Cisco VPN :: VPN Not Working After Adding Subinterface - ASA 5510
Nov 19, 2012
Currently I want to add a second lan (vlan) in a customers network. The new network will be for a wireless infrastructure.There is also VPN Configured on the ASA - One with L2TP for Windows Clients and an IPsec for Cisco Clients.Former we only had one outside (Eth0/0) and one inside interface (Eth0/1) on the ASA.Now I want to use the Eth0/2 with subinterfaces, so that we will be flexible for future, when deploying more vlans.But now, when i turn the first subinterface Eth0/2.2 to no-shut the VPN Connections does not work any more.Bulding up the VPN connection works, but it seems that the traffic is not tunneled. (I checked this, because tracert to an internal adress goes to the internet)Below there is my config, i don't know whats wrong. I think split-tunnel is configured correctly (because it works when i delete eth0/2.2) TREV is the network of this location.Company1,2,3 are remote locations.
: Saved
:
ASA Version 8.2(5)
!
hostname XXXXXXX
domain-name domain.lan
enable password XXXXXXXXXXX encrypted
passwd XXXXXXXXXX encrypted
[code]....
View 3 Replies
ADVERTISEMENT
Jun 13, 2012
I am pretty new to Cisco networking and setting up a test router to use from home to connect into our network. My organization would like for us to provide upper management with home office setups to give them the ability to work from home. We will provide all of the equipment of course (router, phone and workstation). my boss wants me to use some of our old decommissioned equipment to set up a test home office to see how efficient and feasible it would be. I have a Cisco 1700 router, Altigen IP720 phone, and Dell Optiplex 380 workstation.
View 2 Replies
View Related
Oct 14, 2012
I am adding a failover asa to an a firewall that is already in production. They are both 5510's, they both have the same abount of ram, have the same code versions. Will there be any downtime while adding the secondary in?
View 2 Replies
View Related
Jan 30, 2013
We have upgraded our switch and since then Remote web workplace and owa are not working
View 1 Replies
View Related
Nov 28, 2012
I had a working active/passive pair of ASA5510's, and then I had to do a rush firmware upgrade, but didn't have time to do it on the secondary at the same time. Now I have made config changes and upgraded the secondary firmware to be the same, and wish to know if I plug it back in if it will think the secondary has the "correct" config or if it will know that the primary is newer. I disconnected the failover cable because it was complaining about version mismatches constantly.
Is it safe to add the secondary back in or is it possible it will be declared newer and overwrite the config?
View 6 Replies
View Related
Nov 19, 2012
We need to add additional APs to working wireless mesh network (WLC 4402, 1520 series AP).
WLC 4402 supports 1550 series access points with firmware upgrade to 7.0.235.0 :
[URL]
Is AIR-CAP1552E-x-K9 with three external dual band antennas enough for 2-GHz b/g/n local access and 5-Ghz back haul?
Does 1552 Mesh AP work with 1522 Root AP?
View 1 Replies
View Related
Oct 10, 2012
I have a ASA 5510 at our corporate HQ that has one site to site VPN. I need to add 6 additional site to site VPN's to this ASA for our remote branches. How can I add them without affecting the existing site to site VPN? The 6 site to site VPN's will all have the same settings however these settings are different from the existing site to site that I already have set up. How can I set it up so the 6 additional VPN's use their own crypto map and all use the same settings?
View 1 Replies
View Related
Mar 3, 2011
I have a customer with active/standby on a pair of 5510's with the CSC modules. They were inquiring about the AIP/ASA, and since this would NOT work in their current setup, would getting a pair of 5510/AIP configured for transparent failover work placed in front fo the existing units? Would I need to have a switch placed between the AIP and CSC ASA's? Or would I setup the ASA's for context based Active/Active failover to interconnect the ASA's to the existing units, but I still see a need for a switch.
View 1 Replies
View Related
May 5, 2011
I have a S2S VPN setup between a pair of ASAs (5510 and 5505) both running latest. Works fine and connects 3 local vLANs to the remote site, which has one /24 subnet. When I try and add a fourth local subnet it takes it but I can't get it to pass traffic to/from the new subnet. [code] I have added vLAN 20 as a remote network on the 5505 and as a local network on the 5510. Applied, broke the connection and re-applied it.When I ping from the 20 vLAN I get destination cannot be reached from an ISP upstream router and when I tracert, I get DEF GW, ASA's next Hop to the internet and one hop farther out where I get a unreachable message from that (3 hops and a fourth 'hop' that says it cannot reach)
When I ping from vLAN 10 it returns a ping. When I tracert it hits the vLAN Def GW, and then directly to the server I am trying to ping in the remote location (two hops).I can ping all things local form the 10 & 20 vLANs and get out to the internet fine.
View 3 Replies
View Related
Apr 19, 2012
I have a 7200 router with a 12.2.(46a) IOS and I am trying to activate Netflow on a subinterface. From the documentation of Cisco, I should be able to do it since the ios 12.2.(14)S but the command is unavailable.
[URL]
I have tried also to enter the command in the subinterface directly but it doesn't recognize it.
View 2 Replies
View Related
Feb 7, 2013
I have an 861 that we are using for a test network and need to add static igmp addresses for multicast. We are using the router as a router on a stick with subinterfaces on the WAN link. I've looked everywhere to see how to add the static igmp addresses.
interface FastEthernet4
no ip address
no ip route-cache cef
[Code]....
View 0 Replies
View Related
Oct 10, 2011
I am currently working on a 1941w router. The problem that I am having is that I am unable to ping the switch that is directly connected to it and I am unable to ping from the switch to the router. If I take the address off of vlan 1 and move it to gi0/0.1 the pings work, but then client traffic on the wireless ap inside the 1941w fails.
Here is the releveant config off of the 1941w
version 15.0
no service pad
service timestamps debug datetime msec localtime show-timezone
[Code].....
View 3 Replies
View Related
Jul 11, 2012
I have a Cisco 5505 with a security plus license and but I can’t seem to create sub interfaces on it.
ASA1(config)# sh ver
Cisco Adaptive Security Appliance Software Version 8.2(2)4Device Manager Version 6.0(3)
Compiled on Wed 03-Feb-10 14:17 by buildersSystem image file is “disk0:/asa822-4-k8.bin”Config file at boot was “startup-config”
ASA1 up 1 day 18 hours
Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHzInternal ATA Compact Flash, 128MBBIOS Flash Firmware Hub @ 0xffe00000, 1024KB
[code]....
View 3 Replies
View Related
Jan 31, 2013
I am in a non-admin context mode in ASA 5520 8.0 (5) and i m trying to add a new interface
GigabitEthernet1/2.4 172.19.4.1 255.255.254.0 manualGigabitEthernet1/2.6 172.19.6.1 255.255.255.0 CONFIGGigabitEthernet1/2.180 172.19.180.1 255.255.252.0 manualGigabitEthernet1/2.190 172.19.190.1 255.255.254.0 manualgvadc-fw/tgf# conf tgvadc-fw/tgf(config)# int ggvadc-fw/tgf(config)# int gigabitEthernet 1/2?
configure mode commands/options:1/2.180 1/2.190 1/2.4 1/2.6gvadc-fw/tgf(config)# int gigabitEthernet 1/2.168 ?ERROR: % Unrecognized commandgvadc-fw/tgf(config)#
what do i do?
View 2 Replies
View Related
Nov 5, 2012
We have an environment where we terminate our DSL customers over PPPoE on a 7606-S MPLS PE router with RSP720. The PPPoE sessions are terminated on a GIG V2 interface of a SIP-400. Currently the IOS running on the device is c7600rsp72043_rp-ADVIPSERVICESK9-M, Version 12.2(33)SRD. The following is the current configuration used.
bba-group pppoe 7virtual-template 7
interface GigabitEthernet2/1/3.142647 accessencapsulation dot1Q 14 second-dot1q 2647pppoe enable group 7
interface Virtual-Template7 ip vrf forwarding TESTip address 10.10.10.1 255.255.255.252
In the above scenario everything works well.
However we had to upgrade the router IOS to 15.2(4)S Advance IPServicesk9 to support 4-byte ASN. After the upgrading we observed certain commands used to terminate PPPoE on the sub-interfaces not available on 15.2(4)S , although PPPoE on Gig and Ethernet with QinQ support is listed under 15.2S feature set.
View 1 Replies
View Related
Oct 31, 2012
I have a circuit that will be delivered to a client next week and we are installing an ASA 5585x for them. They will have a circuit coming in with a few VLANs configured on it. One VLAN for the Internet and one for connectivity to another client.
So does the ASA allow you to create the "outside" interface on a subinterface?
View 2 Replies
View Related
Oct 23, 2011
On our ASA5520 we have three subinterfaces configured on our Gi0/1. Is it possible to configure a DHCP Server on one of these subinterfaces?
View 4 Replies
View Related
Apr 5, 2012
I'm trying to set up an 802.1 q trunk between my layer 3 switch and ASA5520. I understand I need to create a subinterface to accomplish this and have done so. However, the subinterface does not respond to pings, and when I attempt to run the packet tracer on the firewall itself, I get a message saying Flow is denied by configured rule. But the strange thing is it shows the output interface as "np identity ifc":
(The VLAN in question is VLAN2 192.168.2.3 is the VLAN2 address on the switch). The ASA config is as follows:
ASA Version 8.2(5) <context>
hostname context2
names
!
interface GigabitEthernet0/0.2
nameif Inside0/0.2
[Code] ....
View 3 Replies
View Related
Feb 26, 2013
I am suggesting an ASR1001 as a head end router for a small hub spoke WAN consisting of 4 branch sites connecting to the head via LES. 3 are 100mb, one is 30 mb. I will be connecting the LES circuits to a swithc and then trunking to the router. I would like to apply outbound shaping to these 4 subinterfaces on the router, and just want to check this is supported?
View 1 Replies
View Related
Jun 28, 2011
We have 2.5 Mbps connection from an ISP at our branch routers (1800 series)with single physical link terminated on FE0 but have two subinterfaces with separate subnets.
I have applied the following policy-map outbount under physical Interface FastEthernet 0. Show poliocymap output is as follows
Policy Map QoS-OUT
Class Email
priority 512 (kbps)
Class SQL
priority 512 (kbps)
Class File-Copy
police cir 1024000 bc 32000
conform-action transmit
exceed-action drop
Class CCTV
police cir 384000 bc 12000
conform-action transmit
exceed-action drop
But it seems that sometimes( not all the time ) the CCTV traffic seems to exceed the 384k and chokes the entire link(2.5 mbps).
View 4 Replies
View Related
Apr 23, 2013
I am having an issue where I can't get to external network sources via my sub interface which is attached to a 192.168.10.X VLAN I created to for Guest wireless traffic. The internal interface is a 10.5.X.X network. I can get out the external interface, but anything that we have A records for such as our mobile iron server that we can hit from the outside via https and an external IP can't be hit from the subinterface at all. Would this be a DNS rewrite issue or inspection problem?
View 3 Replies
View Related
Sep 8, 2012
I need to configure a subinterface eg g0/0.1 and g0/0.2 with a untagged VLAN for each subinterface on a Cisco 2821.
View 5 Replies
View Related
Dec 7, 2011
I need very Urgent Time based Bandwidth limit on subinterface in Cisco 3845 Router.At Present 3Mb input/output rate-limit of our one of the client now they need between 9:00 to 20:59 3 Mb and between 21:00 to 8:59 they need 9 Mb bandwidth, please see current b/w limit config of our client in my router subinterface.
interface GigabitEthernet0/1.12
description *** xyz ***
encapsulation dot1Q 12
ip address 10.11.12.13 255.255.255.248
rate-limit input 3072000 576000 1152000 conform-action transmit exceed-action drop
rate-limit output 3072000 576000 1152000 conform-action transmit exceed-action drop
Now how can i achive of my requrement to time based b/w limit.
