WebVPN on 2821 Router

I have had my WebVPN working fine on my 2821. Now yesterday my ACS server died and I had to load it on another server to get stuff back up. I had my router setup wrong and had to get into the router using ROMMON mode, changing the Config-Register, etc, the ugly way. I got the AAA turned off and can now access the router. However, my WebVPN no longer works and I was thinking I had this issue before and I had to do something with re-creating my certificates, keys, etc.
Anyone have any ideas? I am all out at this point.

Hi Jonas,
Yes you can use different permissions for different group of users depending on where your users are located , for e.g locally on the router or on radius server.
If its there on radius server, then you can push down some attributes and map it to use specific policy group or if users are created locally then you can use aaa attribute list.
The following is the document for your reference:-
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6657/prod_white_paper0900aecd8051ac3a.html
Also lets take an example, for local user on router
aaa authentication login list SSL local
aaa authorization network localauthor local
webvpn context SSL
policy group policy_1
policy group ABC
default-group-policy policy_1
aaa authentication list SSL
aaa authorization list localauthor
gateway gateway_1
inservice
aaa attribute list ABC
attribute type user-vpn-group "ABC" mandatory
attribute type webvpn-context "SSL"
username cisco privilege 15 secret 5 $1$A840$hEkdXCQJRuPC3U5O8N3Gd0
username cisco aaa attribute list ABC
User cisco will be binded you use the policy as ABC and context as SSL and if there is no condition user will use the default policy policy_1.
I hope it helps.
Thanks,
Shilpa

Similar Messages

L2TP network server 2821 router?

Can 2821 router with appropirate IOS image be L2TP network server and support 400-500 L2TP simultaneous connections? We want to use access VPDN that uses L2TP as tunneling protocol to provide remote users access to our services and to the Internet.

Hi Marija,
That's right, the 2821 can be used as an L2TP server (LNS or LAC).
It supports 900 IDBs, which means that you can provide access to around 900 remote-users. Also, it supports a maximum of 880 L2TP sessions/tunnels.
You can find detailed information on the following link:
http://www.cisco.com/en/US/tech/tk827/tk369/technologies_design_guide_chapter09186a00800d9cc7.html
Regards,
Juan Corrales

CCP Express wont install on 2821 router

Hello everyone,
I am trying to install Cisco Configuration Professional 2.4 Express on my 2821 router. During the installation process, I get notified there is 0 bytes available of routers flash memory. When I run a "show flash:" command, I receive the following error:
%Error show flash: (No device available)
The output of the "show version" (edited) command is:
Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 12.4, RELEASE SOFTWARE (fc1)
ROM: System Bootstrap, Version 12.4(1r) [hqluong 1r], RELEASE SOFTWARE (fc1
Router uptime is 2 weeks, 5 days, 4 hours, 54 minutes
System returned to ROM by power-on
System image file is "flash:c2800nm-adventerprisek9-mz.124-12c.bin"
Cisco 2821 (revision 53.51) with 512000K/12288K bytes of memory.
Processor board ID FTX1006C4SB
2 Gigabit Ethernet interfaces
1 Serial interface
2 Virtual Private Network (VPN) Modules
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
500976K bytes of ATA CompactFlash (Read/Write)
Configuration register is 0x2102
After some reading on Cisco site, I saw that 2800 routers do not support internal flash, but only CF cards. What I would like to know is how can I install CCP Express on CF card?
Thank you in advance.

bump?

2821 Router with EVM-HD-6FXO

Hi all,
I want to buy a 2821 router with an EVM-HD-6FXO module. The 2821 is running IOS "c2800nm-ipbase-mz.124-15.T10.bin". My question is can I use the 2821 as a Gateway for CUCM v10.5 or if I have change upgrade the IOS to a different version.
Thanks.

Yes, run SIP or H323 which is version agnostic, even MGCP will work though according to Cisco 15.X code is required.
Chris

How to view Log on the cisco 2821 Router

Hi,
can any one help me to view the Log on the Cisco 2821 router for any issue occur.
Thanks,
Saroj

