WLC 5508 7.0.98.0 has vpn client connection issues

Hi
my guest ssid is set to L2 security none and L3 Web policy and authentication local. clients that need to connect to some vpn server (internet) are reporting disconnection issues with the vpn session but not the wireless network. as soon as they get connected via another wireless internet connection the vpn connection gets stable. that makes me thing is in deed the my wireless network the one causing issues.  is there a know issues with the web authentication WLAN and vpn clients?  no firewall in the middle.
Exclusionlist.................................... Disabled
Session Timeout.................................. Infinity
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ xxxxxxxxxxxxxxxx
WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
--More or (q)uit current module or <ctrl-z> to abort
Quality of Service............................... Bronze (background)
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ Disabled
   Accounting.................................... Disabled
   Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Enabled
        ACL............................................. Unconfigured
        Web Authentication server precedence:
        1............................................... local
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   H-REAP Local Switching........................ Disabled
   H-REAP Learn IP Address....................... Enabled
   Client MFP.................................... Optional but inactive (WPA2 not configured)
   Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled

Thanks Scott,
We have two controllers and all the APs (50) are associated with the primary Controller,what is the best path to follow for the upgrade.
we don't have Field recoversy image installed on our controller, do we have to do the FSU upgrade?
(Cisco Controller) >show sysinfo
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.0.98.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... N/A
Firmware Version................................. FPGA 1.3, Env 1.6, USB console                                                        1.27
Build Type....................................... DATA + WPS
System Name...................................... Airespace_01
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
IP Address....................................... 10.0.0.201
Last Reset....................................... Power on reset
System Up Time................................... 9 days 2 hrs 57 mins 21 secs
System Timezone Location......................... (GMT -6:00) Central Time (US and Canada)
Current Boot License Level....................... base
Current Boot License Type........................ Permanent
Next Boot License Level.......................... base
Next Boot License Type........................... Permanent
Configured Country............................... Multiple Countries:US,CN,DE,TW,HK
Is the below Upgrade Path make sense ?
1. Upgrade the Primary controller and reboot- wait till all APs associate with primary controller and download the new image
2. Upgrade the secondary controller and reboot
3. Failover the APs to secondary controller and test
Siddhartha

Similar Messages

  • Mac Lion VPN client connectivity

    We are looking to get VPN client connectivity from Mac Lion laptops to a Cisco ASA.  Windows users work ok, and Mac can connect but they will not resolve internal dns addresses so they will not pass any data. Is there any special configuration needed on the ASA or MAC?

    Hi
    Could you post the log from the client and the router please?

  • Which ports to open in PIX for outgoing Cisco VPN client connections ?

    I have Cisco vpn clients behind the PIX and i want them to connect to a vpn 3005 which i behind another PIX . Can anybody tell me which ports i have to open on both the PIX firewalls ?

    It depends on how you have deployed your VPN Remote Access users.
    By default, if you enable IPSec-Over-TCP or IPSec-over-UDP, then port 10000 is used for both, these methods are Cisco Proprietary and can be changed.
    If you use NAT-T (NAT Traversal), the Standards-based implementation, then it uses UDP-4500).
    either way, the operation of the VPN depends on:
    1) Whether these service have been enable on the VPN Concentrator
    2) Enabling the relevant transport settings on the VPN Client connection Properties.
    Regarding the PIX infront of the VPNC3005, you will need to allow these above ports inbound to your VPNC3005 Public interface.
    Locally, it depends if you filter outbound connections through your PIX. If you don't, then the PIX will allow the connection for the VPN Client attempting to access the remote VPNC3005

  • Mavericks Server VPN client connection won't work

    I have read many of the problems regarding remote clients not being able to connect to Mavericks Server 3.0 via L2TP outside of the network.
    My understanding that Apple has fixed this with 3.02 update.
    Since the update, I tried to setup my first time VPN connection and am having similar problems to the noted prior issues.
    Mavericks Server has DNS, OD, and VPN setup and running with most current update as of 2/4/14.
    My Airport Extreme router is managed via Server App and has VPN ports opened.  Have shutoff Back to My Mac and Find my Mac also on the server.  I have also put in my hostname miniserver."example".com into the DNS on my Fatcow registrar pointing to my public IP address.   "example" obviously being my domain name.
    My Mavericks Macbook Pro has been setup with VPN client/shared secret and the public ip address of my router.  The Macbook will connect to the VPN inside the network, but will not connect outside of the local network.  Have tried setting up my home Mavericks iMac with the same result.
    Have read other discussions regarding copying the old racoon vpn from mountain lion server, but understand that shouldn't be necessary as Apple has allegedly fixed the problem.  Also do not want to have to redo everytime Apple pushes out a Server update.
    First time I have ever setup VPN and seems close, but not quite, to working.
    Thanks.....

    Select the Network tab in AirPort Utility and click Network Options. In the sheet that opens, check the box marked
    Allow incoming IPSec authentication
    if it's not already checked, and save the change.

  • VPN client connect to CISCO 887 VPN Server bat they stop at router!!

    Hi
    my scenario is as follows
    SERVER1 on lan (192.168.5.2/24)
    |
    |
    CISCO-887 (192.168.5.4) with VPN server
    |
    |
    INTERNET
    |
    |
    VPN Cisco client on xp machine
    My connection have public ip address assegned by ISP, after ppp login.
    I've just configured (with Cisco Configuration Professional) the ADSL connection and VPN Server (Easy VPN).
    All the PC on LAN surf internet and remote PC connect to VPN Cisco server via cisco VPN client.
    But all remote PC after connection to Cisco VPN server don't ping SERVER1 in lan and therefore don't see SERVER1 and every other resource in LAN.
    They can ping only router!!!
    They are configured with Cisco VPN client (V5.0.007) with "Enabled Trasparent Tunnelling" and "IPSec over UDP NAT/PAT".
    What is wrong in my attached configuration? (I've alspo tried to bind Virtual-Template1 both to unnambered Dialer0 and to Loopback0 but without luck)
    Peraps ACL problem?
    Building configuration...
    Current configuration : 5019 bytes
    ! Last configuration change at 05:20:37 UTC Tue Apr 24 2012 by adm
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname gate
    boot-start-marker
    boot-end-marker
    no logging buffered
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authentication login ciscocp_vpn_xauth_ml_2 local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    memory-size iomem 10
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-453216506
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-453216506
    revocation-check none
    rsakeypair TP-self-signed-453216506
    crypto pki certificate chain TP-self-signed-453216506
    certificate self-signed 01
            quit
    ip name-server 212.216.112.222
    ip cef
    no ipv6 cef
    password encryption aes
    license udi pid CISCO887VA-K9 sn ********
    username adm privilege 15 secret 5 *****************
    username user1 secret 5 ******************
    controller VDSL 0
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group EXTERNALS
    key 6 *********\*******
    dns 192.168.5.2
    wins 192.168.5.2
    domain domain.local
    pool SDM_POOL_1
    save-password
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group EXTERNALS
       client authentication list ciscocp_vpn_xauth_ml_2
       isakmp authorization list ciscocp_vpn_group_ml_2
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA1
    set isakmp-profile ciscocp-ike-profile-1
    interface Loopback0
    ip address 10.10.10.10 255.255.255.0
    interface Ethernet0
    no ip address
    shutdown
    interface ATM0
    no ip address
    no atm ilmi-keepalive
    interface ATM0.1 point-to-point
    pvc 8/35
      encapsulation aal5snap
      protocol ppp dialer
      dialer pool-member 1
    interface FastEthernet0
    no ip address
    interface FastEthernet1
    no ip address
    interface FastEthernet2
    no ip address
    interface FastEthernet3
    no ip address
    interface Virtual-Template1 type tunnel
    ip unnumbered Dialer0
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface Vlan1
    ip address 192.168.5.4 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat inside
    ip virtual-reassembly in
    interface Dialer0
    ip address negotiated
    ip nat outside
    ip virtual-reassembly in
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname ******@*******.****
    ppp chap password 0 alicenewag
    ppp pap sent-username ******@*******.**** password 0 *********
    ip local pool SDM_POOL_1 192.168.5.20 192.168.5.50
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 600 life 86400 requests 10000
    ip nat inside source list 1 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 192.168.5.0 0.0.0.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 permit ip 192.168.5.0 0.0.0.255 any
    dialer-list 1 protocol ip permit
    line con 0
    line aux 0
    line vty 0 4
    transport input all
    end

    Hello,
    Your pool of VPN addresses is overlapping with the interface vlan1.
    Since proxy-arp is disabled on that interface, it will never work
    2 solutions
    1- Pool uses a different network than 192.168.5
    2- Enable ip proxy-arp on interface vlan1
    Cheers,
    Olivier

  • VPN client connect to CISCO 887 VPN Server but I can't ping Local LAN

    Hi
    my scenario is as follows
    SERVER1 on lan (192.168.1.4)
    |
    |
    CISCO-887 (192.168.1.254)
    |
    |
    INTERNET
    |
    |
    VPN Cisco client on windows 7 machine
    My connection have public ip address assegned by ISP, after ppp login.
    I've just configured (with Cisco Configuration Professional) the ADSL connection and VPN Server (Easy VPN).
    All the PC on LAN surf internet and remote PC connect to VPN Cisco server via cisco VPN client.
    But all remote PC after connection to Cisco VPN server don't ping SERVER1 in lan and therefore don't see SERVER1 and every other resource in LAN. I can't even ping the gateway 192.168.1.254
    I'm using Cisco VPN client (V5.0.07) with "IPSec over UDP NAT/PAT".
    What is wrong in my attached configuration? (I've alspo tried to bind Virtual-Template1 both to unnambered Dialer0 and to Loopback0 but without luck)
    Perhaps ACL problem?
    Building configuration...
    Current configuration : 4921 bytes
    ! Last configuration change at 14:33:06 UTC Sun Jan 26 2014 by NetasTest
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname TestLab
    boot-start-marker
    boot-end-marker
    enable secret 4 5ioUNqNjoCPaFZIVNAyYuHFA2e9v8Ivuc7a7UlyQ3Zw
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authentication login ciscocp_vpn_xauth_ml_2 local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    memory-size iomem 10
    crypto pki trustpoint TP-self-signed-3013130599
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3013130599
    revocation-check none
    rsakeypair TP-self-signed-3013130599
    crypto pki certificate chain TP-self-signed-3013130599
    certificate self-signed 01
    3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
    31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
    69666963 6174652D 33303133 31333035 3939301E 170D3134 30313236 31333333
    35305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
    4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 30313331
    33303539 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
    8100A873 940DE7B9 112D7C1E CEF53553 ED09B479 24721449 DBD6F559 1B9702B7
    9087E94B 50CBB29F 6FE9C3EC A244357F 287E932F 4AB30518 08C2EAC1 1DF0C521
    8D0931F7 6E7F7511 7A66FBF1 A355BB2A 26DAD318 5A5A7B0D A261EE22 1FB70FD1
    C20F1073 BF055A86 D621F905 E96BD966 A4E87C95 8222F1EE C3627B9A B5963DCE
    AE7F0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
    551D2304 18301680 14E37481 4AAFF252 197AC35C A6C1E8E1 E9DF5B35 27301D06
    03551D0E 04160414 E374814A AFF25219 7AC35CA6 C1E8E1E9 DF5B3527 300D0609
    2A864886 F70D0101 05050003 81810082 FEE61317 43C08637 F840D6F8 E8FA11D5
    AA5E49D4 BA720ECB 534D1D6B 1A912547 59FED1B1 2B68296C A28F1CD7 FB697048
    B7BF52B8 08827BC6 20B7EA59 E029D785 2E9E11DB 8EAF8FB4 D821C7F5 1AB39B0D
    B599ECC1 F38B733A 5E46FFA8 F0920CD8 DBD0984F 2A05B7A0 478A1FC5 952B0DCC
    CBB28E7A E91A090D 53DAD1A0 3F66A3
    quit
    no ip domain lookup
    ip cef
    no ipv6 cef
    license udi pid CISCO887VA-K9 sn ***********
    username ******* secret 4 5ioUNqNjoCPaFZIVNAyYuHFA2e9v8Ivuc7a7UlyQ3Zw
    username ******* secret 4 Qf/16YMe96arcCpYI46YRa.3.7HcUGTBeJB3ZyRxMtE
    controller VDSL 0
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group EXTERNALS
    key NetasTest
    dns 8.8.4.4
    pool VPN-Pool
    acl 120
    crypto isakmp profile ciscocp-ike-profile-1
    match identity group EXTERNALS
    client authentication list ciscocp_vpn_xauth_ml_2
    isakmp authorization list ciscocp_vpn_group_ml_2
    client configuration address respond
    virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    mode tunnel
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    mode tunnel
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA1
    set isakmp-profile ciscocp-ike-profile-1
    interface Ethernet0
    no ip address
    shutdown
    interface ATM0
    no ip address
    no atm ilmi-keepalive
    hold-queue 224 in
    pvc 8/35
    pppoe-client dial-pool-number 1
    interface FastEthernet0
    no ip address
    interface FastEthernet1
    no ip address
    interface FastEthernet2
    no ip address
    interface FastEthernet3
    no ip address
    interface Virtual-Template1 type tunnel
    ip address 192.168.2.1 255.255.255.0
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface Vlan1
    ip address 192.168.1.254 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1452
    interface Dialer0
    ip address negotiated
    ip mtu 1452
    ip nat outside
    ip virtual-reassembly in
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname ****
    ppp chap password 0 *********
    ppp pap sent-username ****** password 0 *******
    no cdp enable
    ip local pool VPN-Pool 192.168.2.210 192.168.2.215
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 600 life 86400 requests 10000
    ip nat inside source list 100 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    access-list 100 remark
    access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 100 remark
    access-list 100 permit ip 192.168.1.0 0.0.0.255 any
    access-list 120 remark
    access-list 120 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    line con 0
    exec-timeout 5 30
    password ******
    no modem enable
    line aux 0
    line vty 0 4
    password ******
    transport input all
    end
    Best Regards,

