuilt cisco IPSEC vpn client and KeyLife Timeout setting...

    Hi Guys
    I am having issues with the in built cisco vpn client on the mac, I am currrently using Mac OSx 10.7.4
    I have a Fortigate 200B device and have setup the IPSec VPN settings to have a keylife of 86400 seconds.
    However the expereince I am having with the mac clients is that after about 50 minutes the users are being asked to re-authencate to the VPN...
    When checkin the debug logs I can see that the peer (mac client) is setting the phase 2 tunnel key lifetime to 3600 seconds which is 1 Hour...
    Usually in IPSec a re-negeotiation process takes place about 10 minutes or so before the key expires..
    My question is where are the VPN settings kept in the Mac... I know it uses Racoon for the IPSec exchange of key and so I would like to tweak the VPN profiles so that the mac sets the lifetime of the key to 86400 instead of 3600 by default...
    Also want to be able to set logging to debug mode for the Racoon application on mac clients.
    Your help is much appreciated
    Kind Regards
    Mohamed

    Hi Tony,
    to the best of my knowledge this is currently not possible, but will be once this enhancement is implemented:
    CSCsw31922    Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions
    You may want to try and ask in the AAA forum if there is anything you can do on ACS...
    hth
    Herbert

  • Configure a VPN client and Site to Site VPN tunnel

    Hi, I'm setting up a test network between 2 sites. SiteA has a 515E PIX and SiteB has a 501 PIX. Both sites have been setup with a site to site VPN tunnel, see SiteA config below. I also require that remote clients using Cisco VPN client 3.6 be able to connect into SiteA, be authenticated, get DHCP info and connect to hosts inside the network. However, when I add these config lines, see below, to SiteA PIX it stops the vpn tunnel to SiteB. However, the client can conect and do as needed so that part of my config is correct but I cannot see why the site to site vpn tunnel is then no longer.
    SiteA config with working VPN tunnel to SiteB:
    SITE A
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.x.x.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.x.x.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.x.x.0.0 201.201.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    SiteA-pix(config)#
    Lines I add for Cisco VPN clients is attached
    I entered each line one by one and did a reload and sh crypto map all was OK until I entered the crypto map VPNPEER lines.
    Anyone any ideas what this can be?
    Thanks

    Heres my config:
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.11.11.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    access-list 80 permit ip SiteA_INT 255.255.0.0 200.220.0.0 255.255.0.0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.255.255.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool pix_inside 200.x.x.100-200.220.200.150
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.0 0.0.0.x.x.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host 200.200.200.20 letmein timeout 10
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set AAADES esp-3des esp-md5-hmac
    crypto dynamic-map DYNOMAP 10 match address 80
    crypto dynamic-map DYNOMAP 10 set transform-set AAADES
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map 30 ipsec-isakmp dynamic DYNOMAP
    crypto map outside_map client authentication RADIUS
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption 3des
    isakmp policy 30 hash sha
    isakmp policy 30 group 2
    isakmp policy 30 lifetime 86400
    vpngroup Remote address-pool pix_inside
    vpngroup Remote dns-server 200.200.200.20
    vpngroup Remote wins-server 200.200.200.20
    vpngroup Remote default-domain mycorp.co.uk
    vpngroup Remote idle-time 1800
    vpngroup Remote password password
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    I will attach debug output later today.
    Thanks

  • Cisco VPN client and mac mail

    Hi all,
    I wonder if someone can be more helpful than my uni IT department who take a minimum of a week to get you an IP address...
    My new uni uses Cisco VPN client for connection to the Wi-Fi network. It all works great apart from one (very annoying problem):-my e-mail accounts in mac mail don't seem to be able to connect via the VPN. I have had both an IMAP and a POP server e-mail account work automatically wherever I connect in the world for over a year now-so its not the way I've set up the accounts.
    Is there any way to get mac mail to "see" the VPN connection. If I have to physically plug-in my mac this seems a tad ridiculous when it works in every coffee shop with free wi-fi.
    My uni are not helpful as they want people to use either outlook or better still log-on to their e-mail using the web. I don't even want to use their e-mail-what is the point when I move jobs again in a year. What I do currently is use an IMAP account from my last job which I've set to forward to my "e-mail for life" from my undergrad uni. I basically only give out my life e-mail address and this also goes on all my papers.
    If I can't access this easily and sort all my mail in all the folders I've created to filter out things like facebook etc. I'm wondering what the point of mac mail is.

