ZBFW Intra zone traffic not working

I am having an issue on one of our 2811 routers where I can't get traffic between interfaces within the same zone to flow. I know this should happen by default and that's why it is so confusing.
One of the interfaces is fastethernet0/0.1 which is internal LAN And the others are tunnel interfaces using IPSEC tunnel protection back to the main datacenter. By design one tunnel is preferred over the other by using OSPF costing. Due to this there doesn't seem to be any asymmetric routing.
I inter zone traffic working just fine by defining the policy and zone pair. It is just when I enable another zone on our internal LAN interfaces it stops passing traffic. Just to note I do have this working on our LAB 2811 router running the same IOS version.
Any recommendations would be helpful. I have a case open with TAC but they aren't figuring it out. So now I'm calling the experts.
Thanks in advance. Elton
Sent from Cisco Technical Support iPhone App

Here is the sanitized configuration. The zone that I am trying to apply is "LAN".
I would like to apply it to all of the tunnel interfaces along with the fastethernet0/0.1 interface. This is working on another 2811 router.
Thanks again for the assistance.
version 12.4
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
hostname ****************
boot-start-marker
boot-end-marker
logging message-counter syslog
logging buffered 16384 informational
enable secret 5 ******************************
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ if-authenticated
aaa session-id common
clock timezone est -5
clock summer-time SummerTime recurring
dot11 syslog
ip source-route
ip traffic-export profile CAPTURE mode capture
bidirectional
incoming access-list CAPTURE_IN
outgoing access-list CAPTURE_OUT
length 512
ip cef
ip dhcp excluded-address 192.168.43.33 192.168.43.37
ip dhcp pool CREDIT_CARD_SCANNERS
   network 192.168.43.32 255.255.255.224
   default-router 192.168.43.33
   dns-server 4.2.2.2 8.8.4.4
   lease 2
no ip domain lookup
ip multicast-routing
ip inspect log drop-pkt
ip inspect name incoming tcp router-traffic
ip inspect name incoming udp router-traffic
login on-failure log every 3
no ipv6 cef
ntp server 10.69.16.1
multilink bundle-name authenticated
isdn switch-type basic-ni
voice-card 0
crypto pki trustpoint TP-self-signed-218647659
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-218647659
revocation-check none
rsakeypair TP-self-signed-218647659
crypto pki certificate chain TP-self-signed-218647659
certificate self-signed 03
30820242 308201AB A0030201 02020103 300D0609 2A864886 F70D0101 04050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32313836 34373635 39301E17 0D313130 36303831 38303833
395A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3231 38363437
36353930 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
F9FF373A F00F58CF F4C6E6B1 C7676D6E EBD0D2D1 E239FAAA 42BD4335 B779D873
A2D654FA 04F47F90 CCC79596 B3D5B719 D3994E6E 43B05D4D 4419D92C F8EC6149
5094F9AB 7CB11EFA 5E72B723 A04D2999 BB43A8B8 11314E45 CA26BA77 909A63AA
64A95D75 411C5141 026AA11A EA27724F A6832EBF A0C5DD7B A1E48803 4B8C0585
02030100 01A36C30 6A300F06 03551D13 0101FF04 05300301 01FF3017 0603551D
11041030 0E820C42 524B2D43 32383131 2D543130 1F060355 1D230418 30168014
CA02D9F0 3B1772EE BECCFD40 888CD35B 4BF00440 301D0603 551D0E04 160414CA
02D9F03B 1772EEBE CCFD4088 8CD35B4B F0044030 0D06092A 864886F7 0D010104
05000381 810077C0 3260CF10 8652CE8D 6B0DE3F8 9BD87870 51087020 E00CC56B
F01EBC1C F6DE78D9 D309E3D6 B63B713C 80FEE77B CEA7AD0D 3CA587B3 26912CC8
EADA52D9 74698936 B8196FE0 120071EA B9F4CF3C 14D9E67C 34A0EA61 192BF856
F77B5034 D45834CE D38D241A B1B08694 C786FAAF 9833D6DD DDF00562 F4839A51
7ECEE3C1 BC06
        quit
username ************************** privilege 15 secret 5 ***********************************
archive
log config
hidekeys
crypto isakmp policy 1
authentication pre-share
crypto isakmp key ***************** address *****************
