Cisco Firewall :: 2911 / Site To Site VPN Using 3G USB Modem?
Sep 26, 2011Using 3G USB modem on a Cisco router 2911 can you establish site to site VPN?
View 3 Replies
ADVERTISEMENT
Cisco WAN :: 2911 - Site-to-site IPsec Vpn / Unable To Ping Remote Network
Apr 3, 2013I have two Cisco routers - 2911 in HQ and RV180 in branch office. Because in HQ LAN network I have some development servers, to which guys from branch office need to have acces, I decided to setup VPN site-to-site between HQ and branch office. Everything went quite smoothly, on both devices I see, that ipsec connection is established. Unfortunately I am not able to ping resources from one network to other one and vice versa. Below is the configuration of 2911 router (I skipped som unimportant (imho) configuration directives) :
crypto isakmp policy 1
encr 3des
hash md5
[Code].....
Cisco VPN :: 2911 Site-to-Site VPN / Local Server Access Internet
Aug 18, 2011I have a Cisco 2911 router configured with a couple of VPN tunnels . The issue that I am having is that I cannot access the servers (WEB,EMIL) thru the tunnel . After looking around found out that adding a route-map to my static NAT rule will fix the issue . Once I do that I am able to access the serves thru the VPN but my local machines lose internet access .So I have to delete the access list The issue seems to be with the Access list 110 permit ip [code]
View 5 Replies View RelatedCisco VPN :: 2911 Multiple Site-to-site VPNs With Resilience - Possibilities?
Jan 24, 2013[code] Site-to-site VPNs in place between Site A and Site B and between each site to the DC. Site A and Site B have Cisco 2911 routers, there are ASA’s at the DC. The existing Site-to-site VPNs carry data and voice traffic between the sites (though voice and data is on separate VLANs in separate subnets)
ISP1 currently used for the existing circuits at Sites A and B but we have experienced issues with them recently which has disrupted service. So new circuits are to be installed at each site with ISP2. (See basic diagram attached which shows current set-up with intention to get new circuits via ISP2 installed)
We have 3 ports on our Cisco 2911 routers with 2 ports already in use for the existing connections (1 for the LAN and 1 for the WAN connection to ISP1) Can we simply use the 3rd port for the connection to ISP2 or would it be far more advisable to use a 2nd router (for redundancy, etc)
Would it be feasible to have a set-up where we have e.g. voice traffic go over a site-to-site VPN via ISP1 and data traffic go via site-to-site VPN via ISP2 but each can take over from the other in the event of a failure?
Cisco VPN :: Configuring IPsec Site-to-site VPN With 2911 Router
Mar 15, 2011I have a Cisco 2911 router and a Cisco RV 120W router and i would like to establish a VPN tunnel between theese two. I have defined the settings on the Cisco RV 120W router and i just want the Cisco 2911 to follow those. setting up a connection with Cisco IOS.
View 1 Replies View RelatedCisco Routers :: Site-to-Site VPN - Configure It Between RV042 And 2911
Dec 29, 2012Is there a way to set up a Site-to-site VPN between RV042 & Cisco 2911? I "googled" this and obtained a document, but it is not regarding Cisco 2911: [URL]
Routers are needed to setup it successfully. I have tried on both routers several configuration steps, no success...
Cisco VPN :: Site-to-Site Configuration Between 2911 To SA540
Jun 11, 2013I am attempting to establish a Site To Site VPN between our SA540 and 2911 routers and somewhere I have a misconfiguration that eludes me. I suspect maybe in the 2911 Transform Set? Here is the output from the SA540. [code]
View 1 Replies View RelatedCisco VPN :: Site-to-site Mailfunction 2911 To RV 120W
Mar 21, 2011Im trying to configure a IPsec site-to-site between Cisco 2911 and Cisco RV 120W routers and im having some trouble with it. Hoping some could shine some light on this matter. Posting my running config on 2911 and also the config of the Cisco RV 120W (.jpg)
View 17 Replies View RelatedCisco VPN :: Site-to-Site VPN Using ASA 2911 Behind Dual WAN Router
Aug 30, 2011I have a remote office with a dual WAN router (2911) in front of an ASA (5510). Our main office currently has an ipsec site to site vpn to that remote office ASA. The router has two ISPs. ISP-A is the wan link used for the site to site and has provided us with a /28 public address space which we use on the ASA outside interface for the site to site. Now we are in the process of getting a second ISP which will also provide a /28 or /29 public address space. I would like to use that second ISP for backing up the site to site in case ISP-A link goes down. I think I have the IP SLA config worked out. My question involves NAT. On the router I would like to configure a static nat that only takes place if ISP-A goes down. In other words, if everything is working fine, then the router does not nat the ASA outside address, but if the ISP-A link goes down, then the router will NAT the ASA outside address to one of ISP-B provided public addresses.