Cisco devices use the syslog to manage system logs and alerts. But in Cisco devices there is lack of large internal storage space for storing these kinds of logs.So to overcome Cisco devices has the following two options:
1) internanal buffer — That is a small part of memory buffers to collect log the most recent messages. The buffer size is limited and , when the device reboots, these syslog messages are lost.by default it is on
(If not follow this steps
conf t
logging on
logging console.....console logs
logging buffer size ......set the size of buffer
terminal monitor.......to gets logs on the remote terminal like telnet,ssh etc.
sh logging.........to see buffer logs.)
2) Syslog server— By using this we can send messages to an external device for storing this logs and the storage size does depend on the available disk space of the external syslog server. This option is not enabled by default.
If you have any syslog server please find the below simple config .
conf t
logging host x.x.x.x
logging traps (i.e 0 1 2 3 4 5 .. according to your requirement)
before enabling logging be sure that your router is properly configure to collect proper time from any NTP server or manually configure to get time
command to set time manually on router is (set clock ) or to use ntp server use ntp server x.x.x.x to sync clock to router router.
Hop thant is informative ,
Regards,
Ashish

Cisco 2821 Router as a NTP Server

We are using a 2821 Router as our boundary router. It has installed into it a 9 port HWIC for layer 2 switching as well as allowing the router to communicate on the Network Management VLAN. All of the devices on the Network Management VLAN are segregated from the managed traffic, which unfortunately also doesn't allow them external NTP services. Can the router be programmed as a NTP server so that all of the network appliances can utilize it for NTP from either it's NM Vlan IP address or from a loopback address? Thanks in advance for the help.

What are the commands needed in the router for it to provide time to other appliances?
If your router has successfully synchronized with an authoritative NTP server? NOT A THING.
In my network, only the site's distribution switch is allowed to go out and get NTP. All other access switch goes to the distribution switch by using the command "ntp server ". You can have multiple NTP server IP address and if you prefer to have a "favorite" you can append your command with the "prefer" option: ntp server prefer.
If you have clients then point their NTP to your router. For troubleshooting, I prefer the command "sh ntp associate". If your NTP server IP address starts with a "*" this is good and means that your NTP is synchronized.
Hope this answers your question.

Cisco 2821 router IOS and Ipsec

Hi all.I was wondering can you create VPN tunnels using Ipsec on a 2821 router if you have only the IPBASE image(the basic image 2821 router comes with) on the router or do you need some other version of IOS?
I've gone totally nuts trying to find out but can't seem to find an answer.Thanks in advance.

Igor
You can not create IPSec tunnels if the 2821 is running the IP BASE image. You need a feature set that supports crypto to do IPSec. In general image names that include k9 in the image name will support crypto. You probably would want the Advanced Security feature set or the Advanced IP Services feature set, both of which do support crypto and do support IPSec tunnels.
HTH
Rick

Cisco 2821 router won't keep config

Hi
I have a cisco 2821 router that i'm trying to load a config on and for some reason it will not stay once i reboot it.
I can get the config on and give it a host name and everything that i need but when i reboot it goes back to
router> as the host name and no config on it.What would be causing this problem as this is my first time seeing
this before and thanks for your help in advance.

Check your config-registry using the "sh version" command. It should be 0x2102 and you can change this using the command "config-registry 0x2102" and a reboot.

Fast EtherChannel between Catalyst 3750 and 2821 Router

Hi Guys
I'm trying to setup a Fast EtherChannel between a cat3750-smi and a 2821 router that consists of only 2 links.
I am following instructions per TAC, but I'm getting an error along the way;
On the cat3750:
interface port-channel 1
no switchport
Command Rejected: Not a convertable port
Can anyone help???
Also... do the IP Addresses for the EtherChannel need to be the same for both port-channels? Or do I assign the switch like 192.168.1.1 and the router 192.168.1.2 ?
Thanks!
Adam

Hi Adam,
The ip address cannot be same but it should belong to same subnet. So one side 192.168.1.1 and other side 192.168.1.2 will work fine.
Its better to convert your layer 2 port as a layer port fist so what you do the port which you want to be port channel go that that interface and convert with "switchport" command
once it is a layer 3 port configure with channel group and automatically layer 3 port channel will be created and you can sssign an ip address then.
Just give a try and update if it works.
Regards,
Ankur

WAAS network module and 2821 router?

What WAE network modules will work in a 2821 router? This 2821 has a dual-T1 Multipoint connection back to our data center and I know that the users will benefit greatly from WAAS, but I'd rather not have to upgrade the router to a 3800 just to install a WAE module

NME-WAE-502 will give you full functionality with the enterprise licence. This is the NME that is the most widely used for WAAS.
NME-WAE-302 is available, but only supports the transport license which give you TCP optimizations only (no application AO support).
NME-WAE-522 is only supported in the 3800 series routers.
Hope that helps,
Dan

Anyconnect Failed to Connect using WEBVPN on IOS Router 2800 Series

Hi All,
Kindly need your help. I was trying to built Remote Access VPN connection on my lab environment. The component is Router 2811 with (c2800nm-advsecurityk9-mz.124-22.T5.bin), Anyconnect Client ( anyconnect-win-3.1.05160-k9.pkg ), Laptop ( Firewall and Antivirus disabled, already register webvpndomain.com into hosts file on Win32/Driver/Etc ).
I was able to connect using anyconnect if I'm initiate connection via web (https://webvpndomain.com) and start tunnel connection SVC. I'm also able to reach my LAN and I get my private IP Address assigned by my vpn pool on the router. The problem is when I'm initiate connection to vpn directly from the computer, I mean I'm not using web (https://webvpndomain.com) and I'm just press "connect" on my anyconnect software that already installed on my Laptop the connection always fail. I get error message : Connection attempt has failed
Here I'm also attach my router configuration, so you can see what I've done or what mistake that I've made on the configuration.
Is anybody in here have experience this problem on deploying Remote Access VPN using webvpn and anyconnect as vpn client ?
I'm really appreciate anybody that get into this discussion
Best Regards,
Nanda

Try using webvpndomain.com/myVPNGW as host

WebVPN on 881 Router and Groups

Hi there,
i have an question and i hope anyone can help me.
Is it possible on an Cisco Router to build WebVPN groups ?
I want build one group for users with grand access rights.
--> Connect with anyconnect or Web Portal and have access to all Servers on 10.0.0.0 Network.
And another group for users with limited access priveleges.
--> Connect with anyconnect or Web Portal and can access only Server 10.0.0.10 Port XXXX and Server 10.0.0.20 on Port XXXX
Info: i have an 881GW Router
thanks alot
kind regards
Jonas Diehl

Hi Jonas,
Yes you can use different permissions for different group of users depending on where your users are located , for e.g locally on the router or on radius server.
If its there on radius server, then you can push down some attributes and map it to use specific policy group or if users are created locally then you can use aaa attribute list.
The following is the document for your reference:-
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6657/prod_white_paper0900aecd8051ac3a.html
Also lets take an example, for local user on router
aaa authentication login list SSL local
aaa authorization network localauthor local
webvpn context SSL
policy group policy_1
policy group ABC
default-group-policy policy_1
aaa authentication list SSL
aaa authorization list localauthor
gateway gateway_1
inservice
aaa attribute list ABC
attribute type user-vpn-group "ABC" mandatory
attribute type webvpn-context "SSL"
username cisco privilege 15 secret 5 $1$A840$hEkdXCQJRuPC3U5O8N3Gd0
username cisco aaa attribute list ABC
User cisco will be binded you use the policy as ABC and context as SSL and if there is no condition user will use the default policy policy_1.
I hope it helps.
Thanks,
Shilpa

Traffic Shaping on Cisco 2821 router

I have two sites and connected with MPLS links of 2MB with Cisco 2821 routers. Now a requirement came that two sites will have additional server ( one each location - for data replication purpose) and 75% of the bandwidth needs to be allocated to data replication servers on each site and rest of 25% bandwidth will be utilize for both sides normal traffic.
Is there any additional modules to be added on each router to isolate the traffic. Please let me know.
Thanks,

To expand on the information that Collin provided . . .
If you really want to cap the bandwidth to a class of traffic, i.e. truly limit replication to 75%, you can add a policer or shaper to a class, similar to what Collin shows.
e.g.
policy-map RestrictAltiris
class Altiris
bandwidth percent 20
shape average 1500000
However, like Collin, since CBWFQ guarantees bandwidth allocations, you rarely need to cap bandwidth if you, for instance, insure your other traffic gets the other 25% (i.e. 100% less 75% for replication).
e.g.
policy-map RestrictAltiris
class Altiris
bandwidth percent 75
(NB: BTW, there are other rules pertaining to bandwidth reservations, but prior examples, both Collin's and mine, should suffice.)
Also BTW, since you mention MPLS, and since MPLS often allows multisite communication, if there are more than just these two sites that can communicate with these two sites across their 2 Mbps links, other considerations apply for dealing with such a situation.
PS:
Although software based QoS should meet your stated requirements, there are optional modules to provide "WAN optimization", see http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/product_data_sheet0900aecd8058218c.html.
PPS:
BTW, when Collin describes:
". . . but when the link gets congested the router will limit the traffic for this host to 20% of the total interface bandwidth, and all the remaining traffic to 80%.", this might be just a bit misleading since when the link is congested individual classes aren't really limited they are instead guaranteed their bandwidths as a minimum, not precisely the same thing. For example with 20% and 80% guarantees, either class could still obtain unused bandwidth from the other class while the link is congested.
[edit]
This being true, for something like what you describe, I would recommend using the least amount of bandwidth guarantee that data replication needs. Assuming your other traffic, on average, doesn't consume more than 25% of the bandwidth, you might find even providing replication only 1% for a bandwidth guarantee works fine. Why you would want to do this, by lowering the bandwidth guarantee for replication, you allow other traffic to burst. Such bursting capability normally improves any kind of transactional or conversational applications and doesn't (usually) unduly delay replication.

Connecting Cisco 2821 Router, Switch, and Cable Modem

Hey everyone,
I am currently in the Cisco Network Academy at my school and just finished CCNA 1. I have a few questions though.
I am purchasing new equipment and that equipment includes:
1-Cisco 2821 2-port Gigabit Router
1-Linksys SE3016 16-Port Gigabit Switch (unmanaged)
1-Cisco WAP4410n Wireless Access Point
1-Motorla SurfBoard Gigabit Cable Modem (no router built in-Just standalone Modem used with Comcast Xfinity High Speed Internet)
1-12U Network Rack (not enclosed)
I am confused on how I will connect the cable modem to the router and the router to the switch and the WAP so that I still have WiFi. Since the router only has 2 Ge Ports, how would I cable this up?
If my assumptions are correct, would I do the following set up?
Take the Cable Modem and run a Straight Thru to Port 1 of the Router.
Connect the Switch Port 1 to Port 2 of the Router using a Straight Thru cable (I believe I will most likely have to Subnet a network, won't I?).
Connect Switch Port 2 to WAP using Straight Thru Cable (so I still have WiFi in my home).
Connect all my computers and other devices to the Switch (this includes several PC's/Laptops, two printers that are ethernet, two TV's that are ethernet, an AppleTV and a Blue Ray Player that are both ethernet, and some Cisco Powerline Network Adapters).
Will that set up work?
Also, how would I configure the router to work with my cable modem AND act as a DHCP Server so that all of my devices get IP Addresses? I have the Cisco Command Guide Book, but it is confusing to me as of now.
Thanks!
Chris

A good start but a few points I would make.
If you set the clock manually, you may find it resets itself after a router reboot. I would look at pointing it at an NTP server:
#ntp server x.x.x.x
#clock timezone GMT (Assuming you are UK based)
Although not required, I would put a description on each of the interfaces as it may help identify them later if you are not physically in front of the Router.
#interface gi0/0
#description WAN
Same for LAN
You have set up your LAN subnet with a /16 subnet mask which is effectively 10.0.0.1 - 10.0.255.254. This is a large subnet allowing over 65k hosts which is not best practice on enterprise networks. It probably won't cause you any issues but I doubt you will have any more than 254 hosts so personally I would use a /24 subnet (255.255.255.0)
The only major thing missing is NAT which needs to be configured on the router to translate the LAN IP addresses from their 10.* private range to the Public IP address on the Gi0/0 WAN Interface.
Firstly you need to define the 'inside' and 'outside' NAT interfaces which is fairly self explanatory:
#interface gi0/0
#ip nat outside
#interface gi0/1
#ip nat inside
Gi0/0 is your outside interface because its facing the Outside world (i.e the internet) and Gi0/1 is your inside interface because its facing Inside your LAN.
Then you need to tell the router which addresses to translate against by first creating an access list:
#ip access-list standard LAN-Addresses
#permit 10.0.0.0 0.0.255.255
Finally you need to tell the router to start translating:
#ip nat inside source list LAN-Addresses interface gi0/0 overload
Oh, I have just noticed that you do not have a 'default route' configured. A router forwards packets by first looking up the destination IP address of the packet (i.e where its going) in it's own routing table. Obviously home routers are not going to have an entry for every Public IP subnet on the internet so they use something called a default route which effectively says 'If I cannot find an entry for this packet in my routing table, use the default route'.
As you are on DHCP and your IP address (and even default gateway) could change on your WAN interface, I would not bother with the next hop address in the default route but rather use the outgoing interface as below:
#ip route 0.0.0.0 0.0.0.0 gi0/0
Hope this helps!

Migrating the configuration 2821 router to 3925

Hi ,
I need help am planning to migrate the configuration from 2821 isr to 3925 , i want to know is there any challenges are there while migrating.

Hi Vasant,
I think there will not be any major challenges in migration just you need to consider the type of card and link you are using on the router. However use the below link that will give you the major techspec difference in ISRG1 & G2 routers.
http://www.cisco.com/c/dam/en/us/products/collateral/routers/1900-series-integrated-services-routers-isr/aag_c45_556315.pdf
Thanks & Regards
sandeep

WebVPN on 2821 Router

Similar Messages

Maybe you are looking for