crypto isakmp key **************** address *********************
crypto isakmp key ************* address **********************
crypto isakmp key ******************* address *********************
crypto isakmp keepalive 120 periodic
crypto ipsec transform-set TRANSFORM-AES esp-aes esp-sha-hmac
crypto ipsec transform-set TRANSFORM-AES-TRAN esp-aes esp-sha-hmac
mode transport require
crypto ipsec profile PROFILE-DMVPN
set transform-set TRANSFORM-AES
crypto ipsec profile PROFILE-DMVPN-TRAN
set transform-set TRANSFORM-AES-TRAN
track 1 ip sla 1 reachability
track 10 interface FastEthernet0/1 line-protocol
class-map type inspect match-any CC_SCAN_TRAFFIC_CLASS
match access-group name CC_SCAN_OUT
class-map type inspect match-all BBDBU-CMAP
match access-group name BBDBU
policy-map type inspect CC_SCAN_TRAFFIC_POLICY
class type inspect CC_SCAN_TRAFFIC_CLASS
inspect
class class-default
drop log
policy-map type inspect BBDBU-PMAP
class type inspect BBDBU-CMAP
pass
class class-default
drop log
zone security internet
zone security CC_SCAN_LAN
zone security LAN
zone-pair security self-to-internet source self destination internet
service-policy type inspect BBDBU-PMAP
zone-pair security internet-to-self source internet destination self
service-policy type inspect BBDBU-PMAP
zone-pair security CC_SCAN-TO-INTERNET source CC_SCAN_LAN destination internet
service-policy type inspect CC_SCAN_TRAFFIC_POLICY
interface Tunnel1
description Broadband backup circuit
bandwidth 256
ip address 10.69.7.111 255.255.255.0
ip mtu 1400
ip pim sparse-mode
ip nhrp authentication ****************
ip nhrp map 10.69.7.1 *********************
ip nhrp network-id **************
ip nhrp holdtime 300
ip nhrp nhs 10.69.7.1
ip nhrp server-only
ip ospf authentication-key 7 *******************
ip ospf network broadcast
ip ospf cost 130
ip ospf priority 0
tunnel source FastEthernet0/1
tunnel destination ********************
tunnel key ********************
tunnel protection ipsec profile PROFILE-DMVPN-TRAN
interface Tunnel2
description Backup Tunne2
bandwidth 512
ip address 10.69.10.111 255.255.255.0
ip mtu 1400
ip pim sparse-mode
ip nhrp authentication **************
ip nhrp map 10.69.10.1 ********************
ip nhrp network-id **************
ip nhrp holdtime 300
ip nhrp nhs 10.69.10.1
ip nhrp server-only
ip ospf authentication-key 7 ********************
ip ospf network broadcast
ip ospf priority 0
tunnel source FastEthernet0/1
tunnel destination ********************
tunnel key *********************
tunnel path-mtu-discovery
tunnel protection ipsec profile PROFILE-DMVPN-TRAN
interface Tunnel16
description mGRE TUNNEL FOR NYe0008981
bandwidth 1500
ip address 10.69.4.111 255.255.255.0
ip mtu 1400
ip flow ingress
ip pim sparse-mode
ip nat outside
ip nhrp authentication ****************
ip nhrp map 10.69.4.1 *********************
ip nhrp network-id ***************
ip nhrp holdtime 300
ip nhrp nhs 10.69.4.1
ip nhrp server-only
ip virtual-reassembly
ip ospf network broadcast
ip ospf cost 120
ip ospf priority 0
tunnel source Serial0/0/0
tunnel destination ******************
tunnel key ******************
tunnel protection ipsec profile PROFILE-DMVPN-TRAN
interface Tunnel17
description mGRE TUNNEL FOR NYe0008981
bandwidth 1450
ip address 10.69.8.111 255.255.255.0
ip mtu 1400
ip flow ingress
ip pim sparse-mode
ip nhrp authentication *******************
ip nhrp map 10.69.8.1 ****************
ip nhrp network-id **************
ip nhrp holdtime 300
ip nhrp nhs 10.69.8.1
ip nhrp server-only
ip ospf network broadcast
ip ospf cost 125
ip ospf priority 0
tunnel source Serial0/0/0
tunnel destination *****************
tunnel key ****************
tunnel protection ipsec profile PROFILE-DMVPN-TRAN
interface FastEthernet0/0
description PARENT INTERFACE
no ip address
ip flow ingress
ip traffic-export apply CAPTURE size 10000000
duplex auto
speed auto
interface FastEthernet0/0.1
description DEFAULT VLAN
encapsulation dot1Q 1 native
ip address 10.27.19.1 255.255.255.0
