Cisco VPN :: Disable TCP 1723 And 10000 On Concentrator?
Jul 17, 2012Where did I need to go on the Concentrator to disable tcp 1723 and 10000? We don't require these to be open and our pen test shows these as being open.
View 1 Replies
ADVERTISEMENT
Cisco :: W2K8 R2 - LMS 4.2 Maximum Records In Syslog Report Is 10000
Jul 31, 2012LMS 4.2.1 W2K8 R2
I seem to be unable to generate a syslog report that contains > 10,000 records. And I don't mean with run type immediate either. I am scheduling them to run at the next 5 minute interval (incidentally, why not have an option that just says "run in background now"?)
I am facing an issue where a bunch of errors are being generated by a voice gateway and I want to determine when the problem started. My syslog contains 7 days of records. If I schedule a report to give me all syslog records for the last 1 week (or 7 days I have tried it both ways) for all devices at that location I get 10,000 records, and they are all for the current date. If I schedule a report and select a date range in the past, I get records within that date range, but only 10,000.
Cisco Switching/Routing :: Get Traffic From 192.168.1.33 On UDP Ports 10000-20000 And 5222?
Jul 29, 2012So I am trying to get traffic from 192.168.1.33 on UDP ports 10000-20000 and port 5222 (udp) to have DSCP set to EF and Forwarded accordingly.
Building configuration...
Current configuration : 32481 bytes!! Last configuration change at 22:52:11 UTC Mon Jul 30 2012!version 12.2no mls acl tcam share-globalmls netflow interfacemls qosmls cef error action freezevty-async!!spanning-tree mode pvstdiagnostic bootup level completeaccess-list 99 permit 192.168.1.51access-list 99 permit 192.168.1.9access-list 99 permit 192.168.1.8access-list 99 permit 192.168.1.12access-list 111 permit udp any any range 10000 20000access-list 111 permit udp any any range 1 9999access-list 111 permit tcp any anyaccess-list 111 permit udp any any range 20001 49151access-list 111 permit udp any any range 50000 65535access-list 150 permit udp any any eq 5060!redundancymain-cpu auto-sync running-configmode sso!ip access-list extended Modesto_Officeremark Wireless Linkpermit tcp any any establishedpermit icmp any anypermit udp host 65.214.162.12 host 99.24.26.84 eq tftppermit ip host 65.214.162.24 host
[code]....
Cisco Switching/Routing :: UDP Port 10000 And IPv6 Ports Listening
Aug 30, 2012I've several production Catalyst switches that are listening on the same IPv4 and IPv6 ports. The problem is I don't want the switches listening on the IPv6 ports.[code] How to shut down these listening ports?I also have a few production switches listening on UDP/10000 and I cannot determine why this port is listening. [code] I've seen where UDP/10000 is Network Data Management Protocol and is related to Storage networks ###, but I've also seen where UDP/10000 is the default port for IPSEC data.I don't believe UDP/10000 is related to either NDMP or IPSEC data, though I could be very wrong.
View 4 Replies View RelatedCisco WAN :: 1723 - PPTP Over NAT NVI
Dec 20, 2010i have a user in LAN which needs access to remote PPTP server. My router uses NAT NVI for some reasons to provide internet access.
Problem is what tcp/1723 is NATed successfully and it appears what GRE traffic is NATed as well, but GRE packets are NOT passed back to user on LAN.
Config is that simple:
interface Fas4
ip address x.x.x.x x.x.x.x
ip nat enable
interface Vlan1
ip address 10.0.0.1 255.255.255.0
ip nat enable
ip access-list extended nat_clients
permit ip 10.0.0.0 0.0.0.255 any
ip nat source list nat_clients interface Fas4(code)
Cisco VPN :: ASA 5505 - Internet Native Client / TCP Discarded 1723
Jul 15, 2012I'm configuring this asa for to connect home users to my network using the native microsoft vpn clients with windows xp over internet.This asa have on the outside interface one public intenet ip and in the inside inferface have configured in the the network 192.168.0.x and i want to acces to this network from internet users using native vpn clients.I tested with one pc connected directly to the outside interface and works well, but when i connect this interface to internet and tried to connect on user to the vpn i can see in the logs this, and can't connect with error 800.TCP request discarded from "public_ip_client/61648" to outside:publicip_outside_interface/1723"
(running configuration)
: Saved
:
ASA Version 8.4(3)
!
hostname ciscoasa
enable password *** encrypted
[code].....
