Cisco VPN :: ASA 5520 8.4(3) Tunnel Default Gateway And Various Subnets

Apr 9, 2012

I am struggling on a problem for over 2 weeks despite of various researches.
 
We have a Cisco router, then an ASA 5520 8.4(3).
The private interface of the ASA is connected to a switch, and so on connected to one interface of the router.
The private interface is as following : 129.88.63.253 255.255.248.0 (/21) =>
It is in the 129.88.56.0/21 subnet
 
Here is the part of the router config we are interested in  :
!
interface Vlan32
ip address 129.88.63.254 255.255.248.0 (this is the tunnel default gateway configured on the ASA - 129.88.56.0/21 subnet)
ip address 129.88.71.254 255.255.255.0 secondary
ip address 129.88.75.254 255.255.252.0 secondary
ip access-group CVPN-depuis-129.88.56 in
ip access-group CVPN-vers-129.88.56 out
ip verify unicast source reachable-via rx allow-default
no ip redirects
mls rp ip
!
 
On the ASA, there is currently one default route for the tunneled traffic :
route Private 0.0.0.0 0.0.0.0 129.88.63.254 tunneled
As you can see, it's on the same subnet as the primary IP address of interface Vlan32 on the router.
 
The scenario is as following :
- we can connect to the VPN with the appropriate alias (LDAP connection), then we get an IP address in the defined range (it's a local ASA pool)
- the pool is : 129.88.71.0/24
- but, once we are connected, we can't do anything, because it seems like we don't have any network access

View 9 Replies


ADVERTISEMENT

Cisco VPN :: Tunnel Between 2 ASA 5505s With Same Default Gateway?

Jan 4, 2012

Is it possible to create a site-to-site ipsec vpn (lab environment) between two 5505's (ASA IOS 8.2(5) & asdm-645-206) with the same default gateway. I.E. a back to back site-to-site VPN tunnel or do I need to deploy a router and hang each 5505 off a different interface? We have plenty of public IP's but only one default gateway to our ISP (Internet).

View 2 Replies View Related

Cisco Switching/Routing :: 1841 Tunnel Without Default Gateway Not Connecting

Feb 12, 2012

I'm trying to configure an IPSEC VPN + tunnel for multicast data. When the default gateway is set on the router (1841) it works fine but if I only set a route to the IPSEC peer via our gateway then the tunnel fails to come up. The end point is to a 3rd party. [code]
 
I found that if I add a static route for the tunnel destination via fa0/0, the public facing interface, the tunnel comes up..ip route 10.23.4.2 255. 255. 255. 255 FastEthernet0/0
 
and I can then ping the tunnel IP at the far end - 10.23.0.5.Why would that be? Is there a better way to do this without using a default route??

View 4 Replies View Related

Cisco Routers :: Getting VPN Gateway To Gateway With NAT For Multiple Subnets / RV082?

Feb 11, 2012

I have a pair of RV082 routers and I'd like to configure gateway to gateway VPN tunnel as described in a cookbook, "How to configure a VPN tunnel that routes all traffic to the Remote Gateway," (file name Small_business_router_tunnel_Branch_to_Main.doc).  I followed this cookbook and found that my while the Main office has internet connectivity, the branch subnet doesn't have internet connectivity. 
 
Routing does behave as advertised, where all traffic does go to the main office.  However, the 192.168.1.0 subnet in the branch office does not get internet connectivity.  I've read in other posts that the Main office router will only provide NAT for the local subnet, not the branch office subnet.  Is  there a way to configure the RV082 router to provide NAT for all subnets?
 
If not, which Cisco product will provide the VPN Tunnel connectivity as well as the NAT for all subnets?  Can the RV082 be used as part of the final solution or are my RV082s a  wasted expenditure?

Following is the configuration that I'd implemented, (real IP and IKE keys are bogus). 
  