    I've updated ios to c870-advipservicesk9-mz.124-24.T8.bin  and tried to ping from rv320 to 871 and vice versa. Ping stil not working.
    router#sh crypto session detail 
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection     
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation     
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Dialer0
    Uptime: 00:40:37
    Session status: UP-ACTIVE     
    Peer: 93.190.178.205 port 500 fvrf: (none) ivrf: (none)
          Phase1_id: 192.168.1.100
          Desc: (none)
      IKE SA: local 93.190.177.103/500 remote 93.190.178.205/500 Active 
              Capabilities:(none) connid:2001 lifetime:07:19:22
      IPSEC FLOW: permit ip 10.1.1.0/255.255.255.0 10.1.2.0/255.255.255.0 
            Active SAs: 4, origin: dynamic crypto map
            Inbound:  #pkts dec'ed 0 drop 30 life (KB/Sec) 4500544/1162
            Outbound: #pkts enc'ed 5 drop 0 life (KB/Sec) 4500549/1162

  • VPN client connected to VPN but can't ping or access to server

    HI ,
    i need help urgently, had been troubleshooting for a day, but have no ideal what wrong with the config.
    Basically there is 2 set of VPN configured, one is site to site IPSEC VPN and another one is connect via VPN client software coexist in same router.
    This recently we having problem on client can't access or ping to internal server which is 192.168.6.3 from VPN client software.
    VPN client will connect to VPN ip pool as10.20.1.0 to 10.20.1.100
    Software itself shown connected but request time out when ping.
    Below is the config. Some of the command might be extra as when i did some test, but end up didn't work.
    aaa new-model
    aaa authentication login userauthen local
    aaa authorization network adminmap group VPNClient
    aaa authorization network groupauthor local
    aaa authorization network map-singapore local
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key emptyspace address 203.142.83.218 no-xauth
    crypto isakmp keepalive 15 periodic
    crypto isakmp client configuration address-pool local ippool
    crypto isakmp client configuration group map-singapore
    key cisco123
    dns 192.168.6.3
    domain cisco.com
    pool ippool
    acl 102
    crypto isakmp profile VPNclient
       match identity address 27.54.43.210 255.255.255.255
       match identity group vpnclient
       client authentication list userauthen
       client configuration address respond
    crypto ipsec security-association idle-time 86400
    crypto ipsec transform-set REMSET esp-3des esp-md5-hmac
    crypto ipsec transform-set DYNSET esp-aes esp-md5-hmac
    crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10
    set transform-set DYNSET
    set isakmp-profile VPNclient
    reverse-route
    crypto map VPNMAP client authentication list userauthen
    crypto map VPNMAP isakmp authorization list map-singapore
    crypto map VPNMAP client configuration address respond
    crypto map VPNMAP 10 ipsec-isakmp dynamic dynmap
    crypto map VPNMAP 11 ipsec-isakmp
    description VPN to ASA5520
    set peer 203.142.83.218
    set security-association lifetime kilobytes 14608000
    set security-association lifetime seconds 86400
    set transform-set REMSET
    match address 100
    interface GigabitEthernet0/0
    ip address 27.54.43.210 255.255.255.240
    ip nat outside
    no ip virtual-reassembly
    duplex full
    speed 100
    crypto map VPNMAP
    interface GigabitEthernet0/1
    ip address 192.168.6.1 255.255.255.0
    ip nat inside
    no ip virtual-reassembly
    duplex full
    speed 100
    interface GigabitEthernet0/2
    description $ES_LAN$
    no ip address
    shutdown
    duplex auto
    speed auto
    ip local pool ippool 10.20.1.0 10.20.1.100
    ip forward-protocol nd
    ip pim bidir-enable
    no ip http server
    ip http authentication local
    no ip http secure-server
    ip nat inside source list 1 interface GigabitEthernet0/0 overload
    ip nat inside source list 101 interface GigabitEthernet0/0 overload
    ip nat inside source route-map nonat interface GigabitEthernet0/0 overload
    ip nat inside source static 192.168.6.3 27.54.43.212
    ip route 0.0.0.0 0.0.0.0 27.54.43.209
    ip route 192.168.1.0 255.255.255.0 27.54.43.209
    ip route 192.168.151.0 255.255.255.0 192.168.6.151
    ip route 192.168.208.0 255.255.255.0 27.54.43.209
    ip access-list extended RA_SING
    permit ip 192.168.6.0 0.0.0.255 192.168.1.0 0.0.0.255
    permit ip 192.168.6.0 0.0.0.255 10.0.0.0 0.255.255.255
    permit ip 10.0.0.0 0.255.255.255 192.168.6.0 0.0.0.255
    permit ip 192.168.6.0 0.0.0.255 192.168.208.0 0.0.0.255
    permit ip 10.20.1.1 0.0.0.100 192.168.6.0 0.0.0.255
    permit ip 10.20.1.0 0.0.0.255 10.0.0.0 0.255.255.255
    deny   ip any any log
    access-list 1 remark Local Network
    access-list 1 permit 192.168.6.0 0.0.0.255
    access-list 1 permit 192.168.102.0 0.0.0.255
    access-list 1 permit 192.168.151.0 0.0.0.255
    access-list 2 remark VPNClient-range
    access-list 2 permit 10.0.0.0 0.255.255.255
    access-list 10 permit 192.168.6.0 0.0.0.255
    access-list 10 permit 192.168.102.0 0.0.0.255
    access-list 10 permit 192.168.151.0 0.0.0.255
    access-list 10 permit 10.0.0.0 0.255.255.255
    access-list 100 permit ip 192.168.6.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 100 permit ip 192.168.102.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 100 permit ip 192.168.6.0 0.0.0.255 192.168.208.0 0.0.0.255
    access-list 100 permit ip host 192.168.6.7 host 192.168.208.48
    access-list 101 deny   ip 192.168.6.0 0.0.0.255 10.0.0.0 0.255.255.255
    access-list 101 permit ip 10.0.0.0 0.255.255.255 any
    access-list 101 permit ip 192.168.6.0 0.0.0.255 any
    access-list 102 permit ip 10.0.0.0 0.255.255.255 any
    access-list 120 deny   ip any any log
    access-list 120 deny   ip 192.168.6.0 0.0.0.255 192.168.1.0 0.0.0.255 log
    access-list 120 deny   ip 192.168.6.0 0.0.0.255 10.0.0.0 0.255.255.255
    access-list 120 deny   ip 192.168.6.0 0.0.0.255 192.168.208.0 0.0.0.255
    no cdp run
    route-map nonat permit 10
    match ip address 120
    control-plane
    alias isakmp-profile sh crypto isakmp sa
    alias exec ipsec sh crypto ipsec sa
    banner motd ^CC^C

    I did not try to ping 4.2.2.2. I just know I can not ping comcasts dns servers. I have updated the firmware on the router and it did not work. The computer was able to access the internet until about a week ago, I don't understand what could have changed that I would now need a static DNS.

  • Remote access VPN clients connected to Internet from VPN

    Greetings,
    I need to let remote VPN clients to connect to Internet from the same ASA VPN server
    " client connects to ASA through VPN tunnel from outside interface then access Internet from the same ASA from outside interface again
    thanks

    you'll need to configure 'same-security-traffic permit intra-interface' on the ASA .
    Also, need to setup the corresponding nat statements for your clients pool range.
    i.e.
    global (outside) 1 interface
    nat (outside) 1 access-list anyconnectacl
    where anyconnectacl is the pool for your clients:
    access-list anyconnectacl permit ip 172.16.1.0 255.255.255.0 any

  • IOS VPN will not respond to Cisco VPN Client connections.

    Hi all,
    I am about to set my routers on fire here.
    I have two 2921 ISRs both with Security licenses on separate leased lines. I have configured one to accept VPN connections from our Cisco VPN Client remote workers.
    I have followed the set up process I used on another site with an 1841/Sec router and the same clients and I have also checked against the config given in the latest IOS15 EasyVPN guide.
    With all debugs active, all I see is
    038062: Dec  8 14:03:04.519: ISAKMP (0): received packet from x.y.z.z dport 500 sport 60225 Global (N) NEW SA
    038063: Dec  8 14:03:04.519: ISAKMP: Created a peer struct for x.y.z.z, peer port 60225
    038064: Dec  8 14:03:04.519: ISAKMP: New peer created peer = 0x3972090C peer_handle = 0x8001D881
    038065: Dec  8 14:03:04.523: ISAKMP: Locking peer struct 0x3972090C, refcount 1 for crypto_isakmp_process_block
    038066: Dec  8 14:03:04.523: ISAKMP:(0):Setting client config settings 3E156D70
    038067: Dec  8 14:03:10.027: ISAKMP (0): received packet from x.y.z.z dport 500 sport 60225 Global (R) MM_NO_STATE
    Below is the abridged config.
    System image file is "flash0:c2900-universalk9-mz.SPA.154-1.T1.bin"
    aaa new-model
    aaa authentication login default local
    aaa authentication login VPNAUTH local
    aaa authorization exec default local
    aaa authorization network VPN local
    aaa session-id common
    crypto isakmp policy 10
     encr aes
     authentication pre-share
     group 14
    crypto isakmp client configuration group VPN
     key ****-****-****-****
     dns 192.168.177.207 192.168.177.3
     domain xxx.local
     pool VPNADDRESSES
     acl REVERSEROUTE
    crypto ipsec transform-set HASH esp-aes esp-sha-hmac
     mode tunnel
    crypto ipsec profile IPSECPROFILE
     set transform-set HASH
    crypto dynamic-map VPN 1
     set transform-set HASH
     reverse-route
    crypto map VPN client authentication list VPNAUTH
    crypto map VPN isakmp authorization list VPN
    crypto map VPN client configuration address respond
    crypto map VPN 65535 ipsec-isakmp dynamic VPN
    ip local pool VPNADDRESSES 172.16.198.16 172.16.198.31
    ip access-list extended REVERSEROUTE
     permit ip 192.168.0.0 0.0.255.255 any
     permit ip 10.0.0.0 0.0.0.255 any
    ip access-list extended FIREWALL
     2 permit udp any host a.b.c.d eq non500-isakmp
     3 permit udp any host a.b.c.d eq isakmp
     4 permit ahp any host a.b.c.d
     5 permit esp any host a.b.c.d
    If anyone can see anything wrong, I would be so pleased and it would save the destruction of an ostensibly innocent router.
    Thanks,
    Paul

    > I actually love you. Thank you so much.
    Sorry, I'm married ... ;-)
    > Im not using a virtual template. Can I get away without the Crypto Map if I use one...? All my tunnels are VTIs
    oh yes, I could have seen that ...
    crypto isakmp profile VPN-RA
    match identity group VPN
    client authentication list VPNAUTH
    isakmp authorization list VPN
    client configuration address respond
    virtual-template 1
    interface Virtual-Template1 type tunnel
    description Tunnel fuer Cisco VPN-Client
    ip unnumbered GigabitEthernet0/0
    ip virtual-reassembly in
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile IPSECPROFILE
    Your isakmp-config and ipsec profile stays the same.

  • Inside lan is not reachable even after cisco Remote access vpn client connected to router C1841 But can ping to the router inside interface and loop back interface but not able to ping even to the directly connected inside device..??