View 6 Replies View RelatedCisco VPN :: To Allow All Traffic Between Site To Site VPN 2911
May 1, 2013I have 3x site-to-site vpn connections setup on my Cisco 2911 router which is based at Head Office. They all connect OK but there appears to be some ports blocked.Access any applications using HTTPS Our Proxy Agent uses port 8280 - When the internal address is used, it doesn't work. When the public address is used, it works. Printers are unable to use scan to email - Port 25.I'm confident that nothing is being restricted at the remote sites as all of these functions worked on our old Head Office router.All i want to do is allow ANY traffic to and from Head Office and all the VPN sites. I'm fairly new to this type of router having made the jump from small business equipment.
View 2 Replies View RelatedCisco VPN :: Site-to-site Between ASA 5505 And 2911?
Feb 8, 2012I'm trying to setup VPN S2S. Office router 2911 ip a.a.a.a, remote office ASA 5505 8.4(3) with ip b.b.b.b, but no luck.
2911 config:
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
[code].....
Cisco VPN :: 2911 Router - EasyVPN And Site To Site On Same Router
Nov 27, 2011On my 2911 router, can I have both an Easy VPN server, and a site-to-site VPN? Also, with an Easy VPN, is it possible to specify another internet (outside) IP address in my assigned range as the address remote users use . . . rather than the specific IP address assigned to the interface?
View 3 Replies View RelatedCisco VPN :: 5510 Site To Site VPN Access To Servers With Overlapped Remote Site
May 18, 2012I have a requirement to create a site to site vpn tunnel on ASA 5510 from a remote site to my HO, ihave already other site-to-site tunnels are up and running on the ASA.The issue is my remote site has got the network address which falls in one of the subnet used in HO(192.168.10.0/24).My requirement is only My remote site need to accees couple of my servers in HO which is in 192.168.200.0/24 subnet.
View 2 Replies View RelatedCisco VPN :: 2901 / 2921 / 5505 ASA - Router Versus Firewall Site To Site VPN?
May 30, 2013I would like to know both Cisco 2901 or 2921 router and Cisco 5505 ASA can build site to site VPN.
1) what is the different to build site to site VPN between router and firewall ?
2) which is the best choice if using in site to site VPN connection ?
Cisco Firewall :: ASA 5505 / Site To Site VPN Using Public Addresses On Local Network
Jul 28, 2011I have a request to establish a site to site VPN with a customer. While collecting the information I give them our local network subnet which is a private subnet (192.168.5.0). They asked me if I could give them a public address instead. They can not work with the 192.168.5 subnet. Is this possible?
My side of the VPN is an ASA 5505 running 8.2(2). The other side i believe is a Checkpoint.
Cisco Firewall :: ASA 5505 Site To Site RTP Traffic Is Hitting Deny All Rule?
Aug 13, 2012Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.
Currently the rules are as follows
Incoming External
allow ip any any
allow tcp any any
allow udp any any
default deny
[code].....
It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.
Cisco Firewall :: ASA 5510 Identity NAT Configuration For Remote Access VPN And Site-to-Site
Mar 9, 2011I am try to configure ASA 5510 with 8.3 IOS version.My internal users are 192.168.2.0/24 and i configured dynamic PAT and are all internet .
i want configure identity NAT for remote access VPN.Remote users IP pool is 10.10.10.0 to 10.10.10.10
i know to configure NAT exemption in IOS 7.2 version. But here IOS 8.3 version. configure NAT exemption for 192.168.2.0/24 to my remote pool( 10.10.10.0 to 10.10.10.10).