Gateway To Gateway    
Remote                                                   Main Office
 Add a New Tunnel
Tunnel No.                  1                                               2
Tunnel Name :               n1-2122012_n2-1282012        n1-2122012_n2-1282012
Interface :                  WAN1                                    WAN1

[code].....

View 2 Replies View Related

Cisco Routers :: RVS4000 To Use A Gateway To Gateway IPSec Tunnel

Oct 17, 2011

Can I have use a Gateway-to-Gateway IPSec tunnel whereby a user can surf the Internet using his local Internet connection and at the same time connect through the IPSec tunnel to a remote subnet using RVS4000 routers?

View 1 Replies View Related

Cisco Routers :: RV8082 Setup A VPN Tunnel With Gateway-to-Gateway

Apr 8, 2012

I have two Cisco RV8082 Routers which I would like to setup a VPN Tunnel with Gateway to Gateway.  One location is a static IP Address.  The other location is a dynamic IP address.

View 2 Replies View Related

Cisco Routers :: RV042 VPN Tunnel For Multiple Subnets?

Aug 5, 2011

We have 4 RV 042 routers and  cisco router at HQ, we have Site to Site VPN tunnels in between, All branch offices are connected to HQ via S2S VPN tunnels
 
10.10.1.0/ 24 HQ
10.10.2.0/24 Branch 1
10.10.3.0/24 Branch 2
10.10.4.0/24 Branch 3
10.10.5.0/24 Branch 4
  
now lets say i am branch 1, i can access 10.10.1.0/24 network but cant access 10.10.5.0/24 network, means i dont have branch to branch connection, it should be through HQ, means my RV042 at brnach  should fwd all traffic to HQ for another branches also. Under VPN tunnel if i try to configure remote destination 10.10.0.0/21 its not allowing me it says network overlaping with local network, how i can sole it, I know how to do in cisco, we can permit those networks in access lists.

View 1 Replies View Related

Cisco VPN :: ASA 5520 Not Processing RRI Subnets

Jun 18, 2012

I am coming to this forum because TAC and several CCIEs are having trouble finding me a solution to my problem.
I have Two 5520s each running 841 connected in two different data centers with two different internet providers. I have 100+ 5505s that have the capability to connect to either 5520 via EZVPN to either 5520. Up to now there has not been a need for a 5505 connected to one 5520 to talk to another 5505 on the other 5520. Each 5505 accesses network resources as in any enterprise network. Our company recently started telecommuting and I have been giving 5505s and a VOIP phone out to people. What was discovered is, if you are on one 5505 connected to a 5520 and the other 5505 is connected to the other 5520 the audio in voip does not work. If both the 5505s are connected to the same 5520 than everything works fine. Conversely a 5505 on one 5520 cannot ping a 5505 on the other 5520. 5505s on the same 5520 can ping each other no problem.
 
My problem: All 5505's are configured for a 172.18.xxx.xxx  255.255.255.224 subnet. This subnet is not used anywhere else. So I have a 100 Class "C" subnets carved up into 255.255.255.224 networks. If I look at a specific route for a subnet on one 5520 I see it pointed to the outside interface via RRI. I can look for the route in the 5520s connected CORE switch and I see the route pointed to the 5520. We have a fiber connection to the CORE in the other data center. The route is in this CORE switch as well. When I look for the route in the 5520 connected to this core it is not there. I have all other routes visible but not this particular route which should show on the inside interface. All I show on the 5520 are the 5505s connected to this ASA. So the 5520 is not processing the RRI subnets from the other 5520 and vise versa. Thats why a 5505 on one 5520 cannot ping a 5505 on the other 5520. I only see 172.18.0.0/27 on the outside interface of both 5520s. I do not see any 172.18.0.0/27  on the inside interface on either.
 
I have had numerous TAC cases open on this and no one seems to either understand my problem or have a solution for me. My local sales rep CCIE says the problem looks like a bug in 841 (which I am running) and that the ASA is not processing RRI from eigrp which I am running as well. The whole network is running the same instance of EIGRP including the 5520's.
 