    Hii frnds,
    here is the configuration in my router C1841..for the cisco ipsec remote access vpn..i was able to establish a vpn session properly...but there after i can only reach up to the inside interfaces of the router..but not to the lan devices...
    Below is the out put from the router
    r1#sh run
    Building configuration...
    Current configuration : 3488 bytes
    ! Last configuration change at 20:07:20 UTC Tue Apr 23 2013 by ramana
    ! NVRAM config last updated at 11:53:16 UTC Sun Apr 21 2013 by ramana
    version 15.1
    service config
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname r1
    boot-start-marker
    boot-end-marker
    enable secret 5 $1$6RzF$L6.zOaswedwOESNpkY0Gb.
    aaa new-model
    aaa authentication login local-console local
    aaa authentication login userauth local
    aaa authorization network groupauth local
    aaa session-id common
    dot11 syslog
    ip source-route
    ip cef
    ip domain name r1.com
    multilink bundle-name authenticated
    license udi pid CISCO1841 sn FHK145171DM
    username ramana privilege 15 secret 5 $1$UE7J$u9nuCPGaAasL/k7CxtNMj.
    username giet privilege 15 secret 5 $1$esE5$FD9vbBwTgHERdRSRod7oD.
    redundancy
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group ra-vpn
    key xxxxxx
    domain r1.com
    pool vpn-pool
    acl 150
    save-password
      include-local-lan
    max-users 10
    crypto ipsec transform-set my-vpn esp-3des esp-md5-hmac
    crypto dynamic-map RA 1
    set transform-set my-vpn
    reverse-route
    crypto map ra-vpn client authentication list userauth
    crypto map ra-vpn isakmp authorization list groupauth
    crypto map ra-vpn client configuration address respond
    crypto map ra-vpn 1 ipsec-isakmp dynamic RA
    interface Loopback0
    ip address 10.2.2.2 255.255.255.255
    interface FastEthernet0/0
    bandwidth 8000000
    ip address 117.239.xx.xx 255.255.255.240
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map ra-vpn
    interface FastEthernet0/1
    description $ES_LAN$
    ip address 192.168.10.252 255.255.255.0 secondary
    ip address 10.10.10.1 255.255.252.0 secondary
    ip address 172.16.0.1 255.255.252.0 secondary
    ip address 10.10.7.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    ip local pool vpn-pool 172.18.1.1   172.18.1.100
    ip forward-protocol nd
    ip http server
    ip http authentication local
    no ip http secure-server
    ip dns server
    ip nat pool INTERNETPOOL 117.239.xx.xx 117.239.xx.xx netmask 255.255.255.240
    ip nat inside source list 100 pool INTERNETPOOL overload
    ip route 0.0.0.0 0.0.0.0 117.239.xx.xx
    access-list 100 permit ip 10.10.7.0 0.0.0.255 any
    access-list 100 permit ip 10.10.10.0 0.0.1.255 any
    access-list 100 permit ip 172.16.0.0 0.0.3.255 any
    access-list 100 permit ip 192.168.10.0 0.0.0.255 any
    access-list 150 permit ip 10.10.7.0 0.0.0.255 172.18.0.0 0.0.255.255
    access-list 150 permit ip host 10.2.2.2 172.18.1.0 0.0.0.255
    access-list 150 permit ip 192.168.10.0 0.0.0.255 172.18.1.0 0.0.0.255
    control-plane
    line con 0
    login authentication local-console
    line aux 0
    line vty 0 4
    login authentication local-console
    transport input telnet ssh
    scheduler allocate 20000 1000
    end
    r1>sh ip route
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, + - replicated route
    Gateway of last resort is 117.239.xx.xx to network 0.0.0.0
    S*    0.0.0.0/0 [1/0] via 117.239.xx.xx
          10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
    C        10.2.2.2/32 is directly connected, Loopback0
    C        10.10.7.0/24 is directly connected, FastEthernet0/1
    L        10.10.7.1/32 is directly connected, FastEthernet0/1
    C        10.10.8.0/22 is directly connected, FastEthernet0/1
    L        10.10.10.1/32 is directly connected, FastEthernet0/1
          117.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C        117.239.xx.xx/28 is directly connected, FastEthernet0/0
    L        117.239.xx.xx/32 is directly connected, FastEthernet0/0
          172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        172.16.0.0/22 is directly connected, FastEthernet0/1
    L        172.16.0.1/32 is directly connected, FastEthernet0/1
          172.18.0.0/32 is subnetted, 1 subnets
    S        172.18.1.39 [1/0] via 49.206.59.86, FastEthernet0/0
          192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
    C        192.168.10.0/24 is directly connected, FastEthernet0/1
    L        192.168.10.252/32 is directly connected, FastEthernet0/1
    r1#sh crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    117.239.xx.xx   49.206.59.86    QM_IDLE           1043 ACTIVE
    IPv6 Crypto ISAKMP SA
    r1 #sh crypto ipsec sa
    interface: FastEthernet0/0
        Crypto map tag: giet-vpn, local addr 117.239.xx.xx
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
       remote ident (addr/mask/prot/port): (172.18.1.39/255.255.255.255/0/0)
       current_peer 49.206.59.86 port 50083
         PERMIT, flags={}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
        #pkts decaps: 2, #pkts decrypt: 2, #pkts verify: 2
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: 117.239.xx.xx, remote crypto endpt.: 49.206.xx.xx
         path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
         current outbound spi: 0x550E70F9(1427009785)
         PFS (Y/N): N, DH group: none
         inbound esp sas:
          spi: 0x5668C75(90606709)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            conn id: 2089, flow_id: FPGA:89, sibling_flags 80000046, crypto map: ra-vpn
            sa timing: remaining key lifetime (k/sec): (4550169/3437)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0x550E70F9(1427009785)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            conn id: 2090, flow_id: FPGA:90, sibling_flags 80000046, crypto map: ra-vpn
            sa timing: remaining key lifetime (k/sec): (4550170/3437)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE
         outbound ah sas:
         outbound pcp sas:

    hi  Maximilian Schojohann..
    First i would like to Thank you for showing  interest in solving my issue...After some research i found that desabling the " IP CEF" will solve the issue...when i desable i was able to communicate success fully with the router lan..But when i desable " IP CEF "  Router cpu processer goes to 99% and hangs...
    In the output of " sh process cpu" it shows 65% of utilization from "IP INPUT"
    so plz give me an alternate solution ....thanks in advance....

  • No Internet access after cisco vpn client connection

    Hi Experts,
    Kindly check below config.the problem is  vpn is connected but no internet access
    on computer after connecting vpn
    ASA Version 8.0(2)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    names
    interface Ethernet0/0
     nameif outside
     security-level 0
     ip address 192.168.10.10 255.255.255.0
    interface Ethernet0/1
     nameif inside
     security-level 100
     ip address 192.168.14.12 255.255.255.0
    interface Ethernet0/2
     shutdown
     no nameif
     no security-level
     no ip address
    interface Ethernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     shutdown
     no nameif
     no security-level
     no ip address
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    access-list dubai_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0
    access-list INSIDE_nat0_outbound extended permit ip any 192.168.14.240 255.255.2
    55.240
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    ip local pool testpool 192.168.14.240-192.168.14.250
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list INSIDE_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 192.168.10.12 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.14.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set setFirstSet esp-3des esp-md5-hmac
    crypto dynamic-map dyn1 1 set transform-set setFirstSet
    crypto dynamic-map dyn1 1 set reverse-route
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto map mymap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 1
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 43200
    crypto isakmp policy 65535
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    username testuser password IqY6lTColo8VIF24 encrypted
    username khans password X5bLOVudYKsK1JS/ encrypted privilege 15
    tunnel-group mphone type remote-access
    tunnel-group mphone general-attributes
     address-pool testpool
    tunnel-group mphone ipsec-attributes
     pre-shared-key *
    prompt hostname context
    Cryptochecksum:059363cdf78583da4e3324e8dfcefbf0
    : end
    ciscoasa#

    Hi Harish,
    Please check the o/ps below and route print in attached file
    Latest ASA Config
    ASA Version 8.0(2)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    names
    interface Ethernet0/0
     nameif outside
     security-level 0
     ip address 192.168.10.10 255.255.255.0
    interface Ethernet0/1
     nameif inside
     security-level 100
     ip address 192.168.14.12 255.255.255.0
    interface Ethernet0/2
     shutdown
     no nameif
     no security-level
     no ip address
    interface Ethernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     shutdown
     no nameif
     no security-level
     no ip address
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    access-list dubai_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0
    access-list INSIDE_nat0_outbound extended permit ip any 192.168.14.0 255.255.255
    .0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip local pool testpool 192.168.15.240-192.168.15.250
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 192.168.10.12 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.14.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set setFirstSet esp-3des esp-md5-hmac
    crypto dynamic-map dyn1 1 set transform-set setFirstSet
    crypto dynamic-map dyn1 1 set reverse-route
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto map mymap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 1
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 43200
    crypto isakmp policy 65535
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    no crypto isakmp nat-traversal
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    group-policy mphone internal
    group-policy mphone attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dubai_splitTunnelAcl
    username testuser password IqY6lTColo8VIF24 encrypted privilege 15
    username testuser attributes
     vpn-group-policy mphone
    username khans password X5bLOVudYKsK1JS/ encrypted privilege 15
    username khans attributes
     vpn-group-policy mphone
    tunnel-group mphone type remote-access
    tunnel-group mphone general-attributes
     address-pool testpool
    tunnel-group mphone ipsec-attributes
     pre-shared-key *
    prompt hostname context
    Cryptochecksum:12308d7ff6c6df3d71181248e8d38ba8
    : end
    ciscoasa#
    Route Print after vpn connection 
    C:\>route print
    ===========================================================================
    Interface List
    0x1 ........................... MS TCP Loopback interface
    0x40003 ...00 24 01 a2 e6 f1 ...... D-Link DFE-520TX PCI Fast Ethernet Adapter -
     Packet Scheduler Miniport
    0x250004 ...00 05 9a 3c 78 00 ...... Cisco Systems VPN Adapter - Packet Schedule
    r Miniport
    ===========================================================================
    ===========================================================================
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0     192.168.10.1  192.168.10.211       20
            127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
         192.168.10.0    255.255.255.0   192.168.10.211  192.168.10.211       20
       192.168.10.211  255.255.255.255        127.0.0.1       127.0.0.1       20
       192.168.10.255  255.255.255.255   192.168.10.211  192.168.10.211       20
         192.168.14.0    255.255.255.0     192.168.15.1  192.168.15.240       1
         192.168.15.0    255.255.255.0   192.168.15.240  192.168.15.240       20
       192.168.15.240  255.255.255.255        127.0.0.1       127.0.0.1       20
       192.168.15.255  255.255.255.255   192.168.15.240  192.168.15.240       20
        213.42.233.97  255.255.255.255     192.168.10.1  192.168.10.211       1
            224.0.0.0        240.0.0.0   192.168.10.211  192.168.10.211       20
            224.0.0.0        240.0.0.0   192.168.15.240  192.168.15.240       20
      255.255.255.255  255.255.255.255   192.168.10.211  192.168.10.211       1
      255.255.255.255  255.255.255.255   192.168.15.240  192.168.15.240       1
    Default Gateway:      192.168.10.1
    ===========================================================================
    Persistent Routes:
      None
    C:\>
    C:\>ipconfig /all
    Windows IP Configuration
            Host Name . . . . . . . . . . . . : asu
            Primary Dns Suffix  . . . . . . . :
            Node Type . . . . . . . . . . . . : Unknown
            IP Routing Enabled. . . . . . . . : No
            WINS Proxy Enabled. . . . . . . . : No
    Ethernet adapter Local Area Connection 7:
            Connection-specific DNS Suffix  . :
            Description . . . . . . . . . . . : D-Link DFE-520TX PCI Fast Ethernet A
    dapter
            Physical Address. . . . . . . . . : 00-24-01-A2-E6-F1
            Dhcp Enabled. . . . . . . . . . . : No
            IP Address. . . . . . . . . . . . : 192.168.10.211
            Subnet Mask . . . . . . . . . . . : 255.255.255.0
            Default Gateway . . . . . . . . . : 192.168.10.1
            DNS Servers . . . . . . . . . . . : 213.42.20.20
                                                195.229.241.222
    Ethernet adapter Local Area Connection 8:
            Connection-specific DNS Suffix  . :
            Description . . . . . . . . . . . : Cisco Systems VPN Adapter
            Physical Address. . . . . . . . . : 00-05-9A-3C-78-00
            Dhcp Enabled. . . . . . . . . . . : No
            IP Address. . . . . . . . . . . . : 192.168.15.240
            Subnet Mask . . . . . . . . . . . : 255.255.255.0
            Default Gateway . . . . . . . . . :

  • Tiger VPN (PPTP) connection issues

    Hello everyone.
    I'm having major issues trying to connect to office VPN from home; hoping someone can point me in the right direction. (And my profound apologies in advance for the long post -- just trying make sure to include enough detail to debug whatever might be happening)
    At the office we have a 3Com OfficeConnect VPN Firewall sitting in front of a Microsoft 2003 Exchange server. (3Com product page for this VPN box is http://www.3com.com/products/en_US/detail.jsp?tab=features&sku=3CR870-95&pathtyp e=purchase). Home connection is a Linksys WRT54GL wireless router in front of a broadband cable modem. PPTP pass-through is enabled in the router config.
    At home I have a WinXP-SP2 laptop and my G4 Powerbook (OS 10.4.7) sitting side-by-side. From the XP laptop, I can get into the VPN using XP's built-in client without any problems. The DNS lookup and authentication steps take about 2-3 seconds combined. Once the connection is established, both external sites (cnn.com) and internal sites (intranet.companyname.local) load in a browser window without any appreciable delay. I can also access Windows shared drives on the internal network without problems, including large (10's of MB or more) file copies to/from the XP laptop's HD.
    On the Powerbook, using Tiger's built-in VPN client, I can connect OK (though the authentication step takes a bit longer, about 4-5 seconds), but after that, almost nothing works. I can ping the internal DNS server, but after a few pings with reasonable delays (~15 millisecond range), the round-trip times suddenly jump to handfuls of seconds. In the browser, trying to load an internal webpage (http://intranet.companyname.local) times out before anything shows up on screen. In Finder, using Go>Connect to Server... very slowly establishes the connection (~10-15 seconds or longer), and sometimes opens a Finder window... but then invariably times out. I have never once had the connection remain stable enough to transfer so much as a single file from the shared volume onto the Powerbook's Desktop before it times out and disconnects.
    On the XP machine, relevant(?) VPN config settings are:
    require secured password
    require data encryption (disconnect if none)
    PPTP VPN
    LCP extensions enabled
    software compression enabled
    multi-link negotiation for single link connections DISABLED
    server type = PPP
    transports = TCP/IP
    authentication = MS CHAP
    encryption = MPPE 128
    compression = none
    PPP multilink framing = off
    and, once the VPN connection is established, parameters are (from "ipcofig /all"):
    Windows IP Configuration
    Host Name . . . . . . . . . . . . : (companyname)-hj2
    Primary Dns Suffix . . . . . . . : (companyname).local
    Node Type . . . . . . . . . . . . : Unknown
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : (companyname).local
    Ethernet adapter Wireless Network Connection:
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2915ABG Network Connection
    Physical Address. . . . . . . . . : XX-XX-XX-XX-XX-XX
    Dhcp Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . : 192.168.1.104
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 192.168.1.1
    DHCP Server . . . . . . . . . . . : 192.168.1.1
    DNS Servers . . . . . . . . . . . : 192.168.1.1
    PPP adapter (ConnectionName):
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
    Physical Address. . . . . . . . . : XX-XX-XX-XX-XX-XX
    Dhcp Enabled. . . . . . . . . . . : No
    IP Address. . . . . . . . . . . . : 172.16.0.70
    Subnet Mask . . . . . . . . . . . : 255.255.255.255
    Default Gateway . . . . . . . . . : 172.16.0.70
    DNS Servers . . . . . . . . . . . : 172.16.0.11
    finally, results of "ping -n 10 (InternalServer)":
    Pinging (InternalServer).(companyname).local [172.16.0.5] with 32 bytes of data:
    Reply from 172.16.0.5: bytes=32 time=4ms TTL=128
    Reply from 172.16.0.5: bytes=32 time=10ms TTL=128
    Reply from 172.16.0.5: bytes=32 time=10ms TTL=128
    Ping statistics for 172.16.0.5:
    Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 4ms, Maximum = 10ms, Average = 9ms
    On the Powerbook, I have a VPN (PPTP) connection set up with "Send all traffic over VPN connection" unchecked. In the Network panel of System Preferences, I have tried manually adding (and removing) "local, (companyname).local" in the Search Domains line, and manually adding (and removing) the IPs of our internal DNS servers (172.16.0.5, 172.16.0.11) under the TCP/IP tab. Proxies are turned off in all cases.
    With those settings, the relevant(?) parts of running "ifconfig" from a Terminal window after starting the VPN are as follows:
    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
    inet 127.0.0.1 netmask 0xff000000
    en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    inet6 fe80::XXX:XXXX:XXXX:XXXX%en1 prefixlen 64 scopeid 0x5
    inet 192.168.1.100 netmask 0xffffff00 broadcast 192.168.1.255
    ether XX:XX:XX:XX:XX:XX
    media: autoselect status: active
    supported media: autoselect
    fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
    lladdr XX:XX:XX:XX:XX:XX:XX:XX
    media: autoselect <full-duplex> status: inactive
    supported media: autoselect <full-duplex>
    ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1444
    inet 172.16.0.69 --> 172.16.0.11 netmask 0xffff0000
    The associated connection log from Internet Connect is:
    Tue Jul 18 08:50:57 2006 : PPTP connecting to server 'vpn.(companyname).com' (XXX.XXX.XXX.XXX)...
    Tue Jul 18 08:50:57 2006 : PPTP connection established.
    Tue Jul 18 08:50:58 2006 : using link 0
    Tue Jul 18 08:50:58 2006 : Using interface ppp0
    Tue Jul 18 08:50:58 2006 : Connect: ppp0 <--> socket[34:17]
    Tue Jul 18 08:50:58 2006 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xb851f701> <pcomp> <accomp>]
    Tue Jul 18 08:50:58 2006 : rcvd [LCP ConfReq id=0x1 <mru 1492> <auth chap MS> <magic 0x80697000>]
    Tue Jul 18 08:50:58 2006 : lcp_reqci: returning CONFACK.
    Tue Jul 18 08:50:58 2006 : sent [LCP ConfAck id=0x1 <mru 1492> <auth chap MS> <magic 0x80697000>]
    Tue Jul 18 08:50:58 2006 : rcvd [LCP ConfRej id=0x1 <asyncmap 0x0> <pcomp> <accomp>]
    Tue Jul 18 08:50:58 2006 : sent [LCP ConfReq id=0x2 <magic 0xb851f701>]
    Tue Jul 18 08:50:58 2006 : rcvd [LCP ConfAck id=0x2 <magic 0xb851f701>]
    Tue Jul 18 08:50:58 2006 : sent [LCP EchoReq id=0x0 magic=0xb851f701]
    Tue Jul 18 08:50:58 2006 : rcvd [CHAP Challenge id=0x1 <4f0656add65818c2>, name = "Guest"]
    Tue Jul 18 08:50:58 2006 : sent [CHAP Response id=0x1 <0000000000000000000000000000000000000000000000004c86e5ccf08b95431034ef14706021 d358dc21b96a59157301>, name = "(UserName)"]
    Tue Jul 18 08:50:58 2006 : rcvd [LCP EchoRep id=0x0 magic=0x80697000]
    Tue Jul 18 08:50:58 2006 : rcvd [CHAP Success id=0x1 "Authentication succeeded, welcome!"]
    Tue Jul 18 08:50:58 2006 : CHAP authentication succeeded: Authentication succeeded, welcome!
    Tue Jul 18 08:50:58 2006 : Disabling 40-bit MPPE; MS-CHAP LM not supported
    Tue Jul 18 08:50:58 2006 : sent [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
    Tue Jul 18 08:50:58 2006 : rcvd [IPCP ConfReq id=0x1 <addr 172.16.0.11> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
    Tue Jul 18 08:50:58 2006 : sent [IPCP TermAck id=0x1]
    Tue Jul 18 08:50:58 2006 : rcvd [CCP ConfReq id=0x1 <mppe +H +M +S +L -D -C>]
    Tue Jul 18 08:50:58 2006 : sent [CCP ConfNak id=0x1 <mppe +H -M +S -L -D -C>]
    Tue Jul 18 08:50:58 2006 : rcvd [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
    Tue Jul 18 08:50:58 2006 : rcvd [CCP ConfReq id=0x2 <mppe +H -M +S -L -D -C>]
    Tue Jul 18 08:50:58 2006 : sent [CCP ConfAck id=0x2 <mppe +H -M +S -L -D -C>]
    Tue Jul 18 08:50:58 2006 : MPPE 128-bit stateless compression enabled
    Tue Jul 18 08:50:58 2006 : sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>]
    Tue Jul 18 08:50:58 2006 : sent [IPV6CP ConfReq id=0x1 <addr fe80::020a:95ff:fea5:564c>]
    Tue Jul 18 08:50:58 2006 : sent [ACSCP] 01 01 00 10 01 06 00 00 00 01 02 06 00 00 00 01
    Tue Jul 18 08:50:58 2006 : rcvd [LCP ProtRej id=0x1 80 57 01 01 00 0e 01 0a 02 0a 95 ff fe a5 56 4c]
    Tue Jul 18 08:50:58 2006 : rcvd [LCP ProtRej id=0x2 82 35 01 01 00 10 01 06 00 00 00 01 02 06 00 00 00 01]
    Tue Jul 18 08:50:58 2006 : rcvd [IPCP ConfRej id=0x1 <ms-dns3 0.0.0.0>]
    Tue Jul 18 08:50:58 2006 : sent [IPCP ConfReq id=0x2 <addr 0.0.0.0> <ms-dns1 0.0.0.0>]
    Tue Jul 18 08:50:58 2006 : rcvd [IPCP ConfNak id=0x2 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:50:58 2006 : sent [IPCP ConfReq id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:50:58 2006 : rcvd [IPCP ConfAck id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:01 2006 : sent [IPCP ConfReq id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:01 2006 : rcvd [IPCP ConfAck id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:04 2006 : sent [IPCP ConfReq id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:04 2006 : rcvd [IPCP ConfAck id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:07 2006 : sent [IPCP ConfReq id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:07 2006 : rcvd [IPCP ConfAck id=0x3 <addr 172.16.0.69> <ms-dns1 172.16.0.11>]
    Tue Jul 18 08:51:08 2006 : rcvd [IPCP ConfReq id=0x1 <addr 172.16.0.11> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
    Tue Jul 18 08:51:08 2006 : ipcp: returning Configure-REJ
    Tue Jul 18 08:51:08 2006 : sent [IPCP ConfRej id=0x1 <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
    Tue Jul 18 08:51:08 2006 : rcvd [IPCP ConfReq id=0x2 <addr 172.16.0.11>]
    Tue Jul 18 08:51:08 2006 : ipcp: returning Configure-ACK
    Tue Jul 18 08:51:08 2006 : sent [IPCP ConfAck id=0x2 <addr 172.16.0.11>]
    Tue Jul 18 08:51:08 2006 : ipcp: up
    Tue Jul 18 08:51:08 2006 : local IP address 172.16.0.69
    Tue Jul 18 08:51:08 2006 : remote IP address 172.16.0.11
    Tue Jul 18 08:51:08 2006 : primary DNS address 172.16.0.11
    The problem is that despite this apparently successful negotiation, the VPN connection doesn't really work. If I type "intranet" into the browser URL bar, it doesn't pick it up as "intranet.companyname.local" and instead treats this as a search query, which it passes to google... which times out. If I type "intranet.companyname.local" into the URL bar instead, it appears to do the DNS lookup correctly... but then times out again.
    Ping times look like this at first:
    PING (InternalServer).(companyname).local (172.16.0.5): 56 data bytes
    64 bytes from 172.16.0.5: icmp_seq=0 ttl=128 time=16.605 ms
    64 bytes from 172.16.0.5: icmp_seq=1 ttl=128 time=15.920 ms
    64 bytes from 172.16.0.5: icmp_seq=2 ttl=128 time=16.154 ms
    ^C
    --- (InternalServer).(companyname).local ping statistics ---
    3 packets transmitted, 3 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 15.920/16.226/16.605/0.284 ms
    ... but then if I try it again two seconds later:
    PING (InternalServer).(companyname).local (172.16.0.5): 56 data bytes
    64 bytes from 172.16.0.5: icmp_seq=0 ttl=128 time=727.144 ms
    64 bytes from 172.16.0.5: icmp_seq=1 ttl=128 time=1727.030 ms
    64 bytes from 172.16.0.5: icmp_seq=2 ttl=128 time=2727.260 ms
    64 bytes from 172.16.0.5: icmp_seq=3 ttl=128 time=3726.747 ms
    64 bytes from 172.16.0.5: icmp_seq=4 ttl=128 time=5723.986 ms
    64 bytes from 172.16.0.5: icmp_seq=5 ttl=128 time=5719.810 ms
    64 bytes from 172.16.0.5: icmp_seq=6 ttl=128 time=6720.334 ms
    64 bytes from 172.16.0.5: icmp_seq=7 ttl=128 time=6719.848 ms
    ^C
    --- (InternalServer).(companyname).local ping statistics ---
    15 packets transmitted, 8 packets received, 46% packet loss
    round-trip min/avg/max/stddev = 727.144/4224.020/6720.334/2176.543 ms
    OK, enough for now. Can anyone spot what I might be doing wrong, and/or suggest something to try to remedy this? If there is any additional logging/debug info that would be useful, please ask and I will track it down.
    Thanks very much in advance!!! /HJ

    Problem not entirely solved, but mostly working now. It turns out the issue was with the 3Com OfficeConnect VPN box. It was causing all sorts of headaches and had to be manually power cycled at least once a week, so we ditched it and got a Linux-based Firewall/VPN appliance (http://www.ingate.com/ingate_vpn.php).
    Now I can connect and mount Windows drives via SMB (both the command line and the Finder's "Connect to Server" approach seem to work). Performance still exhibits annoying lags at random times, and occasionally the VPN connection disconnects for no good reason, but at least I can get at my files from home. The other issues -- such as being able to resolve "xxx.yyy.local" addresses in the browser by making sure I hit the internal DNS server before any external ones -- all seem to be network configuration issues on my end.
    In short, my guess is that the 3Com box was causing issues with some low-level timing parameters or other related settings in how the VPN connection was being established. I was just starting to teach myself about ARP tables, NTLMv2 authentication, and the like when we replaced it with the new firewall.
    Hope this helps.
    /Heywood

  • Cisco VPN Client connects, but doesn't....

    Have an issue where the workstation connects to the remote router using Cisco VPN Client successfully, but cannot receive traffic, but can...... I can see the connection with sh cry isa sa, and can see the packets encrypt/decrypt via sh cry ipse sa, as well as see the encrypt/decrypt in the VPN Client status, these numbers match up with the number of pings that are sent across the tunne.  I can also see the ougoing and incoming packets with wireshark on the Cisco adapter on the workstation that is connected over the tunnel, icmp to:x.x.x.37 from:x.x.x.100, icmp from:x.x.x.100 to:x.x.x.37. Even with wireshark seeing the traffic, the requests time out. Any ideas?

    Matthew,
    If you are seeing packets encrypted/decrypted on both sites, but not getting an actual response, it sounds like tough one.
    Have you tried disabling the client's firewall?
    Also, you to discard a possible problem with the VPN virtual adapter have you tried to uninstall/reinstall the VPN Client?
    Sorry, the suggetions I'm giving you are very basic but it definetely sounds kind of a weird problem...
    Let me know how it goes.
    Raga

  • Cisco VPN Client - Connects but no shares

    My Windows IT folks configured Cisco VPN Client 4.9.0.1 (0100) on both the XP and Mac side of my MacBook Pro.
    Authentication works fine from both sides but none of the shared drives or folders mount on the Mac side. They do mount via Windows Explorer from the XP side. The configurations are exactly the same.
    From the Mac side using Terminal I am able to ping the various shared drives on the company server. How can I get them to mount.

    Hi KW and Welcome to Apple Discussions...
    You will receive more "views" to your post if you reposted in the Leopard forum... go here: http://discussions.apple.com/category.jspa?categoryID=235
    Carolyn

  • Site to site VPN re-connection issue

    Hi I done site -to -site VPN between two UC 560 and I am able to make call too. Both site I am using DDNS FQDN. Now I am facing these problems,
    1. When ever any of the site gone down , it is taking around 45 minute to get reconnect the VPN. 
    2. With in 2 minute Dialer interface is getting WAN  IP address from service provider and it is updating with Dyndns also. But while checking crypto session details from my local UC I can see the peer address is not changing or showing none.
    please help me to overcome this issue
    I tested by restarting ROUTER-A  UC560
    Please find the status of remote site:
    ROUTER-B#sh crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    2.50.37.13      86.99.72.10     MM_NO_STATE       2004 ACTIVE (deleted)
    ROUTER-B#sh crypto isa saIPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    ROUTER-A#sh crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    ROUTER-B#sho crypto session detail
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Dialer0
    Session status: UP-NO-IKE
    Peer: 86.99.72.10 port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.10.0/255.255.255.0 192.168.50.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 12452 drop 0 life (KB/Sec) 4477633/1050
            Outbound: #pkts enc'ed 15625 drop 228 life (KB/Sec) 4477628/1050
    ROUTER-A# sho crypto session det
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Virtual-Access2
    Session status: DOWN
    Peer:  port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.50.0/255.255.255.0 192.168.10.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
    Interface: Dialer0
    Session status: DOWN
    Peer:  port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.50.0/255.255.255.0 192.168.10.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 23 life (KB/Sec) 0/0
    **** Here I can see the peer IP is 86.99.72.10, but address had been changed to  92.98.211.242 in ROUTER-A
    Please see the debug crypto isakpm
    ROUTER-A#debug crypto isakmp
    Crypto ISAKMP debugging is on
    ROUTER-A#terminal monitor
    000103: Aug  6 18:40:48.083: ISAKMP:(0): SA request profile is (NULL)
    000104: Aug  6 18:40:48.083: ISAKMP: Created a peer struct for , peer port 500
    000105: Aug  6 18:40:48.083: ISAKMP: New peer created peer = 0x86682AAC peer_handle = 0x80000031
    000106: Aug  6 18:40:48.083: ISAKMP: Locking peer struct 0x86682AAC, refcount 1 for isakmp_initiator
    000107: Aug  6 18:40:48.083: ISAKMP: local port 500, remote port 500
    000108: Aug  6 18:40:48.083: ISAKMP: set new node 0 to QM_IDLE
    000109: Aug  6 18:40:48.083: ISAKMP:(0):insert sa successfully sa = 8B4EBE04
    000110: Aug  6 18:40:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000111: Aug  6 18:40:48.083: ISAKMP:(0):No pre-shared key with !
    000112: Aug  6 18:40:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000113: Aug  6 18:40:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000114: Aug  6 18:40:48.083: ISAKMP: Unlocking peer struct 0x86682AAC for isadb_unlock_peer_delete_sa(), count 0
    000115: Aug  6 18:40:48.083: ISAKMP: Deleting peer node by peer_reap for : 86682AAC
    000116: Aug  6 18:40:48.083: ISAKMP:(0):purging SA., sa=8B4EBE04, delme=8B4EBE04
    000117: Aug  6 18:40:48.083: ISAKMP:(0):purging node 2113438140
    000118: Aug  6 18:40:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000119: Aug  6 18:40:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000120: Aug  6 18:41:18.083: ISAKMP:(0): SA request profile is (NULL)
    000121: Aug  6 18:41:18.083: ISAKMP: Created a peer struct for , peer port 500
    000122: Aug  6 18:41:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000032
    000123: Aug  6 18:41:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000124: Aug  6 18:41:18.083: ISAKMP: local port 500, remote port 500
    000125: Aug  6 18:41:18.083: ISAKMP: set new node 0 to QM_IDLE
    000126: Aug  6 18:41:18.083: ISAKMP:(0):insert sa successfully sa = 86685DFC
    000127: Aug  6 18:41:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000128: Aug  6 18:41:18.083: ISAKMP:(0):No pre-shared key with !
    000129: Aug  6 18:41:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000130: Aug  6 18:41:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000131: Aug  6 18:41:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb_unlock_peer_delete_sa(), count 0
    000132: Aug  6 18:41:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000133: Aug  6 18:41:18.083: ISAKMP:(0):purging SA., sa=86685DFC, delme=86685DFC
    000134: Aug  6 18:41:18.083: ISAKMP:(0):purging node 379490091
    000135: Aug  6 18:41:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000136: Aug  6 18:41:18.083: ISAKMP: Error while processing KMI message 0, error 2.
    000137: Aug  6 18:42:48.083: ISAKMP:(0): SA request profile is (NULL)
    000138: Aug  6 18:42:48.083: ISAKMP: Created a peer struct for , peer port 500
    000139: Aug  6 18:42:48.083: ISAKMP: New peer created peer = 0x86691200 peer_handle = 0x80000033
    000140: Aug  6 18:42:48.083: ISAKMP: Locking peer struct 0x86691200, refcount 1for isakmp_initiator
    000141: Aug  6 18:42:48.083: ISAKMP: local port 500, remote port 500
    000142: Aug  6 18:42:48.083: ISAKMP: set new node 0 to QM_IDLE
    000143: Aug  6 18:42:48.083: ISAKMP:(0):insert sa successfully sa = 866E1758
    000144: Aug  6 18:42:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000145: Aug  6 18:42:48.083: ISAKMP:(0):No pre-shared key with !
    000146: Aug  6 18:42:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000147: Aug  6 18:42:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000148: Aug  6 18:42:48.083: ISAKMP: Unlocking peer struct 0x86691200 for isadb_unlock_peer_delete_sa(), count 0
    000149: Aug  6 18:42:48.083: ISAKMP: Deleting peer node by peer_reap for : 86691200
    000150: Aug  6 18:42:48.083: ISAKMP:(0):purging SA., sa=866E1758, delme=866E1758
    000151: Aug  6 18:42:48.083: ISAKMP:(0):purging node -309783810
    000152: Aug  6 18:42:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000153: Aug  6 18:42:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000154: Aug  6 18:43:18.083: ISAKMP:(0): SA request profile is (NULL)
    000155: Aug  6 18:43:18.083: ISAKMP: Created a peer struct for , peer port 500
    000156: Aug  6 18:43:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000034
    000157: Aug  6 18:43:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000158: Aug  6 18:43:18.083: ISAKMP: local port 500, remote port 500
    000159: Aug  6 18:43:18.083: ISAKMP: set new node 0 to QM_IDLE
    000160: Aug  6 18:43:18.083: ISAKMP:(0):insert sa successfully sa = 8B4AB780
    000161: Aug  6 18:43:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000162: Aug  6 18:43:18.083: ISAKMP:(0):No pre-shared key with !
    000163: Aug  6 18:43:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000164: Aug  6 18:43:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000165: Aug  6 18:43:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb _unlock_peer_delete_sa(), count 0
    000166: Aug  6 18:43:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000167: Aug  6 18:43:18.083: ISAKMP:(0):purging SA., sa=8B4AB780, delme=8B4AB78 0
    000168: Aug  6 18:43:18.083: ISAKMP:(0):purging node 461611358
    000169: Aug  6 18:43:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000170: Aug  6 18:43:18.083: ISAKMP: Error while processing KMI message 0, erro r 2.
    000171: Aug  6 18:44:48.083: ISAKMP:(0): SA request profile is (NULL)
    000172: Aug  6 18:44:48.083: ISAKMP: Created a peer struct for , peer port 500
    000173: Aug  6 18:44:48.083: ISAKMP: New peer created peer = 0x8B4A25C8 peer_handle = 0x80000035
    000174: Aug  6 18:44:48.083: ISAKMP: Locking peer struct 0x8B4A25C8, refcount 1 for isakmp_initiator
    000175: Aug  6 18:44:48.083: ISAKMP: local port 500, remote port 500
    000176: Aug  6 18:44:48.083: ISAKMP: set new node 0 to QM_IDLE
    000177: Aug  6 18:44:48.083: ISAKMP:(0):insert sa successfully sa = 8B4EC7E8
    000178: Aug  6 18:44:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000179: Aug  6 18:44:48.083: ISAKMP:(0):No pre-shared key with !
    000180: Aug  6 18:44:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000181: Aug  6 18:44:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000182: Aug  6 18:44:48.083: ISAKMP: Unlocking peer struct 0x8B4A25C8 for isadb_unlock_peer_delete_sa(), count 0
    000183: Aug  6 18:44:48.083: ISAKMP: Deleting peer node by peer_reap for : 8B4A25C8
    000184: Aug  6 18:44:48.083: ISAKMP:(0):purging SA., sa=8B4EC7E8, delme=8B4EC7E8
    000185: Aug  6 18:44:48.083: ISAKMP:(0):purging node -1902909277
    000186: Aug  6 18:44:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000187: Aug  6 18:44:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000188: Aug  6 18:45:18.083: ISAKMP:(0): SA request profile is (NULL)
    000189: Aug  6 18:45:18.083: ISAKMP: Created a peer struct for , peer port 500
    000190: Aug  6 18:45:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000036
    000191: Aug  6 18:45:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000192: Aug  6 18:45:18.083: ISAKMP: local port 500, remote port 500
    000193: Aug  6 18:45:18.083: ISAKMP: set new node 0 to QM_IDLE
    000194: Aug  6 18:45:18.083: ISAKMP:(0):insert sa successfully sa = 86685DFC
    000195: Aug  6 18:45:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000196: Aug  6 18:45:18.083: ISAKMP:(0):No pre-shared key with !
    000197: Aug  6 18:45:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000198: Aug  6 18:45:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000199: Aug  6 18:45:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb_unlock_peer_delete_sa(), count 0
    000200: Aug  6 18:45:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000201: Aug  6 18:45:18.083: ISAKMP:(0):purging SA., sa=86685DFC, delme=86685DFC
    000202: Aug  6 18:45:18.083: ISAKMP:(0):purging node 1093064733
    000203: Aug  6 18:45:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000204: Aug  6 18:45:18.083: ISAKMP: Error while processing KMI message 0, error 2.
    000205: Aug  6 18:46:48.083: ISAKMP:(0): SA request profile is (NULL)
    000206: Aug  6 18:46:48.083: ISAKMP: Created a peer struct for , peer port 500
    000207: Aug  6 18:46:48.083: ISAKMP: New peer created peer = 0x86682BE0 peer_handle = 0x80000037
    000208: Aug  6 18:46:48.083: ISAKMP: Locking peer struct 0x86682BE0, refcount 1 for isakmp_initiator
    000209: Aug  6 18:46:48.083: ISAKMP: local port 500, remote port 500
    000210: Aug  6 18:46:48.083: ISAKMP: set new node 0 to QM_IDLE
    000211: Aug  6 18:46:48.083: ISAKMP:(0):insert sa successfully sa = 866E1758
    000212: Aug  6 18:46:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000213: Aug  6 18:46:48.083: ISAKMP:(0):No pre-shared key with !
    000214: Aug  6 18:46:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000215: Aug  6 18:46:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000216: Aug  6 18:46:48.083: ISAKMP: Unlocking peer struct 0x86682BE0 for isadb_unlock_peer_delete_sa(), count 0
    000217: Aug  6 18:46:48.083: ISAKMP: Deleting peer node by peer_reap for : 86682BE0
    000218: Aug  6 18:46:48.083: ISAKMP:(0):purging SA., sa=866E1758, delme=866E1758
    000219: Aug  6 18:46:48.083: ISAKMP:(0):purging node -1521272284
    000220: Aug  6 18:46:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000221: Aug  6 18:46:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000222: Aug  6 18:47:03.131: ISAKMP (0): received packet from 2.50.37.13 dport 500 sport 500 Global (N) NEW SA
    000223: Aug  6 18:47:03.131: ISAKMP: Created a peer struct for 2.50.37.13, peer port 500
    000224: Aug  6 18:47:03.131: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000038
    000225: Aug  6 18:47:03.131: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for crypto_isakmp_process_block
    000226: Aug  6 18:47:03.131: ISAKMP: local port 500, remote port 500
    000227: Aug  6 18:47:03.131: ISAKMP:(0):insert sa successfully sa = 8B4C1924
    000228: Aug  6 18:47:03.131: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000229: Aug  6 18:47:03.131: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1
    000230: Aug  6 18:47:03.131: ISAKMP:(0): processing SA payload. message ID = 0
    000231: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000232: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    000233: Aug  6 18:47:03.131: ISAKMP (0): vendor ID is NAT-T RFC 3947
    000234: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000235: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    000236: Aug  6 18:47:03.131: ISAKMP (0): vendor ID is NAT-T v7
    000237: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000238: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    000239: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID is NAT-T v3
    000240: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000241: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    000242: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID is NAT-T v2
    000243: Aug  6 18:47:03.131: ISAKMP:(0):found peer pre-shared key matching 2.50.37.13
    000244: Aug  6 18:47:03.131: ISAKMP:(0): local preshared key found
    000245: Aug  6 18:47:03.131: ISAKMP : Scanning profiles for xauth ... sdm-ike-profile-1
    000246: Aug  6 18:47:03.131: ISAKMP:(0): Authentication by xauth preshared
    000247: Aug  6 18:47:03.131: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    000248: Aug  6 18:47:03.131: ISAKMP:      encryption 3DES-CBC
    000249: Aug  6 18:47:03.131: ISAKMP:      hash SHA
    000250: Aug  6 18:47:03.131: ISAKMP:      default group 2
    000251: Aug  6 18:47:03.131: ISAKMP:      auth pre-share
    000252: Aug  6 18:47:03.131: ISAKMP:      life type in seconds
    000253: Aug  6 18:47:03.131: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    000254: Aug  6 18:47:03.135: ISAKMP:(0):atts are acceptable. Next payload is 0
    000255: Aug  6 18:47:03.135: ISAKMP:(0):Acceptable atts:actual life: 1800
    000256: Aug  6 18:47:03.135: ISAKMP:(0):Acceptable atts:life: 0
    000257: Aug  6 18:47:03.135: ISAKMP:(0):Fill atts in sa vpi_length:4
    000258: Aug  6 18:47:03.135: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    000259: Aug  6 18:47:03.135: ISAKMP:(0):Returning Actual lifetime: 1800
    000260: Aug  6 18:47:03.135: ISAKMP:(0)::Started lifetime timer: 1800.
    000261: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000262: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    000263: Aug  6 18:47:03.135: ISAKMP (0): vendor ID is NAT-T RFC 3947
    000264: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000265: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    000266: Aug  6 18:47:03.135: ISAKMP (0): vendor ID is NAT-T v7
    000267: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000268: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    000269: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID is NAT-T v3
    000270: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000271: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    000272: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID is NAT-T v2
    000273: Aug  6 18:47:03.135: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000274: Aug  6 18:47:03.135: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1
    000275: Aug  6 18:47:03.135: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    000276: Aug  6 18:47:03.135: ISAKMP:(0): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_SA_SETUP
    000277: Aug  6 18:47:03.135: ISAKMP:(0):Sending an IKE IPv4 Packet.
    000278: Aug  6 18:47:03.135: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000279: Aug  6 18:47:03.135: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2
    000280: Aug  6 18:47:03.191: ISAKMP (0): received packet from 2.50.37.13 dport 500 sport 500 Global (R) MM_SA_SETUP
    000281: Aug  6 18:47:03.191: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000282: Aug  6 18:47:03.191: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3
    000283: Aug  6 18:47:03.191: ISAKMP:(0): processing KE payload. message ID = 0
    000284: Aug  6 18:47:03.199: ISAKMP:(0): processing NONCE payload. message ID = 0
    000285: Aug  6 18:47:03.203: ISAKMP:(0):found peer pre-shared key matching 2.50.37.13
    000286: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000287: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID is DPD
    000288: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000289: Aug  6 18:47:03.203: ISAKMP:(2001): speaking to another IOS box!
    000290: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000291: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID seems Unity/DPD but major 223 mismatch
    000292: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID is XAUTH
    000293: Aug  6 18:47:03.203: ISAKMP:received payload type 20
    000294: Aug  6 18:47:03.203: ISAKMP (2001): His hash no match - this node outside NAT
    000295: Aug  6 18:47:03.203: ISAKMP:received payload type 20
    000296: Aug  6 18:47:03.203: ISAKMP (2001): No NAT Found for self or peer
    000297: Aug  6 18:47:03.203: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000298: Aug  6 18:47:03.203: ISAKMP:(2001):Old State = IKE_R_MM3  New State = IKE_R_MM3
    000299: Aug  6 18:47:03.203: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000300: Aug  6 18:47:03.203: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000301: Aug  6 18:47:03.203: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000302: Aug  6 18:47:03.203: ISAKMP:(2001):Old State = IKE_R_MM3  New State = IKE_R_MM4
    000303: Aug  6 18:47:03.295: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) MM_KEY_EXCH
    000304: Aug  6 18:47:03.295: ISAKMP:(2001):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000305: Aug  6 18:47:03.295: ISAKMP:(2001):Old State = IKE_R_MM4  New State = IKE_R_MM5
    000306: Aug  6 18:47:03.295: ISAKMP:(2001): processing ID payload. message ID = 0
    000307: Aug  6 18:47:03.295: ISAKMP (2001): ID payload
            next-payload : 8
            type         : 1
            address      : 2.50.37.13
            protocol     : 17
            port         : 500
            length       : 12
    000308: Aug  6 18:47:03.295: ISAKMP:(0):: peer matches *none* of the profiles
    000309: Aug  6 18:47:03.295: ISAKMP:(2001): processing HASH payload. message ID = 0
    000310: Aug  6 18:47:03.295: ISAKMP:(2001): processing NOTIFY INITIAL_CONTACT protocol 1
            spi 0, message ID = 0, sa = 0x8B4C1924
    000311: Aug  6 18:47:03.295: ISAKMP:(2001):SA authentication status:
            authenticated
    000312: Aug  6 18:47:03.295: ISAKMP:(2001):SA has been authenticated with 2.50.37.13
    000313: Aug  6 18:47:03.295: ISAKMP:(2001):SA authentication status:
            authenticated
    000314: Aug  6 18:47:03.295: ISAKMP:(2001): Process initial contact,
    bring down existing phase 1 and 2 SA's with local 92.98.211.242 remote 2.50.37.13 remote port 500
    000315: Aug  6 18:47:03.295: ISAKMP: Trying to insert a peer 92.98.211.242/2.50.37.13/500/,  and inserted successfully 8668106C.
    000316: Aug  6 18:47:03.295: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000317: Aug  6 18:47:03.295: ISAKMP:(2001):Old State = IKE_R_MM5  New State = IKE_R_MM5
    000318: Aug  6 18:47:03.295: ISAKMP:(2001):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    000319: Aug  6 18:47:03.295: ISAKMP (2001): ID payload
            next-payload : 8
            type         : 1
            address      : 92.98.211.242
            protocol     : 17
            port         : 500
            length       : 12
    000320: Aug  6 18:47:03.295: ISAKMP:(2001):Total payload length: 12
    000321: Aug  6 18:47:03.295: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000322: Aug  6 18:47:03.295: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000323: Aug  6 18:47:03.295: ISAKMP:(2001):Returning Actual lifetime: 1800
    000324: Aug  6 18:47:03.299: ISAKMP: set new node -1235582904 to QM_IDLE
    000325: Aug  6 18:47:03.299: ISAKMP:(2001):Sending NOTIFY RESPONDER_LIFETIME protocol 1
            spi 2291695856, message ID = 3059384392
    000326: Aug  6 18:47:03.299: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000327: Aug  6 18:47:03.299: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000328: Aug  6 18:47:03.299: ISAKMP:(2001):purging node -1235582904
    000329: Aug  6 18:47:03.299: ISAKMP: Sending phase 1 responder lifetime 1800
    000330: Aug  6 18:47:03.299: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000331: Aug  6 18:47:03.299: ISAKMP:(2001):Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE
    000332: Aug  6 18:47:03.299: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    000333: Aug  6 18:47:03.299: ISAKMP:(2001):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    000334: Aug  6 18:47:03.307: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) QM_IDLE
    000335: Aug  6 18:47:03.307: ISAKMP: set new node -687536412 to QM_IDLE
    000336: Aug  6 18:47:03.307: ISAKMP:(2001): processing HASH payload. message ID = 3607430884
    000337: Aug  6 18:47:03.307: ISAKMP:(2001): processing SA payload. message ID = 3607430884
    000338: Aug  6 18:47:03.307: ISAKMP:(2001):Checking IPSec proposal 1
    000339: Aug  6 18:47:03.307: ISAKMP: transform 1, ESP_3DES
    000340: Aug  6 18:47:03.307: ISAKMP:   attributes in transform:
    000341: Aug  6 18:47:03.307: ISAKMP:      encaps is 1 (Tunnel)
    000342: Aug  6 18:47:03.307: ISAKMP:      SA life type in seconds
    000343: Aug  6 18:47:03.307: ISAKMP:      SA life duration (basic) of 3600
    000344: Aug  6 18:47:03.307: ISAKMP:      SA life type in kilobytes
    000345: Aug  6 18:47:03.307: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    000346: Aug  6 18:47:03.307: ISAKMP:      authenticator is HMAC-SHA
    000347: Aug  6 18:47:03.307: ISAKMP:(2001):atts are acceptable.
    000348: Aug  6 18:47:03.307: ISAKMP:(2001): processing NONCE payload. message ID = 3607430884
    000349: Aug  6 18:47:03.311: ISAKMP:(2001): processing ID payload. message ID = 3607430884
    000350: Aug  6 18:47:03.311: ISAKMP:(2001): processing ID payload. message ID = 3607430884
    000351: Aug  6 18:47:03.311: ISAKMP:(2001):QM Responder gets spi
    000352: Aug  6 18:47:03.311: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    000353: Aug  6 18:47:03.311: ISAKMP:(2001):Old State = IKE_QM_READY  New State = IKE_QM_SPI_STARVE
    000354: Aug  6 18:47:03.311: ISAKMP:(2001): Creating IPSec SAs
    000355: Aug  6 18:47:03.311:         inbound SA from 2.50.37.13 to 92.98.211.242 (f/i)  0/ 0
            (proxy 192.168.10.0 to 192.168.50.0)
    000356: Aug  6 18:47:03.311:         has spi 0x4C5A127C and conn_id 0
    000357: Aug  6 18:47:03.311:         lifetime of 3600 seconds
    000358: Aug  6 18:47:03.311:         lifetime of 4608000 kilobytes
    000359: Aug  6 18:47:03.311:         outbound SA from 92.98.211.242 to 2.50.37.13 (f/i) 0/0
            (proxy 192.168.50.0 to 192.168.10.0)
    000360: Aug  6 18:47:03.311:         has spi  0x1E83EC91 and conn_id 0
    000361: Aug  6 18:47:03.311:         lifetime of 3600 seconds
    000362: Aug  6 18:47:03.311:         lifetime of 4608000 kilobytes
    000363: Aug  6 18:47:03.311: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) QM_IDLE
    000364: Aug  6 18:47:03.311: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000365: Aug  6 18:47:03.311: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI
    000366: Aug  6 18:47:03.311: ISAKMP:(2001):Old State = IKE_QM_SPI_STARVE  New State = IKE_QM_R_QM2
    000367: Aug  6 18:47:03.323: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) QM_IDLE
    000368: Aug  6 18:47:03.323: ISAKMP:(2001):deleting node -687536412 error FALSE reason "QM done (await)"
    000369: Aug  6 18:47:03.323: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    000370: Aug  6 18:47:03.323: ISAKMP:(2001):Old State = IKE_QM_R_QM2  New State = IKE_QM_PHASE2_COMPLETE
    000371: Aug  6 18:47:53.323: ISAKMP:(2001):purging node -687536412
    ROUTER-A# sho crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    92.98.211.242   2.50.37.13      QM_IDLE           2001 ACTIVE
    RUNNING CONFIGURATION OF ROUTER-A
    Building configuration...
    Current configuration : 29089 bytes
    ! Last configuration change at 21:31:11 PST Tue Aug 7 2012 by administrator
    version 15.1
    parser config cache interface
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    service internal
    service compress-config
    service sequence-numbers
    hostname xxxxxxxxxxXX
    boot-start-marker
    boot-end-marker
    enable secret 4 LcV6aBcc/53FoCJjXQMd7rBUDEpeevrK8V5jQVoJEhU
    aaa new-model
    aaa authentication login default local
    aaa authentication login Foxtrot_sdm_easyvpn_xauth_ml_1 local
    aaa authorization network Foxtrot_sdm_easyvpn_group_ml_1 local
    aaa session-id common
    clock timezone ZP4 4 0
    clock summer-time PST recurring
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-4070447007
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4070447007
    revocation-check none
    rsakeypair TP-self-signed-4070447007
    crypto pki certificate chain TP-self-signed-4070447007
    certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 34303730 34343730 3037301E 170D3132 30373331 30353139
      30375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 30373034
      34373030 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100BBA6 F2C9A163 B7EAB25D 6C538A5B 29832F58 6B95D2C0 1FBE0E72 BD4E9585
      6230CAD1 8DA4E337 5A11332C 36EAFF86 02D8C977 6CD2AA50 D76FB97F 52AE73AD
      E777194B 011C95EB E2A588B4 3A7D618E F1D03E3F EF1A60FB 26372B63 9395002D
      38126CC5 EA79E23C 40E0F331 76E7731E D03E2CE8 F1A0B5E9 B83AA780 D566A679
      599F0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 14C8BC47 90602FB0 18A8821A 85A3444F 874E2292 27301D06
      03551D0E 04160414 C8BC4790 602FB018 A8821A85 A3444F87 4E229227 300D0609
      2A864886 F70D0101 05050003 8181001B D0EA74FE 7EDD03FE 68733D87 6434D20B
      80481807 DD4A488E FFEFA631 245F396F 5CADF523 1438A70B CA113994 9798483D
      F59221EA 09EDB8FC 6D1DBBAE FE7FE4B9 E79F064F E930F347 B1CAD19B 01F5989A
      8BCFDB1D 906163A4 C467E809 E988B610 FE613177 A815DFB0 97839F92 4A682E8F
      43F08787 E08CBE70 E98DEBE7 BCD8B8
                quit
    dot11 syslog
    ip source-route
    ip cef
    ip dhcp relay information trust-all
    ip dhcp excluded-address 10.1.1.1 10.1.1.9
    ip dhcp excluded-address 10.1.1.241 10.1.1.255
    ip dhcp excluded-address 192.168.50.1 192.168.50.9
    ip dhcp excluded-address 192.168.50.241 192.168.50.255
    ip dhcp pool phone
    network 10.1.1.0 255.255.255.0
    default-router 10.1.1.1
    option 150 ip 10.1.1.1
    ip dhcp pool data
    import all
    network 192.168.50.0 255.255.255.0
    default-router 192.168.50.1
    ip inspect WAAS flush-timeout 10
    ip inspect name SDM_LOW dns
    ip inspect name SDM_LOW ftp
    ip inspect name SDM_LOW h323
    ip inspect name SDM_LOW https
    ip inspect name SDM_LOW icmp
    ip inspect name SDM_LOW imap
    ip inspect name SDM_LOW pop3
    ip inspect name SDM_LOW netshow
    ip inspect name SDM_LOW rcmd
    ip inspect name SDM_LOW realaudio
    ip inspect name SDM_LOW rtsp
    ip inspect name SDM_LOW esmtp
    ip inspect name SDM_LOW sqlnet
    ip inspect name SDM_LOW streamworks
    ip inspect name SDM_LOW tftp
    ip inspect name SDM_LOW tcp router-traffic
    ip inspect name SDM_LOW udp router-traffic
    ip inspect name SDM_LOW vdolive
    ip ddns update method sdm_ddns1
    HTTP
      add http://xxxxxxxs:[email protected]/nic/update?system=dyndns&[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
      remove http://xxxxxxx:[email protected]/nic/update?system=dyndns&[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
    interval maximum 2 0 0 0
    interval minimum 1 0 0 0
    no ipv6 cef
    multilink bundle-name authenticated
    stcapp ccm-group 1
    stcapp
    trunk group ALL_FXO
    max-retry 5
    voice-class cause-code 1
    hunt-scheme longest-idle
    voice call send-alert
    voice rtp send-recv
    voice service voip
    allow-connections h323 to h323
    allow-connections h323 to sip
    allow-connections sip to h323
    allow-connections sip to sip
    no supplementary-service h450.2
    no supplementary-service h450.3
    supplementary-service h450.12
    sip
      no update-callerid
    voice class codec 1
    codec preference 1 g711ulaw
    codec preference 2 g729r8
    voice class h323 1
      call start slow
    voice class cause-code 1
    no-circuit
    voice register global
    mode cme
    source-address 10.1.1.1 port 5060
    load 9971 sip9971.9-2-2
    load 9951 sip9951.9-2-2
    load 8961 sip8961.9-2-2
    voice translation-rule 1000
    rule 1 /.*/ //
    voice translation-rule 1112
    rule 1 /^9/ //
    voice translation-rule 1113
    rule 1 /^82\(...\)/ /\1/
    voice translation-rule 1114
    rule 1 /\(^...$\)/ /82\1/
    voice translation-rule 2002
    rule 1 /^6/ //
    voice translation-rule 2222
    rule 1 /^91900......./ //
    rule 2 /^91976......./ //
    voice translation-profile CALLER_ID_TRANSLATION_PROFILE
    translate calling 1111
    voice translation-profile CallBlocking
    translate called 2222
    voice translation-profile OUTGOING_TRANSLATION_PROFILE
    translate called 1112
    voice translation-profile XFER_TO_VM_PROFILE
    translate redirect-called 2002
    voice translation-profile multisiteInbound
    translate called 1113
    voice translation-profile multisiteOutbound
    translate calling 1114
    voice translation-profile nondialable
    translate called 1000
    voice-card 0
    dspfarm
    dsp services dspfarm
    fax interface-type fax-mail
    license udi pid UC560-FXO-K9 sn FHK1445F43M
    archive
    log config
      logging enable
      logging size 600
      hidekeys
    username administrator privilege 15 secret 4 LcV6aBcc/53FoCJjXQMd7rBUDEpeevrK8V5jQVoJEhU
    username pingerID password 7 06505D771B185F
    ip tftp source-interface Vlan90
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    lifetime 1800
    crypto isakmp key xxxxxxx address 0.0.0.0 0.0.0.0
    crypto isakmp client configuration group EZVPN_GROUP_1
    key xxxxxxx
    dns 213.42.20.20
    pool SDM_POOL_1
    save-password
    max-users 20
    crypto isakmp profile sdm-ike-profile-1
       match identity group EZVPN_GROUP_1
       client authentication list Foxtrot_sdm_easyvpn_xauth_ml_1
       isakmp authorization list Foxtrot_sdm_easyvpn_group_ml_1
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile SDM_Profile1
    set transform-set ESP-3DES-SHA
    set isakmp-profile sdm-ike-profile-1
    crypto map multisite 1 ipsec-isakmp
    description XXXXXXX
    set peer xxxxxxxxxx.dyndns.biz dynamic
    set transform-set ESP-3DES-SHA
    match address 105
    qos pre-classify
    interface GigabitEthernet0/0
    description $ETH-WAN$
    no ip address
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    pppoe enable group global
    pppoe-client dial-pool-number 1
    interface Integrated-Service-Engine0/0
    description Interface used to manage integrated application modulecue is initialized with default IMAP group
    ip unnumbered Vlan90
    ip nat inside
    ip virtual-reassembly in
    service-module ip address 10.1.10.1 255.255.255.252
    service-module ip default-gateway 10.1.10.2
    interface GigabitEthernet0/1/0
    switchport mode trunk
    switchport voice vlan 100
    no ip address
    macro description cisco-switch
    interface GigabitEthernet0/1/1
    switchport voice vlan 100
    no ip address
    macro description cisco-phone
    spanning-tree portfast
    interface GigabitEthernet0/1/2
    no ip address
    macro description cisco-desktop
    spanning-tree portfast
    interface GigabitEthernet0/1/3
    description Interface used to communicate with integrated service module
    switchport access vlan 90
    no ip address
    service-module ip address 10.1.10.1 255.255.255.252
    service-module ip default-gateway 10.1.10.2
    interface Virtual-Template1 type tunnel
    ip unnumbered Vlan1
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile SDM_Profile1
    interface Vlan1
    description $FW_INSIDE$
    ip address 192.168.50.1 255.255.255.0
    ip access-group 101 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    h323-gateway voip bind srcaddr 192.168.50.1
    interface Vlan90
    description $FW_INSIDE$
    ip address 10.1.10.2 255.255.255.252
    ip access-group 103 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    interface Vlan100
    description $FW_INSIDE$
    ip address 10.1.1.1 255.255.255.0
    ip access-group 102 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    interface Dialer0
    description $FW_OUTSIDE$
    mtu 1492
    ip ddns update hostname xxxxxxxxxx.dyndns.biz
    ip ddns update sdm_ddns1
    ip address negotiated
    ip access-group 104 in
    ip mtu 1452
    ip nat outside
    ip inspect SDM_LOW out
    ip virtual-reassembly in
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname CCCCCC
    ppp chap password 7 071739545611015445
    ppp pap sent-username CCCCC password 7 122356324SDFDBDB
    ppp ipcp dns request
    ppp ipcp route default
    crypto map multisite
    ip local pool SDM_POOL_1 192.168.50.150 192.168.50.160
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip http path flash:/gui
    ip dns server
    ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip route 10.1.10.1 255.255.255.255 Vlan90
    access-list 100 remark auto generated by SDM firewall configuration
    access-list 100 remark SDM_ACL Category=1
    access-list 100 permit ip 192.168.10.0 0.0.0.255 any
    access-list 100 permit ip host 255.255.255.255 any
    access-list 100 permit ip 127.0.0.0 0.255.255.255 any
    access-list 100 permit ip any any
    access-list 101 remark auto generated by SDM firewall configuration##NO_ACES_5##
    access-list 101 remark SDM_ACL Category=1
    access-list 101 permit udp any host 192.168.50.1 eq non500-isakmp
    access-list 101 permit udp any host 192.168.50.1 eq isakmp
    access-list 101 permit esp any host 192.168.50.1
    access-list 101 permit ahp any host 192.168.50.1
    access-list 101 permit ip 192.168.10.0 0.0.0.255 any
    access-list 101 permit ip any any
    access-list 101 permit ip 10.1.10.0 0.0.0.3 any
    access-list 101 permit ip 10.1.1.0 0.0.0.255 any
    access-list 101 permit ip host 255.255.255.255 any
    access-list 101 permit ip 127.0.0.0 0.255.255.255 any
    access-list 102 remark auto generated by SDM firewall configuration##NO_ACES_7##
    access-list 102 remark SDM_ACL Category=1
    access-list 102 permit udp any host 10.1.1.1 eq non500-isakmp
    access-list 102 permit udp any host 10.1.1.1 eq isakmp
    access-list 102 permit esp any host 10.1.1.1
    access-list 102 permit ahp any host 10.1.1.1
    access-list 102 permit ip any any
    access-list 102 permit tcp 10.1.10.0 0.0.0.3 any eq 2000
    access-list 102 permit udp 10.1.10.0 0.0.0.3 any eq 2000
    access-list 102 permit ip 192.168.50.0 0.0.0.255 any
    access-list 102 permit ip 10.1.10.0 0.0.0.3 any
    access-list 102 permit ip host 255.255.255.255 any
    access-list 102 permit ip 127.0.0.0 0.255.255.255 any
    access-list 103 remark auto generated by SDM firewall configuration##NO_ACES_7##
    access-list 103 remark SDM_ACL Category=1
    access-list 103 permit udp any host 10.1.10.2 eq non500-isakmp
    access-list 103 permit udp any host 10.1.10.2 eq isakmp
    access-list 103 permit esp any host 10.1.10.2
    access-list 103 permit ahp any host 10.1.10.2
    access-list 103 permit tcp 10.1.1.0 0.0.0.255 eq 2000 any
    access-list 103 permit udp 10.1.1.0 0.0.0.255 eq 2000 any
    access-list 103 permit ip 192.168.50.0 0.0.0.255 any
    access-list 103 permit ip 10.1.1.0 0.0.0.255 any
    access-list 103 permit ip host 255.255.255.255 any
    access-list 103 permit ip 127.0.0.0 0.255.255.255 any
    access-list 103 permit ip any any
    access-list 104 remark auto generated by SDM firewall configuration##NO_ACES_13##
    access-list 104 remark SDM_ACL Category=1
    access-list 104 permit ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 104 permit udp any any eq non500-isakmp
    access-list 104 permit udp any any eq isakmp
    access-list 104 permit esp any any
    access-list 104 permit ahp any any
    access-list 104 permit ip any any
    access-list 104 permit ip 192.168.50.0 0.0.0.255 any
    access-list 104 permit ip 10.1.10.0 0.0.0.3 any
    access-list 104 permit ip 10.1.1.0 0.0.0.255 any
    access-list 104 permit icmp any any echo-reply
    access-list 104 permit icmp any any time-exceeded
    access-list 104 permit icmp any any unreachable
    access-list 104 permit ip 10.0.0.0 0.255.255.255 any
    access-list 104 permit ip 172.16.0.0 0.15.255.255 any
    access-list 104 permit ip 192.168.0.0 0.0.255.255 any
    access-list 104 permit ip 127.0.0.0 0.255.255.255 any
    access-list 104 permit ip host 255.255.255.255 any
    access-list 104 permit ip host 0.0.0.0 any
    access-list 105 remark CryptoACL for xxxxxxxxxx
    access-list 105 remark SDM_ACL Category=4
    access-list 105 permit ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 106 remark SDM_ACL Category=2
    access-list 106 deny   ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 106 permit ip 10.1.10.0 0.0.0.3 any
    access-list 106 permit ip 192.168.50.0 0.0.0.255 any
    access-list 106 permit ip 10.1.1.0 0.0.0.255 any
    dialer-list 1 protocol ip permit
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    snmp-server community public RO
    tftp-server flash:/phones/521_524/cp524g-8-1-17.bin alias cp524g-8-1-17.bin
    tftp-server flash:/ringtones/Analog1.raw alias Analog1.raw
    tftp-server flash:/ringtones/Analog2.raw alias Analog2.raw
    tftp-server flash:/ringtones/AreYouThere.raw alias AreYouThere.raw
    tftp-server flash:/ringtones/DistinctiveRingList.xml alias DistinctiveRingList.xml
    tftp-server flash:/ringtones/RingList.xml alias RingList.xml
    tftp-server flash:/ringtones/AreYouThereF.raw alias AreYouThereF.raw
    tftp-server flash:/ringtones/Bass.raw alias Bass.raw
    tftp-server flash:/ringtones/CallBack.raw alias CallBack.raw
    tftp-server flash:/ringtones/Chime.raw alias Chime.raw
    tftp-server flash:/ringtones/Classic1.raw alias Classic1.raw
    tftp-server flash:/ringtones/Classic2.raw alias Classic2.raw
    tftp-server flash:/ringtones/ClockShop.raw alias ClockShop.raw
    tftp-server flash:/ringtones/Drums1.raw alias Drums1.raw
    tftp-server flash:/ringtones/Drums2.raw alias Drums2.raw
    tftp-server flash:/ringtones/FilmScore.raw alias FilmScore.raw
    tftp-server flash:/ringtones/HarpSynth.raw alias HarpSynth.raw
    tftp-server flash:/ringtones/Jamaica.raw alias Jamaica.raw
    tftp-server flash:/ringtones/KotoEffect.raw alias KotoEffect.raw
    tftp-server flash:/ringtones/MusicBox.raw alias MusicBox.raw
    tftp-server flash:/ringtones/Piano1.raw alias Piano1.raw
    tftp-server flash:/ringtones/Piano2.raw alias Piano2.raw
    tftp-server flash:/ringtones/Pop.raw alias Pop.raw
    tftp-server flash:/ringtones/Pulse1.raw alias Pulse1.raw
    tftp-server flash:/ringtones/Ring1.raw alias Ring1.raw
    tftp-server flash:/ringtones/Ring2.raw alias Ring2.raw
    tftp-server flash:/ringtones/Ring3.raw alias Ring3.raw
    tftp-server flash:/ringtones/Ring4.raw alias Ring4.raw
    tftp-server flash:/ringtones/Ring5.raw alias Ring5.raw
    tftp-server flash:/ringtones/Ring6.raw alias Ring6.raw
    tftp-server flash:/ringtones/Ring7.raw alias Ring7.raw
    tftp-server flash:/ringtones/Sax1.raw alias Sax1.raw
    tftp-server flash:/ringtones/Sax2.raw alias Sax2.raw
    tftp-server flash:/ringtones/Vibe.raw alias Vibe.raw
    tftp-server flash:/Desktops/CampusNight.png
    tftp-server flash:/Desktops/TN-CampusNight.png
    tftp-server flash:/Desktops/CiscoFountain.png
    tftp-server flash:/Desktops/TN-CiscoFountain.png
    tftp-server flash:/Desktops/CiscoLogo.png
    tftp-server flash:/Desktops/TN-CiscoLogo.png
    tftp-server flash:/Desktops/Fountain.png
    tftp-server flash:/Desktops/TN-Fountain.png
    tftp-server flash:/Desktops/MorroRock.png
    tftp-server flash:/Desktops/TN-MorroRock.png
    tftp-server flash:/Desktops/NantucketFlowers.png
    tftp-server flash:/Desktops/TN-NantucketFlowers.png
    tftp-server flash:Desktops/320x212x16/List.xml
    tftp-server flash:Desktops/320x212x12/List.xml
    tftp-server flash:Desktops/320x216x16/List.xml
    tftp-server flash:/bacdprompts/en_bacd_allagentsbusy.au alias en_bacd_allagentsbusy.au
    tftp-server flash:/bacdprompts/en_bacd_disconnect.au alias en_bacd_disconnect.au
    tftp-server flash:/bacdprompts/en_bacd_enter_dest.au alias en_bacd_enter_dest.au
    tftp-server flash:/bacdprompts/en_bacd_invalidoption.au alias en_bacd_invalidoption.au
    tftp-server flash:/bacdprompts/en_bacd_music_on_hold.au alias en_bacd_music_on_hold.au
    tftp-server flash:/bacdprompts/en_bacd_options_menu.au alias en_bacd_options_menu.au
    tftp-server flash:/bacdprompts/en_bacd_welcome.au alias en_bacd_welcome.au
    tftp-server flash:/bacdprompts/en_bacd_xferto_operator.au alias en_bacd_xferto_operator.au
    radius-server attribute 31 send nas-port-detail
    control-plane
    voice-port 0/0/0
    station-id number 401
    caller-id enable
    voice-port 0/0/1
    station-id number 402
    caller-id enable
    voice-port 0/0/2
    station-id number 403
    caller-id enable
    voice-port 0/0/3
    station-id number 404
    caller-id enable
    voice-port 0/1/0
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/0-OP
    caller-id enable
    voice-port 0/1/1
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/1-OP
    caller-id enable
    voice-port 0/1/2
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/2-OP
    caller-id enable
    voice-port 0/1/3
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/3-OP
    caller-id enable
    voice-port 0/4/0
    auto-cut-through
    signal immediate
    input gain auto-control -15
    description Music On Hold Port
    sccp local Vlan90
    sccp ccm 10.1.1.1 identifier 1 version 4.0
    sccp
    sccp ccm group 1
    associate ccm 1 priority 1
    associate profile 2 register mtpd0d0fd057a40
    dspfarm profile 2 transcode 
    description CCA transcoding for SIP Trunk Multisite Only
    codec g729abr8
    codec g729ar8
    codec g711alaw
    codec g711ulaw
    maximum sessions 10
    associate application SCCP
    dial-peer cor custom
    name internal
    name local
    name local-plus
    name international
    name national
    name national-plus
    name emergency
    name toll-free
    dial-peer cor list call-internal
    member internal
    dial-peer cor list call-local
    member local
    dial-peer cor list call-local-plus
    member local-plus
    dial-peer cor list call-national
    member national
    dial-peer cor list call-national-plus
    member national-plus
    dial-peer cor list call-international
    member international
    dial-peer cor list call-emergency
    member emergency
    dial-peer cor list call-toll-free
    member toll-free
    dial-peer cor list user-internal
    member internal
    member emergency
    dial-peer cor list user-local
    member internal
    member local
    member emergency
    member toll-free
    dial-peer cor list user-local-plus
    member internal
    member local
    member local-plus
    member emergency
    member toll-free
    dial-peer cor list user-national
    member internal
    member local
    member local-plus
    member national
    member emergency
    member toll-free
    dial-peer cor list user-national-plus
    member internal
    member local
    member local-plus
    member national
    member national-plus
    member emergency
    member toll-free
    dial-peer cor list user-international
    member internal
    member local
    member local-plus
    member international
    member national
    member national-plus
    member emergency
    member toll-free
    dial-peer voice 1 pots
    destination-pattern 401
    port 0/0/0
    no sip-register
    dial-peer voice 2 pots
    destination-pattern 402
    port 0/0/1
    no sip-register
    dial-peer voice 3 pots
    destination-pattern 403
    port 0/0/2
    no sip-register
    dial-peer voice 4 pots
    destination-pattern 404
    port 0/0/3
    no sip-register
    dial-peer voice 5 pots
    description ** MOH Port **
    destination-pattern ABC
    port 0/4/0
    no sip-register
    dial-peer voice 6 pots
    description ôcatch all dial peer for BRI/PRIö
    translation-profile incoming nondialable
    incoming called-number .%
    direct-inward-dial
    dial-peer voice 50 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/0
    dial-peer voice 51 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/1
    dial-peer voice 52 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/2
    dial-peer voice 53 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/3
    dial-peer voice 54 pots
    description ** FXO pots dial-peer **
    destination-pattern A0
    port 0/1/0
    no sip-register
    dial-peer voice 55 pots
    description ** FXO pots dial-peer **
    destination-pattern A1
    port 0/1/1
    no sip-register
    dial-peer voice 56 pots
    description ** FXO pots dial-peer **
    destination-pattern A2
    port 0/1/2
    no sip-register
    dial-peer voice 57 pots
    description ** FXO pots dial-peer **
    destination-pattern A3
    port 0/1/3
    no sip-register
    dial-peer voice 2000 voip
    description ** cue voicemail pilot number **
    translation-profile outgoing XFER_TO_VM_PROFILE
    destination-pattern 399
    b2bua
    session protocol sipv2
    session target ipv4:10.1.10.1
    voice-class sip outbound-proxy ipv4:10.1.10.1 
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    dial-peer voice 58 pots
    trunkgroup ALL_FXO
    corlist outgoing call-emergency
    description **CCA*North American-7-Digit*Emergency**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9911
    forward-digits all
    no sip-register
    dial-peer voice 59 pots
    trunkgroup ALL_FXO
    corlist outgoing call-emergency
    description **CCA*North American-7-Digit*Emergency**
    preference 5
    destination-pattern 911
    forward-digits all
    no sip-register
    dial-peer voice 60 pots
    trunkgroup ALL_FXO
    corlist outgoing call-local
    description **CCA*North American-7-Digit*7-Digit Local**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9[2-9]......
    forward-digits all
    no sip-register
    dial-peer voice 61 pots
    trunkgroup ALL_FXO
    corlist outgoing call-local
    description **CCA*North American-7-Digit*Service Numbers**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9[2-9]11
    forward-digits all
    no sip-register
    dial-peer voice 62 pots
    trunkgroup ALL_FXO
    corlist outgoing call-national
    description **CCA*North American-7-Digit*Long Distance**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91[2-9]..[2-9]......
    forward-digits all
    no sip-register
    dial-peer voice 63 pots
    trunkgroup ALL_FXO
    corlist outgoing call-international
    description **CCA*North American-7-Digit*International**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9011T
    forward-digits all
    no sip-register
    dial-peer voice 64 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91800.......
    forward-digits all
    no sip-register
    dial-peer voice 65 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91888.......
    forward-digits all
    no sip-register
    dial-peer voice 66 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91877.......
    forward-digits all
    no sip-register
    dial-peer voice 67 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91866.......
    forward-digits all
    no sip-register
    dial-peer voice 68 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91855.......
    forward-digits all
    no sip-register
    dial-peer voice 2100 voip
    corlist incoming call-internal
    description **CCA*INTERSITE inbound call to xxxxxxxxxx
    translation-profile incoming multisiteInbound
    incoming called-number 82...
    voice-class h323 1
    dtmf-relay h245-alphanumeric
    fax protocol cisco
    no vad
    dial-peer voice 2101 voip
    corlist incoming call-internal
    description **CCA*INTERSITE outbound calls to xxxxxxxxxx
    translation-profile outgoing multisiteOutbound
    destination-pattern 81...
    session target ipv4:192.168.10.1
    voice-class h323 1
    dtmf-relay h245-alphanumeric
    fax protocol cisco
    no vad
    no dial-peer outbound status-check pots
    telephony-service
    sdspfarm units 5
    sdspfarm transcode sessions 10
    sdspfarm tag 2 mtpd0d0fd057a40
    video
    fxo hook-flash
    max-ephones 138
    max-dn 600
    ip source-address 10.1.1.1 port 2000
    auto assign 1 to 1 type bri
    calling-number initiator
    service phone videoCapability 1
    service phone ehookenable 1
    service dnis overlay
    service dnis dir-lookup
    service dss
    timeouts interdigit 5
    system message Cisco Small Business
    url services http://10.1.10.1/voiceview/common/login.do
    url authentication http://10.1.10.1/voiceview/authentication/authenticate

