Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client andinside network?

..also keep in mind that your split-tunnel ACL can be extended if specified in the following format:   x.x.x.x mask  y.y.y.y mask (your vpn pool) 10.18.0.0 255.255.0.0 10.18.14.0 255.255.255.0   --- On Fri, 8/7/09, Scott Granados wrote: From: Scott Granados Subject: Re: [c-nsp] ASA5520, can't

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client and inside network?

..NAT entries are not required as long as *nat-control* is not enabled. I can't recall the default but you can verify your setup - sh run nat-control. The PC in question wouldn't happen to be behind a firewall and using an rfc1918 addr. on the 10.x space as well ? Also, NAT-T (ipsec/UDP port 10,0

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client and inside network?

Hi Scott, ...at first pass - have you *exempted* your vpn pool<->split-tunnel subnets from NAT on the appropriate interfaces? Regards, ./Randy --- On Fri, 8/7/09, Scott Granados wrote: From: Scott Granados Subject: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client a

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client andinside network?

I'm thinking this might be it. I'm probably doing bad things with the connected pool. Thanks for the pointers. - Original Message - From: Randy To: Michael K. Smith - Adhost ; Scott Granados Cc: cisco-nsp@puck.nether.net Sent: Friday, August 07, 2009 4:02 PM Subject: Re:

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client and inside network?

Hi, so the client is attached directly to a Sprint air card or directly to a cable internet connection with a real IP address. I have udp 1 defined in the group policy and see that port being used in the client logs. Thanks Scott - Original Message - From: Randy To: Rob Gi

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client andinside network?

Hi Michael, Wouldn't the more specific /24 come in to play instead of the much larger /16? If I route the /16 via 10.18.14.1 but the /24 of 10.18.14.1 is directly connected I would have thought the /24 would win. I'll definitely give this a try however. Thanks Scott - Original Messag

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client and inside network?

I actually don't have any nat entries because I didn't think I needed any what with this not being used for anything but VPN, is this incorrect? - Original Message - From: "Rob Gilreath" To: Cc: "Scott Granados" Sent: Friday, August 07, 2009 2:35 PM Subject: Re: [c-nsp] ASA5520, can

Re: [c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client andinside network?

> -Original Message- > From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp- > boun...@puck.nether.net] On Behalf Of Scott Granados > Sent: Friday, August 07, 2009 1:47 PM > To: cisco-nsp@puck.nether.net > Subject: [c-nsp] ASA5520,can't pass traffic over ipsec tunnel between > Cisco

[c-nsp] ASA5520, can't pass traffic over ipsec tunnel between Cisco client and inside network?

Hi, I'm having difficulties configuring VPN tunnels between a PC with the Cisco VPN client (windows XP) and an ASA5520. BACKGROUND I have an ASA5520 with a public interface of 206.x.x.232 and an inside address of 10.18.14.6. The outside interface is connected to the public internet directly,

Re: [c-nsp] IPSLAs with OpenNMS or Other?

Not one hit on this one, perhaps broadening the question to as follows might help: Anyone using IPSLA's standalone have any pointers to monitor voice have any pointers (what tests to run, packet sizes, frequency of tests)? Thanks, -Jeff -Original Message- From: cisco-nsp-boun...@puck.

[c-nsp] RedSeal users?

Slightly OT, but with all the NMS e-mails going around lately it might have some relevance. I'm in the middle of a RedSeal (http://www.redseal.net/) deployment, and I was wondering if anyone else on the list was using this product. I'd just like to get an idea of whether it has been useful, and w

Re: [c-nsp] TACACs access filtered by device

We take it another step, using the linux tac-plus, specifying a acl for each user, and commands they can or cannot run The only problem we've run into is one user who needs higher access on one router but still limited access on another, we've gotten around that a little bit by setting priv

Re: [c-nsp] TACACs access filtered by device

Yes! seems to be pretty simple I will try it today :-D ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] TACACs access filtered by device

On Fri, 2009-08-07 at 13:01 +0200, luismi wrote: > We have here several Cisco devices and I would like to know if it is > possible to filter who get access to some specific devices using the > tacacs.conf file or the AAA configuration inside the devices. > > Is that possible? It is, and it works

Re: [c-nsp] TACACs access filtered by device

We don't use it this way, but it looks like the linux tac_plus daemon supports authorization ACLs. See the line "acl = dial_only" at http://www.linuxcertif.com/man/5/tac_plus.conf/#EXAMPLE_TAC_PLUS_CONFIGURATION_311843h Christopher Hunt luismi wrote: Hi, We have here several Cisco device

Re: [c-nsp] TACACs access filtered by device

Hi, We don't use here ACS, just tacacs-server over linux. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] TACACs access filtered by device

You can do it using ACS if you have an ACS server. The way we've done it is create groups of devices and then just assign the user whatever rights and then only allow said user to access that group of users. Works well. Outside of ACS I'm not sure if there's a way. If you want more details let m

[c-nsp] TACACs access filtered by device

Hi, We have here several Cisco devices and I would like to know if it is possible to filter who get access to some specific devices using the tacacs.conf file or the AAA configuration inside the devices. Is that possible? ___ cisco-nsp mailing list ci