Cisco VPN :: 2951s / Pre-Shared Key For Remote Peer Missing?
Mar 25, 2013
I am trying to establish a site-to-site VPN between two Cisco routers (2951s). I am using the below config on both routers. One router has an interface with a public IP assigned to it, the other uses a private IP and is natted by our ASA outbound.
If i remove the tunnel protection ipsec profile command from the tunnel interface, the tunnel comes up no problem and I can ping both ends of the tunnel. But as soon as I apply the tunnel protection on the tunnel interface, it dies. Both sides of the tunnel show up but no pings are allowed and I see in the debugs that for some reason the routers don't think the Pre-Shared keys are configured properly. I have gone as far as making the ISAKMP keys very simple and I know there is something I'm missing here.
On the ASA i'm allowing ESP (protocol 50) and ISAKMP (UDP 500) both directions (in and out of the firewall). I am also allowing UDP NAT-T (4500) just in case. I don't see anything on the firewall being blocked but I can't be certain that isn't causing the problem. What could I be missing here?
*****Router Config*****
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
lifetime 1800
crypto isakmp key cisco123 address PUBLICIPHERE
[code]....
View 3 Replies
ADVERTISEMENT
Sep 26, 2012
I currently have a E3000 router. I have set up a shared USB drive successfully through this router. After a couple of months, I needed to re-locate my router into a different room. After doing so, I plug back in the USB drive and cannot access it. If I go through the GUI, it tells me that the drive type is not supported, and if I just plug it into a computer to obtain the infromation off of it, I get a "drive is corrupted" error
View 5 Replies
View Related
May 25, 2012
I have an ASA 5520 with multiple site-to-site VPN's. A remote customer has changed their Public IP address and now the VPN has gone down. How can I easily change the peer IP of the remote site to the new one without have to put the pre-shared key in again as we don't know what it is and they don't manage their firewall.
View 7 Replies
View Related
Jul 8, 2012
I am unable to VPN to my network from outside using cisco VPN client to PIX-515E. When I try it say: Reason 412: the remote peer is no longer responding. From inside everything work ok, I can connect... (same computer, same settings...)
View 3 Replies
View Related
Mar 18, 2012
We are trying to add an additional LAN-to-LAN IPsec VPN to our network. We currently have one remote office connected, when we configure the second VPN matching the first the tunnel never begins to establish. There is an ACL that is dening the static IP for our remote office.
The layout is as follows:
Main office = ASA 5520
Remote Office A = ASA (Unknown Model)
Remote Office B = Adtran Router
All devices have static IP addresses.
We used the ASDM VPN wizard to create both VPN's.
We have created a rule allowing all traffic from our remote office IP, and that had no effect on the VPN aside from eliminating the following message from our logging:
4 Mar 19 2012 15:18:01 106023 67.50.19.230 50234 TWT-hq-e 31326 Deny udp src TWT-outside:67.50.19.230/50234 dst inside:TWT-hq-e/31326 by access-group "outside-in" [0x0, 0x0]
We have verified that both sides are configured the same however the VPN never is initiated so as of right now the ASA is simply blocking all attempts from our remote office to connect.
View 1 Replies
View Related
Mar 5, 2013
I've been using an ASA 5505 -- ASA 9.1(1) -- with an IPSec Remote Access VPN. Everything works properly, though I recently noticed that when my IPSec session is disconnected, I get the standard message ID 113019, but within that message the Peer IP address is incorrect. In fact, it isn't even close to my actual remote address. [code]
When I first researched the IP, I found it coming from China, which freaked me out. I changed settings, rolled back to 9.0(1), and nothing worked. Finally I rebooted, reconnected the VPN, and the IP changed. This time it was an address from RIPE NIC. I rebooted again, now an address from ARIN in the USA. One more reboot, now a random Comcast residential address.
Within that boot cycle, the peer address always stays the same. I've connected from different devices, different IPs, different ISPs - nothing matters. Additionally, there are no firewall logs for these IP addresses at all.
ASA Remote Access VPN peer addresses in disconnect message are incorrect and change at reboot.
View 3 Replies
View Related
Mar 14, 2011
I have an ASR 1002. Behind that and across another small MAN network (considered inside) I have an ASA. On the remote end, I have a simple 2811.
I need to create a vpn peer from the remote router to both the ASR (to hand off traffic there) and also a peer at the ASA (to encrypto across the MAN). The ASR1002 has the serial connection (DS3) to our MPLS cloud in which the remote is on the opposite side of.
