VRF Aware WCCP !!!!!! PLEASE!!!!!!
I am looking for a forcast of when WCCP will have VRF support. Head-End scalability is pretty tough to achieve with out it. ywa I can stack WAE's ( up to 32) in a WCCP service group but if the Edge WAE's are in A VRF, it breaks.
Any Ideas?
The VRF awareness for 12.4(T) is still probably 8-12 months out. VRF aware WCCP features are definitely in the pipeline, but nothing has been publically published on availability timelines.
It's now publically available on the forum... but , I've only found it on the 3750 and 3550 documentation.
at the 3750 you will need to place the redirect statement on each of the VLANs, ip wccp 61 redirect in
Kindly find here GRE Tunnel with VRF Configuration Example:
http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a00801e1294.shtml
I have gotten as far as the WAE registering the router:
"WCCP configuration for TCP Promiscuous service 61 and 62 succeeded.
WCCP configuration for TCP Promiscuous succeeded.Please remember to
configure WCCP service 61 and 62 on the corresponding router."
wae01#sh wccp router
Router Information for Service: TCP Promiscuous 61
Routers Configured and Seeing this Wide Area Engine(1)
Router Id Sent To Recv ID
0.0.0.0 209.1.1.1 0000022F
The router registers the WAE as a WCCP client:
router04#
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 61 acquired on WCCP
client 209.1.1.2"
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 62 acquired on WCCP
client 209.1.1.2"
The router however cannot figure out what its ID is and does not see
itself as a WCCP group router.
router04#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: -not yet determined-
Protocol Version: 2.0
Service Identifier: 61
Number of Service Group Clients: 1
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
Fast: 0
CEF: 0
Redirect access-list: ACCELERATED-TRAFFIC
Total Packets Denied Redirect: 0
Total Packets Unassigned: 25957
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
This is a short summary of important commands for working with VRF's.
View the VRF instances and the associated interfaces.
ml-mr-c6-gs#show ip vrf
Name Default RD Interfaces
blurvrf 100:2 Vlan215
Vlan326
tgvrf 100:1 Vlan132
Vlan325
TenGigabitEthernet1/1
ml-mr-c6-gs#
Show the routing table for a specific VRF.
ml-mr-c6-gs#show ip route vrf tgvrf
Routing Table: tgvrf
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external,
---More--
Gateway of last resort is 128.117.243.57 to network 0.0.0.0
O E2 192.52.106.0/24 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 192.168.150.0/24 [110/160] via 128.117.243.57, 1d19h, Vlan325
172.17.0.0/29 is subnetted, 3 subnets
O E2 172.17.1.16 [110/0] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.8 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.0 [110/1] via 128.117.243.57, 1d19h, Vlan325
--More--
Debugging should otherwise be similar to a regular switch or router.
Final Teragrid VRF Design and Diagrams
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/final.shtml
Teragrid Testbed Design
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/testbed.shtml
Cisco 4500 Series Switch Cisco IOS s/w config guide 12.1(20)EW
Configuring VRF-Lite
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/vrf.html
sachin garg
Similar Messages
-
I want to put one Cache-Engine at PE router to provide caching services for different VPNs.
Customer will have Separate VPN to access Internet, Cache-engine is put at common VRF & accesible from Customer sites in different VPNs
Can't find any related document, & don't have Lab to test. Anyone experience this, please confirm for me.
Thanks a lot
LongThe VRF awareness for 12.4(T) is still probably 8-12 months out. VRF aware WCCP features are definitely in the pipeline, but nothing has been publically published on availability timelines.
It's now publically available on the forum... but , I've only found it on the 3750 and 3550 documentation.
at the 3750 you will need to place the redirect statement on each of the VLANs, ip wccp 61 redirect in
Kindly find here GRE Tunnel with VRF Configuration Example:
http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a00801e1294.shtml
I have gotten as far as the WAE registering the router:
"WCCP configuration for TCP Promiscuous service 61 and 62 succeeded.
