Cisco IPSec VPN connect but no traffic? [SOLVED] - System Admin Discussion Boards

It's depend upon which Version of XP you use. Navigate the given link to get full details
Link[^]

Hope, it will works for you.
Smile | :)

modified on Wednesday, December 15, 2010 7:50 AM

the OP is asking about pixel data, not about disk sector numbers and addresses.

Unsure | :~

Luc Pattyn [Forum Guidelines] [Why QA sucks] [My Articles] Nil Volentibus Arduum

Please use <PRE> tags for code snippets, they preserve indentation, improve readability, and make me actually look at the code.

Luc Pattyn wrote:
the OP is asking about pixel data, not about disk sector numbers and addresses.

Oh its my fault Smile | :)

Good you realise that, Take it easy Smile | :)

AshishKr wrote:
Good you realise that, Take it easy

Ok I will

panda-kh wrote:
hi, does windows xp professional support 48bit color depth?

Depends on the driver of the graphics card. Mine doesn't Smile | :)

I are Troll Suspicious | :suss:

ok, i will check the driver of the graphic card.

Well I've never used CodeProject for anything other than C# related questions.. so here it goes:

For exercise.. I am trying to create a secure VPN tunnel between this Cisco 1841 Router and a Sonicwall router. No in both routers it shows that the tunnel is active. The problem is I cannot ping / access any computers between the LANs. On the Sonicwall side I have a computer at 192.168.1.250. While on the Cisco side I have a computer at 192.168.11.55. I can not reach either one of them.. evn though the tunnel is active:

inbound esp sas:
      spi: 0xD1BC1B8E(3518765966)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3003, flow_id: FPGA:3, crypto map: vpn
        sa timing: remaining key lifetime (k/sec): (4541007/2298)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

outbound esp sas:
      spi: 0xAE589C1E(2925042718)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3004, flow_id: FPGA:4, crypto map: vpn
        sa timing: remaining key lifetime (k/sec): (4541027/2297)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

Current configuration : 3972 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CompsysRouter
!
boot-start-marker
boot-end-marker
!
enable secret *****************
enable password ***********
!
aaa new-model
!
!
!
aaa session-id common
ip cef
!
!
!
!
no ip domain lookup
ip domain name ********.local
ip inspect name myfw http timeout 3600
ip inspect name myfw tcp timeout 3600
ip inspect name myfw udp timeout 3600
ip inspect name myfw dns timeout 3600
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
crypto pki trustpoint TP-self-signed-1821875492
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1821875492
 revocation-check none
 rsakeypair TP-self-signed-1821875492
!
!
crypto pki certificate chain TP-self-signed-1821875492
 certificate self-signed 01
  30820245 308201AE A0030201 02020101 300D0609 2A864886 F70D0101 04050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 31383231 38373534 3932301E 170D3130 31323130 32333433 
  35325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 38323138 
  37353439 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  8100CC57 E44AB177 3594C4C7 E88B1A4F CE4FD392 87CDB75C 2A6A6B1A 87D10791 
  0134F1FC 54A84BB6 08A40213 35B9DD0A FD813D2F 1C778D01 3F8EBEB0 C4793850 
  F52F7906 FDBC56A5 A4829AC5 4180DDA7 F54E3AAD DD1D4537 F1F19F11 9AE8A8A0 
  91C98934 233CF608 1447DA83 41B09E55 4A0FF674 8D060945 07D3F3F9 8EA7B412 
  5FD30203 010001A3 6D306B30 0F060355 1D130101 FF040530 030101FF 30180603 
  551D1104 11300F82 0D436F6D 70737973 526F7574 6572301F 0603551D 23041830 
  168014DC A9938F71 7CCF0E6D 8BC5DFA5 033DD7E4 0F605130 1D060355 1D0E0416 
  0414DCA9 938F717C CF0E6D8B C5DFA503 3DD7E40F 6051300D 06092A86 4886F70D 
  01010405 00038181 00148C2F AA7CA155 463B56F2 324FE1ED 3682E618 75E3048F 
  93E1EA61 3305767A FA93567B AA93B107 83A2F3D6 8F773779 E6BF0204 DC71879A 
  5F7FC07F 627D8444 48781289 7F8DC06A BC9057B1 4C72AE1F B64284BE 94C6059C 
  7B6B8A5D 83375B86 3054C760 961E8763 91767604 5E0E0CE3 3736133A E51ACF26 
  14F3C7C5 60E08BE3 88
  quit
username jdixon secret 5 $*****************
!         
!
ip ssh time-out 60
ip ssh authentication-retries 2
! 
!
crypto isakmp policy 1
 encr aes 256
 authentication pre-share
 group 2
 lifetime 28800
crypto isakmp key <SHAREDKEY> address  <REMOTE ROUTER>
!
!
crypto ipsec transform-set compsys esp-aes 256 esp-sha-hmac 
!
crypto map vpn 10 ipsec-isakmp 
 set peer <REMOTE ROUTER>
 set transform-set compsys 
 match address 101
!
!
!
interface FastEthernet0/0
 ip address "LOCAL ROUTER OUTSIDE" 255.255.255.248
 ip access-group Inbound in
 ip nat outside
 ip inspect myfw out
 ip virtual-reassembly
 duplex auto
 speed auto
 no keepalive
 crypto map vpn
!
interface FastEthernet0/1
 ip address 192.168.11.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 <OUTSIDE GATEWAY>
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 1 interface FastEthernet0/0 overload
ip nat inside source static tcp 192.168.11.55 3389 interface FastEthernet0/0 9999
!
ip access-list extended Inbound
 permit icmp any any
 permit gre host "REMOTE ROUTER" host "LOCAL ROUTER"
 permit esp host "REMOTE ROUTER" host "LOCAL ROUTER"
 permit udp host "REMOTE ROUTER" host "LOCAL ROUTER" eq isakmp
 permit ahp host "REMOTE ROUTER" host "LOCAL ROUTER"
 permit udp host "REMOTE ROUTER" host "LOCAL ROUTER" eq non500-isakmp
 permit ip host "REMOTE ROUTER" any
 permit tcp any host "LOCAL ROUTER" eq 22
!
access-list 1 permit 192.168.11.0 0.0.0.255
access-list 101 permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255
!
!
!
!
control-plane
!         
!
!
line con 0
line aux 0
line vty 0 4
!
scheduler allocate 20000 1000
end

So what am I missing? I started setting up this router two days ago for learning Cisco / routing. From tutorials I have followed, I have everythign setup correctly but traffic just isn't flowing!

modified on Saturday, December 11, 2010 4:54 PM

Someone from Cisco forms helped me:

access-list 150 deny ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 150 permit ip 192.168.11.0 0.0.0.255 any
ip nat inside source list 150 interface fastethernet0/0 overload
no ip nat inside source list 1 interface fastethernet0/0 overload

Here is my scenario:

1) A login session running some interactive displays on Windows XP Pro.
2) A remote desktop connection connects to XP via RDP. It takes over the control. When the job done, it closes the connection.
3) When the connection closes, I want to restore the previous login session automatically.

How do I acheive step #3. I've tried TSCON command, but it gives some error. I tried using one account only or using two accounts.

Best,
Jun

You can login as console using the /console switch on older RDP or /admin on new RDP (vista, win7, 2008 , etc). Will connect you to same one each time

Hi all,

We have an office With windows Server 2008 having 7 Work stations(Computers). I need to add a new computer to the server . i have alredy created a new computer and user in the Active directory users and computers on the server but the problem i have is to connect that Work station(the new computer) to the server . Let me share few steps that i did

- i logged in as administrator of that computer. I right click MY COMPUTER-PROPERTIES-COMPUTER NAME-CHANGE then i wrote the name of the computer and the Domain name
-MY NETWORK PLACES-RIGHT CLICK LAN-PROPERTIES-TCP/IP-PROPERTIES then i wrote the prefered DNS SERVER ip address the same as the one from the server-OK

After trying to log in it didnt allow me for both administrator and any domain user

Any one with idea on this. i appreciate your support thanks a lot

You have to go into the system settings and set the workstation as a domain member. Depending on the OS this will look different.

Its not enough to JUST set the user and the machine to have a domain account, you have to tell the workstation that is now the member of the domain so that when you log in you see the domain name option and the workstation will use that as the point of authentication.

In Win7 it is a link in the Computer name, domain, and work-group area of the System information box.

In Windows XP you can Right click on My Computer and one of the tabs allows you to move from Work-group to Domain mode.

Either way you will need to know the domain admins username and password.

Keep in mind that this also changes the users local profile so any customisations that are not machine generic will be gone. It also repoints things like the My Documents folder and stuff like that so you may have to go around and hunt stuff down and move it tot h new user profile.

LinkedIn[^] | Blog[^] | Twitter[^]

thanks for the helpfull information it fixes my problem

Hello,

Can you please assist me on how to add a Computer DNS in Windows Server 2008 and if there is a tutorial somewhere send me a link. The issue came back as now i cannot log in to the new computer added and i looked to the older computers there is a computer Domain Name System(DNS) but in the new one it does not allow me to add the computer DNS - i guess that is a problem i have

thanks for your continued support

hi , please remember to search our articles !

Hi all,

We have a small office with Windows server 2008 and 7 domain users . We are getting an error message "A DUPLICATE NAME EXISTS IN THE NETWORK" in each user during logging in .Anyone with idea on how to remove this duplicate name please we need a help

thanks for your continued support

Hmmm username or machine name?

LinkedIn[^] | Blog[^] | Twitter[^]

That message only shows up when you have two machines on the network with the same computer name.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak

thanks i fixed the problem

Hi guy.

I want to develope a bootloader that load a .com application(second stage of bootloader) and execute it. How I can do that ?

Thanks alot.

I don't think you can do this unless you can also load the requisite system support libraries, which need Windows to be running.

Just say 'NO' to evaluated arguments for diadic functions! Ash

One of my clients has finally got fed up with users abusing free internet access, and has asked me to lock each user's accessible content down to only those sites they need for their job. He doesn't want to spend money on a decent firewall or additional software to do this.

The domain is spread over a large area and several floors, and I would lose a day walking around each system to put a content password on each PC, together with the approved sites per user. It is a Server 2003 Active Directory environment, which does not provide such a facility directly.

Is there anyway this can be done from the PDC?

The hard-to-manage solution would involve only approving a small site list and distributing that through policy. But, this gets out of control when you have multiple groups of people using different site lists and you're constantly adding new "work related" sites all the time. Also, if the users install other browser software besides IE, they can easily bypass this restriction.

The better option is install a proxy server and route everyones browser through it. You get much better management capability, higher security and no little ways for the users to bypass it.

BTW: The money that your boss doesn't spend on a firewall is going to be burned up managing this through policies. Either way, he's spending money on this. There's just no way around it.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak

Dave Kreskowiak wrote:
The hard-to-manage solution would involve only approving a small site list and distributing that through policy.

Unfortunately, the list is quite extensive, and this would mean dozens of sites for each user, most of which would be irrelevant.

Dave Kreskowiak wrote:
and you're constantly adding new "work related" sites all the time.

This will definitely happen.

I am currently thinking that RDP into each user's PC would probably be the only way of getting the job done without a budget.