ip helper-address 10.69.16.7
ip pim sparse-mode
ip tcp adjust-mss 1344
ip traffic-export apply CAPTURE size 10000000
ip policy route-map PBR
ip ospf priority 0
interface FastEthernet0/0.10
description INITIAL VLAN
encapsulation dot1Q 10
ip traffic-export apply CAPTURE size 10000000
interface FastEthernet0/0.20
description AUTH-FAIL VLAN
encapsulation dot1Q 20
ip traffic-export apply CAPTURE size 10000000
shutdown
interface FastEthernet0/0.43
description CREDIT_CARD_SCANNERS
encapsulation dot1Q 43
ip address 192.168.43.33 255.255.255.224
ip nat inside
ip virtual-reassembly
zone-member security CC_SCAN_LAN
ip traffic-export apply CAPTURE size 10000000
interface FastEthernet0/0.98
description Remediation Vlan
encapsulation dot1Q 98
ip address 10.69.243.1 255.255.255.248
ip access-group Remediation in
ip helper-address 10.69.252.7
ip inspect incoming out
ip traffic-export apply CAPTURE size 10000000
ip ospf priority 0
interface FastEthernet0/0.99
description GUEST VLAN
encapsulation dot1Q 99
ip traffic-export apply CAPTURE size 10000000
interface FastEthernet0/0.666
description VENDOR VLAN
encapsulation dot1Q 666
ip traffic-export apply CAPTURE size 10000000
interface FastEthernet0/1
mtu 1492
ip address 192.168.1.47 255.255.255.0 secondary
ip address ************************** ip flow ingress
ip nat outside
ip virtual-reassembly
zone-member security internet
duplex auto
speed auto
interface Serial0/0/0
ip address **************************
ip flow ingress
encapsulation ppp
no fair-queue
service-module t1 remote-alarm-enable
service-module t1 fdl both
no cdp enable
interface BRI0/2/0
no ip address
encapsulation ppp
shutdown
dialer pool-member 1
isdn switch-type basic-ni
isdn point-to-point-setup
isdn spid1 71878317920101 7831792
isdn spid2 71878340300101 7834030
no cdp enable
interface Async0/1/0
no ip address
encapsulation slip
interface Dialer1
description T-1 Site ISDN Backup
ip address 192.168.103.38 255.255.255.0
encapsulation ppp
no ip route-cache cef
no ip route-cache
dialer pool 1
dialer idle-timeout 120 either
dialer load-threshold 32 either
dialer-group 1
no peer default ip address
no cdp enable
ppp multilink
router ospf 1
router-id 10.27.19.1
log-adjacency-changes
area 48 stub
network 10.27.19.0 0.0.0.255 area 48
network 10.69.4.0 0.0.0.255 area 48
network 10.69.7.0 0.0.0.255 area 48
network 10.69.8.0 0.0.0.255 area 48
network 10.69.10.0 0.0.0.255 area 48
network 10.69.243.0 0.0.0.7 area 48
ip forward-protocol nd
no ip forward-protocol udp domain
no ip forward-protocol udp time
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm
no ip forward-protocol udp tacacs
ip forward-protocol udp bootpc
ip route 198.203.191.83 255.255.255.255 ******************** track 1
ip route 198.203.192.245 255.255.255.255 *************** track 1
ip route 198.203.192.20 255.255.255.255 ****************** track 1
ip route 8.8.4.4 255.255.255.255 ***************** track 1
ip route 4.2.2.2 255.255.255.255 ******************* track 1
ip route 8.8.8.8 255.255.255.255 ********************** track 10
ip route 0.0.0.0 0.0.0.0 Dialer1 200
ip route 10.48.9.254 255.255.255.255 *****************
ip route 10.48.32.101 255.255.255.255 *****************
ip route 10.48.32.102 255.255.255.255 *****************
ip route 161.11.124.78 255.255.255.255 ******************
ip route 173.226.250.130 255.255.255.255 **************
ip route 204.89.170.126 255.255.255.255 ****************
no ip http server
no ip http secure-server
ip pim rp-address 10.69.31.1
ip nat pool CC_DMV_POOL 10.27.19.253 10.27.19.253 prefix-length 24
ip nat inside source route-map CC_BB_NAT interface FastEthernet0/1 overload
ip nat inside source route-map CC_DMV_NAT pool CC_DMV_POOL overload
ip tacacs source-interface FastEthernet0/0.1
ip access-list extended BBDBU
permit esp host *****************************
permit udp host **************************
permit gre host *******************************
permit udp host ****************************
permit gre host **************************
