Cisco Switching/Routing :: RV048 - VPN Tunnel Established But Cannot Access Or Ping
Oct 27, 2012
i have 2 RV048 and one RV016
I have established VPN gateway to gateway tunnels; all routers use functional DYNDNS
IPrange site 1 192.168.123.1-254 external adres x.y.z.w
IPrange site 2 192.168.124.1-254 external adres a.b.c.d
IPrange site 3 192.168.122.1-254 external adres e.f.g.h.i
site 1 with 192.168.123.x has two win 2008R2DC servers, running AD, DNS, DHCP, RRAS with address 192.168.123.4-5
i can ping the routers only if i add the route to it but cannot ping further (route add command)
if i dont establish the route then nothing pings
How can i use the tunnel to connect to the servers in site 1
View 2 Replies
ADVERTISEMENT
Jan 20, 2013
i successfully established site to site with 2 two ASA 5010. The problem is that traffic on not passing, This is current setup:1) Left side : only 1 private network 3) Right side : 1 private network, management network, 2 DMZ networks with public IP, On right ASA some netting is setup so servers in DMZ can be reached from private network. The goal would be that VPN client on left side can reach all resources on the right side (except management network, Just to get things going tunnel is built with only left and right private networks, but after tunnel is established i can't ping anything on other side.
View 4 Replies
View Related
May 2, 2012
I have two 5510's that I am trying to get a tunnel established. One has an exsistinig tunnel to a 5505 that works but I cant get the next one to get past the first phase. I have sanitized the attached configs
View 5 Replies
View Related
Sep 15, 2011
I was hoping that the latest firmware would fix my (2) 'bugs', but it did not. We are using the RV042s at our remote medical clinics as an end-point VPN router to our Nortel 1700 VPN router, replacing our old Nortel Contivity 100s.When I try and do a reset when connected remotely via the WAN interface, the RV042 hangs and will only reset by re-powering.
View 1 Replies
View Related
Jul 22, 2012
I'm having some problems getting an ipsec tunnel established between a cisco 887VA router and a cisco srp527w router.I am working from a few text books and some example materials. I have worked through many combinations of what I have got and am still struggling a little bit.I look at debug results and it appears as though the policies do not match between the devices:
Jul 23 05:44:37.759: ISAKMP (0): received packet from XXX.XXX.XXX.XXX dport 500 sport 500 Global (R) MM_NO_STATE
broute1#
Jul 23 05:44:57.079: ISAKMP:(0):purging SA., sa=85247558, delme=85247558
broute1#
Jul 23 05:45:17.031: ISAKMP (0): received packet from XXX.XXX.XXX.XXX dport 500 sport 500 Global (N) NEW SA
[code]....
Some specific questions:
1) on the SRP in the example's I have used (and I have a few SRP->SRP VPN's that work) I see you need to enter the preshared key, I'm not seeing in the examples I have used anything about the IKE preshared key on the IOS box. Any examples where you use the preshared key for IKE? I wonder if this is my primary issue as it states clearly in the log that there is no Preshared key :|
2) I have used a mish mash of names between the various sections as on the SRP the naming convention isnt the same; ie: which parts of the IPSEC negotiation come from the IKE policy section and which from the IPSEC policy section. Do the names really matter across different ends of the VPN?
3) I notice when I perform this command in the(config-crypto-map)#:
set peer FQDN
It is converted to:
set peer XXX.XXX.XXX.XXX
Is this expected? I want the device to look at the FQDN as this particular host is using DDNS and not use a static IP address.
View 4 Replies
View Related
Mar 18, 2013
We try to establish a Site-To-Site- IP Sec- connection between a Cisco 876 (local site) and a Check Point-firewall (remote site). The Cisco 876 is not directly connected to the internet, but is behind a DSL- Router with port-forwarding, forwarding ports 500 and 4500. The running config of the Cisco 876 is appended to this discussion thread. Unfortunately I get no output when debugging the connection with commands "debug crypto isakmp" and "debug crypto ipsec".
From the Checkpoint-firewall point of view the connection seems to establish, but there is no ping answer.
The server on the local site that should be reached from the network behind the Checkpoint-firewall has a routing entry "route -P add [inside ip-net remote] 255.255.255.0 [inside ip local]" (see also appended running config for naming of ip- addresses). Establishing a Cisco VPN- Client connection to the same Cisco 876 router works fine.
View 7 Replies
View Related
May 26, 2013
I have a cisco 876 with, c870-adventerprisek9-mz.124-6.T9.bin. I have configured a VLAN with ID 230, an SVI with IP 192.168.230.1/24 and I have assigned switch port fa 2 to it…
interface Vlan230
ip address 192.168.230.1 255.255.255.0
VLAN ISL Id: 230
[Code]......
View 5 Replies
View Related
May 2, 2012
Connected server on a tenGigabitEthernet interface simple configuration setup
switchport
switchport access vlan 201
end
for server connection. Connected with Fibre. The interface is up and up but cannot ping server?
View 10 Replies
View Related
Mar 31, 2012
I have a new 3560G to set up a small network for a remote site. I configured the vlan and an SVI as the gateway. The switch is also the DHCP server for the LAN. I configured Gi0/2 as L3 port, connecting to the nearest neighbor. My network runs EIGRP so i advertised the routes into the EIGRP process. The switch forms EIGRP neighbors and learns all routes in the enterprise network. The problems I'm having now are: 1. The switch learns all routes in my enterprise LAN and can ping devices in the enterprise LAN, but I can’t ping any interface on the switch from the enterprise LAN. 2.
View 5 Replies
View Related
Dec 12, 2011
I set this up and I can ping all the gateways but never the hosts. I was hoping I could make these links between 6500's a mix of L2 and L3. Check it out. They are connected in a linear fashion R1--->R2--->R3. I can ping from R1 to R3's SVI4 gateway but I can never ping a host on that SVI4. I was hoping that I could use the port-channels between 6500's as routed links or as trunk links depending on the type of traffic....thought it would ease the migration. I suppose I could always get rid of the port-channels and just make separate L2 and L3 links between the 6500's.
View 3 Replies
View Related
Jan 18, 2013
From My Router that connects to Cable modem i am unable to ping website 4.2.2.2I am able to ping all other websites fines.Same website i can ping from my pc and all other switches fine.Router has only 1 ACL thats for NAT.
View 25 Replies
View Related
Oct 22, 2009
After I change my router, I recently found out that I cannot access remote network resources after VPN tunnel is established. I use CISCO System VPN client. I can see the connection is successful. I cannot ping server on the remote network
View 2 Replies
View Related
Apr 8, 2013
I have created the tunnel interface on cisco 1841 router. The tunnel is up but can't ping to it's interface ip, the ping drops.
R1#show ip int brief
Interface IP-Address OK? Method Status Protocol
Tunnel10 10.10.10.1 YES manual up up
[Code]......
View 4 Replies
View Related
May 30, 2012
I had a pix that had two working tunnels going to one 5510 and one 5520. Today the VPN tunnel to our 5520 stopped working but if I do sh cry isa sa both tunnels have QM_IDLE as the state. (both ends) I tried to debug crypto isakmp 255 but all I get is PEER_REAPER_TIMER and no other output on the pix side.
View 20 Replies
View Related
Nov 22, 2011
I am looking for alternatives to GRE since it isnt officially supported on 3750's. I am dealing with a Managed MPLS situation where the carrier manages the routers at each site and I only have read-only access.
The carrier is resistant to making any changes to the router since it would be a one-off or deviation from their standard config. What I am trying to do is to force all site traffic for our department coming from different locations to be forced all the way back to corporate and not "see" any of the other departments. I am not concerned about encrypting the traffic but finding a way to route the traffic back to corporate since I am pretty much not able to make any router changes.
