Our enterprise uses a VPN Concentrator 3000 for our VPN access. Is there a way to view a log history of what user connected to VPN and what IP address they were assigned? It would be for 2 days ago which was over the weekend.
View 3 RepliesI have been trying to setup a LAN-to-LAN VPN between two sites that are using a 3000 series CISCO Concentrator. After following the basic setups from the CISCO site, I am still unable to create a tunnel. At the moment I'm starting to believe it is how I have physically setup the network. Site 1 is using a Billion BiPAC 7404VNPX ADSL2+ Modem, Site 2 is using a Netgear DGN2000 ADSL2+ Modem, The VPN Concentrators are setup behind these devices with each firewall setup to allow the needed ports forwarded.
View 5 Replies View RelatedOur VPN 3000 concentrator's admin password was changed by somebody so i reset the password by using straight through serial cable, now the problem is it allows me to login with admin through console but not through admin web interface or telnet. I have enabled telnet and http access but still no success. Concentrator is using internal database so no AAA server is configured.
View 1 Replies View RelatedI have a client who saw there was a android version of the AnyConnect client and want me to go through and get their VPN 3000 Concentrator confingured to be able to connect in with it.
The Conncentrator is currently setup several groups of users and the base group is set up to all other products to connec tin via a pre shared key. It took alot research to get it configured to this point and all the searches i pull up are for a ASA.
I have a VPN Concentrator 3000 with LAN-to-LAN DES-56 connections connected to it (Cisco PIX 506). Everything was working fine and then over the night something messed up on it. No settings were changed or anything.
First issue was anything using DHCP (getting IPs from the sites local PIX) couldn't be pinged or reach out through the Concentrator. It was only Thin Clients that didn't work. I could still ping the PIX, printers and desktop computers that were static set IPs. But this was happening at every site going through this Concentrator. The sites going through out MPLS network are fine.
I tried setting the Thin Clients to a static IP but still couldn't ping them.
I then decided to reboot the Concentrator, when it came back up all sites reconnected back to the Concentrator but now couldn't ping anything at the sites, not even the LAN IP of the PIX (or printers and desktops now). I power cycled a few of the sites PIXs but they still were not pingable even though the Concentrator showed they were connected.
I then decided to physical power cycle the Concentrator, it's back up and all sites are connected but none of the devices on the LAN side are reachable.
The Concentrator can ping the sites WAN IP but nothing on the LAN side going through and out the Concentrator. It can ping the LAN through the private interface (going back towards my LAN) just not going through the public interface (over the WAN).
The sessions show that Bytes are Rxing but no Bytes are Txing.
I have 3000 concentrator in 192.168.1.x/24 network (concentrator has static IP of 192.168.1.4/24 assigned to its private int). I can manage it thru HTTP from any PC in the same subnet, but connection failes while trying to connect from PC on different subnet (i.e. 10.1.1.x/24). Is there ACL in concentrator config which needs to be modified to allow management from different subnet?
View 2 Replies View RelatedI've the following scenario VPN Concentrator is connected to a router which is connected to a router and at the edge Cisco 515E PIX is connected to the internet. The problem is that the normal VPN Dial-up connection (a utility of windows) are getting connected but Cisco VPN Client throws error 412. Here's what I've tried (Initially groups and user were created):
(1) Allowed port 10000 on PIX ( access-list from-outside-coming-in permit tcp any host <public ip> eq 10000) and checked IPSec over UDP on VPN Conc. under Mode Config tab. Also checked IPSec over TCP tab under tunneling panel at port 10000. Tried connecting through VPN Client but it threw error 412
(2) In the reference guide, I read that IPSec over NAT is allowed on ports ranging from 4000 something to 40000 something.
I tried 33333, both on PIX and VPN Conc. under Mode Config tab but still no use. Same error 412.
is it generally possible to configure a site to site VPN connection between Cisco VPN Concentrator 3000 and Cisco RV220W / RV120W?
View 2 Replies View RelatedI have an old VPN 3000 Concentrator that I do not have any idea what is running on it. The previous network admin didn't leave a password for it, so I tried to reset the password. I was successful in doing so, but when I try to access it with the default of admin/admin via web browser, I still cannot access it. I am loathe to remove or power off this device without knowing what is on it.