permit esp host ***********************
permit ip host **************************
permit ip host *****************************
permit icmp any host 8.8.8.8 echo
permit icmp host 8.8.8.8 any echo-reply
ip access-list extended BRK
permit ip 10.27.19.0 0.0.0.255 host 10.69.31.128
ip access-list extended CAPTURE_IN
permit ip host 10.27.19.10 host 10.69.66.108
ip access-list extended CAPTURE_OUT
permit ip host 10.69.66.108 host 10.27.19.10
ip access-list extended CC_SCAN_OUT
permit icmp 192.168.43.32 0.0.0.31 host 8.8.8.8
permit udp 192.168.43.32 0.0.0.31 host 8.8.8.8 eq domain
permit tcp 192.168.43.32 0.0.0.31 host 8.8.8.8 eq domain
permit tcp 192.168.43.32 0.0.0.31 host *************************
permit tcp 192.168.43.32 0.0.0.31 host **************************
permit tcp 192.168.43.32 0.0.0.31 host **************************
permit udp 192.168.43.32 0.0.0.31 host 4.2.2.2 eq domain
permit udp 192.168.43.32 0.0.0.31 host 8.8.4.4 eq domain
permit tcp 192.168.43.32 0.0.0.31 host 4.2.2.2 eq domain
permit tcp 192.168.43.32 0.0.0.31 host 8.8.4.4 eq domain
ip access-list extended Remediation
permit ip 10.69.240.0 0.0.15.255 host 10.69.252.7 log
permit icmp 10.69.240.0 0.0.15.255 10.69.66.0 0.0.0.255 log
permit tcp any host 10.69.16.182 eq 443 log
permit tcp any host 10.69.17.38 eq 8444 log
permit udp any any eq bootps
deny   ip any any
ip access-list extended VTY
permit tcp 10.69.66.0 0.0.0.255 any eq telnet log
permit tcp 10.69.66.0 0.0.0.255 any eq 22 log
permit tcp 10.69.31.0 0.0.0.255 any eq 22 log
permit tcp 10.69.31.0 0.0.0.255 any eq telnet log
permit tcp 10.48.32.96 0.0.0.7 any eq telnet log
permit tcp 10.48.32.96 0.0.0.7 any eq 22 log
permit tcp 1.11.1.0 0.0.0.255 any eq telnet log
permit tcp 1.11.1.0 0.0.0.255 any eq 22 log
deny   ip any any
ip sla 1
icmp-echo 8.8.8.8 source-interface FastEthernet0/1
timeout 7000
threshold 7000
frequency 10
ip sla schedule 1 life forever start-time now
logging 10.69.27.129
access-list 1 permit 10.69.66.11
access-list 1 remark SNMP Managers
access-list 1 permit 10.69.31.97
access-list 1 permit 10.69.31.100
access-list 1 permit 10.69.31.101
access-list 1 permit 10.69.66.59
access-list 1 permit 10.69.66.108
access-list 1 permit 10.69.16.223
access-list 1 permit 10.69.30.242
access-list 1 permit 10.69.16.250
access-list 1 permit 10.69.19.229
access-list 1 permit 10.69.16.150
access-list 1 permit 10.69.27.129
access-list 4 permit 10.69.31.148
access-list 4 permit 10.69.31.149
access-list 4 permit 10.69.31.150
access-list 4 permit 10.69.31.151
access-list 101 deny   ospf any any
access-list 101 permit ip any any
dialer-list 1 protocol ip list 101
route-map CC_DMV_NAT permit 10
match ip address CC_SCAN_OUT
match interface Tunnel16
route-map PBR permit 10
description BRK
match ip address BRK
set ip next-hop 10.69.7.1
route-map CC_BB_NAT permit 10
match ip address CC_SCAN_OUT
match interface FastEthernet0/1
snmp-server community ******************
snmp-server community *****************
snmp-server community ******************
snmp-server location **********************
snmp-server enable traps snmp coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps flash insertion removal
snmp-server enable traps envmon
snmp-server enable traps config
snmp-server enable traps syslog
tacacs-server host 10.69.31.18 timeout 10
tacacs-server host 10.69.31.17
tacacs-server directed-request
tacacs-server key 7 ********************
control-plane
mgcp fax t38 ecm
mgcp behavior g729-variants static-pt
banner login ^C************************************
Unauthorized Entry To This Device Is
        STRICTLY PROHIBITED
************************************^C
line con 0
exec-timeout 30 0
logging synchronous
line aux 0
line 0/1/0
exec-timeout 60 0
modem InOut
modem autoconfigure discovery
transport input all
stopbits 1
speed 115200
flowcontrol hardware
line vty 0 4
access-class VTY in
exec-timeout 30 0
password 7 *********************
logging synchronous
transport input ssh
scheduler allocate 20000 1000
end