My questions:
1) Is it possible the 5520 is not allowing 172.18.0.0/27  on both the outside and inside interface? Even though all subnets are masked proper the ASA maybe thinks it is being spoofed? I have not been able to confirm this using the real time log.
2) Could this really be a bug? I have looked at all the release notes and have not found anything resembling my problem. TAC has not recommended that I upgrade or downgrade my IOS.

View 6 Replies View Related

Cisco WAN :: How To Handle Non-overlapping Subnets With ASA 5520

Nov 25, 2011

Our IPS has given us a second range of IPs as we were running out.  Unfortunately, they can only give us two non overlapping range.  I am running two ASA 5520 in fail over to handle our traffic but I don't know the best way to use both external ranges.  This is not a failover scenario -- and I need outward facing servers on both ranges.  It is adventageous to us to keep the two external subnets separating two of our operations so we don't want to bring everything into one subnet (long story).I have one NIC designated outside that will need to cater for both wans.  As there are two subnet there are two gateways.  How do I keep the traffic on track?

View 4 Replies View Related

Cisco Firewall :: 5520 Change Of Subnets

May 19, 2013

i have a asa 5520 that is working with three zones DMZ, inside and outside.
 
my DMZ is for all my branches and it had a /24 subnet my inside had a /24 subnet and all was fine i could talk to branches and they could talk to me. i also had all the branchess accessing internet via the ASA which is at HO. i changed the subnets from /24 to /21 and broke everything
 
below is the configs for the asa
!
interface GigabitEthernet0/0
nameif outside

[Code].....

View 4 Replies View Related

Cisco Firewall :: S2S VPN Between ASA 5520 And 5505 With 2 Subnets On Different VLAN

May 26, 2013

Site A:
ASA5520
VLAN data               subnet 172.16.10.x/24
VLAN Voice             subnet 10.0.0.x/24
 
Site B:
ASA5505 Base license
VLAN data               subnet 192.168.10.x/24
VLAN Voice (restr)    subnet 10.0.1.0/24
 
The callmanager is located on site A and needs to sent out DHCP-offers to site B through the VPN so the IP-phones can register to the callmanager. I got the VPN up and running for the data-subnet but i can't get traffic through the voice-subnet/VLAN.
 
Can the ASA's do the job or do I need to route traffic before the ASA's on both sides and sent it through the tunnel, configured both subnets as interesting traffic? Ofcourse the last situation I need to upgrade the license for the 5505 to gain more VLAN's.

View 4 Replies View Related

Cisco VPN :: 5520 Cannot Connect Remote Subnets Via ASA To Draytek Router VPN

Jun 19, 2011

my local site has Cisco 2811 router connecting locally to ASA 5520. Remote site A has Draytek Vigor2950. I have working vpn between local subnet 10.0.0.0/24 and remote site A 10.100.6.0/24. I have remote sites B (10.100.7.0/24) and C (10.100.8.0/24). I would like to route traffic from local site to remote sites B and C via the local-to-remote A vpn. On Draytek routers B and C, I have added to subnet 10.0.0.0/24 to the remote network profile list. On local router, I route traffic for subnets 10.100.7.x and 10.100.8.x to the ASA. On ASA I have added these subnets to the profile for local-to-remoteA vpn.But the vpn will not establish when I attempt to ping from local to remote B or C.

View 5 Replies View Related

Cisco Firewall :: ASA 5520 - Allowing Guest Wireless Network Access To Internal Subnets

Jan 23, 2012

We have a Cisco wireless infrastructure in place that includes a guest network with its own subnet that is a sub interface of the inside interface on our ASA 5520.  There are no routes for it to be allowed access to the internal subnets.  So it can only access the internet.  This is primarily used by the public, but we have several non employee personnel that we only want to give internet access and force them to access the internal network through our clientless SSL vpn portal or through other internet facing internal resources such as webmail.I have done packet traces from within the ASA and the break appears to be there is no ACL allowing the traffic back into the network once the web resource replies to the request and the traffic is attempting to come back into the network from the web resource.  Is that as clear as mud?
 