    On 12/01/12 12:06, JebediahShapnacker wrote:
    >
    > Hello.
    >
    > I would like to setup a site to site VPN between 2 of our site. We have
    > Bordermanager .7 on one end and IPCop on the other.
    i'm not familiar with Bordermanager version but be sure you're using 3.9
    with sp2 and sp2_it1 applied.
    There are not specific documents that i'm aware that explains conf
    between ipcop and bm but if ipcop behaves as standard ipsec device, you
    can use as a guideline some of the docs that explains how to configure
    bm with third party firewalls.
    - AppNote: CISCO IOS 12.2(11) T with NBM 3.8 Server
    Novell Cool Solutions: AppNote
    By Upendra Gopu
    - BorderManager and Novell Security Manager Site-to-Site VPN
    Novell Cool Solutions: Feature
    By Jenn Bitondo
    - Setting Up an IPSec VPN Tunnel between Nortel and an NBM 3.8.4 Server
    Author Info
    8 November 2006 - 7:37pm
    Submitted by: kchendil
    - AppNote: NBM to Openswan: Site-to-site VPN Made Easy
    Novell Cool Solutions: AppNote
    By Gaurav Vaidya
    - AppNote: Interoperability of Cisco PIX 500 and NBM 3.8 VPN
    Novell Cool Solutions: AppNote
    By Sreekanth Settipalli
    Digg This - Slashdot This
    Posted: 28 Oct 2004
    etc

Maybe you are looking for

  • Elements 7 Collage won't work

    I'd like to do a collage. But how you can see, there is nothing... Why and how can I get them back? I know I could to it. But since a couples of weeks its empty (sorry for my english, it's not my mother language=)...) Can somebody help me??? Thanks v

  • Invalid Table Name

    There is an Oracle database set up on our network with data I need to extract. I have an odbc connection to this database. When I connect via MS Access to link the table, the table name is listed DOVE.MCORPS. When I connect to the database and use th

  • Sql developer 3.0 executable does nothing when running

    I just downloaded SQL Developer 3.0 and extracted it to an empty folder. After extracting I have tried to open/run the sqldeveloper.exe and nothing happens. I have tried downloading the program again and extracting the files a couple more times and g

  • Walkman not working with headphones

    Each time i plug my head phones in the music pausrs i press play then it plays through front speakers. Even though the head phones are still plugged in. Can anyone help me?

  • TS1398 internet pages are not loading on ipad.  anyone know why?

    We have two ipads in our home.  All of the sudden, the ipads are having difficulty loading pages.  An initial page downloads, but when clicking a link, the web page shows it is partially downloaded and the connection circle just spins.