Similar Messages

AVC INTRA CODEC is not working

Im using a dual 2.5 GHz Power PC G5 8GB ram OSX 10.4.11 and FCP studio 2 w/all the latest
updates.
I get a WARNING " AVC-intra codec is unsuported on PPC" when I try to log and transfer
a avc 100 file from my 32GB P2 card .
I downloaded the codec from panasonic but its not working.
I read that it need to have an intel based mac, is this true?

*I read that it need to have an intel based mac, is this true?*
Application-Specific Requirements
Final Cut Pro
Capturing HD resolution video using the ProRes 422 format requires a Mac Pro with an Intel Xeon processor or a G5 Quad computer and a qualified third-party capture card.
*AVCHD support is only available on Intel based Macs.*
http://www.apple.com/finalcutstudio/specs.html

Live Upgrade with Zones - still not working ?

Hi Guys,
I'm trying to do LiveUpdate from Solaris update 3 to update 4 with non-global zone installed. It's driving me crazy now.
I did everything as described in documentation, installed SUNWlucfg and supposedly updated SUNWluu and SUNWlur (supposedly because they are exactly the same as were in update 3) both from packages and with script from update 4 DVD, installed all patches mentioned in 72099, but lucreate process still complains about missing patches and I've checked if they're installed five times. They are. It doesn't even allow to create second BE. Once I detached Zone - everything went smooth, but I had an impression that Live Upgrade with Zones will work in Update 4.
It did create second BE before SUNWlucfg was installed, but failed on update stage with exactly the same message - install patches according to 72099. After installation of SUNWlucfg Live Upgrade process fails instantly, that's a real progress, must admit.
Is it still "mission impossible" to Live Upgrade with non-global zones installed ? Or am I missed something ?
Any ideas or success stories are greatly appreciated. Thanks.

I upgraded from u3 to u5.
The upgrade went fine, the zones boot up but there are problems.
sshd doesn't work
svsc -vx prints out this.
svc:/network/rpc/gss:default (Generic Security Service)
State: uninitialized since Fri Apr 18 09:54:33 2008
Reason: Restarter svc:/network/inetd:default is not running.
See: http://sun.com/msg/SMF-8000-5H
See: man -M /usr/share/man -s 1M gssd
Impact: 8 dependent services are not running:
svc:/network/nfs/client:default
svc:/system/filesystem/autofs:default
svc:/system/system-log:default
svc:/milestone/multi-user:default
svc:/system/webconsole:console
svc:/milestone/multi-user-server:default
svc:/network/smtp:sendmail
svc:/network/ssh:default
svc:/network/inetd:default (inetd)
State: maintenance since Fri Apr 18 09:54:41 2008
Reason: Restarting too quickly.
See: http://sun.com/msg/SMF-8000-L5
See: man -M /usr/share/man -s 1M inetd
See: /var/svc/log/network-inetd:default.log
Impact: This service is not running.
It seems as thought the container is not upgraded.
more /etc/release in the container shows this
Solaris 10 11/06 s10s_u3wos_10 SPARC
Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.
Use is subject to license terms.
Assembled 14 November 2006
How do I get it to fix the inetd service?

Help with time zone setting not working in my treo 750

When I set my home time zone in the time setting option and I confirm the change, it does not take the change. The home time zone is always set to Pacific Standard Time. Does anybody knows how to fix this bug?
Post relates to: None

rcury4 wrote:
"Time machine couldn't coplete the backup to Rick's backup disk". "Unable to complete backup. an error occurred while creating the backup folder".
See #C10 in Time Machine - Troubleshooting
"Time Machine couldn't complete the backup to "Rick's Backup Disk". An error occurred while copying files. The problem may be temporary. If the problem persists, use disk utility to repair your backup disk."
Not one of Apple's more informative messages.
There's a problem with a file on your system. See #C3 in the above link. It will show you how to locate the message(s) that describe the problem, then help you fix it. If that doesn't help, post back with details, including all the messages, what you've done, and the results.

Map App- Show Traffic Not Working

Hi Guys,
So I noticed over the holiday weekend, when I went into my Map Application to check the traffic in my area, the "show traffic" feature wasn't working. I clicked on the "show traffic" option and nothing changed. It was still the regular map graphic without the green, yellow and red lines. The I pressed "hide traffic" and of course, it looks like map. When I tired "show traffic" again, still no traffic lines. Do I have a bug in my Map App or does this sometimes happen? I haven't been able to get it work and it's going on 5 days now. In the past, I never had this problem before- it ALWAYS gave me the traffic and was usually pretty accurate. I depend on this to get around my area so it's a major bummer right now that it won't work. Any suggestions on how I can fix this? I've tried syncing and my 3Gs is up to date with the latest software and app upgrades, etc.
Thanks so much!!!

that worked! duh! i guess i thought i DID restart my phone- but you know what? all my apps keep updating themselves because of the new iphone update so maybe like you said, when i downloaded an update to an app- it messed the "show traffic" up. glad this was an easy fix and thank you so much for your post! you're the best!!!!