View 6 Replies View RelatedWe have two 3000 vpn concentrators. Under both of their load balancing fields, Configuration - Load balancing , the checkbox for loadbalancing is enabled.However both have different priorities, one with 10 and other with 1. Does this mean both are actually loadbalancing. What does the priorities indicate here?If we replace the concentrators with ASA , how will this load balancing need to be configured on ASA & how will it work.
View 5 Replies View RelatedI manage a VPN 300 concentrator which has been happily working for several years without any problems. All users are part of the same group and authenticate to an RSA server. We recently moved from RSA authentication manager 6.1 to RSA authentication manager 7.1. Everthing continued working fine for several weeks, then at the beginning of this week we started getting users intermittently failing to connect to the VPN. I'm not sure if this problem relates to our new RSA server, but we have other network devices which authenticate to it with no problem so I guess the problem is with the VPN concentrator itself.
When users fail they just get a generic "Reason 427 connection terminated by peer" error message. The live event log shows "group = vpn, status = Not-in-service" when their connection fails. Other times they connect normally and no error messages are displayed. There seems to be no real pattern, sometimes your connection fails but if you keep trying you will eventually get in [however it can take many attempts over an hour or two before you succeed, or you may get in straight away with no problem].
I dont believe its a network problem, as I have run continuous pings to the concentrator and the RSA server whilst users are experiencing these problems and there are no drops.
The RSA servers authentication monitor always shows that the user has successfully authenticated, whether the users connection actually succeeds or not. I am tempted to just reboot the concentrator, but we have site-to-site VPN tunnels connected off it and I'm a little concerned that if it is faulty it may not come back up at all.
We have to setup an IPSEC tunnel for a client that does not what to exchange private IP address information for security and overlapping address space reasons. We will both be natting our source private ip address space as public IP address space and send those packets through the established tunnel. Im using a Cisco 3000 concentrator.
View 1 Replies View RelatedWe recently had a Port Scan done on our external IP Addresses. One of those IP Addresses scanned was our Concentrator 3000. The report came back with the following TCP ports being open on the Concentrator 3000 - 80, 443, 1723, 10000, 10001, 10002, 10003, 10004, and 10009. I am unsure if it is necessary to have any or all of these open. The Concentrator 3000 is in front of our ASA5520.
View 1 Replies View Relatedis it possible to use cisco AnyConnect client to connect users with Cisco VPN 3000 appliance?If so how to configure VPN 3000 concentrator to work with AnyConnect?
View 1 Replies View RelatedI was wondering if the ASA 5520 Firewall had the ability to view web traffic or site surfing or does this only work if I have a logging server configured for the ASA to log to? I don't use the ASA much since I'm the database administrator for my company but from time to time I'm asked when nobody else is available. I just checked the ASDM & see that the buffer clears after so many lines & I don't believe we've got a logging server.
View 2 Replies View RelatedIs it possible to configure a site-to-site VPN between an ASA 5510 running 8.2(1) and an old Cisco VPN Concentrator 3000? I've only been able to find an old 3000 to PIX guide on Cisco's site, and I cannot figure out how the two device's VPN options match up.
These are the options from the 3000:
IKE Proposal
Authentication:
Encryption options:
On the 5510's Site-to-Site Connection Profile, all the options are clumped into two boxes under Encrption Algorithms:
IKE Proposal: Encryption, Hash, DH Group, Authentication
IPsec Proposal: ESP Encryption, ESP Authentication
We have a pre-shared key configured, but I cannot find a set of options on the 5510 to match the 3000; I always get this error:
3Jan 24 201310:10:09713902Group = 63.192.x.x, IP = 63.x.x.191, Removing peer from correlator table failed, no match!1Jan 24 201310:10:11713900Group = 63.x.x.191, IP = 63.x.x.191, construct_ipsec_delete(): No SPI to identify Phase 2 SA!
I am trying to setup 4 cameras to view with remote live view. I set up my server with IP addresses of 192.168.1.80 .... 85. The screen has only the option for 1 video channel. I have seen on-line screen shots that have options for channel 1 through 8. I want to assign each camera to a different channel so I will be able to use remote live view to show all 4 cameras at the same time. I can only show one at a time. Do I need a different version than 3.3 or some obscure windows 7 setting?