WCCP configuration for TCP Promiscuous succeeded.Please remember to
configure WCCP service 61 and 62 on the corresponding router."
wae01#sh wccp router
Router Information for Service: TCP Promiscuous 61
Routers Configured and Seeing this Wide Area Engine(1)
Router Id Sent To Recv ID
0.0.0.0 209.1.1.1 0000022F
The router registers the WAE as a WCCP client:
router04#
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 61 acquired on WCCP
client 209.1.1.2"
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 62 acquired on WCCP
client 209.1.1.2"
The router however cannot figure out what its ID is and does not see
itself as a WCCP group router.
router04#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: -not yet determined-
Protocol Version: 2.0
Service Identifier: 61
Number of Service Group Clients: 1
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
Fast: 0
CEF: 0
Redirect access-list: ACCELERATED-TRAFFIC
Total Packets Denied Redirect: 0
Total Packets Unassigned: 25957
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
This is a short summary of important commands for working with VRF's.
View the VRF instances and the associated interfaces.
ml-mr-c6-gs#show ip vrf
Name Default RD Interfaces
blurvrf 100:2 Vlan215
Vlan326
tgvrf 100:1 Vlan132
Vlan325
TenGigabitEthernet1/1
ml-mr-c6-gs#
Show the routing table for a specific VRF.
ml-mr-c6-gs#show ip route vrf tgvrf
Routing Table: tgvrf
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external,
---More--
Gateway of last resort is 128.117.243.57 to network 0.0.0.0
O E2 192.52.106.0/24 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 192.168.150.0/24 [110/160] via 128.117.243.57, 1d19h, Vlan325
172.17.0.0/29 is subnetted, 3 subnets
O E2 172.17.1.16 [110/0] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.8 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.0 [110/1] via 128.117.243.57, 1d19h, Vlan325
--More--
Debugging should otherwise be similar to a regular switch or router.
Final Teragrid VRF Design and Diagrams
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/final.shtml
Teragrid Testbed Design
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/testbed.shtml
Cisco 4500 Series Switch Cisco IOS s/w config guide 12.1(20)EW
Configuring VRF-Lite
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/vrf.html
sachin garg -
When will wccp be vrf aware on 6500
wccp is vrf aware for many plataforms, when will wccp vrf aware on 6500 plataform? Someone knows the roadmap for this feature?
Zach Seils wrote:VRF-aware WCCP will not be supported on the 6500 platform until the next-generation Supervisor (SUP-2T).
Hi Zach, is this a limitation of the Sup 720 (as in, the hardware can't support it), or will a future IOS release be able to support VRF aware WCCP on the Sup 720? -
VRF aware Remote Access on ZBF
Hello,
In our environment we have a Zone based firewall on CIsco ASR 1000 XE router, terminating normal IPsec VPN sessions on ZBF. The router has one outgoing physical interface (g0/0/0) connected to ISP as outside Interface and multiple Interfaces on the Inside network on Port channels VLAN/VRF.
The remote access VPN (Easy VPN) is applied using crypto map configuration on the interface connected to ISP.
Now, there was also a requirement to provide IPSec termination on the same physical inteface g0/0/0 to a different customer via a VRF aware Remote access. Two configuration templates were implemented with similar results. IPSec Tunnel comes up fine for the VRF profile but tunnel cannot pass traffic. Ping from IPsec client to an IP address on the Inside network times out and trace route shows that this gets dropped somwhere in the ISP cloud.