I know that this has to be a common problem and a way around this is to allow the guest wireless network access to the internal network but only for the select resources that they require.  And that this can be done seemlessly by network specific routes and or alternate DNS entries, but I would like to keep this simple and just allow them to access the web resource, webmail and VPN, from the guest wireless using internet DNS servers without route trickery.

View 8 Replies View Related

The Default Gateway Is Not Available?

Feb 21, 2013

i joined because i keep on having the same problem. i read around the forum a bit before joining and i saw that mcafee was causing the problem for a lot of people. i dont have mcafee so that cant be it several crashes per day. like, literally close to 100 of them.

View 3 Replies View Related

Default Gateway Not Available

May 3, 2012

Periodically, I drop internet everywhere around my college's campus. I'm literally four feet from a router, but it doesn't seem to matter. I'll disconnect, run troubleshooter, and I'll get the error message saying that the default gateway is not available. My college is designed for Macs, but I'm running Windows 7. My Mac colleagues do not experience problems. The computer works at home and at nearly every other wireless network I've brought it in range of. Specifically, either IBM or Dell.

Dell XPS 15
i7-2720QM
8gb Ram
Windows 7 Home Premium SP 1
540? Something around 500 Nvidia graphics card

Ipconfig results:

Windows IP Configuration
Host Name . . . . . . . . . . . . : George-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No

[code].....

View 14 Replies View Related

Default Gateway Is Not Available?

Nov 30, 2011

I recently got a new laptop and ever since, the internet goes in and out. Most of the time it is not out long enough to display the no connectivity icon or stop music from streaming but it is noticeable. When I run the troubleshooter it says that the default gateway is unavailable. I tried manually setting the connection information but the same thing keeps happening except the troubleshooter then says that DHCP is not enabled. I've disabled every firewall I can find and updated all the drivers available. Here is my info:[CODE]

View 3 Replies View Related

Cisco :: ASA 5505 As Default-Gateway?

Mar 28, 2012

I am trying to get rid of 2 old 2651xm's and 2 2950's from my CCNA days and want to get into the ASA realm. Can I be able to use the ASA, not only as a security appliance / firewall, but also be able to write the access lists, etc, to be able to use this as my router to push packets to and from my internal LAN to the outside world? I guess I should have stated as this being the front end device to my network, just after my DSL Cable modem, that is..and being the only device. I am trying to have this as my main router /firewall solution and then I have an old Linksys router I will pipe off one of the L2 ports to have an AP for my wireless devices? Is this a real solution an ASA can provide?

View 2 Replies View Related

Cisco :: Cannot Ping Default Gateway From R2 To R

Feb 13, 2013

i'm having problem to ping succesfully default gateway on Router1 from Router2. Basically i can: - ping from R1 the serial interface on R2 and default gateway on R2 - telnet from R1 to R2 - ping from R2 to serial link on R1, BUT I CANNOT ping default gateway from R2 to R1 Below is the photo showing topology and running configuration on both routers

View 2 Replies View Related

Cisco WAN :: Can't Use ASA5505 As Default Gateway For LAN

Mar 16, 2011

We have a network consisting of a central site and a few remote offices. The sites are all connected via MPLS and also have VPNs over ADSL / internet connections as a backup. The remote offices have Cisco 837 routers for the ADSL connections which we can manage but the MPLS routers are managed by the service provider providing the MPLS connections. At the central site we have a Cisco 891 for the the MPLS connection (which we manage) and a Cisco ASA5505 for the backup VPNs.
 
In order to implement failover from MPLS to VPN in the event of any MPLS line going down I have tried to use ip sla monitors and tracked objects on the 891 as per Cisco's documentation. The problem that I am finding is that I can't set the number of ICMP echo failures required before the tracked route is dropped. Whenever the ip sla monitor fails to get a response the tracked route is dropped immediately. This is too sensitive as packets are occasionally dropped which results in the routes bouncing back and forth between MPLS and VPN too frequently (disconnecting users in the process).
 
I have tried different threshold types and values, tried configuring ip sla monitor reaction-triggers (although I don't understand what little documentation that I can find on this) and have even looked at event manager. I have been working on this for a few weeks now and am getting nowhere.
 
The Cisco ASA5505's implementation of ip sla monitor is much better in that it is possible to specify the number of packets but unfortunately we can't use the ASA as the default gateway for the LAN as the asymmetrical routing that occurs does not work with the firewall function of the ASA.
 
Any issue with ip sla monitor on IOS and managed to get it working?

View 2 Replies View Related

No Default Gateway When Hardwired?

Jan 3, 2011

When I plug my laptop up to our modem, all i get is local access. IPconfig gives me to default gateway or dns suffix. Naturally there is no wireless. My roomates laptop runs fine wired or not and we have the same set up.Not sure what to do.

View 12 Replies View Related

Default Gateway Came Up Empty

Feb 8, 2013

I am having issues playing certain games on my ps3. So I've been searching for solutions and I came across a video that wanted me to go to run/cmd/ipconfig. I have little knowledge of computers but I'm not sure that what my ipconfig is showing is supposed to be there. At first I googled and learned about ipv6 addresses because i found that weird but i think that checks out fine. I then googled about the weird numbers and letters in my default gateway and came up empty. Is there a reason thats there?

View 3 Replies View Related

Possible To Use Ubuntu Box As Default Gateway

Jan 2, 2011

I have Squid proxy installed on a ubuntu box here. Currently all my PC's use my ADSL modem as their default gateway but what i wanted to do was see if it was possible to use the ubuntu box as the default gateway, and have it route through Squid to my ADSL modem.

View 3 Replies View Related

Cannot Connect To Default Gateway

May 20, 2011

I am trying to change the password on my D-Link router. So i typed ipconfig into cmd and the default gateway i get is 169.234.95.I have tried what used to work at home such as 192.168.0.1 and all of those.

View 9 Replies View Related

Not Able To Ping Default Gateway

Sep 10, 2012

I have a VM server, whose IP is in customer VLAN600 ( 172.60.60.10/24 ) and Peer end is switch then Firewall.Switch is configured with same VLAN600 and learning mac-address of Server on VLAN 600, Firewall is also having VLAN600 and IP is 172.60.60.1/24.Server is not able to Ping/reach Firewall and vice versa.

View 1 Replies View Related

Cannot Connect To Default Gateway?

Dec 18, 2012

cannot connect to my default gateway 192.168.1.1 frustrating.

View 1 Replies View Related

No Internet Or Default Gateway

May 8, 2011

Basically, I'm using a broadband modem, which appears to be connecting fine, with all the required lights being on. My ISP says that, from their end, everything is perfect. Even my laptop shows Local Area Network as connected.However, for some reason, I am not able to access the internet. I was able to use it till last evening, but suddenly the internet stopped working. On Google Chrome, it says that there is no DNS or something.Subsequently, when I tried to access my modem settings, it shows as 'webpage not available'. I then noticed that there is no default gateway! I was able to access it the day before, but now I can't.

View 10 Replies View Related

DD-WRT WRT150N Default Gateway?

Feb 7, 2012

i recently had to do a 30/30/30 reset to my Linksys WRT150N which has DD-WRT installed on it... I can't access the configuration settings on the router by typing in 192.168.1.1. I did IPCONFIG/ALL and couldn't nothing came up for Default Gateway.

View 4 Replies View Related

Error - Default Gateway Is Not Available

Sep 17, 2012

It only happens with 1of my laptops, all others have not problems. In the network and sharing ctr, it intermittently says Access type: internet then suddenly I get a no internet access. I've tried release renew DNS, reboot computer, release/renew IP. When it says I have internet access, I attempt to connect to no avail.

View 7 Replies View Related

Cisco :: Default - Gateway On Switch Command

Mar 27, 2013

I'm really not clear about default-gateway on switch command, not the function but how its works.i have 1 multilayer switch (MLS 1) that have 2 vlan within it, vlan 2 and 100. on vlan 2 i assign ip address of 192.168.1.1 and on vlan 100 is 172.16.1.254. both vlans are up. then under that multilayer switch i added 2 more MLS (MLS 2 and MLS 3), and the links of MLS 2 and 3 to MLS 1 are trunking. and both MLS 2 and 3 have a same vlan with MLS 1. that i assign an ip address on vlan 2 in MLS 2 192.168.1.2 and i set default gateway 192.168.1.1, and i do the same to MLS 3 but the ip address of vlan 2 is 192.168.1.3i already setup the routing protocol on MLS 1 so that vlan 2 could contact vlan 100. but the fact it doesnt work at all, both MLS 2 and 3 cannot contact vlan 100 eventhough that are already have default-gateway setup, is there anything wrong with the configuration ??

View 3 Replies View Related

Cisco :: BGP And Default Gateway 50% Loss Between Hosts

Mar 22, 2013

Why it makes problems to use a default route on a BGP-router (cisco 6500 with sup720 3bxl).Only a very few amount of hosts have that kind of problem and the 50% paket loss is only between this hosts. So another host has no loss to any of the affected hosts. looks for me like there is a problem in the CEF-table.The router has a BGP-fulltable. The gateway of last resort is only set for cases like a flapping BGP-route, so that the traffic is sent to a default next hop, because sometimes he knows a better route which isnt flapping.

View 1 Replies View Related

Cisco VPN :: 5510 - ASA 8.4.(1) VPN L2L Can Only Be Established Through Default Gateway

Jun 19, 2011

We have an ASA 5510, with two internet connections. One inteded for VPN l2l and the other for general users inet access.

On asa 8.04, I configured the crypto map on inteface "VPNAccess" and a static route to the L2L remote peer through VPN internet access, the default rotue was pointing the general inet router.
 
We bought a new firewall with 8.4.1, and now asa only tries to initiate traffic if remote peer is on the default gateway.
 
It ignores more specific routes (i mean longer masks) and always tries to use default gateway, but only for VPN, if I make a trace route for that peers it uses correctly the routing table.

View 12 Replies View Related

Cisco Routers :: RV042 Not As Default Gateway?

Apr 11, 2012

I have RV042 on my remote network, i have problems with VPN connection ,  user can connect to RV042 but only inside IPs that can ping from vpn user.Is it any  way to make the traffic from Rv042 will back to RV042 . maybe with nat.. in example below 192.168.5.100  is my lan IP from my DSL dhcp, and 172.27.0.20 ip on remote, traffic not back to my pc/vpn client, what i want is to translate 192.168.5.100 to RV042 LAN ip address
 
1485: ICMP echo request (len 32 id 256 seq 29) 192.168.5.100 > 172.27.0.20
1486: ICMP echo reply (len 32 id 256 seq 29) 172.27.0.9 > 192.168.5.100
1487: ICMP echo request (len 32 id 256 seq 30) 192.168.5.100 > 172.27.0.20
1488: ICMP echo reply (len 32 id 256 seq 30) 172.27.0.9 > 192.168.5.100

[code]....

View 3 Replies View Related

Change The Default Gateway Of RDP On Server?

Oct 11, 2011

I rdp into our server 2008 via IP. This is a router on ip 0.1, this is forwarded to my server on IP 0.3. This server was setup with DHCP default gateway of 0.1. We added a new outside connection on IP 0.2. I was talked through the changes so that internal DHCP requests went to gateway IP 0.2 but RDP still used 0.1. I plan on getting rid of 0.1.Where is the setting to change the RDP to use default gateway of 0.2?

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved