Cisco VPN :: 2911 - Unable To Access LAN Using Client Tunnel To Router

Sep 4, 2011

I recently purchased a Cisco 2911 to replace my Cisco 1711 router. I copied the  configuration from the Cisco 1711 router to the Cisco 2911 router.  Everything seemed to work correctly except when I VPN tunnel into the Cisco 2911  router using Cisco's VPN client version 5.0. I can ping the router LAN interface from my PC that is VPNed into the  router but I can no longer ping or access the devices on the LAN side of the  router as I did on the Cisco 1711 router. I don’t see errors in the log or hits  blocking anything in the acls. It’s using the same configuration that I had on  the Cisco 1711 router, and this did work on the Cisco 1711. The Cisco 2911  router is running IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version  15.0(1)M1, RELEASE SOFTWARE (fc1).
 
Here is the VPN clinet portion of the configuration: The LAN is addressed as 192.168.0.0/24. The router LAN interface is 192.168.0.1, which I can ping and access. I can't ping or access anything on the LAN (192.168.0.0/24) beside the router.
 
aaa authentication login vpnclientauth local
aaa authorization network vpngroupauth local
!
crypto isakmp client configuration group remote-clients
key 6 xxxx
pool clients
[Code]....

View 11 Replies


ADVERTISEMENT

Cisco VPN :: 2911 / Getting Simple Remote Client-initiated VPN For Employees To Access Corporate Resources?

Nov 24, 2011

I want a simple remote client-initiated VPN for employees to access corporate resources from home simultaneously with being able to access the internet. I am using CCP and seem to have several options including Easy VPN server, SSL VPN. I also can choose "Full Tunnel" or not.I have a 2911 router. I have a static range of internet IP addresses. The router is already functioning with inside to outside and outside to inside NAT, etc.

View 1 Replies View Related

Cisco VPN :: 1921 - Internet Access Via VPN Client Tunnel

Jun 5, 2011

we use the Cisco VPN-Client to connect to our CISCO1921 Router and want to go out again on the same interface to the internet. We configured the connection with the IOS scurity package, have no split tunneling - so the client is forced with it's default gateway to our router - we also have pushed our local dns-server to the client and he gets dns results. Now I think we have to got out with some kind of NAT, because our client has a private IP from the IPSec Client pool. At the moment we have no NAT inside/outside, bacause we only use official IP addres in- and ouside (data-room usage).
 
- Is it possible to get the NAT function going in and out on the same interface with crypto_map IPSec user comming in and going out to the internet ?
- Is it more secure to configure this with vrf ?
- Has some a link to example configurations for this ?

View 4 Replies View Related

Cisco WAN :: 2911 Router VPN Tunnel And Default Routing?

Feb 16, 2012

I have a Cisco 2911 that I am configuring for a remote site.  I have configured a IPSec Tunnel from our main site ( ASA 5510 ).  The Tunnel is up and I can connect from the main site LAN to the address of the 2911 through the IPSec Tunnel.  The 2911 is equipped with a 16port switch service module.  The switch is configured with an address and I can open a telnet session to the switch.  From that session, I am able to reach hosts on the LAN across the IPSec tunnel.  However, when I open a telnet session to the 2911 router, I cannot reach hosts on the main site LAN from that address.  When I do, the traffic is sent outside of the tunnel instead of inside it.  It works from the service module as traffic between the interfaces have the ACL for insteresting traffic applied, but traffic generated from the address of the 2911 router does not seem to get picked up by the ACL on the IPSec tunnel and it is getting the default route applied and going directly to the outside interface instead of to the tunnel. how to make this work?

View 3 Replies View Related

Cisco VPN :: Configure ASA 5505 NEM Client To Allow Access To Internet When Tunnel To Headend Is Down?

Jan 31, 2011

How can I configure an ASA 5505 NEM client to allow access to the Internet when the tunnel to the headend is down?  I am planning on deploying back to back ASA 5505s in network extension mode but I do not want to block Internet access on the client side if the tunnel to the server should go down.

View 4 Replies View Related

Cisco VPN :: Router WebVPN And Client Certificate / 2911

Jun 3, 2012

In my test lab I can't to make work my webvpn configuration = I have several components: MS AD, MS CS (but without NDES), router 2911 and client computer. Client and router have a certificate from MS CS. In my configuration I use authentication by certificate or aaa (LDAP) and authentication by aaa working good. But authentication by client certificate doesn't work. And my internal https services don't work also -  "Invalid or no certificate", but this strange because I imported CA certificate for this.

My 2911 version: Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(3)T, RELEASE SOFTWARE (fc1)
 
My Config:
 
aaa authentication login webvpn group ldap local
ip local pool webvpn 192.168.200.1 192.168.200.254
bind authenticate root-dn cn=webvpn,ou=staff,dc=domain,dc=com password P@ssw0rd
webvpn gateway vpn
ip address <ip address> port 4443
ssl trustpoint root-ca

[code].....

View 3 Replies View Related

Cisco VPN :: EasyVPN Server (Router 2911) VPN Client On Windows 7?

Oct 11, 2012

I have couple of issues with my EasyVPN server and Cisco VPN Client on Win7.
 
1: VPN Client establishes the connection, traffic flow, destination network can be pinged. After a few minutes traffic stops passing the VPN. No ping to IP or DNS names can be made. In order to resole it. Users have to re-establish the VPN again. Occastioanl it stays and continue to work.
 
2: VPN Clients don't pick the same IP address from local address pool even though I specified "RECYLE" option in the IP local pool command.
 
Configuration:

##############################################################################
 TQI-WN-RT2911#sh run
Building configuration...
 Current configuration : 7420 bytes
!
! Last configuration change at 14:49:13 UTC Fri Oct 12 2012 by admin
! NVRAM config last updated at 14:49:14 UTC Fri Oct 12 2012 by admin

[code].....

View 2 Replies View Related

VPN Tunnel Between Wireless Router And Client

Feb 6, 2012

I would like to know whether I will be able to setup a VPN tunnel between a wireless router and wireless client on the same network. What I plan to do is to first setup up my router to use DD-Wrt as its OS. I have read some tutorials on the Internet, about how one can configure a VPN server when using this router OS.Now if I assume that I have a client on the same WLAN network who is already connected and so on; - can the client connect to the router's VPN server and then connect to the Internet using the VPN tunnel that has been established? The purpose of this configuration is to see whether if this setup (if it can actually be configured that way) would protect against wireless man in the middle attacks that use trivial tools such as Cain and Abel.

View 4 Replies View Related

Cisco VPN :: Router 2911 - Unable To Do Tunneling

Sep 3, 2012

We have a router 2911 recently purchased which supports vpn but we are not able to do vpn tunneling, So what is required to use VPN connection.

Does ios has to upgrade or some kind of license is required.If license is required then what kind of license.Router version is 15.0(1r) M15 which I found in sh version command.

View 2 Replies View Related

Cisco VPN :: 861W From Client To Router Split-tunnel

Mar 27, 2011

I can connect to the router over VPN just fine, problem is that once I connect I can not access the 192.168.1.0 network... can't ping a workstation on the network 192.168.1.25, I can however Ping the Router which is 192.168.1.254. 
 
FastEthernet 4 is my WAN
 
used this for setup: [URL]
 
Here is the config:
 
! Last configuration change at 13:50:29 UTC Tue Mar 16 1993 by cjcatucci!version 15.0no service padservice timestamps debug datetime msecservice timestamps log datetime msecservice password-encryption!hostname c861w!boot-start-markerboot-end-marker!no logging monitorenable secret

[Code].....

View 5 Replies View Related

Cisco Routers :: RV220W PPTP Users Unable To Access Subnet Across Tunnel

Apr 21, 2012

I have two offices connected with an IPSEC VPN tunnel using RV220W routers.  The Tunnel works fine for local users between the two sites(Site 1:10.0.0.x; site 2 is 10.0.2.x).  I have also set up PPTP users for remote access.  PPTP users that connect to site 1 cannot access site 2 and vice versa.   The PPTP users have no trouble accessing the resources on the site that they connect to.  I have tried activating RIP and adding various static routes with no success.  If I PPTP connect to site 1 and I tracert to an IP address on site 2 the route goes to the site 1 router and then goes to the internet(connected to the site 1 router) where it stops.

View 2 Replies View Related

Cisco VPN :: Zfw VPN Tunnel 2911

Mar 2, 2012

Recently i attempted to build a LAN 2 LAN VPN tunnel from an Asa to a 2911 running zone based firewall.  This was a standard IPSec psk tunnel nothing fancy.  I got the tunnel to establish but i could only get traffic to encap on the Asa side and decap on the 2911 side.  I couldn't get return traffic.I followed this doc here for classic IPSec in the last example. URL

And I am sure the Asa is right I built a ton of those but I am new to zfw.  I did not see anything about a NAT exempt rule.  But since everything uses real IPs instead of NAT I wasnt sure and I could not find any info.  Do I need to do NAT exempt?  If so do you use a route map on the end of you NAT overload config line like in the past?

Also I have a zone-pair to "self" and I was not sure if I needed anything there to be able to ping the inside interface of the 2911 when the tunnel is up from the remote end.

View 7 Replies View Related

Unable To Access Internet After Connecting To VPN Using Cisco VPN Client?

Aug 4, 2011

On my Windows 7 laptop, after connecting to my office Network using Cisco VPN clientThe entire Internet is utilized by the VPN. I am unable to browse the internet on my computer till I disconnect the VPN Client.

View 3 Replies View Related

Cisco Routers :: Unable To Access LAN Behind RV042 From Quick VPN Client?

Aug 22, 2011

Very recently, we had implemented Site-to-Site VPN tunnel between two Linksys RV042 4-port VPN routers. Everybody in our remote site is accessing and sharing the data through this tunnel and it is working fine.
 
Now, we have a plan to implement the same for our mobile clients also. For this, we had followed all the basic configuration procedures and user got connected to Quick VPN tunnel. Here is a problem we had observed. The mobile client user is connected to the tunnel, but unable to access the office LAN from the PC.

View 1 Replies View Related

Cisco VPN :: 861 Easy VPN Software Client Unable To Access Few Networks

Feb 19, 2013

I have access to network 10.3.1.0 /24 but I am not able to access 10.3.2.0/24 and other networks behind the Easy VPN server.I am using a software client to connect to the server.I have configured split tunnel to the network 10.3.0.0 /16 and it shows up in the route details too. I can ping 10.3.1.0 network but not 10.3.2.0 and so on.The Easy VPN server is configured on Cisco 861 with VPN module. [code]

View 6 Replies View Related

Cisco VPN :: 5510 Unable To Access Secondary Subnet From VPN Client

Jun 5, 2012

I have an ASA 5510 running v8.4(3)9 and have setup a remote user VPN using the Cisco VPN client v5.0.07.0410 which is working appart from the fact that I cannot access resources on a secondary subnet.The setup is as follows:

-ASA inside interface on 192.168.10.240
-VPN clients on 192.168.254.x
 
I can access reources on the 192.168.10 subnet but not any other subnets internally, I need to specifically allow access to the 192.168.20 subnet,[code]

View 3 Replies View Related

Cisco Switching/Routing :: Unable To Configure VPN On 2911 Router

Jan 29, 2012

I have a Cisco 2911 router that I will like to use it for setting up a site to site VPN but the router does not support VPN commands. When I issue crypto isakmp command, it says command no recognized. When I issue ipsec transform-set command, it says command not recognized. The IOS running on my router is c2900-universalk9-mz.SPA.151-2.T1.bin. Also see the output of my show licences features command: [code]
 
what can be done on this router to enable use it for setting up a VPN connection.

View 6 Replies View Related

Cisco VPN :: 881 Setup - Client Unable To Gain Access To Network Resources

Jun 18, 2012

I have a Cisco 881 setup with the following VPN config.
 
[code]...
 
The client is able to connect just fine to the network via VPN,  but I am unable to gain access to any of the local resources.  I know 192.168.1.1 has SSH running and 192.168.1.50 has telnet running but if I try to connect to either using the correct program they just timeout. I am really at a loss on why the vpn connection connects but I can not gain access to any of the resources on the VPN network.

View 3 Replies View Related

Cisco Switching/Routing :: 2821 - Router VPN Client Split Tunnel Is Not Working

Mar 14, 2013

i've configured Cisco VPN CLient on a router 2821, and it is working fine.I could access inside resourses normally>the problem is that when i connect with VPN i lost connectivity to internet? What is wrong with my configuration? Below the running config of the router.
 
CISCO2821#sh run
Building configuration... 
Current configuration : 5834 bytes
!
version 12.4

[Code].....

View 3 Replies View Related

Cisco WAN :: 2911 - DMVPN Tunnel 0 Up - Line Protocol Down

Jul 8, 2011

We have a 6 spoke DMVPN setup. Five of the six spokes work fine. On the 6th spoke, a 2911, we have created a Tunnel0. Other spokes and the hubs can ping it's ip, but it can't ping itself. When we do a show interface it shows the Tunnel 0 is up, but the protocol is down. What does that mean?

View 4 Replies View Related

Cisco VPN :: 2911 ISR Remote Client Connects Just Once?

Feb 2, 2011

After trying to configure remote client VPN access to a Cisco 2911 ISR using the CLI I tried to use the Cisco Configuration Professional. However, either way I have the same problem. A client can successfully connect and access servers but just once. When the client disconnects and tries to connect again there is no access to the servers even though the VPN tunnel appears to be up. I've tried multiple versions of the Cisco vpn client SW and all behave the same: 1st connection can access servers, subsequent connections can't. I've also tried a second (different) client after the original connection and still no luck. If I reload the router the client can get the vpn connection and access the servers but if the client disconnects from the vpn and tries again there is no access to the servers.
 
I've also tried it with and without NAT but it doesn't seem to make any difference.
 
The config generated using CCP is as follows:
 
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec

[Code].....

View 4 Replies View Related

Cisco VPN :: Remote Access With 2 WAN Link In 2911-SEC-k9 Router

Mar 4, 2012

I am having cisco 2911-sec-k9 router.
 
And I got 2 internet connections from isp one is static ip leased line and the other one i dsl dynamic ip one.
 
What I want is i need to configure internet load balance between these 2 internet and also i need to use static ip for remote access vpna and for my exchange port forwarding.
 
My dsl line in 100 mps and my leased line 2mb dedicated.
 
I configured the router as with some example config i got on internet my internet is fine but load balancing not happening and i configured the REMOTE ACCESS VPN  . I am able to connect the remote access vpn but no communication through remote access . i cannot reach any device through remote access.
 
Note: if load balancing is not possible how i can configure for internet traffic use dsl line and for remote access vpn and live exchange port forwarding through leased line.
 
I am attaching my configuration and also debug crypto isakmp status

View 1 Replies View Related

Cisco WAN :: 2911 Unable To Ping From LAN To WAN

Apr 26, 2012

I have the following setup where the Cisco ME 3400 provided by the ISP.
 
My Cisco 2911 is configured as below:
 
CORE_Router#sh run
Building configuration...
 Current configuration : 6075 bytes

[Code].....

View 6 Replies View Related

Cisco VPN :: ASA5520 Client-less SSL VPN With Smart-Tunnel

Sep 12, 2012

I have implemented a Clientless SSL VPN solution with Smart-Tunnel feature on Cisco ASA 5520, software 8.4(4)1.I have been successful in making Bookmarks which employ Smart-Tunnel feature to avoid content rewritting (if any). And in reality it works fine with some links. However there are some links to an Oracle portal, it doesn't work.I was able to log into the Oracle portal with its username/password. However when i click into a button of the drop-down menu, nothing happens while normally there should be a box appearing. The Oracle portal runs with some Java stuffs which i don't really know as i am not a programming engineer anyway.

View 1 Replies View Related

Cisco VPN :: Establish Tunnel From Client To ASA 5520

Oct 2, 2012

I have remote branches that connect to the corporate office as a site-to-site VPN. Now the clients at the branch are getting an application that is using an unsecured port (tcp/23). I would like to use a set of ASA 5520's that I have at the corporate office, with the AnyConnect license on them. I want the client machines to establish a tunnel from the client to one of these ASA's. The ASA' then would have a connection to the VLAN that the receiving server is housed on. The trick is to just establish the tunnel from the client to the ASA that will allow the IP of the client to not be translated. So I would use the ASA as a security 'pass-through' for the clients that use this new application.

View 1 Replies View Related

Cisco :: Can't Get Any Client To Establish DTLS Tunnel When Connecting

Nov 25, 2012

I've been labbing on my asa5505 at home, setting up different VPN solutions for testing purposes. However, I can't get my anyconnect client to establish a DTLS tunnel when connecting (anyconnect only shows tls, and does not display any errors about not connecting with dtls)I have set dtls port to 444 and this port is open on the other side.

View 2 Replies View Related

Cisco Firewall :: ASA 8.3 And Smart Tunnel Vsphere Client?

Aug 11, 2010

i`ve setup smart tunnel with different applications. (mstsc.exe, putty.exe). This works fine. I`ve now tried to add the vSphere client appliaction (VpxClient.exe). But i don`t get it working.

View 3 Replies View Related

Cisco :: ACLs To Limit Ports With Client - Based VPN Tunnel

Jun 16, 2011

I have a customer I've built a webvpn tunnel for.Users on this tunnel need to have http access to a server at 10.1.1.12 and nothing else.That's fine, but in order for name resolution to work properly they need to be able to send DNS requests to 10.1.1.9.I'm working with two different access lists, my non access list (nat 0) and my split tunnel access list. I can't specify ports in the nat 0 access list, but I did try writing my split tunnel access list as follows:

-access-list split permit ip host 10.1.1.12 172.16.4.0 255.255.255.0
-access-list split permit udp host 10.1.1.9 eq 53 172.16.4.0 255.255.255.0

When I do that users can access the 10.1.1.9 dns server, but they can hit it on anything (ping, 3389, etc.).I'm trying to figure out how I can limit them so they will only be able to pull dns but nothing else.They have the Any connect Essentials license, so unfortunately a clientless VPN is not an option. Is there some other access list I can interpose that will limit things the way I want?

View 2 Replies View Related

Cisco Routers :: RV110W As VPN Client - Routing All Traffic Through Tunnel

Apr 3, 2012

I am using a RV110W as a VPN client to establish a VPN conection since some months. So far everything works fine. But all traffic is routet thru the VPN tunnel. Now I try only to route specific adresses thru the tunnel but not the internet acess.
 
RV110W is in Gateway mode
WAN interface is connected with internet
I am using PPTP with PAP and MPPE for VPN
so far no static routes (I could not set e.g. a route to 0.0.0.0 because web-interface says its not a valid adress)
 
Goal is to route only traffic for the target network thru tunnel and the rest direct via WAN interface.

View 3 Replies View Related

Cisco VPN :: 5520 / 5505 - Split Tunnel On Easy Client

Mar 16, 2013

Is it possible with ASAVPNSERVER 5520 and an EasyVPN 5505 Client to have the client do split tunnel to a single public IP address?  Both devices are on 8.2(5) 33.  Could you possible provide sample config for split tunnel?

View 1 Replies View Related

Cisco VPN :: 800 - How To Setup Both Ends Of IPsec Tunnel Using Software Client

Sep 29, 2011

how to setup a both ends of an IPSEC VPN tunnel using a software client such as shrewsoft vpn and an 800 series router?
 
I've tried following the instructions on cisco's site, but I don't really understand which interface I should use? Dialer, VLAN1 or UnNumbered to a Loopback?
 
I'm OK with most basic features of the router, but never had any luck with VPNs?

View 3 Replies View Related

Cisco VPN :: ASA5505 - Remote Client To Browse Internet Through Tunnel?

May 28, 2011

inside network----ASA5505========internet===========Remote VPN client.
 
The ASA has one public IP on its outside interface and using PAT to the internet. It only has two interfaces, inside and outside using vlan. I created a IPSec VPN through CLI. My goal is for the remote client to browse the Internet throught tunnel.
 
Q1: Is it possible?

Q2: The remote side gets connected and has IP from the pool, with is part of inside network. But it cannot ping anything, including the gateway, which is the inside interface. I debug it, it shows the ASA receives the ping packages, but it doesnt send anything back to the client.

View 5 Replies View Related

Cisco VPN :: To Match Tunnel Group With ASA 8.2 And VPN Client IPSec Authorization

Apr 15, 2010

I have configured a lab for RA VPNs with a ASA5510 software version 8.2 and VPN Client 5 using digital certificates with Microsoft CA on a Windows 2003 server. I did the configuration based on this document from Cisco website: URL
 
Now the vpn works just fine, but now I need to configure different tunnel-groups so I can provide different services to different users. The problem I have now is that I don't know how to configure it so the certificate matches the tunnel-group name. If i do a debug crypto isakmp on ASA I get this error messages:
 
%ASA-7-713906: IP = 165.98.139.12, Trying to find group via OU...%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload:   Unknown%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IKE ID...%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload:   Unknown%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IP ADDR...%ASA-7-713906: IP = 165.98.139.12, Trying to find group via default group...%ASA-7-713906: IP = 165.98.139.12, Connection landed on tunnel_group DefaultRAGroup

So basically when using certificates I always connect the RA VPN only with the default group DefaultRAGroup. Do I need to use a different web enrollment template for certificate request instead of the user template??? How can I define the OU on the User certificate so it matches the tunnel-group???

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved