Cisco VPN :: 3005 - Double NAT?
Oct 27, 2011
I have inherited a Cisco VPN 3005 and need to configure an interesting scenario:
2 LAN-2-LAN tunnels: 1 required an outside IP and has an existing static NAT of 192.168.1.1 -> 12.2.1.1 for 0.0.0.0 as the destination.I now have a need to created a new NAT for 192.168.1.1 to translate to 10.99.1.1 for destination of 13.3.1.1, 14.3.1.1 and 15.3.1.1.
Is it possible to have the above scenario, or even NAT 12.2.1.1 from the first NAT back to 10.99.1.1??
View 1 Replies
ADVERTISEMENT
Jan 13, 2013
My organization has an old 3005 that i need to wipe the config of. The problem is that i cant gain access to the device via the console port. Every time i try connecting using a terminal session, all i see is a blinking cursor. As a result, my question to the group is there another way to wipe the config on this device?
View 2 Replies
View Related
Mar 29, 2011
I have an interesting problem. I've configured a site to site VPN connection between these two devices. I am using the CDMA card as the primary and only outside connection on the 1921. What happens is that by default the cellular connection is offline. When traffic is generated internally from that network to the concentrator side of this scenario the cellular connection goes online and builds the tunnel, no problem. However, I cannot initiate the tunnel from the concentrator side. I think what i need is a way to force the cellular connection to always be on, and if it fails to come back online.
View 3 Replies
View Related
Dec 28, 2011
I try to connect from my Windows 7 32bit PC with CISCO VPN Client (5.0.07.0410) to a CISCO Concentrator 3005.
Initializing the connection using certificate "xxx"
Contacting the security gateway at x.x.x.x...
Negotiating security policies...
Securing communications channel...
Secure VPN Connection terminated by Peer.
Reason 435: Firewall Policy Mismatch.
Connection terminated on: Dez 28, 2011 18:06:56 Duration: 0 day(s), 00:00.00
Not connected.
The client did not match the firewall policy configured on the central site VPN device. Cisco Systems Integrated Client Firewall should be enabled or installed on your computer.
Log on CISCO Concentrator:
32284 12/28/2011 18:06:56.620 SEV=5 IKE/141 RPT=40 x.x.x.x
Client-reported firewall does not match configured firewall: terminating tunnel.
Received -- Vendor: (0), Product (0), Caps: 0000. Expected -- Vendor: Cisco Sy
stems(1), Product: Cisco Integrated Client(0x00000001), Caps: 0002
32287 12/28/2011 18:06:56.740 SEV=5 IKE/194 RPT=8064 80.153.72.120
Group [xxx]
Sending IKE Delete With Reason message: Firewall Parameter Mismatch.
The strange thing is, that I don't have any problems with the same CISCO VPN Client on a Windows Vista PC:
32755 12/28/2011 19:04:24.540 SEV=6 IKE/143 RPT=6612 x.x.x.x
Processing firewall record. Vendor: Cisco Systems(1), Product: Cisco Integrated
Client(1), Caps: 0002, Version Number: 0.0.0.0, Version String:
View 2 Replies
View Related
Aug 4, 2011
I have created an L2L tunnel between my self and a 3rd party. I am using a Cisco ASA 5520 and the other end is using a Cisco 3005 VPN concentrator. The tunnel will get established and pass traffic both ways for a little while, it varies, sometimes 1 hour or last time we built it it was working for 17 hours, but at some point my ASA will stop transmitting but it will still be receiving packets. These errors start to show up when I look at the traffic going through my ASA interfaces:
713042 IKE Initiator unable to find policy: Intf Outside, Src: 192.168.xx.16, Dst: 10.1.xx.30
Then when I try to ping their hosts .30 and .27 I get:
713041 Group = 68.23.xx.xx, IP = 68.23.xx.xx, IKE Initiator: New Phase 2, Intf private, IKE Peer 68.23.xx.xx local Proxy Address 192.168.xx.16, remote Proxy Address 10.1.xx.30, Crypto map (Outside_map)
713041 Group = 68.23.xx.xx, IP = 68.23.xx.xx, IKE Initiator: New Phase 2, Intf private, IKE Peer 68.23.xx.xx local Proxy Address 192.168.xx.16, remote Proxy Address 10.1.xx.27, Crypto map (Outside_map)
713050 Group = 68.23.xx.xx, IP = 68.23.xx.xx, Connection terminated for peer 68.23.xx.xx. Reason: Peer Terminate Remote Proxy 10.1.xx.27, Local Proxy 192.168.xx.16
When I first configured this tunnel it was with 3DES and SHA for phase 1 & 2, but when the tunnel would come up my phase 1 would negotiate to an MD5 hash, even though I specifically entered SHA, so me and the 3rd party decided to bring all the hashes for phase 1 & 2 down to MD5, and that was when it was up for the longest, but the problem still came back eventually. My ASA config posted below:
ASA Version 8.2(3)
name 192.168.xx.16 Server description Server
name 10.1.xx.27 XYZ_01
name 10.1.xx.28 XYZ_02
name 10.1.xx.29 XYZ_03
[code].....