View 2 Replies
View Related
Dec 4, 2012
I have configured a site to site VPN tunnel using my Cisco ISR 891 router. The tunnel connects between my network 10.88.10.0 to the remote network 10.210.65.0. When I ping the remote nnetwork my VPN tunnel comes up and all is well.
I have recently connected a second network to my 10.88.... network. The new local network is 192.168.0.0. I have now managed to get the two local networks pinging each other. I can also carry out RDP sessions between systems on both networks. Hence I am happy that both networks are communicating.
I used the Fastethernet Port 8 on my ISR 891 to physically connect to the new 192.168 network and then entered the appropraite 'Static Routes' on the 192.168 exisiting router(Netgear Router). Hence certain traffic arriving at the netgear will now be forwarded to Port FE8 on the cisco ISR 891.. See FE8 Port config at the bottom of this post. I have used tracert to ensure that the traffic does arrive at Port FE8,(192.168.0.235).
I cannot seem to ping any device on the remote 10.210.65.0 network from the 192.168 network. However, as stated above I can sucessfully ping the same remote device from the local 10.88 network. I must be missing something that allows the 192.168 traffic to use the existing VPN tunnel. I have added the following command to the IpSec rules for the VPN tunnel using the Cisco Configuration Professionla tool.
Permit 192.168.0.0/0.0.0.255 10.210.0.0/0.0.255.255 ip
View 4 Replies
View Related
Aug 2, 2012
I have a IPSec tunnel that is working in one direction. Below is the router config from the side that can connect to the other side perfectly. I believe the issue is with this router as while I was waiting on delivery for the ASA I had an SRP527W sitting in it's place and had exactly the same problem.On one side I have a 887VA router and the other an ASA5505.The network behind the 887VA can access the remote site perfectly, backup services are traversing the link as are web interfaces for applications. In the other direction I can ping hosts but cannot connect. What else is interesting is if from the remote site I attempt to connect to a particular device that performs a port redirect the remote site browser gets so far as being redirected to port 5000 but then hangs.
I am seeing some very generic packet drop debug notices on the 887va on the NAT-ACL access list but I think this is as it should be as it is dropping the tunnel traffic from the NAT'ing.The config for the router is here, I will post the ASA config when I get to the other site shortly but I am convinced the issues is on this device, all the crypto configurations match.I have looked at the MTU's on each side, the path MTU on both sides is 1492. The asa does say the media MTU is 1500 but I believe that is the ADSL link so shouldnt matter?I even went so far as installing CCP and testing the VPN. It says the tunnel is up. It did state a failure:A ping with data size of this VPN interface MTU size and 'Do not Fragment' bit set to the other end VPN device is failing. This may happen if there is a lesser MTU network which drops the 'Do not fragment' packets. [code]
View 1 Replies
View Related
Apr 20, 2012
I am in a test environment using an ASA 55005 and a Cisoc 2611xm router. ASA is running version 8.4 and router is running is ios12.4. My VPN tunnel comes up but I am unable to ping between remote hosts. I used the ASDM and SDM for the configuration. Attached is a copy of both configs.
View 8 Replies
View Related
Aug 5, 2011
I have a RVS4000 at one location and a second RVS4000 at home. I have established an IPSec VPN tunnel between them and it is UP. I can ping the routers from each end no problem. I can ping the IPs listed in the "Local Group Setup" and the "Remote Group Setup" from both ends no problem. I can even open up a shared resource from a Win 7 machine (e.g. by typing \10.10.10.100 in start-run from a computer on my home network).
But - i can't ping anything else on one network from the other. What gives? I need to access a 10.10.10.101 machine but can't even ping it.
- both RVS4000 boxes have latest firmware (V1.3.3.5)
- home RVS4000 setup with IP 10.10.11.1
- home network has a server with IP 10.10.11.20
- other location RVS4000 setup with IP 10.10.10.1
- other location server setup with IP 10.10.10.100
Tunnel settings on home RVS4000 (the other location properly mirror these).
- Local Security Gateway Type : IP Only
- Local Security Group Type : Subnet
[code]....
View 2 Replies
View Related
Apr 7, 2011
I have an GRE Tunnel across my head office and remote site with multiple subnets using cisco 1841 routers.I can ping most of the devices on the remote side, but I can not ping certain devices.These devices respond to ping requests on the local LAN, but not through the WAN link. If I change the IP of device than it start responding. I am using same gateway and mask on these devices.The remote site is running classic STP on switches with distribution switch being the root bridge.
View 4 Replies
View Related
Nov 2, 2012
I have HQ side with ASA 5520 (8.4) & Branch Side with ASA 5505 Design
VPN LAN<------->ASA5520(8.4)----->Thomson Business TG628s----->Internet<--->ADSL Modem------>ASA5505(8.2)
Now on both modems UDP 500 & TCP/UDP 4500 ports are enabled I can ping from internal LAN of HQ to internal LAN of branch but I cant ping from internal LAN of branch to internal LAN of HQ
HQ ASA 5520 Side
ASA Version 8.4(3)
host name aljoaib-fw01
[ code]....
Branch side ASA 5505
ASA Version 8.2(5)
host name GTC- DMM- FIREWALL
domain-name ALJOAIB.COM
enable password 7pgp93AEPfHtDc5N encrypted
[Code]....
Both sides have static ip address.
View 22 Replies
View Related
Mar 14, 2013
i'm desperately trying to get LACP working over a dot1q Tunnel. The "Service Provider" Switches are two 4506-E Switches with SUP7-E connected via a 10G Link, running on cat4500e-universalk9.SPA.03.03.00.SG.151-1.SG
sample config:
dot1q tag vlan native
interface GigabitEthernet3/1
switchport access vlan 2001
[Code].....
View 4 Replies
View Related
Mar 7, 2013
I have an IPSec tunnel configured on my Cisco 1941. The other device is an ZyXEL router.I can see the tunnel is up but there is no traffic.This comes out the show crypto ipsec sa
interface: Dialer1
Crypto map tag: CMAP_AVW, local addr 10.10.10.89
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.200.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.150.0/255.255.255.0/0/0)
current_peer 20.20.20.161 port 500
[code]....
View 3 Replies
View Related
May 22, 2013
We have a site were we have a 887 cisco hsiung a GRE tunnel
When pinging anything froom the tunnel source to the tunnel dest on the local lan we get a 50% packet loss
ping
Protocol [ip]:
Target IP address: 10.9.93.22
[Code].....
replicated the setup exatly in our lab and it works 100% with exactly the same config.
View 2 Replies
View Related
Nov 2, 2009
On my ASA5520 I am trying to do a IPSEC tunnel between two sites. When I ping the protected network on the other side I get this when debugging IPSEC:
IPSEC(crypto_map_check): crypt o map man map 20 does not hole match for ACL man1
Not too sure what this means...
View 11 Replies
View Related
Nov 17, 2012
I have seen an error in GRE configured between two routers over WAN. i am monitoring the WAN link and GRe tunnel via WhatsupGold NMS and it reported that Gre tunnel having packet loss sometimes and this time it affects the services and traffic passing over tunnel.sh int t101 shows output drops . is that the problem ? i have read that i have to adjust MTC size but i tried to change the tunnel MTU to 1400 but still sh int t101 shows MTU as 1514 ? What could be the problem of output drops in my tunnel link. [code]
View 1 Replies
View Related
Feb 12, 2012
I'm trying to configure an IPSEC VPN + tunnel for multicast data. When the default gateway is set on the router (1841) it works fine but if I only set a route to the IPSEC peer via our gateway then the tunnel fails to come up. The end point is to a 3rd party. [code]
I found that if I add a static route for the tunnel destination via fa0/0, the public facing interface, the tunnel comes up..ip route 10.23.4.2 255. 255. 255. 255 FastEthernet0/0
and I can then ping the tunnel IP at the far end - 10.23.0.5.Why would that be? Is there a better way to do this without using a default route??
View 4 Replies
View Related
Nov 20, 2011
In fact i receive traffic on a one client per vlan basis (traffic is PPPoE), i receive all this traffic on a router, collecting all these vlan on a bridge where the pppoe packets are treated.When I use a transeiver to convert operator fiber arrival to my router copper media interface, i have no problem....
When I use dot1q-tunnel to make the same on my 3750, packets seems to be corrupted.I get PPPoE timeouts and packet loss, not regulary, totally stochastic...
I made dozen of tests and different settings, without success I first thougt of MTU issues. [code] I made tests with system MTU and/or system jumbo MTU above 1500, without success.I didn't found any known caveats on 3750 running Version 12.2(25r)SEE4 related to dot1q-tunnel.
View 7 Replies
View Related
Nov 29, 2011
[code] I can not ping IP 192.168.1.1 from SWH02. I observed there sth wrong when trunking over SDH. Because when I config int vlan 121 on another switch(SWH04) already trunking with SWH01, I can ping IP 192.168.1.1 from SWH04.
View 1 Replies
View Related
Apr 8, 2013
I could not ping 8.8.8.8 and access internet after creating the VPN. Below is my setup and router configuration: [code] From the router 1941, i could ping up to 58.185.149.141 but not up to 58.185.149.140. Since i cannot ping 58.185.149.140, i suppose i cannot ping 8.8.8.8. I am sure 58.185.185.140 is there as i use another PC which is connected directed to the office network instead of through the router 1941, it could ping 58.185.149.140.For your info, the g0/1/0 is connected to the PC while g0/1 is connected to the office network.
View 2 Replies
View Related
Mar 1, 2012
I just got a new 1760 router, I have an issue.
My FastEthernet 0/0 interface uses DHCP and got 172.16.2.126 /16.
My Ethernet 0/0 interface is my internal interface, it has static 192.168.0.1 /24.
On the Ethernet 0/0 interface, I have a PC attached, IP 192.168.0.150 /24.
The router's gateway is set to IP 172.16.1.1
My PC can ping 192.168.0.1 and can ping 172.16.2.126 (both interfaces of my router).
My router can ping anywhere on the Internet.
But my PC cannot ping 172.16.1.1. Firewall disabled, all security disabled.
[code].....
View 1 Replies
View Related
Jul 17, 2012
I have a cisco 3825 router with two GE interfaces. GE0/0 is connected to a switch through ethernet cable. I have configured the GE0/0 interface with IP address. I have also configured static route for the local network. However, now I can only ping the GE0/0's own IP from the router. Here are the running-config:
hostname Router
!
boot-start-marker
boot-end-marker
!
!card type command needed for slot 2
enable secret 5 $1$4gxa$sykc0mcaxpCIrGc86i1ZE.
[code]...
The 10.1.52.1 is the current gateway on the 10.1.52.x LAN.
View 34 Replies
View Related
Sep 13, 2011
I configured ASA5520 and RV042 for site-to-site IPSec VPN tunnel.Tunnel get connected, but no ping, no traffic between both end network.
Network:
=======
192.168.113.0/24----------192.168.113.6 -ASA--------public, static IP address------Cisco 2821--------Internet
192.168.10.0/24-----------192.168.10.1 -RV042-----public, static IP address------Cisco 2821--------Internet
ASA5520 config:
----------------------
name 192.168.10.0 VPN
!
interface GigabitEthernet0/1
nameif NET
security-level 100
ip address 192.168.113.6 255.255.255.0
[code]....
View 5 Replies
View Related