1723 Open On Routers But Can't Telnet From Internet Address?
Feb 1, 2011I have small business server 2003 setup as a DC and did not install exchange, i use hosted exchange. i am trying to setup vpn and have opened port 1723 on both of my router. my network routes through a wireless router(192.168.1.1) (port 1723 forwarded to .1.104) to a second wireless router (192.168.2.1) to my server with two nic cards (.2.2 - external and .2.103 - internal) (port 1723 forwarded to .2.2) i can telnet 192.168.2.2 1723, .2.103, .1.104 - my ip of my second router handed by the first router. my server in handling dhcp and it is disabled on my .2 router. I CAN NOT telnet my public ip handed to 1.1 from the ISP(my internet IP). it tries for about 30 secs and dies.
View 8 Replies View Related1723 / Configure VPN To Access Remote LAN Network On Windows 7?
Sep 10, 2012I have two Windows7 machines (PC and laptop). I've set PC as VPN server and laptop as VPN client using default built-in W7 network tools. I've disabled use default gateway in remote network on client machine, so client don't try to route all communication through VPN. I've routed port 1723 (TCP/UDP) on NAT to my server and enabled IPSec/PPTP/L2TP passthrough
I've put my laptop in indepedent network (basically I've connected it via 3G network), connected to VPN server and checked ipconfig /all
I've get:
IP Address: 192.168.1.101
Mask: 255.255.255.255
Gateway: (none)
LAN mask in server LAN network is 255.255.255.0 - I am surely missing something obvious, but Google doesn't give me any good advices; How can I access local LAN network from remote VPN client? How can I access local shared documents?
Cisco Routers :: RV 120W Port Forwarding 1723 To A PPTP Server
Sep 11, 2011We have just acquired a Cisco RV120W Firewall Router and we are experiencing issues with this router. I've read some threads related to port forward issue with RV120W before writing this new topic.
We have 2 locations (site A and site B) connected with a Site to Site VPN (PPTP) running under Windows Server 2008 R2 with TMG 2010. This Site to Site VPN worked very well until we replaced our old router with the RV120W at site B. Since this moment, our engineers are not able to make the site to site VPN work again. The TMG box are located just behind the router.
We have followed some threads about Port Forwarding but it did not solve our issue (others port forwarding rules for RDP for example work). Our RV120W is running the last stable firmware (1.0.2.6) provided by Cisco.
Cisco Routers :: RV120 VPN Firewall Unable To Forward Port 1723
Jul 25, 2011I'm having a problem forwarding port 1723. What i'm trying to do is to use VPN to access my server pc and I don't want to use the VPN software that is in the router. When I telnet the port it goes through but when i try to access it outside of the office I can't get through. I've been using [URL] to check port 1723 and I get this:
Error: I could not see your service on XX.XX.XX.XX on port (1723)
Reason: Connection refused
Cisco :: VPN Concentrator No Logs On Ftp Server
Jun 16, 2011I have a question about VPN Concentrator FTP Backup configuration to get logs on FTP server. I have configure FTP Backup with all details but I still do not see any logs on FTP server. Do you know what could be the issue? I have never used Concentrator and not sure what needs to be done to get in working condition. I am using VPN Concentrator 3015 series.
View 5 Replies View RelatedCisco :: How To Setup LAN-to-LAN VPN Via 3000 Concentrator
May 28, 2011I have been trying to setup a LAN-to-LAN VPN between two sites that are using a 3000 series CISCO Concentrator. After following the basic setups from the CISCO site, I am still unable to create a tunnel. At the moment I'm starting to believe it is how I have physically setup the network. Site 1 is using a Billion BiPAC 7404VNPX ADSL2+ Modem, Site 2 is using a Netgear DGN2000 ADSL2+ Modem, The VPN Concentrators are setup behind these devices with each firewall setup to allow the needed ports forwarded.
View 5 Replies View RelatedCisco VPN :: Wiping An Old 3005 Concentrator?
Jan 13, 2013My organization has an old 3005 that i need to wipe the config of. The problem is that i cant gain access to the device via the console port. Every time i try connecting using a terminal session, all i see is a blinking cursor. As a result, my question to the group is there another way to wipe the config on this device?
View 2 Replies View RelatedCisco VPN :: VPN Concentrator 3000 Login
Apr 14, 2011Our VPN 3000 concentrator's admin password was changed by somebody so i reset the password by using straight through serial cable, now the problem is it allows me to login with admin through console but not through admin web interface or telnet. I have enabled telnet and http access but still no success. Concentrator is using internal database so no AAA server is configured.
View 1 Replies View RelatedCisco VPN :: VPN 3000 Concentrator And AnyConnect?
Aug 14, 2011I have a client who saw there was a android version of the AnyConnect client and want me to go through and get their VPN 3000 Concentrator confingured to be able to connect in with it.
The Conncentrator is currently setup several groups of users and the base group is set up to all other products to connec tin via a pre shared key. It took alot research to get it configured to this point and all the searches i pull up are for a ASA.
Cisco Firewall :: VPN Concentrator On PIX515 DMZ
Feb 7, 2011I'm planning connect VPN concentrator in our company to PIX515 DMZ interface.At the moment , VPN concentrator(used for remote access VPN for laptop users) is connected directly to core switch so as PIx515. Having VPN Concentrator connected directly to LAN is security risk .SO i want to connect VPN concentrator to DMZ of the Firewall(pix515).
We don't have any test environment and we are not allowed to have downtime of more than 10 minutes in production network ,I want to make sure my design and commands would work without problem .I've attached doigram of our curernt setup and new setup I'm planning to work on as well as commands . Does this design will work .Nat , routing everything .
Cisco VPN :: PIX 515E - Configuration As VPN Concentrator
Jul 2, 2012I need to configure a Cisco pix 515e as vpn concentrator. Now the network has 2 Cisco pix in fail over - May I add a new Cisco pix in parallel and redirect the vpn tunnel on it? How do I need to make the configuration in order to work?
View 2 Replies View RelatedCisco Firewall :: PIX 515 E Deployed As VPN Concentrator
Aug 15, 2012Can a Cisco PIX 515E with an Unrestricted License (UR) be deployed as a VPN concentrator? For example, remote users having VPN clients installed on their desktops connect through the Internet and are authenticated by the PIX 515E at the main site.
View 1 Replies View RelatedCisco :: VPN Concentrator 3000 DES-56 LAN To LAN Stopped Tx
Apr 4, 2012I have a VPN Concentrator 3000 with LAN-to-LAN DES-56 connections connected to it (Cisco PIX 506). Everything was working fine and then over the night something messed up on it. No settings were changed or anything.
First issue was anything using DHCP (getting IPs from the sites local PIX) couldn't be pinged or reach out through the Concentrator. It was only Thin Clients that didn't work. I could still ping the PIX, printers and desktop computers that were static set IPs. But this was happening at every site going through this Concentrator. The sites going through out MPLS network are fine.
I tried setting the Thin Clients to a static IP but still couldn't ping them.
I then decided to reboot the Concentrator, when it came back up all sites reconnected back to the Concentrator but now couldn't ping anything at the sites, not even the LAN IP of the PIX (or printers and desktops now). I power cycled a few of the sites PIXs but they still were not pingable even though the Concentrator showed they were connected.
I then decided to physical power cycle the Concentrator, it's back up and all sites are connected but none of the devices on the LAN side are reachable.
The Concentrator can ping the sites WAN IP but nothing on the LAN side going through and out the Concentrator. It can ping the LAN through the private interface (going back towards my LAN) just not going through the public interface (over the WAN).
The sessions show that Bytes are Rxing but no Bytes are Txing.
VPN Concentrator Vendors For Network
Jun 13, 2011I would like to pick the communities brains and get some opinions about VPN concentrators and different vendors.Now as far as I am aware and my research has taken me the Cisco VPN concentrator range has been discontinued and we need to look at the ASA range of devices for replacements.Working with smaller companies and ADSL solutions (dynamic IP assignment) it makes it challenging to establish a site to site VPN without dyndns and the cisco ASA range does not support dyndns VPN connections.Now the question I have or opinions I am looking for is:What I do like about Fortigate is that you have the ability to create virtual Firewalls. I am not looking for answers but rather real life experience with the different vendor products and opinions surrounding VPN concentrators.
View 2 Replies View RelatedCisco VPN :: 3000 Concentrator Manager Access
Aug 8, 2011I have 3000 concentrator in 192.168.1.x/24 network (concentrator has static IP of 192.168.1.4/24 assigned to its private int). I can manage it thru HTTP from any PC in the same subnet, but connection failes while trying to connect from PC on different subnet (i.e. 10.1.1.x/24). Is there ACL in concentrator config which needs to be modified to allow management from different subnet?
View 2 Replies View RelatedCisco VPN :: VPN Concentrator 3000 To View Log History
Nov 21, 2010Our enterprise uses a VPN Concentrator 3000 for our VPN access. Is there a way to view a log history of what user connected to VPN and what IP address they were assigned? It would be for 2 days ago which was over the weekend.
View 3 Replies View RelatedCisco VPN :: VPN Concentrator 3000 Setup With Client
Mar 27, 2011I've the following scenario VPN Concentrator is connected to a router which is connected to a router and at the edge Cisco 515E PIX is connected to the internet. The problem is that the normal VPN Dial-up connection (a utility of windows) are getting connected but Cisco VPN Client throws error 412. Here's what I've tried (Initially groups and user were created):
(1) Allowed port 10000 on PIX ( access-list from-outside-coming-in permit tcp any host <public ip> eq 10000) and checked IPSec over UDP on VPN Conc. under Mode Config tab. Also checked IPSec over TCP tab under tunneling panel at port 10000. Tried connecting through VPN Client but it threw error 412
(2) In the reference guide, I read that IPSec over NAT is allowed on ports ranging from 4000 something to 40000 something.
I tried 33333, both on PIX and VPN Conc. under Mode Config tab but still no use. Same error 412.
Cisco VPN :: Will ISR 881w Connect To 3060 Concentrator
Nov 30, 2011is it possible to do a site to site with a Cisco ISR 881W --> to a Cisco 3060 concentrator head?
View 1 Replies View RelatedCisco VPN :: 3020 Concentrator - How To Restrict Access
Sep 13, 2011Client: CISCO VPN Client
VPN server: Cisco Concentrator 3020 OS v 4.7
I want to get away from configuring split tunneling for security reasons. With Split tunneling and I am able to specify to which subnets the clients have access to. I do it defining "Network Lists"
When I modify the group and select "tunnel everything" under "client config" tab, the users then can access all subnets in the LAN. When I select this option the "Split tunneling network list" is grayed out
End goal is to make all traffic go thru the tunnel but be able to resctrict access to speficic subnets.
Cisco VPN :: VPN Connection Between Concentrator 3000 And RV220W
Jun 27, 2011is it generally possible to configure a site to site VPN connection between Cisco VPN Concentrator 3000 and Cisco RV220W / RV120W?
View 2 Replies View RelatedCisco VPN :: Old VPN 3000 Concentrator Password Reset?
Jul 8, 2012I have an old VPN 3000 Concentrator that I do not have any idea what is running on it. The previous network admin didn't leave a password for it, so I tried to reset the password. I was successful in doing so, but when I try to access it with the default of admin/admin via web browser, I still cannot access it. I am loathe to remove or power off this device without knowing what is on it.
View 6 Replies View RelatedCisco Security :: 3000 Vpn Concentrator Load Balancing
May 19, 2012We have two 3000 vpn concentrators. Under both of their load balancing fields, Configuration - Load balancing , the checkbox for loadbalancing is enabled.However both have different priorities, one with 10 and other with 1. Does this mean both are actually loadbalancing. What does the priorities indicate here?If we replace the concentrators with ASA , how will this load balancing need to be configured on ASA & how will it work.
View 5 Replies View RelatedCisco WAN :: 1921 With HWIC-3G-CDMA To Concentrator 3005?
Mar 29, 2011I have an interesting problem. I've configured a site to site VPN connection between these two devices. I am using the CDMA card as the primary and only outside connection on the 1921. What happens is that by default the cellular connection is offline. When traffic is generated internally from that network to the concentrator side of this scenario the cellular connection goes online and builds the tunnel, no problem. However, I cannot initiate the tunnel from the concentrator side. I think what i need is a way to force the cellular connection to always be on, and if it fails to come back online.
View 3 Replies View RelatedCisco VPN :: 3000 Concentrator Intermittent Login Failures
May 11, 2011I manage a VPN 300 concentrator which has been happily working for several years without any problems. All users are part of the same group and authenticate to an RSA server. We recently moved from RSA authentication manager 6.1 to RSA authentication manager 7.1. Everthing continued working fine for several weeks, then at the beginning of this week we started getting users intermittently failing to connect to the VPN. I'm not sure if this problem relates to our new RSA server, but we have other network devices which authenticate to it with no problem so I guess the problem is with the VPN concentrator itself.
When users fail they just get a generic "Reason 427 connection terminated by peer" error message. The live event log shows "group = vpn, status = Not-in-service" when their connection fails. Other times they connect normally and no error messages are displayed. There seems to be no real pattern, sometimes your connection fails but if you keep trying you will eventually get in [however it can take many attempts over an hour or two before you succeed, or you may get in straight away with no problem].
I dont believe its a network problem, as I have run continuous pings to the concentrator and the RSA server whilst users are experiencing these problems and there are no drops.
The RSA servers authentication monitor always shows that the user has successfully authenticated, whether the users connection actually succeeds or not. I am tempted to just reboot the concentrator, but we have site-to-site VPN tunnels connected off it and I'm a little concerned that if it is faulty it may not come back up at all.
Cisco VPN :: Private-to-Public IP NAT Through IPSEC VPN On 3000 Concentrator
Jul 27, 2011We have to setup an IPSEC tunnel for a client that does not what to exchange private IP address information for security and overlapping address space reasons. We will both be natting our source private ip address space as public IP address space and send those packets through the established tunnel. Im using a Cisco 3000 concentrator.
View 1 Replies View RelatedCisco VPN :: Setup L2L IPSec VPN Between VPN3020 Concentrator And 2811?
Feb 22, 2011I am trying to setup a L2L IPSec VPN between cisco VPN3020 concentrator and Cisco 2811 something is not working and I don't understand why.I describe my situation in detail my router has 2 interfaces
External interface Fa 0/1 ip 193.P.Q.R
Internal interface Fa 0/0 141.G.H.254
Lan on internal interface is 141.G.H.0/24
remote VPN concentrator has 2 interfaces
Public interface 131.A.B.C
Private interface 131.A.I.E
I have to set up L2L so that host 141.G.H.10 can talk to host 131.A.H.D whici is behind the VPN concentrator my router config:
crypto isakmp policy 3 encr 3des hash md5 authentication pre-share group 2crypto isakmp key * address 131.A.B.C!crypto ipsec transform-set presid-set esp-3des esp-md5-hmac !crypto map presid-map 5 ipsec-isakmp set peer 131.A.B.C set transform-set presid-set match address presid!interface FastEthernet0/1 ip address 193.P.Q.R 255.255.255.252 duplex full speed 100 crypto map presid-map!interface FastEthernet0/0 ip address 141.G.H.254 255.255.255.0 duplex auto speed auto!
ip access-list extended presid permit ip host 141.G.H.10 host 131.A.H.D
ip route 0.0.0.0 0.0.0.0 193.P.Q.S
Then I configured VPN3020 accordingly creating a lan to lan profile with the proper IKE proposals ecc ecc when interesting traffic is matched by VPN acl (presid) I see this messages in the VPN concentrator logs:
57101 02/23/2011 15:49:05.310 SEV=4 IKE/119 RPT=4033 193.P.Q.R Group [193.P.Q.R]PHASE 1 COMPLETED 57102 02/23/2011 15:49:05.310 SEV=4 AUTH/22 RPT=3935 193.P.Q.R User [193.P.Q.R] Group [193.P.Q.R] connected, Session Type: IPSec/LAN-to-LAN 57104 02/23/2011 15:49:05.310 SEV=4 AUTH/84 RPT=11 LAN-to-LAN tunnel to headend device 193.P.Q.R connected 57110 02/23/2011 15:49:54.820 SEV=4 IKE/123 RPT=1093 193.P.Q.R Group [193.P.Q.R]IKE lost contact with remote peer, deleting connection (keepalive type: DPD) 57112 02/23/2011 15:49:54.820 SEV=5 IKE/194 RPT=3778 193.P.Q.R Group [193.P.Q.R]Sending IKE Delete With Reason message: Connectivity to Client Lost. 57114 02/23/2011 15:49:54.820 SEV=4 AUTH/23 RPT=14 193.P.Q.R User [193.P.Q.R] Group [193.P.Q.R] disconnected: duration: 0:00:49 57115 02/23/2011 15:49:54.820 SEV=4 AUTH/85 RPT=11 LAN-to-LAN tunnel to headend device 193.P.Q.R disconnected: duration: 0:00:49
and from router side I See this with show crypto isakmp sa
131.A.B.C 193.P.Q.R CONF_XAUTH 5 0 ACTIVE
but the status got stuck in CONF_XAUTH state and then disconnects?
Cisco VPN :: ASA5520 / Concentrator 3000 Open TCP Ports?
Sep 21, 2011We recently had a Port Scan done on our external IP Addresses. One of those IP Addresses scanned was our Concentrator 3000. The report came back with the following TCP ports being open on the Concentrator 3000 - 80, 443, 1723, 10000, 10001, 10002, 10003, 10004, and 10009. I am unsure if it is necessary to have any or all of these open. The Concentrator 3000 is in front of our ASA5520.
View 1 Replies View Related