    Yeah, that stuff normally works for me. Unfortunately this is a situation where you have to use an external Cisco VPN client software, whether you like it or not. Its this horrible clunky thing (which at least half works I guess). So its only like normal wi-fi in terms of selecting the network, then you have to open up this application and put in your log-in etc. Most of the settings on this client seem locked, so there isn't much I can do to configure it.
    I've just got to my (temporary) accommodation which doesn't have wi-fi or VPN (just ethernet) and my mail is working again-so it must be the VPN. Goodness knows how it works with an iPod touch (interested in getting one but kind of pointless if I spend most of my time at work and it doesn't work...)
    Thanks for your suggestions though!

  • Cisco VPN client and SSH

    Hi,
    I am using Cisco VPN client 4.9.01.0180 to connect to remote server. From the Cisco client, I see that I am connecting to the remote server.
    Using the terminal, with command:
    ssh 192.168.1.2 or ssh [email protected] to connect to the remote server.
    However, the output is:
    ssh: connect to host 192.168.1.2 port 22: Operation timed out
    I don't know what is going wrong. The Cisco client 's setting is simple, and no problem using Windows. Do I have to modify the Mac OS?
    Regards,
    Terence

    hi,
    sorry for asking stupid. how and what did you change your subnet to ?
    i have almost the exact same problem (same client and on Windows it does work and I cannot ssh to a Mac in the work office) furthermore i am using a wireless connection (via Airport Express) ... not sure if that matters.
    do i just go into the Network Prefs and select the tcp/ip tab, and manually change the ip-addresses ?
    my settings (DHCP) currently are
    ip 10.0.1.2
    Subnet Mask 255.255.255.0
    Router 10.0.1.1
    The strange thing for me is that if I Remote Desktop to a PC (via VPN) on the same office net as the above Mac I cannot ssh (via Putty), but when i am physically at the PC i am able to ssh.
    any help appreciated
    ./allan

  • VPN Client and Terminal Server

    We have several clients that allow us to vpn into their systems and it has come to the point that we are getting software incompatabilities. What I am trying to do is set up "compatable" connections on a Terminal server box and let our people access this from their workstations. The problem is when the acuall connection thru the vpn client is made they loose connection to the terminal server. I have tried putting in 2 nic's into the terminal server and am able to allocate one for the terminal server but can not find a way to allocate the other to the VPN CLient. Is this possable or is there another way to accomplish this?
    Thanks

    Close,
    What I have is one machine with 2 nic's
    NIC #1 = Terminal Server Access (local lan only) Locked in via registry settings to use ONLY this NIC
    NIC #2 = I would like to "LOCK" the Client software to use ONLY this nic (has a dynamic IP for local lan and access to the Inet via a router.
    Problem: When you connect to the T-Server all is fine UNTIL you start up the client software to access our clients systems via the web connection to the T-Server on the local side stops and gives the appearance of a frozen screen.
    manualy disconnect person from the T-Server and kill the cisco client software then you can re-connect to the T-Server (and it all starts over again)
    The Cisco software acualy makes the connection to our clients system but we can not tell because it want BOTH the NIC's for itself and stops access via NIC#1 to the T-Server.

Maybe you are looking for

  • How can I create this rollover effect in Flash CS5?

    I'm pretty new to Flash, and I want to create a button like these. I understand how to make a basic rollover button, but I haven't got a clue how to do animation like that. http://www.werkstette.dk

  • XRAID won't mount

    For some reason our XRAID (RAID 50) won't mount on the desktop anymore. Restarted everything multiple times to no avail. Disk Utility sees it, but complains about node structure when trying to either mount or eject it. Thinking of running Disk Warrio

  • 10.2.1.2102 - UNHAPPY USER !!!

    I have downloaded and installed it........ BUT since then the battery lasst half the time it did before, and my contacts are just ONE BIG MESS !!!!! Emoticons in text messages just shows as a '?' I am so unhappy that i am ready to ditch the phone ...

  • Passing variables to a SQL script within GC

    Does anyone know if it is possible to pass in a variable to a SQL script job within Grid Control? I don't see that I can but I wanted to ask a larger group before cloing the loop on this. For example, I have a few different databases which contain sc

  • Sales Order Costing using prod version

    Hi Guru, My client use MTO and have prod version 1000 & 2000.  When I create SO and choose prod.version 1000,  prod.order created using BOM/Routing in prod.version 1000, so the prod order cost plan. But in costing SO, prod version 2000 is use as base