View 1 Replies
View Related
Feb 7, 2012
The network is set up like this.
Host -----> 3750 (classic) running IPSERVICES stack ----> 3550 router -----> VPN 3005 Concentrator.
IP routing is disabled on the 3750 (it's acting solely as a switch) IP routing is enabled with an EIGRP process running on the 3550 router that has the network for the 3005 broadcasting.
I can ping the vpn 3005 concentrator from a telnet session in the 3550 but not from the 3750.I can ping between the 3750 and the 3550 vlan management interfaces. Visually speaking it's like this
3750 ------> 3550 [Success!!!!]
3550 ------> VPN 3005 Concentrator [Success!!!!]
3750 ------> 3550 --xxxx--> VPN 3005 Concentrator [Timeout....]
I know this because I tracerout to the 3005 from the 3750 and it resolved the default gateway configured for the 3550 properly but then started timing out.
The 3750 is trunked to the 3550.
3750 is vtp client mode
3550 is vtp server mode
I'm wondering if there's a layer 2 issue involved here as it is a VTP domain and maybe it's not returning properly.
View 2 Replies
View Related
Sep 5, 2011
I have two RFC1918 domains I wish to connect, can I use double NAT with PAT so that each domain is represented as one single ip address with each session a port of that address-
The link is a private point to point link with a /32 mask so could I use this as the PAT address ?
View 3 Replies
View Related
Jun 23, 2011
Facing a problem of double multicast on one of our cisco 3750 switch. On checking with sniffer it was found that out of double packet’s one packet is having source mac-address of vlan and another packet is having a source mac-address of switch base mac-address.
View 3 Replies
View Related
May 18, 2011
I am setting up a new ASA running 8.3 and I am having problems with configuring double NATs.
Here is the thing I am trying to solve:
Original Packet
SRC: 1.1.1.1
DST: 1.1.1.10
After it hits the firewall and it comes out on the outside interface I want this:
SRC: 2.2.2.1
DST: 2.2.2.10
Now when I set this up the way I did in 8.0(4) it just ain't working.
All the NAT examples I can find are simple NATs, I have not been able to find an example of a SRC and DST NAT.
View 3 Replies
View Related
Feb 12, 2011
i bought me a router so that me and a few other friends could play to star craft 2, but i would like to know that if i could play an LAN with NO internet on it?
View 2 Replies
View Related
Feb 3, 2013
I want to know how to have a double SSID but it's forbidden to have a wireless interruption with the wep which is on my cisco aironet 1242AG. I need to have wpa2 in addition of the wep.
View 2 Replies
View Related
Jan 31, 2011
I have 2 LANs in my own PC & 2 Routers (TP-Link WR941N each) with 2 internet accounts (512Kbps each) connected to the same ISP signal & company using NanoStation 5 from ubnt.As u know the connections work separately by default!! (I use Windows 7 64bit)Can I merge them to get double speed (download/upload simultaneously) using reg edit or special software or method?
View 2 Replies
View Related
Jan 4, 2012
We just upgraded our Sg300 series switches to the new IOS so we can get CLI access. The upgrade went fine but it seems we have two login prompts, the first being completely unnecessary as you can just hit return to get by it. IE here is the progression:
1. Connect SSH
2. Receive a "login:" prompt. Anything can be entered here, including just return
3. Login banner is displayed
4. Username Prompt is then displayed. Valid username required
5. Password Prompt displayed - Valid password required
6. Now at CLI 1. Connect SSH
I am trying to get rid of that first login prompt (IE Step 2) as it is causing issues with our configuration software. I have tried every line and authentication command I can think of, the only thing that gets rid of it is using none authentication which obviously we can't stay with. how did you get around it?
View 2 Replies
View Related
Jan 12, 2011
is it to increaze the broadbandwith by using a double usb-modem dial-up ...i know tha we can use double connection, but not in real time...
View 8 Replies
View Related
Jan 31, 2011
I have 2 LANs in my own PC & 2 Routers (TP-Link WR941N each) with 2 internet accounts (512Kbps each) connected to the same ISP signal & company using NanoStation 5 from ubnt. As u know the connections work separately by default!! (I use Windows 7 64bit) Can I merge them to get double speed (download/upload simultaneously) using reg edit or special software or method?