Cisco Firewall :: Adding Multiple Site To Site VPNs In ASA 5510
Oct 10, 2012I have a ASA 5510 at our corporate HQ that has one site to site VPN. I need to add 6 additional site to site VPN's to this ASA for our remote branches. How can I add them without affecting the existing site to site VPN? The 6 site to site VPN's will all have the same settings however these settings are different from the existing site to site that I already have set up. How can I set it up so the 6 additional VPN's use their own crypto map and all use the same settings?
View 1 Replies View RelatedCisco Firewall :: ASA 5505 - Unable To Access Certain Ports Over Site To Site VPN
Jan 16, 2013We have a client that has a Cisco 1801W Firewall that is setup as a site to site VPN terminating to a Cisco ASA 5505. The tunnel is up and established, I can ping from both sides of the tunnel.
The problem is the clients behind the Cisco ASA (192.168.2.x) cannot reach certain ports behind the Router (192.168.1.x). The main thing we're trying to do is browse via UNC path (ex: \192.168.1.120 from a 192.168.2.x machine).
I got 3389 working after I changed the - ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map DM_RMAP_1 extendable Modified the command to include the public IP instead of interface FastEthernet0
I believe it has something to do with the way NAT and route-maps are setup currently but I'm not familar enough with them to make the changes. I worked with Cisco to ensure the VPN tunnel was fine and it's something security related on the Router.
Here is the configuration (removed a few lines not necessary. y.y.x.x = WAN IP of Router x.x.y.y = WAN IP of ASA).
Building configuration...
Current configuration : 23648 bytes
!
version 12.4
no service pad
[Code].....
Cisco Firewall :: ASA 5510 - Allow Only One Host Access To VPN Site To Site Tunnel
May 28, 2012I have a ASA 5510 that has multiple site to site VPNs. I need to create an additiona site to site VPN but only allow 1 host to access and traverse the tunnel. The network is on a 192.168.5.x but the host that will need to access this tunnel needs to be on a 172.16.33.x network. I dont want any other traffic allowed to access or traverse the VPN tunnel for this host. How can I set this up?
View 33 Replies View RelatedCisco Firewall :: ASA 5505 Site To Site VPN Route From Multiple LANs?
Dec 19, 2012I've set up a standard site-to-site VPN between 2 ASA 5505s and the VPN is working fine for traffic between these ASAs and computers which are in the same LANs.but when I'm trying to connect to computers which are in another VLAN I have a problem.
View 1 Replies View RelatedCisco VPN :: 506 Firewall 6.3(4) PDM 1.0 / Broke Remote VPN After Site To Site VPN Tunnel Created?
May 19, 2011It's been a long time since I played in Cisco CLI.Using a Cisco 506 Firewall 6.3(4) PDM 1.0?Problem is I created a site to site tunnnel with a vendor and since then our remote VPN does not work. Completely times out so I am sure I broke something in the crypto map or something similar.
Tunnel is policy 10 using access-list 101
Remote VPN is Policy 20
Config Below:
: Saved:PIX Version 6.3(4)interface ethernet0 10fullinterface ethernet1 10fullnameif ethernet0 outside security0nameif ethernet1 inside security100enable password XLk0qAaMaA6kjvA6 encryptedpasswd VeCrsQbWdIFPwnny encryptedhostname RMS-DR-PIXdomain-name RMS.Localfixup protocol dns maximum-length 512fixup protocol ftp 21fixup protocol h323 h225 1720fixup protocol h323 ras 1718-1719fixup protocol http 80fixup protocol rsh 514fixup protocol rtsp 554fixup protocol sip 5060fixup protocol sip udp 5060fixup protocol skinny 2000fixup protocol smtp 25fixup protocol sqlnet 1521fixup protocol tftp 69namesobject-group network FTP_Clients description FTP Client PCs network-object host 192.168.xxx.xxx network-object host
[code]....
Cisco VPN :: Site To Site VPN IPSEC Tunnel From ASA 5505 To Clavister Firewall
Nov 20, 2012I have weird problem with a Site to site VPN tunnel from a Cisco ASA 5505 to an Clavister Firewall.When I restart the Cisco ASA 5505 the tunnel is up and down,up, down, down, and I get all strange messages when I see if the tunnel is up or down with the syntax: [code]
After a while like 5-10 min the vpn site to site tunnel is up and here is the strange thing happening I have all accesslists and tunnel accesslists right I can only access one remote network (Main site Clavister Firewall) trought the vpn tunnel behind the Cisco ASA 5505, and I have 5 more remote networks that I want to access but only one remote network is working trought the vpn tunnel behind the Cisco ASA. I see that when I do this syntax in ASA: show crypto ipsec sa.They had a Clavister Firewall before on that site before and now they have a Cisco ASA 5505 and all the rules on the main site thats have the big Clavister Firewall is intact so the problems are in the Cisco ASA 5505. [code]
All these remote networks are at the Main Site Clavister Firewall.
Cisco Firewall :: Max Number Of Clients And Site To Site VPN Tunnels On ASA 5505
Aug 15, 2012I wanted to know the maximum VPN client sessions (using the Cisco VPN client) and Site-to-Site VPN tunnels that I can connect to my ASA 5505 simultaneously.
In other words, if I have x VPN clients and y Site-to-Site tunnels, at any time, does x + y have to be <= 10 (Total VPN Peers)? If yes, can I upgrade to the security plus license to increase the Total VPN Peers to 25?
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : Unlimited
Failover : Disabled
VPN-DES : Enabled
[Code]...
Cisco Firewall :: To Setup Syslog For Site-To-Site VPN ASA 5520
Sep 20, 2011Any step by step guide to setup syslog for site to site VPN.(in ASA 5520)Just send me the step to monitor site to site vpn using that in ASA 5520.
View 2 Replies View RelatedCisco Firewall :: 5520 Slow Performance Through Site To Site Vpn
Mar 12, 2012I'm having slow performance thru a Site to Site VPN. I have an ASA 5520 in each site with the version 8.2(4) in both ASA's. I have a 20Mb internet service in one side and in the other side I have 50Mb. When I transfer a file from the Sita A to Site B I get a transfer rate of 130KB/S.
View 1 Replies View RelatedCisco Firewall :: ASA 5505 Setup A Site To Site Tunnel?
Nov 13, 2012I have a 5505 asa code version 8.3(2). Trying to set up a site to site tunnel with someone and he is asking if I can use ike v2. How do I go about setting up the tunnel to use ikev2? Is ikev2 an option with site to site tunnels?
View 5 Replies View RelatedCisco Firewall :: Pix 525 Site To Site IPSec Bandwidth Measurement
Oct 3, 2012I have cisco pix connected at the edge of my GPRS network. Inside is the GPRS core network and outside is the ISP.On cisco pix, i have site to site IPSec configured between my inside GPRS network and Blackberry servers. for blackberry services.Using the ASDM I can see the total number of packets in and out on this site to site IPSec, but if I want to measure the trand of the bandwidth utilisation over this IPSec, per sec, then how can I do this? I have PRTG traffic monitoring, through which I did try, several MIB (listed below) but still not able to find the correct way. how can I get the measurement for the IPSec from cisco pix?
View 1 Replies View RelatedCisco Firewall :: Site-to-Site VPN Between ASA 5510 And 5505 Configuration
Apr 18, 2013I am not very experienced with Cisco networking.
Here is the situation.
Site A - headquarters 192.168.1.x
Site B - remote office 192.168.20.x
Site C - remote office 192.168.30.x
Site A - ASA 5510
Site B - ASA 5505
Site C - ASA 5505
Site-to-site VPN is established and works between A and B, A and C. Users would like to establish a tunnel between B and C to work on a common project and the data is on Site B.
I tried configuring the S2S VPN with pre-shared keys on both firewalls at sites B and C but in the end it is not established (I cannot ping either side). I used the Wizard interface multiple times and one time the CLI. I generally followed the settings chosen between the headquarter and the individual remote sites and tried to replicate them. Obviously I have made a mistake somewhere.
Could there be any limitation on the ASA 5505 in terms of licensing and the number of S2S tunnels?
Cisco Firewall :: Site To Site VPN Between PIX515 And ASA 5505 With Dual ISP?
Apr 13, 2011We have got site to site VPN configured between local site with PIX515 6.3(5) and remote site with ASA 5505 7.2(4) . Because of very unreliable internet connection in remote site , we have added new ISP link which we want to use as redundant link .i understand ASA 5505 can be configured with two ISP link with SLA monitor method for redundancy as per this document ,[URL]
my question is how do i set up this pix 515 to have redundant VPN tunnel with remote site (when primiary ISP link fails in remote site and secondary ISP links takes over ) . I was thinking of using PIX 515 with 2 peers in same crypto map used for that sepcific site to site vpn tunnel,not sure that is the right way or not though.But how would i configure ASA 5505 to use backup interface(where secondar isp router conects ) to particitae in Site to site Tunnel .
Cisco Firewall :: ASA 5510 / 5505 - Site-to-site VPN One Way Access
Dec 12, 2011We have a Cisco ASA 5510 at our main office that makes connection with a 5505 at our other office using site to site VPN. (works)
Now for the question,
we want to access our other office from the main office but we wont want them to have access to our servers etc. so basically we want to control them but they shouldn't have the rights to control us.
Is this possible with a site to site VPN? and how to do it.
Cisco Firewall :: ASA 5505 Site-to-Site With UC540 Routing?
Dec 4, 2012We are setting up a new phone system using the UC540 with a VPN connection between 2 buildings using 2 Cisco ASA 5505's at either end.The problem I am having is getting the phones at the remote site to connect to the UC540 at the main site.
Phones/Computers (10.0.1.0/24) -- ASA -------------VPN Tunnel------------- ASA -- UC540 -----------Data Vlan1 (10.0.0.0/24)
|------Voice Vlan100 (10.1.1.0/24)
What i am told by UC500 support is that the phones at the remote site will connect if they have connectivity to the TFTP subnet on the UC540, which is 10.1.10.0/30 I added the static route on the ASA and I can ping the 10.1.10.1 TFTP server on the UC540 from the ASA, but not for any other device on the 10.0.0.0/24 network, such as the DC. I added the static route there and was able to ping, so something in the ASA seems to be preventing it.
I also can't seem to get the ASA at the remote site to ping 10.1.10.1. I've tried adding the static route there in hopes it would forward it through the VPN tunnel.
Cisco Firewall :: Site To Site VPN Multiple Networks With 3560x
Jul 24, 2012I have Cisco 3560X L3 Switch. We have done Inter VLAN in our internal networks. Below are the VLAN details
Default VLAN1 IP 192.168.125.2 (Gi0/1, Gi0/23, Gi0/24)
Interface Gi0/1 (Port Configure as a Trunk)
Interface VLAN 10 SERVERS_SW (Gi0/2 to 0/6)
IP Address: - 192.168.0.1 255.255.254.0
Interface VLAN 20 USERS_SW (Gi0/7 to 0/18)
IP Address: - 192.168.152.1 255.255.248.0
Interface VLAN 30 SPARE_SERVER_SW (Gi 0/19 to Gi 0/22)
IP Address: - 192.168.8.1 255.255.248.0
We have Sonicwall NSA2400 Firewall and we have setup Site-to-Site between our other offices who has Sonicwall TZ210 firewall. It works fine and they are able to access all the above networks.
Now the problem is we have one more site which uses Vigor Firewall (with Internal Network 192.168.100.0). We have setup the site-to-site vpn between Sonicwall NSA 2400 (Lets say SITE A) and Vigor (Lets say SITE B) but SITE A is unable to ping to SITE B Firewall but SITE B is able to *ONLY* SITE A firewall.
SITE A is trying to ping from User VLANs whose local ip is 192.168.152.0 range.
How to add route to 100.0 so that we will be able to ping and access SITE B networks.