Configuration 1 - Crypto Dynamic Map
crypto isakmp policy 15
encr aes 256
authentication pre-share
group 2
crypto isakmp client configuration group admin-vpn
key _____
pool vpn-pool
acl VPN-LIST
crypto isakmp client configuration group centralsTEMP-vpn
key __________
pool centrals vpn-pool
acl VPN-LIST
crypto isakmp profile softclient
match identity group admin-vpn
client authentication list userauth
isakmp authorization list groupauthor
client configuration address respond
crypto isakmp profile centralsoftclient
vrf Branch
match identity group branch-vpn
client authentication list userauth
isakmp authorization list groupauthor
client configuration address respond
crypto ipsec transform-set SECURITYSET esp-aes esp-md5-hmac
mode tunnel
crypto ipsec transform-set branchtemp esp-aes esp-md5-hmac
mode tunnel
crypto dynamic-map branchvpn 10
set transform-set branchtemp
set isakmp-profile centralsoftclient
reverse-route
crypto dynamic-map vpnmap 10
set transform-set SECURITYSET
set isakmp-profile softclient
crypto map vpnmap 10 ipsec-isakmp dynamic vpnmap ---> Normal VPN
crypto map vpnmap 20 ipsec-isakmp dynamic branchvpn --> IPSec Aware VPN
crypto map vpnmap
Configuration 2 - DVTI
crypto ipsec profile branchclient
set transform-set branchtemp
crypto isakmp profile centralsoftclient
vrf global
match identity group centralsTEMP-vpn
client authentication list userauth
isakmp authorization list groupauthor
client configuration address respond
virtual-template 2
interface Virtual-Template2 type tunnel
ip vrf forwarding branch
ip unnumbered GigabitEthernet0/0/0
tunnel mode ipsec ipv4
tunnel protection ipsec profile branchclient
Please advise if there is any VPN related configuration issue or a Zone based firewall issue.Hi Marcin,
Thank you very much for your response and actually, we did open a TAC and the problem was resolved using Crypto Map dynamic configurations for both Standard and IPSec aware VPN's. Some specific policies on ZBF were tweaked (for example echo-reply packet inspection was deleted(configured for Pass) and also some access-lists which had unwanted entries were cleaned up.
Thanks again for your help.
Best Regards,
Mohan -
Hi
I need to setup a VRF aware IPSec that can take requests from dynamic (unspecified) sources. This is basically like enabling a home user to connect to his MPLS VPN network with a service provider. Please help with the SP network config, not the CPE.
An appropriate link will also help.Each IPSec tunnel is associated with two VRF domains. The outer encapsulated packet belongs to one VRF domain, which we shall call the FVRF, while the inner, protected IP packet belongs to another domain called the IVRF. Another way of stating the same thing is that the local endpoint of the IPSec tunnel belongs to the FVRF while the source and destination addresses of the inside packet belong to the IVRF.
One or more IPSec tunnels can terminate on a single interface. The FVRF of all these tunnels is the same and is set to the VRF that is configured on that interface. The IVRF of these tunnels can be different and depends on the VRF that is defined in the Internet Security Association and Key Management Protocol (ISAKMP) profile that is attached to a crypto map entry.
This document helps you configure VRF aware IPSec.
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_vrf_aware_ipsec_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1158006 -
Hello,
I have a few routers w/ VRF-Aware IPsec tunnels. I'm wondering if I can monitor all my tunnels, from all VRFs, with a single SNMP poll? CISCO-IPSEC-FLOW-MONITOR-MIB, CISCO-IPSEC-MIB , and CISCO-IPSEC-POLICY-MAP-MIB do not give me data for the sum all all of my VRFs. Please advise.
Thanks!
LehiSee http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_iimib.html . Assuming you're running the correct version of code, you can get VRF-aware CISCO-IPSEC-FLOW-MONITOR-MIB and CISCO-IPSEC-MIB support. You will need to make sure you have configured your device to allow for VRF-based SNMP polling. The VRF instances will not show sum totals for the system. To get that, you will need to poll using a non-VRF community string.
-
RADIUS config for VRF-aware VPDN multihop tunnel
Hi,
Can't find the LNS config directives those will lead to get complete(!) vpdn profile from radius.
The configuration is:
LAC-LNS/PE-LNS/CE
LNS/PE - provider edge lns that we want to configure using radius profile for vrf-aware multihop vpdn so that incoming tunnel is switched out to LNS/CE in one of the vrfs configured on LNS/PE.