Mailx not working in zones

mailx working fine with global zone but not working with anyone of the non-global zone on that machine. I tried restarting smtp, copied /etc/mail/ dir form global zone to not-global zone but nothing worked out. Please help me out.
# mailx [email protected]
Subject: test
test body
EOT
/home/tsaini/Mailboxes/Out-Box: No such file or directory

Thanks Michael for your response. I fixed the issue. i did the following things.
1> Edit /etc/nsswitch.conf
# consult /etc "files" only if nis is down.
hosts: files dns nis
2> touch /etc/resolv.conf and put all the nameservers ( it was not copied by default when zone was created)
3>touch /etc/defaultrouter ( it was not copied by default when zone was created)
bash-3.00# /etc/init.d/sendmail stop
bash-3.00# /etc/init.d/sendmail start

Alternate Access Mapping not working for Zone : Intranet

One of our client want to set Alternate Access Mappint (intranet) with url "intranet.theirDomain.com" with local IP address.
is it possible?
subsequest to my previous question (
http://social.technet.microsoft.com/Forums/sharepoint/en-US/3f39711e-301a-40e8-aa7a-855fa2c268b1/alternate-access-mapping-not-working?forum=sharepointadmin )
I want to ask one more question
Can we configure "intranet.theirDomain.com" with local IP address for any other zone?
or
If there is ".com" within the url then it can't be configured for InTRAnet?
Thanks
S H A J A N

The names for the zones don't matter. You could use the 'extranet' zone for another intranet name if you wanted, the names are just to make it a bit more friendly for beginners.
What you describe sounds routine, you create a web application with a name, then use an AAM to allow users to access it with a more friendly name. Frequently you end up creating
http://intranet.domain.com and
http://intranet as an AAM, or vice versa.
You can use .com for an intranet site, you would need to add the site as an A Host record in your DNS server so that traffic is sent to your internal server rather than out into the wider world.

All the traffic go through IPsec tunnel(site to site ) ,but something seems not working correctly

Hi, all,
I have seen a good post in google.com about how to make all the client's traffic though IPsec tunnel then out to the Internet from the Main site,now I attach this configuration and application for discussion, and what the problem is that I am still confused with the configuration on Main site , I hope anyone who can tell me more detail and how to accomplish it. Any answer will be appreciated , thank you !
Quote :
Question ? :
Mine is a very simple configuration. I have 2 sites linked via an IPsec tunnel. Dallas is my Main HQ R1 and Austin R2 is my remote office. I want all traffic from Austin to route thru the tunnel up to Dallas, then out to the Internet.
Dallas (Main) Lan Net is: 10.10.200.0/24
Austin (Remote) LAN Net is: 10.20.2.0/24
The Dallas (Main) site has a VPN config of:
Local Net: 0.0.0.0/0
Remote Net: 10.20.2.0/24
The Austin (Remote) site has a VPN config of:
10.20.2.0/24
Remote Net: 0.0.0.0/0
The tunnel gets established just fine. From the Austin LAN clients, I can ping the router at the main site (10.10.200.1). This is how I know the tunnel is created, but I cannot ping anything beyond the router from the Austin LAN, e.g. 8.8.8.8.
I'm sure it's something simple I failed to configure. Anyone have any pointers or hints?
Answer:
Thanks to Jimp from the other thread, I was able to see why it was not working. To fix, I had to change the Outbound NAT on the main side to Manual. Then I created a new Outbound NAT rule that included the subnet from the Austin network (10.20.2.0). Basically, I just created a copy of the default rule and changed the Source network.
Once I made this change, Voila! Traffic from the remote side started heading out to the Internet. Now all traffic flows thru the Main site. It makes perfect sense why I needed to make this change, it just took a slap in the head from Jimp to point me in the right direction.
My question ?
The answer said "To fix, I had to change the Outbound NAT on the main side to Manual. Then I created a new Outbound NAT rule that included the subnet from the Austin network (10.20.2.0). Basically, I just created a copy of the default rule and changed the Source network." what this mean and
how to do it , could anybody give me the specific configuration ? thanks a lot.

Thank you for Jouni's reply, following is the configuration on Cisco 2800 router ,no firewall enable, :
crypto isakmp policy 100
encr aes 256
authentication pre-share
group 2
crypto isakmp key x.x.x address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 60
crypto ipsec transform-set IPsectrans esp-3des esp-md5-hmac
crypto dynamic-map IPsecdyn 100
set transform-set IPsectrans
match address 102
crypto map IPsecmap 100 ipsec-isakmp dynamic IPsecdyn
interface Loopback1
ip address 10.10.200.1 255.255.255.0
interface FastEthernet0/0
ip address 113.113.1.1 255.255.255.128
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map IPsecmap
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
ip route 0.0.0.0 0.0.0.0 113.113.1.2
ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip any 10.20.2.0 0.0.0.255

Zone Base Forewall for VPN connections does not work after IOS upgrade

Hi all,
We use cisco router 2911 as corporate gateway - there is Zone Based Firewall implemented - I upgraded IOS to last version (15.2(2)T1) - originaly version 15.1(4)M1 - to solve issue with Anyconnect connections (bug CSCtx38806) but I found that after upgrade the VPN users are not able to communicate with sources in other zones.
More specific
WebVPN use this virtual template interface
interface Virtual-Template100
description Template for SSLVPN
ip unnumbered GigabitEthernet0/1.100
zone-member security INSIDE
There are other zones VOICE, LAB, ...
In the policy any connection is allowed (used inspection of icmp, tcp and udp) from INSIDE zone to VOICE or LAB zone
After VPN connection I am able to reach resources in INSIDE zone (which is the most important), but not in other zones. Before upgrade it worked.
Once I changed zone in Virtual-Template interface to VOICE, I was able to reach sources in VOICE zone but not in any other. I searched more and found the stateful firewall is not working for connections from VPN as ping is blocked by policy on returning way - it means by policy VOICE->INSIDE, once I allowed communication from "destination" zone to INSIDE zone - the connections started to work, but of cause it is not something I want to setup.
Does anybody has the same experiance?
Regards
Pavel

It seems to me I should add one importatant note - if client is connected directly in INSIDE zone, he can reach resources in other zones without any issue - so the problem is only when the client is connected by VPN - not in ZBF policy setup.
Pavel

MODIFY and SAVE_TRANSACTION not working for ZONE BO

Hi
I am trying to add/delete location in transportation zone through MODIFY and SAVE_TRANSACTION but the update is not happening in database. I have done deletions and additions in other business objects but for transportation zone it is not working properly. Is something wrong with BO configuration ?
Procedure that I am following for deletion of zone:
1. Read Zone with querybyelements method
2. Read locations for this zone using retrieve_by_association method in edit mode
3. Fill modification table with deletion indicator and appropriate values for location
4. Call method Modify and then save_transaction.
I followed similar procedure for adding/deleting region in transportation zone but this also doesn't work.
Thanks
Anuraag

Hi Anuraag,
In TM you should open the transaction /SCMTMS/ZONE. Here you select the zone you would like to modify and you execute the changes you would like to make.
Regards,
Nico.

Lion Server DNS service not working for locally created zones. Caching working fine.

OS Lion Server DNS service not working for local zones. Was fine under Snow leopard server but Lion server upgrade has severely broken my DNS and web sites. Zones look fine under Server Admin but keep getting "query failed (SERVFAIL) for xxxx at /SourceCache/bind9/bind9-42/bind9/bin/named/query.c:3921" in the logs. BTW - Server Admin cant seem to see the log file either.
Surely someone actually tested that DNS still worked on Lion?

I upgraded from Snow Leopard Server to Lion Server on day 01. I hit the same issue where, after the upgrade, my Lion Server stopped serving names for my private local domain.
I finally took a few minutes to figure out what was wrong. After turning on debug logging and looking through the logs, I found my particular issue, now resolved.
The issue I had was, when the domain initially was setup when I installed Snow Leopard Server, for some reason it created a zone just for the server (in my case, something like zone "s-01.mydomain.priv"), and a separate zone for all the other machines (zone "mydomain.priv", containing all the private IPs for my local domain). I never messed with it because it worked, but generally I would have put all of them in the same zone.
My zone "mydomain.priv" had a nameserver and mail exchanger entry for my server, s-01.mydomain.priv. I could see this in the Server Admin app on the DNS bubble, Zones tab, mydomain.priv selected, and the General Info panel. This was fine in Snow Leopard. This was failing the zone load in the updated bind for Lion Server, though. The issue was that the "mydomain.priv" zone was referencing the s-01.mydomain.priv server, which was not defined in the "mydomain.priv" zone but rather in the "s-01.mydomain.priv" zone.
My fix:
1. In Server Admin, add the server to the zone "mydomain.priv". I put an A record (Add Machine) in the "mydomain.priv" zone for my server named s-01.mydomain.priv.
2. shut down DNS on the OS X Lion Server (hit the Stop DNS button on Server Admin).
3. edit /etc/named.conf by hand, removing the specialized zones that contianed just the server. In this case, it would be the section titled 'zone "s-01.mydomain.priv"' and the section titled 'zone "3.10.1.10.in-addr.arpa"'. Your in-addr.arpa zone name will change based on whatever your server IP address was. My internal one happened to have s-01.mydomain.priv mapped to 10.1.10.3.
4. Once the specialized zones for just the server were removed, I started the DNS up again. Instead of serving four zones as it had in OS X Snow Leopard Server, it now servers two zones. And, now, it is resolving my local machines for the mydomain.priv zone.
YMMV. I did note that it wasn't totally necessary to do step 3, but I never really understood the need for the specialized domain, and keeping it around would have a copy of data that would just confuse things.
Hope that helps. That's been the only hiccup I've noticed updating to OS X Lion Server thus far.

Adobe Flash Player not working for Armorgames Dead Zone

I used to play Dead Zone on Armor Games a while ago, when I recently attempted to start again, it will not start. I have followed all the troubleshooting steps provided by both you and Armor Games. I can load the game on facebook but it does not have my save file. I normally use IE and I get stuck loading with this screen if I try to http://i1367.photobucket.com/albums/r786/adam_smiley1/IEArmorGames_zps7ad1f35f.png if I attempt to use FF I get this error instead http://i1367.photobucket.com/albums/r786/adam_smiley1/FFArmorGames_zpsf81f75d4.png. FF will never recognize that I have ANY version of Flash installed in this case. I have also contacted Armor Games Support for this Issue. I do not have troubles with any other game, just this one. Please Assist.

Hi, Since youtube/Google have not responded to the issue, no one knows for sure what their problem is. This is what I found and posted here last night. Then what I found and posted this morning, which you evidently found about the https.
It appears either one or both are being used to try solving the issue. It's been users coming up with these, not youtube nor Google. It effects all browsers, even Chrome. The only one I haven't seen so far is Safari. Flash Player version doesn't matter, nor Operating Systems.
From last night:
YouTube just updated their video player, so the old version could still be cached in your browser causing it to fail. I would suggest rebooting, and if that's already done then make sure your drivers are up to date.
If that does not work make sure you download the new version of flash. Posted3 hours ago
No, I had the exact same problem but it worked the second I cleared my internet cache which could have to do with what another user above said about that.
Go to tools, options, clear recent history, and only check the 'cache' option, clear now, okay, and then refresh or exit it and open it again. I didn't even have to restart my browser. I'm using firefox too, by the way. Good luck! I hope this helped! Posted 2 hours ago
From today 7/7/11:
Now youtube is having major issues as you could read from what I posted. There is nothing wrong with your computer nor Flash Player. Here is what many users are doing in addition to clearing the cache, history etc.
They are using https instead of http. So try it. Here is one that you can check to see if it works. If so, use the https until youtube/google respond.
https://www.youtube.com/watch?v=N1RiMHpUi1w
Until we hear from youtube or our own Flash Player Team, since I'm sure they are in touch with youtube, I don't know what else to do.
My guess is, that if youtube changed their video player for the videos, then that would be a factor. Right now it is a wait and see.
Thanks,
eidnolb

The radio is not working in my ipod nano, and has the correct zone, how can I make it work?

I bought the new Ipod nano, and the radio is not working. I live in the USA, and has being setting in "America" zone, but is not working!! I plugged the headphones, and I tried in different places, and I not working!!!
What could I do?

Check if the headphones are inserted all the way in till you hear a click. Hope this helps!

Control zone (pinch to zoom, copying) not working since WIN10 update...

After my update to Windows 10, my control zone is not functioning in the way it was before. The copying of text on browsers, zooms in the page and I can't pinch to zoom like I could before....Any assistance would be greatly appreciated as I use my envy for work and school ;c ThanksJen

After my update to Windows 10, my control zone is not functioning in the way it was before. The copying of text on browsers, zooms in the page and I can't pinch to zoom like I could before....Any assistance would be greatly appreciated as I use my envy for work and school ;c ThanksJen

Air Traffic Control Widget Does Not Work With OS 10.6.8

Air Traffic Control Widget Does Not Work With OS 10.6.8.
Any suggestions?
SR

No I have not. I have thought about just downloading another version...
Thanks for your reply.
SR

ZBFW Intra zone traffic not working

Similar Messages

Maybe you are looking for