So basically, I've created a single isakmp policy with two crypto map's by the same name but set to different peers and placed on the remote router then applied it to the serial interface. This works fine. Now i throw in the ASA which is behind the ASR. However, the connection still comes through that ASR to get to the ASA.After setting it up, it works as long as I don't have the crypto map applied to the ASR. If i apply the crypto map to the so interface of the ASR, my asa vpn connection stops working.It almost seems as if the crypto map on the ASR is grabbing my enrypted traffic destined for xx.xxx.24.14 and trying to do something with it. [code]
Why can't i peer from my remote router to both the ASA and the ASR on the opposite end of the serial link?
View 1 Replies
View Related
Feb 25, 2013
I am working on wi-fi networks (ISP), So I need to block the peer to peer on my network.My network involves cisco switch 2950/2960, cisco 2800 routers and Access Points, config for peer to peer blocking, for this where I need to config either switches or router.My network basic setup is, The internet will pass from router to switch and then Access Points.
View 1 Replies
View Related
Apr 19, 2012
I got ASA 5510 with base license, can I block all Peer-2-Peer traffic from inside to outside.
ASA Giga 0/0 connected to ISP Router 2811
ASA Giga 0/1 connected to LAN switch 3560
View 3 Replies
View Related
Jul 25, 2011
I see that Application protection - blocking peer-to-peer file sharing traffic is a capability of Cisco IOS Firewall. How do i configure my Cisco 2911 ISR to block peer-to-peer file sharing traffic?
View 1 Replies
View Related
Feb 13, 2013
I am facing issues in blocking Peer to Peer applications in LAN. I am using 881 Cisco router and below is the config done. [code]
View 1 Replies
View Related
Jul 31, 2011
I recently bought the WAG320N can I block Peer to Peer file sharing on my Network?
View 3 Replies
View Related
Jul 31, 2011
I bought my WAG320N, I too have the internet drop out and from reading in here is a very common problem. Cisco really should bring out a new firmware version and address this issue. Any way you can block peer to peer file sharing with the WAG320N? If so how do you go about it?
View 1 Replies
View Related
Jan 28, 2011
One of the schools whose networks I administer has a peer to peer network running about 30 xp machines. DHCP is achieved and DNS settings distributed via a basic Linksys router; is there any way of distributing proxy server address and port short of entering manually in LAN settings of IE on every terminal - there is no budget to install a server.
View 4 Replies
View Related
Jan 18, 2011
i just set up my 2Xp pc's and one windows7 laptop peer to peer for file and printer sharing but i can not configure internet connection for those pc's
View 2 Replies
View Related
Aug 30, 2011
setting up IPsec for a DMVPN between a 2811 and 2951s in a test lab. I have enabled IPsec on the hub (2811) but I am unable to do so on either of the 2951s. After researching, it seems that I may have the incorrect IOS for this, but I am at a loss which IOS I should be using. Currently the 2951s are on "c2951-universalk9-mz.SPA.151-2.T2.bin" and the only crypto options are(config)#crypto ?
ca Certification authority
key Long term key operations
pki Public Key components
while on the 2811 I get:
WIN-T(config)#crypto ?
ca Certification authority
call Configure Crypto Call Admission Control
ctcp Configure cTCP encapsulation
dynamic-map Specify a dynamic crypto map template
engine Enter a crypto engine configurable menu
gdoi Configure GDOI policy
[code]...
These are all hand me downs?
View 2 Replies
View Related
Apr 16, 2011
I have a ASA 5510 actve/standby and create one site to site VPN with remote peer ip address xx.xx.xx.xx, Our VPN traffic running on 6 mb internet link for video conferancing traffic.Now client give another link 2 mb internet and client told to us our data traffic runnig on 2 mb link but this data traffic running on the same remote peer IP xx.xx.xx.xx.
Secondly request also they need failover over the ISP link.
how we immplement the same on ASA 5510.
View 0 Replies
View Related
Jan 26, 2013
Region : Singapore
Model : TL-WDR4300
Hardware Version : V1
I need to set up remote access to my HDD connected to my WDR4300, so I can always go online when I am out to retrieve the saved files in the HDD. However I have zero knowledge of network setting of the FTP servers, I can gain access when I am home and connected to the Wireless network, but how to gain access remotely.