The "vpdn tunnel authorization " command lets me get the profile for ingress session coming from LAC, but in order to switch the tunnel further to LNS/CE i have to config vpdn-group on LNS/PE. Is it possible to make a RADIUS profile that LNS/PE will use for both ingress and egress tunnels?Hello Alex,
I would like to point you to this forun into another section. There is currently a "Ask The Expert" about MPLS VPNs at http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dda563c
Maybe it will be more suitable to address your questions there.
Hope this Helps!
Regards, Martin -
hi, i want to implement vrf aware nat and i want to create a single pool for all vrfs. when the traffic returns is there a way the ios identify which vrf the IP belongs to so i dont have to specify the pool for each vpn whit static routes? Thanks ahead- asanes
Hi,
As I understand you want to integrate NAT with MPLS based VPNs.
Follwing Cisco link should help:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t13/ftnatvpn.htm#wp1035671
Cheers,
Sultan. -
Hi,
Can we club DMVPN and VRF-Aware IPsec features ?
Regards
MaheshMillion thanks for this.
This now works after disabling CEF on the public facing interface.
Regards,
Zahid -
2800s, AIM-VPN-SSL2, vrf aware IPSEC, high CPU low throughput
We have a couple of new 2821s deployed across a fibre link and they were originally running 12.4 (non T) versions using software encryption. We would get around 8Mb/s throughput. Upgrading to T to use the installed AIM cards we now see the AIM cards in use (show cry isakmp sa det shows then engine as aim vpn), but we still get the same throughput and high CPU. allowing CEF on the interface doubles throughput but with the same high CPU. The only process I can see going high is IP Input. Is this because of vrf aware ipsec - or any other suggestions?
Hi Nick,
I am having the same issue. We have a 2851 as a IPSEC VPN headend with an AIM VPN module but we are seeing high CPU usage(80%) with just 4-5mbps worth of traffic. I have an idea that I might have a NAT issue.
We are currently running, NAT, ZFW, and IPSEC site 2 site VPN on the router.
When I look at my ZONE firewall policy-map output it is showing all of my VPN traffic as process switched.
Inspect
Packet inspection statistics [process switch:fast switch]
tcp packets: [14809800:0]
udp packets: [145107:0]
icmp packets: [20937:12]
I have disabled the ZFW and still see high cpu although it is a little lower.
Packets are not fragmented, CEF and fast switching looks to be enabled. I am using a route-map for my nonats. That is the only thing I can think of now.
I have tried IOS 12.4(20)T3,4 and 12.4(15)T9. Same results.
Anyone have some ideas? -
EIGRP authentication in named mode breaks vrf aware DMVPN
Hi Friends,
I build a vrf aware DMVPN, and advertise the GRE ip in EIGRP named mode. All works well till I enable authentication in af-interface tunnel 0.
Once I enable the authentication "hmac-sha256'', it breaks the crypto and DMVPN.
Any advice on whats the solution to bring the crypto and DMVPN up with EIGRP authentication in named mode ?
Regards
rYsHi,
I attached the config I did, till I apply the authentication in EIGRP,
once I applied the below config, the dmvpn will break
""router eigrp EIGRP
add ipv4 autonom 45678
af-interface tu0
authentication mode hmac-sha256 KEY""
See any more configs I need to add in the crypto to make the dmvpn up.
Thanks -
Hi all,
I want to implement DNS VRF-aware in Nexus 7k running 5.2.X. My goal is to define a domain name and static IP hosts in Nexus per VRF which will serve DNS requests.
I looked into documentation and mentions only DNS VRF aware as DNS client. The following link describes the functionality Im looking for:
http://www.cisco.com/c/en/us/td/docs/ios/ios_xe/ipaddr/configuration/guide/xe_3s/iad_xe_3s_book/iad_vrf-aw_dns_xe.html#wp1069798Please find network diagram attached upload with the original post.
-
Hi
In an Enterprise Network we are using CAT6500 SUP720/MSFC3B with VRF Lite.
According to the Software Advisor VRF aware NAT is not supported on the 6k. But I think with the MPLS image it should be supported.
My question: Is it supported and if yes whats the recommended image if i just want to have vrf-lite with vrf aware NAT - no MPLS
cheers
patrickIF you have a FWSM then you should be good to go for the VRF-Aware NAT. I am not aware of NAT being performed natively on the SUP.
HTH-Cheers,
Swaroop -
Hello ,
Im trying to configure syslog on a CPE which has VRF_A configured on it. Our requirement is to have this CPE send syslogs to two servers , one in customers own network which is part of global routing table and second is providers syslog server which is part of VRF_A.
As per my knowledhe I cannot specify any source interface for syslog through vrf and the source IP is picked up automatically by IOS from the interface which is part of the VRF. However when I have multiple interfacec in the same VRF which IP is picked up by IOS ?
Is there any way to acheive this ? Im attaching a diagram depicting the scenario .
I have put in below config on the device.
logging source-interface Loopback100
logging 3.3.3.3
logging host 69.26.45.139 vrf A
logging 2.2.2.2Saurabh,
the box will pick up the best interface according to the 'sh ip ro vrf A' output and send the syslogs off this interface. We currently hasve these two DDTS'es to address that:
CSCsu22476 Bug Details
Set source interface for VRF-aware syslog messages
Symptom:
customer can not set the source interface for VRF-Aware Syslog messages.
Conditions:
Normal config mode.
Workaround:
Feature is not implemented.
and
CSCtn11379
Allow vrf syslogging from a specific source interface on routers
Symptom: VRF syslogging doesn't allow specifying the source interface. Conditions: VRF syslogging must be enabled. Syslogging to global routing table allows specification of the source interface.Workaround: None.
check them out on CCO for the list of fixed versions, should be working in 15th somewhere.
HTH,
Ivan. -
VRF aware GET-VPN Group-member
Hi,
we want to configure following on some of our routers.
3 VRF-lite (before it has been 3 seperate routers)
For each VRF we have to use a seperate GDOI-Group , different PSKs.
The KS for the different GDOI Groups is the same adresses (central resource reachable from every VRF).
I know that I can configure per GDOI-Group a "client registartion interface ..." which can be an interface in a VRF.
to configure the same KS-address for different GDOI-groups seems to be not possible
crypto gdoi group GROUP-1
identity number 1111111
server address ipv4 22.198.255.29
server address ipv4 22.198.255.33
crypto gdoi group GROUP-2
identity number 2222222
server address ipv4 22.198.255.29
server address ipv4 22.198.255.33
As soon as I configure the KS for GROUP-2 I get an error-message that the KS is already configured.
We can configure different ISAKMP-Profiles (vrf aware), but GDOI-GROUP configuration seems not to be VRF aware.
Is there a way how to achive to use the same KS-Address for different-Groups in different VRFs.
Thx
HubertHi Naman, I think there is a misunderstanding of my problem.
On the branch-routers I have two VRFs. In each VRF I have to configure GET-VPN-GM.
The KS are on central routers in each VRF but they do have the sam IP-address (we use overlapping address-space in both VRFs)
Configuration is like following
ip vrf VRF_10
rd 10:0
route-target export 10:0
route-target import 10:0
maximum routes 1000 warning-only
ip vrf VRF_12
rd 12:0
route-target export 12:0
route-target import 12:0
maximum routes 1000 warning-only
the problem is that we would have to configure to different ISAKMP-PSK for same Server-Address, and thats not possible
crypto isakmp key !$SECURE-WAN-KEY$!101010 address 22.161.255.33
crypto isakmp key !$SECURE-WAN-KEY$!101010 address 22.109.255.45
crypto isakmp key !$SECURE-WAN-KEY$!121212 address 22.161.255.33
crypto isakmp key !$SECURE-WAN-KEY$!121212 address 22.109.255.45
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 1200
crypto gdoi group GROUP-10
identity number 101010
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback0
crypto gdoi group GROUP-12
identity number 121212
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback1
crypto map MAP-10-SECURE-WAN local-address Loopback0
crypto map MAP-10-SECURE-WAN 10 gdoi
set group GROUP-10
crypto map MAP-12-SECURE-WAN local-address Loopback0
crypto map MAP-12-SECURE-WAN 10 gdoi
set group GROUP-12
interface Loopback1
ip vrf forwarding VRF_10
ip address 10.10.10.45 255.255.255.252
interface Loopback1
ip vrf forwarding VRF_12
ip address 12.12.12.45 255.255.255.252
interface gig0/1.10
ip vrf forwarding VRF_10
crypto map MAP-10-SECURE-WAN
interface gig0/1.12
ip vrf forwarding VRF_12
crypto map MAP-12-SECURE-WAN
So my idea was to configure the PSKs per VRF via an ISAKMP-Profile (where i can define VRFs)
ip vrf VRF_10
rd 10:0
route-target export 10:0
route-target import 10:0
maximum routes 1000 warning-only
ip vrf VRF_12
rd 12:0
route-target export 12:0
route-target import 12:0
maximum routes 1000 warning-only
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 1200
crypto keyring ISAKMP_KEY_GETVPN_10
local-address Loopback0
pre-shared-key address 22.161.255.33 key !$SECURE-WAN-KEY$!101010
pre-shared-key address 22.109.255.45 key !$SECURE-WAN-KEY$!101010
crypto keyring ISAKMP_KEY_GETVPN_12
local-address Loopback1
pre-shared-key address 22.161.255.33 key !$SECURE-WAN-KEY$!121212
pre-shared-key address 22.109.255.45 key !$SECURE-WAN-KEY$!121212
crypto isakmp profile ISAKMP_PROFILE_GETVPN_10
vrf VRF_10
keyring ISAKMP_KEY_GETVPN_10
self-identity address
match identity address 22.161.255.33 255.255.255.255
match identity address 22.109.255.45 255.255.255.255
keepalive 20 retry 2
local-address Loopback0
crypto isakmp profile ISAKMP_PROFILE_GETVPN_12
vrf VRF_12
keyring ISAKMP_KEY_GETVPN_12
self-identity address
match identity address 22.161.255.33 255.255.255.255
match identity address 22.109.255.45 255.255.255.255
keepalive 20 retry 2
local-address Loopback1
crypto gdoi group GROUP-10
identity number 101010
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback0
crypto gdoi group GROUP-12
identity number 121212
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback1
crypto map MAP-10-SECURE-WAN local-address Loopback0
crypto map MAP-10-SECURE-WAN isakmp-profile ISAKMP_PROFILE_GETVPN_10
crypto map MAP-10-SECURE-WAN 10 gdoi
set group GROUP-10
crypto map MAP-12-SECURE-WAN local-address Loopback1
crypto map MAP-12-SECURE-WAN isakmp-profile ISAKMP_PROFILE_GETVPN_12
crypto map MAP-12-SECURE-WAN 10 gdoi
set group GROUP-12
But it seems it does not work !!!
Any idea ?
Thx in Advance
Hubert
Maybe you are looking for
-
Error F5 037 while doing manual clearing of GL with F-03
Hi All, My client is trying to clear a Balance sheet account and getting the below error Account & for deductions/discounts must not be tax-relevant Message no. F5 037. Only the message is displayed and there is no help in the 'performance assistant'
-
How well does MS Remote Desktop work?
For those that have used Microsoft's Remote Desktop client, http://www.microsoft.com/mac/products/remote-desktop/default.mspx, have you found it satisfactory? Does it work fine with either Vista or XP? Does the Windows machine need anything special i
-
Hi - I have my photos stored in Itunes on my computer. Is there anyway that I can view these in itunes on my laptop (without having to reimport) kind of like sharing libraries in itunes? Maybe I could remotely link to the others computers iphoto libr
-
I have iphone 4 with bill box evertything but i brought it from a person in germany with vodafone carrier but now its locked in india and i dont have that vodafone simcard and it is more than 2 years old so plzz help
-
One request but with 2 diff layouts
In an interview, I was asked one question. Here it is There is one request, and an executable is attached to it. Now when you run that request, it will ask you whether you want the output in PDF or XLS format, based on which the outfile file will get