View 5 Replies
View Related
Mar 17, 2011
I´m trying to configure a subinterface named Inside with vlan 1 but the interface stops work with this vlan.My switch is a Cisco and use the lan with vlan 1 too.If I change de vlan for other i.e vlan13 works fine. And all others vlans works fine too.Is there a problem to use the vlan 1?
My configuration is:
Cisco ASA:
interface gig0/3
no ip address
no security
no nameif
Interface gig0/3.1
vlan 1
nameif Inside
Securirity-level 100
ip address 10.x.y.x 255.255.224.0
The giga port of the swtich is configure to trunk model.
View 2 Replies
View Related
Jan 24, 2013
We have a 3560 switch running IOS universalk9-mz.150-1.SE3.bin.Recently, we saw two problems with this switch:-
1. if we try to enable subinterface on any routed interface , for eg. gig1/1, it says invalid input detected. It doesnt accept encapsulation command also. Following was done to enable subinterface:
int gig1/1
no ip address
int gig1/1.2000
ip address 1.1.1.1
under the gi1/1.2000 subinterface, it doesnt present the option of ip address.
2. we created a layer 2 vlan 2000 like: vlan 2000 When we do an exit after creating this vlan , it gives following error:-
%SW_VLAN-4-VLAN_CREATE_FAIL: Failed to create VLANs 2000: extended VLAN(s) not allowed in current VTP mode
View 6 Replies
View Related
Jan 10, 2012
QoS on an MFR interface/subinterfaces. We have a remote site with two bundled T1's terminating on a 2951 router for a total bandwidth of 3072. The circuit is provided by Paetec and the subinterfaces are designated for internet and MPLS traffic respectively. The issue we are facing is with outbound voice quality. It seems that no matter how we apply QoS, either to the main MFR interface or the MFR subinterfaces, voice packets do not seem to be prioritized. We tried FRTS, which slowed the entire link down to a crawl, we tried applying a class map to the main interface as well as a service policy, none of which seemed to affect anything.
class-map match-all VOICE
match ip dscp ef
class-map match-any SIGNALING
match ip dscp af31
match ip dscp cs3 (code)
View 4 Replies
View Related
Nov 13, 2011
I need to get some low volume, interactive data, prioritized on frame relay PVCs across our network. I have followed the CBWFQ examples from cisco.com, but my test packets are still showing latency over 1 second. My lab set up has a corporate connected gateway router linked via FE to testrouter 50. TR51 has a T1 frame relay loop to another router acting as a frame relay switch. The other side of the FR switch has a 56k link to testrouter51. I am sourcing test pings from my desktop PC, that are marked as AF43, and leave at a rate of 1/second, when the response comes back in time. I am using a Smartbits to generate some default class traffic at a rate of about 56Kbps only in the 'outbound' direction, toward TR51, as this emulates a file copy from corporate to remote sites, that is causing the AF43 traffic to suffer. Here is the relevant config on the TR50 device:
class-map match-all rtu-data
match ip dscp af43
!
policy-map frame-56
class rtu-data
priority percent 20
class network-mgt-data
bandwidth percent 5(code)
View 1 Replies
View Related
Aug 16, 2011
I'm working on setting up a site-to-site VPN connection that requires us to NAT an internal address. Typically, this would be no big deal, but for some reason, it's not working for us. The remote site is reporting that they are seeing the original IP address and not the mapped address coming across. I've monitored the connection and base on our ASA logs, I too see the un-mapped address.
Is there a quick and easy way of verifying that NAT is working? Logs, etc.?
Unfortunately I don't currently have the remote side's configuration, as they are an external business, but I can provide ours: [code]
Based on the above, it sounds as if our configs aren't jibing, which I would think could be caused by the NAT configuration not working, right? I mean if the VPN applicance on the remote end is expecting a NAT-ed address of 12.131.67.247 and they are receiving 12.10.127.108, that could cause this issue, couldn't it?
View 2 Replies
View Related
Jul 1, 2011
I configured ASA 5510 with IOS 8.4.2 version. I configured SSH to outside and backup interface with any any permission.
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 backup
configured password with command
passwd < Password>
While connecting from outside through Putty i am not able to authenticate the password.
Aftter entering user name as pix its asking password. After entering its not authenticating.
I taken output by telnetting to inside after connecting to the firewall from outside and entering username as pix
PM-ASA-5510# sh ssh sessions
SID Client IP Version Mode Encryption Hmac State Username1 122.169.252.112 2.0 IN aes256-cbc sha1 KeysExchanged pix OUT aes256-cbc sha1 KeysExchanged pixSPM-ASA-5510#
View 5 Replies
View Related
Aug 22, 2012
Our NOC is trying to configure a site to site tunnel to one of our customers. The tunnel is up and operational, however we can't get our NAT rules to match what we want.
We are running ASA version 8.4(3)
The traffic is sourced from 172.16.1.50 (inside1) and destined to192.168.2.9 (outside), the nat configuration is posted below:
NOC-ASA5510-01# show run nat
nat (inside1,inside2) source static ng-noc-networks ng-noc-networks destination static ng-inside2-networks ng-inside2-networks
nat (inside1,outside) source static test test-EXT destination static otherside otherside
object network obj_any
nat (inside1,outside) dynamic interface dns
object network servers-noc
nat (inside1,outside) static 192.168.1.68
Here is the output from the show nat detailed:
NOC-ASA5510-01# show nat detail
Manual NAT Policies (Section 1)
I left off entry 1 but it doesnt have any translated hits either
2 (inside1) to (outside) source static test test-EXT destination static otherside otherside
translate_hits = 0, untranslate_hits = 624
Source - Origin: 172.16.1.50/32, Translated: 192.168.1.67/32
Destination - Origin:192.168.2.9/32, Translated:192.168.2.9/32
Auto NAT Policies (Section 2)
1 (inside1) to (outside) source static servers-noc 192.168.1.68
translate_hits = 0, untranslate_hits = 187
Source - Origin: 172.16.1.101/32, Translated: 192.168.1.68/32
2 (inside1) to (outside) source dynamic obj_any interface dns
translate_hits = 58417, untranslate_hits = 1511
Source - Origin: 0.0.0.0/0, Translated: 192.168.1.66/29
Here are the network objects:
object network test
host 172.16.1.50
object network test-EXT
host 192.168.1.67
[Code]...
View 2 Replies
View Related
Jul 19, 2012
I recently setup a site to site vpn between a asa 5510 and router 1921. It was working great all night and this morning. When traffic stopped rolling through for a few hours the tunnel shutdown. I checked the router using cisco configuration and tells me the tunnel is up. When I check the asa it does not show up in the active tunnels. Any know what would cuase it to drop? and if so what can I do to avoid it.
View 6 Replies
View Related
Mar 8, 2012
I've got an ASA 5510 running 8.4.I have a host on an inside interface, with a static NAT configured on the ASA. The inbound/return half of the NAT doesn't appear to be working. [code] I run a ping from the host (192.168.100.98) to something on the outside (1.2.3.4)Running captures, I can see the outbound ping leaving, having been NATed OK. I can see the reply coming back in to the outside interface with the correct IP address, but I never get the final NATed packet appear on the inside interface. The packet just disappears inside the ASA.
View 2 Replies
View Related
Nov 14, 2011
I implemented a ASA5510 with latest software version. I configured outside interface, default route, PAT to the outside interface. I am able to ping and telnet to the inside interface of the ASA.But internet is not working.Did i miss any configuration?i enabled icmp to outside,. i did a ping to the next hop from ASA. but it is not working.
View 6 Replies
View Related