View 3 Replies
View Related
Apr 26, 2013
This is my Cisco LAB environment used for study but also in production for daily use. I am trying to setup a double-NAT network with just one IP from my ISP through the ASA & 3825 going to (2) end nodes and multiple ports for port forwarding. It is currently working but only as simple PAT and I cannot initiate FTP from the outside. removing the router, but this is my study LAB and it's a bit unconventional for learning purposes. I attached the diagram and need parts of the config.
View 14 Replies
View Related
Sep 30, 2011
I'm currently switching from a certain internet provider to another and I'm forced to get another router. What I wanted to do is since the initial router has to be on the first floor, I'd like to have the second one on the top floor closer to my computer whereas they would share a dedicated connection between each other wirelessly so it would make my connection faster rather than just having my pc connect directly wirelessly to the initial router on the first floor. Is that possible?
View 4 Replies
View Related
Jul 11, 2012
I only have access to rather slow connections (256 Kbps). But since I have two lines and two modems, I was wondering if I could bond them together and make a faster one. My main modem is a Lynksys WAG120N Wireless-N ADSL2+ Modem Router, which as you can see is also in charge of both wired and wireless networks at my place. The second one is an older D-Link ADSL modem (JUST modem).Since I have an extra LAN port on my Lynksys modem, I want to know if and how I can connect the second modem, and combine the two rates.
View 2 Replies
View Related
Aug 30, 2011
I'm new to networking (at least at this level) and need some guidance. First, I have an Actiontec MI424WR (Rev. F) Coax Verizon Fios modem that I use as my home networking wireless router. From a LAN port on that I've connected a cable to the WAN port on my DIR-655 which acts as my gigabit office hard wire/wireless router. I need to keep the home network and the office network separate.All of my computers are Windows, either 7, Vista or XP.Connected to my Dir-655 on the office network are 2 wireless computers, a printer, an IOMEGA 1TB Home Personal Cloud NAS HDD, plus 2 desktop computers.The DIR-655 is set with a static IP address matching the range of the Actiontec. The DIR-655 is set for DHCP for the devices on the network (although 2 of the computers have static IP address).
When the DIR-655 had a Dynamic IP address set by the Actiontec, the IOMEGA NAS HDD kept losing connection with all the devices on the network. Only after I set the DIR-655 to static IP did that stop and everybody started to play nice. I'm not sure why that would make a difference, but it did.But regardless of whether it is set to dynamic or static, no computer on the network or program, even third party programs, can connect to ANY of the time servers out there... and I mean any of them. I've tried at least 20 or more of the standard and not so standard ones. The DIR-655's time is off, and it is set to get time automatically. None of my computers, or my IOMEGA NAS, can access time. The Actiontec, though, seems to be set correctly.Everything connects to the internet just fine. Web, email, auto product upgrades. Fine. So far it's just the time server thing which troubles.I done everything I know how to do to enable Port Forwarding through both routers for NTP > UDP 123 since that is the standard port for the Network Time Protocol, but I could have easily screwed that up.
View 5 Replies
View Related
Nov 1, 2011
On our 6504 - 12.2(33)SXH, we currently have a single connection to our ISP (GI1/1) and want to add another connection (GI1/2) Is there a way to bond the two connections to form a single connection (a single pipe) to double the throughput?
View 3 Replies
View Related
Jan 9, 2013
I would just like to double-check a point with the forum on licensing on 4710 Appliance.If with version 4.2 and above 2Gbps Bandwidth licence is required, the output of the sho license status should be?
View 1 Replies
View Related
Sep 21, 2011
I've a network with 28 computers and 2 servers. Each server have a double Gbit port configured in Load Balancing & Fail Over.Now, I want to buy two Cisco's Switch SG 200-26 and I would know the best way to connect them and if it's possible to interconnect them with more than one cable to share the trafic.
1. Is this following solution a good one (does the link between swhitches will work when computers will access to servers) ?
2. Is this next solution possible ?
View 3 Replies
View Related
Oct 12, 2011
I have an HP C5280 printer running wirelessly via a TP Link wireless print server and D Link Di 624 wireless router. I can print successfully from either my desktop (which is connected direct to the D Link router) or either of my laptops (wireless). However, when I select the double-sided print option I get a print error message after re-inserting the odd number pages to print the other side of the paper and then click 'continue'.Could I resolve this by connecting the printer both direct to the desktop using USB AND leaving it connected via the wireless TP Link print server? This would enable me to print double-sided from my desktop (as I did before when the printer was only connected via the USB desktop port).
