Site to site timeouts : Stop Site-to-Site VPN Drop (ASA & Router)

Site to site timeouts : Stop Site-to-Site VPN Drop (ASA & Router)

  October 30, 2015    Raj

---

By default, site-to-site VPNs timeout after 30 minutes of idle time. On ASA: ========= Enter the vpn-idle-timeout command in group-policy configuration mode or in username configuration mode in order to configure the user timeout period:  hostname(config)#group-policy DfltGrpPolicy attributes hostname(config-group-policy)#vpn-idle-timeout none   Configure a maximum amount of time for...

Read More

Anyconnect licensing

Anyconnect licensing

  October 23, 2015    Raj

---

http://www.tunnelsup.com/understanding-cisco-asa-anyconnect-licensi...

Read More

ASA L2L IPsec not encrypting the traffic (Duplicate SPI troubleshooting)

ASA L2L IPsec not encrypting the traffic (Duplicate SPI troubleshooting)

  October 22, 2015    Raj

---

What is an SPI ?SPIs are the components that are going to be used to provideprotection to an outgoing packet ( Security Parameter Index ), so we aregoing to see that it will identify a packet that is going to beprotected via an encryption How to identify that we have duplicate...

Read More

Site to site Error messages

Site to site Error messages

  October 15, 2015    Raj

---

During debug I could see this log:Queueing KEY-ACQUIRE messages to be processed when P1 SA is complete. I referred many documents to figure out what does this message say, and tried all their suggestions but couldn't get my tunnel up.Then I realized I have been missing something in my configuration. I took a closer look and found that I have not enabled isakmp on my DMZ interface where I was trying...

Read More

EZVPN on routers

EZVPN on routers

  October 12, 2015    Raj

---

Server side:================= username ezvpn-spoke1 password cisco1 aaa authentication login USER_AAA local aaa authentication login USERLIST local aaa authorization network GROUP_AAA local Create A pool: ====================ip local pool VPN-POOL 10.1.1.1 10.1.1.10 Split ACL : ip access-list extended SPLIT_T permit ip 192.168.0.0 0.0.255.255 any !--- IKE configuration ! crypto isakmp policy...

Read More

VPN client on ASA

VPN client on ASA

  October 12, 2015    Raj

---

This section describes how to configure remote access VPNs and includes the following topics: •Configuring Interfaces •Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface •Configuring an Address Pool •Adding a User •Creating a Transform...

Read More

TND Feature for Anyconnect VPN : TND - Trusted Network Detection

TND Feature for Anyconnect VPN : TND - Trusted Network Detection

  October 08, 2015    Raj

---

...

Read More

Anyconnect CLI config on ASA

Anyconnect CLI config on ASA

  October 07, 2015    Raj

---

upload .pkg file to asa You can ASDM to ASA and put .pkg file to your disk0. or you can copy fro your TFTP copy tftp flash enter source IP enter source file name anyconnect-win-3.1.05152-k9 destination file name , let it be same just hit enter ! Here is the scenario ! !...

Read More

VTI - DVTI cofig for VPN client

VTI - DVTI cofig for VPN client

  October 06, 2015    Raj

---

crypto isakmp policy 10  encr 3des  hash md5  authentication pre-share  group 5 ! !Create a pool: ip local pool ippool 192.168.1.1 192.168.1.2!!Split ACL:!access-list 101 permit ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255! !Create isakmp group: !================ crypto isakmp client configuration group cisco key cisco acl 101 pool ippool ! aaa authentication login methodlist1...

Read More

VTI - Static VTI config

VTI - Static VTI config

  October 06, 2015    Raj

---

R2# conf t inter fa1/1 no shut ip address 1.1.1.1 255.255.255.252 exit ! inter fa1/0 no shut ip add 10.10.10.1 255.255.255.0 exit ! crypto ipsec profile myprofile set transform-set tunnel1 ! inter tu0 ip add 172.16.14.1 255.255.255.252 tunnel source 1.1.1.1 tunnel destination...

Read More

GRE over IPSec

GRE over IPSec

  October 06, 2015    Raj

---

R2# ! Interface configuration: conf t inter fa1/1 no shut ip address 1.1.1.1 255.255.255.252 exit ! ! Interface configuration: inter fa1/0 no shut ip add 10.10.10.1 255.255.255.0 exit ! ! Create a virtual tunnel Interface, give an IP address to this interface. This...

Read More

VPN Client on router

VPN Client on router

  October 02, 2015    Raj

---

If you want aaa authentication to be done <otherwise you can skip this part and directly start from phase 1 config> aaa new-model ! !--- In order to enable Xauth for user authentication, !--- enable the aaa authentication commands. aaa authentication login...

Read More