View 6 Replies
View Related
Mar 12, 2011
i want to set up my two computers /win xp/ installed using peer to peer network , just tell me the needed steps
View 2 Replies
View Related
Jan 24, 2013
I want to prevent guest from doing peer - peer communication on my Guest (5508) controllers. Is this a feature on the WLC or only by applying an ACL on the router interface?
View 2 Replies
View Related
May 17, 2012
What is difference between Peer to Peer network and point to point network???
View 5 Replies
View Related
Jan 10, 2013
Why does Cisco recommend a configuration of originate-only on the ASA with multiple peers configured and the answer-only to the other end? Shouldn't it work as Bi-Directional ?
[URL]
The only scenario I see which could break is if both peers try to establish a VPN at the same time to the ASA. Is there any other reason ?
View 0 Replies
View Related
Dec 7, 2012
I believe that the Cisco Unified Communications Manager Express matches the outbound VoIP dial peer digit-by-digit, because:
1. when using the debug command it shows how it works digit-by-digit till it match a pattern
2. It says in the study guide ( If a match is found, the router immediately processes the call - chapter 6) so I understand its not en bloc
View 3 Replies
View Related
Oct 18, 2011
We are having an issue with BGP flapping peer. We have a ASR1002 as Route Reflector and it work fine with all peers except with 2 peers.
View 3 Replies
View Related
Jun 10, 2013
I have a few site-to-site VPNs connecting to my ASA 5520, but one of the remote VPNs is changing it's public IP, how can I change this IP on the ASA without starting again? On the ADSM it is greyed out so I can't edit it, but can I just change it in the CLI?
View 2 Replies
View Related
Sep 25, 2011
am in the progess of replacing a Zyxel USG 300 to a Cisoa ASA 5510.In the Zyxel I have some Site to Site, where the peer is a dyndns.org adresse, becourse the peer is a dynamic ip-adress.
I have maybe 10 site to site´s where the peer is a dynamic with a dyndns.org adress, and the presharedkey is diffrent at each tunnel.How can i make this configuration at the ASA 5510?
View 1 Replies
View Related
Feb 14, 2013
I have another odd issue (I get those alot) I have an asterisk box that moves around between 2 IPs, thus the dial-peers are unpredictable as to their target IP. They work as the dial-peer will eventually (after 1 min) time out and go to the other dial peer, but waiting 1 min sucks, and it's a tiny network, 5-10 sec would be WAY more than enouph. Does anyone know off hand a way to get them to time out faster?
View 5 Replies
View Related
Oct 22, 2011
I have a simple question regarding dead peer detection on the ASA 5520. I am using a cellular VPN device to connect back to an ASA 5520 and I have noticed that the connection drops at random periods during the day. The vendor for the cellular device recommends disabling dead peer detection on their device, which I have done. The question is, where is this disabled on the ASA? is it the IKE Keepalive setting under the tunnel group option?
View 1 Replies
View Related
Apr 1, 2012
I'm running a 5505 with DHCP on the outside interface. All 5505 are connecting to 5545.Can I configure the ASA for a site to site to automactically discover the the peer address and automatically establish a connection with 5545?In other words can I configure all settings for the site to site except the peer address. Once connected on network and get outside DHCP, can it also put that address is the peer section of site to site?
View 1 Replies
View Related
Feb 13, 2011
I confgured one L2L VPN on my ASA 5505.
How to add another L2L configuration for an additional peer ?
View 4 Replies
View Related
May 19, 2013
It seems the 7.3.101 version Mobility group peer cannot up,: refer to the attach,
Peer 1: version: 7.3.101
Peer 2: version 7.0.98
Peer3: version 7.2.103
Today we got new two WLC for Anchor use, and config the mobility group, but it's failed and cannot up, the ping is ok.
View 13 Replies
View Related
Nov 21, 2011
i still newbie to configure eBGP, i have Router 3600 series, and i configure BGP neighbor to my ISP, but the peer still don't established,there is warning like this, Connections established 339; dropped 339 "Last reset 2w4d, due to Peer closed the session No active TCP connection"
any one can explain to me about "due to Peer closed the session"? i've read some documents for troubleshooting BGP, and do some step to troubleshoot.
View 15 Replies
View Related
Jan 22, 2011
I've connected my 3 pc's to share file printer and internet using peer to peer connection but on the clients pc the internet connection is soooo slow? my two computers are windows XP an d one Windows7.
View 1 Replies
View Related