View 5 Replies View RelatedI'm running a cisco 891 with ios Version 15.2(4)M3 ,now I have a dialer 0 interface with fast0 and 1 as well, all is working fine.now I just read about the new sh int 'INT' history feature but when I do it I get nothing.. not a graph or anything I get just nothing as if I just hit enter.anything I need to do to enable the feature?,if I do a sho proc cpu history that works just fine but not the sh int XYZ history commands
View 2 Replies View RelatedI have a question about VPN Concentrator FTP Backup configuration to get logs on FTP server. I have configure FTP Backup with all details but I still do not see any logs on FTP server. Do you know what could be the issue? I have never used Concentrator and not sure what needs to be done to get in working condition. I am using VPN Concentrator 3015 series.
View 5 Replies View RelatedMy organization has an old 3005 that i need to wipe the config of. The problem is that i cant gain access to the device via the console port. Every time i try connecting using a terminal session, all i see is a blinking cursor. As a result, my question to the group is there another way to wipe the config on this device?
View 2 Replies View RelatedI'm planning connect VPN concentrator in our company to PIX515 DMZ interface.At the moment , VPN concentrator(used for remote access VPN for laptop users) is connected directly to core switch so as PIx515. Having VPN Concentrator connected directly to LAN is security risk .SO i want to connect VPN concentrator to DMZ of the Firewall(pix515).
We don't have any test environment and we are not allowed to have downtime of more than 10 minutes in production network ,I want to make sure my design and commands would work without problem .I've attached doigram of our curernt setup and new setup I'm planning to work on as well as commands . Does this design will work .Nat , routing everything .
I need to configure a Cisco pix 515e as vpn concentrator. Now the network has 2 Cisco pix in fail over - May I add a new Cisco pix in parallel and redirect the vpn tunnel on it? How do I need to make the configuration in order to work?
View 2 Replies View RelatedCan a Cisco PIX 515E with an Unrestricted License (UR) be deployed as a VPN concentrator? For example, remote users having VPN clients installed on their desktops connect through the Internet and are authenticated by the PIX 515E at the main site.
View 1 Replies View Relatedhave doubt, now my system is under my company domain,is there possible my network admin can watch my browser history
View 1 Replies View RelatedI would like to pick the communities brains and get some opinions about VPN concentrators and different vendors.Now as far as I am aware and my research has taken me the Cisco VPN concentrator range has been discontinued and we need to look at the ASA range of devices for replacements.Working with smaller companies and ADSL solutions (dynamic IP assignment) it makes it challenging to establish a site to site VPN without dyndns and the cisco ASA range does not support dyndns VPN connections.Now the question I have or opinions I am looking for is:What I do like about Fortigate is that you have the ability to create virtual Firewalls. I am not looking for answers but rather real life experience with the different vendor products and opinions surrounding VPN concentrators.
View 2 Replies View RelatedI have a lap top that someone else uses, is there anyway I can set some setting that erasing the history is not an opinion?
View 1 Replies View RelatedIf I loose bookmarks on my Browser, can I contact my ISP for a log to my internet history?
View 7 Replies View RelatedHow to clear history of cisco ASA 5520 ?
View 1 Replies View RelatedWe are using the ASA 5520 as Firewall and VPN gateway for remote access by employees and vendors. Is there a way to view a history of VPN user logins? We used to have (or we still have but no longer using it) th CVPN 3005. This device keeps log files of all activities. I miss having this capability in the ASA 5520.
View 4 Replies View RelatedWhere did I need to go on the Concentrator to disable tcp 1723 and 10000? We don't require these to be open and our pen test shows these as being open.
View 1 Replies View Relatedis it possible to do a site to site with a Cisco ISR 881W --> to a Cisco 3060 concentrator head?
View 1 Replies View RelatedClient: CISCO VPN Client
VPN server: Cisco Concentrator 3020 OS v 4.7
I want to get away from configuring split tunneling for security reasons. With Split tunneling and I am able to specify to which subnets the clients have access to. I do it defining "Network Lists"
When I modify the group and select "tunnel everything" under "client config" tab, the users then can access all subnets in the LAN. When I select this option the "Split tunneling network list" is grayed out
End goal is to make all traffic go thru the tunnel but be able to resctrict access to speficic subnets.
I want to do something with IP SLA and started by estabilishing a baseline.
I'm trying to check history on an ASR. I tested same config on a 3845 and was forgetting the "history filter all". After this I could see history table on 3845 but still history is empty on the ASR1006. The operation started because I can see information with "show ip sla statistics".
know if i missed something or maybe this is not supported in ASR1006?
re-ld-tcc-02_ASR1006#show vers
Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-ADVIPSERVICESK9-M), Version 15.2(1)S2, RELEASE SOFTWARE (fc1)
[Code]......