View 1 Replies
View Related
Nov 19, 2011
I'm suffering from an annoying problem with my E4200 router. I have a DSL connection. I have my DSL modem in bridge mode and I have my router set up to sign into my ISP's PPPoE to avoid double-routing. This set up worked marvelously with my previous WRT54G and WRT610N routers.Now the E4200 signs me out of PPPoE every ten minutes or so. I have the connection setting on "Keep Alive" but it seems to be dropping the connection regularly. I took the router back and was given a replacement. The new router is doing the same exact thing and now I am beyond the 30 day return limit so I'm stuck with the E4200. I'm running the latest firmware 1.0.03
I reinstalled the WRT610N and the connection is steady but the WRT610N has its own problems (devices connected via wireless cannot see wired devices and vice-versa). I'd like my new router to actually work properly. I've ruled out errors on my end and given that two brand new units of the E4200 generated the same problem I tend to believe it is a design error.
View 9 Replies
View Related
Nov 21, 2011
I have a problem with my home network/internet - I have a working wireless network that I have used for some time now and it works just fine. the problem is that internet restrictions where I live require me to register each unit to the building network before I can gain access to the internet. My caretaker told me today that normally, I only should register my primary computer and the wireless router to be able to use the internet freely. However when a new laptop appears( I have a guest), I can easily connect it to my own wireless, but it can't use the internet, as if it needed to be registered again. I ran out of registration codes and I really would like to have freedom i connection opportunities. The caretaker said that the system gives every registered unit a "fake" IP, so after giving it to mu router, all other units connected through that router should have unlimited access. Is my network configured in a wrong way? I don't know how to ask this in a more simple way... I just want to be able to connect a friends laptop to the net with just my local password, which isn't happening.
View 3 Replies
View Related
Jul 20, 2011
I'm trying to test fast roaming using a Cisco 2100 Series controller and 2 1140 APs. The initial authentication succeeds fine and the wireless connection works ok using WPA2+CCKM and LEAP with a Cisco ACS radius server.The problem is that the client does not attempt to preauthenticate with the other AP because the RSN Capabilities IE in the AP beacons and probe responses do not set the RSN Preauthentication capable bit. I can't figure out what it takes to get the APs to indicate to clients that it can do preauthentication. I'm been crawling through all the documentation I can find, to no avail.
View 1 Replies
View Related
Aug 22, 2011
We are about to share a 10 MBit ISP connection with 2 others companies, and they are going to split the bill up into 3,3 and 4 Mbit, so we where thinking that we could setup a switch before their and ours router and provide them with a static IP from our ISP. But is it possible to set a bandwidth limit on the ports of a Cisco Catalyst 2960-8TC, so that we can set a limit of 3,3 and 4 on 3 ports.
View 1 Replies
View Related
Dec 3, 2011
I want to PAT my project of WLAN and i attached the document, how I create the Testing Criteria of the said scenarios, PAT document includes WCS 7.0, WLC 5508, MSE 3310, Cisco AP 3502e and ACS 4.2.
View 0 Replies
View Related
Jul 12, 2012
I have cisco ASA5510 firewall using in my network but unable to bolck Url's unwanted. can i block the [URL] on the asa by using regular exp.
View 3 Replies
View Related
Mar 1, 2012
I have 7 POE switches that have ESI IP phones attached. I have two VLANS, 1 and 2. VLAN 2 is used for voice and is defined in each switch.The ESI IP phones connect to my POE switch ports and the pc attaches through the ESI IP phone.
I have had voice quality issue between floors in my building. Talking to others on my floor via the IP phone, there are no voice quality issues. [code]
View 1 Replies
View Related
Nov 18, 2012
is it possible to connect Cisco Ap-1242AG with non-cisco wireless router to work as repeater?
View 1 Replies
View Related
May 1, 2012
I am looking at a config on a 5550 FW, and am trying to make sense of the syntax of the following rules. I have been to the Cisco site, but can't find much on the syntax.
View 8 Replies
View Related
Mar 10, 2011
I currently use a device called the Access Enforcer which runs OpenBSD. I have 3 stable, working VPN tunnel's where the other side's device is a Cisco ASA 5520 or 5540. I was setting up my 4th VPN where the other side used a Cisco ASA 5520 and ran into issue's. The Cisco side can bring up the tunnel. Once the tunnel is up each side can talk to the other side. However, when the tunnel is dropped, the OpenBSD side cannot bring up the tunnel. The error received is on the OpenBSD device is "isakmpd[29581]: transport_send_messages: giving up on exchange from-XX.X.X.0/24-to-XX.XXX.XXX.240, no response from peer XX.XX.XXX.141:4500". I have been trying to figure this out for weeks now and can't seem to find the cause.
View 3 Replies
View Related
