[afnog] Delivery Status Notification (Failure)
Seun Ojedeji
seun.ojedeji at gmail.com
Fri Aug 3 22:53:28 UTC 2012
Hello Emma,
Good talking with you on mobile and congratulation on your school ranking!
Try those stuff when you have access to the router on Monday and if symptom
persist then we could further investigate the config you posted.
Cheers!
On Fri, Aug 3, 2012 at 11:29 PM, Onowojo E. <onowojemma at yahoo.com> wrote:
> config on router
>
> hostname uuuu
> !
> boot-start-marker
> boot-end-marker
> !
> logging buffered 52000
> enable password class
> !
> no aaa new-model
> memory-size iomem 10
> !
> !
> ip cef
> no ip dhcp use vrf connected
> ip dhcp excluded-address 10.43.0.1 10.43.0.50
> !
> ip dhcp pool class
> import all
> network 10.43.0.0 255.255.255.0
> domain-name class.com
> dns-server 10.40.0.6 66.178.2.25
> default-router 10.43.0.1
> !
> !
> ip domain name class.com
> !
> multilink bundle-name authenticated
> !
> !
> !
> crypto isakmp policy 1
> encr 3des
> authentication pre-share
> group 2
> !
> crypto isakmp policy 2
> encr 3des
> authentication pre-share
> group 2
> crypto isakmp key @#cgn!abc address #######
> !
> !
> crypto ipsec transform-set war esp-3des esp-sha-hmac
> !
> crypto map SDM_CMAP_1 1 ipsec-isakmp
> description Tunnel to########
> set peer ########
> set transform-set war
> match address 100
> !
> !
> crypto pki trustpoint TP-self-signed-2167060814
> enrollment selfsigned
> subject-name cn=IOS-Self-Signed-Certificate-2167060814
> revocation-check none
> rsakeypair TP-self-signed-2167060814
> !
> !
> !
> username cisco privilege 15 secret 5 ########
> archive
> log config
> hidekeys
> !
> !
> !
> !
> !
> interface FastEthernet0/0
> no ip address
> shutdown
> duplex auto
> speed auto
> !
> interface FastEthernet0/1
> no ip address
> shutdown
> duplex auto
> speed auto
> !
> interface FastEthernet0/0/0
> description #ETH-WANS#
> ip address ######.26 255.255.255.248
> ip mtu 1400
> ip nat outside
> ip virtual-reassembly
> duplex auto
> speed auto
> crypto map SDM_CMAP_1
> crypto ipsec df-bit clear
> !
> interface FastEthernet0/1/0
> description #FE int to 2nd ETH-LAN#
> ip address 10.43.0.1 255.255.255.0
> ip nat inside
> ip virtual-reassembly
> duplex auto
> speed auto
> !
> ip route 0.0.0.0 0.0.0.0 ######
> !
> !
> ip http server
> ip http authentication local
> ip http secure-server
> ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/0/0
> overload
> !
> ip access-list extended suf
> permit tcp 10.43.0.0 0.0.0.255 any eq www
> !
> access-list 1 remark CCP_ACL Category=2
> access-list 1 permit 10.43.0.0 0.0.0.255
> access-list 100 remark CCP_ACL Category=4
> access-list 100 remark IPSec Rule
> access-list 100 permit ip 10.43.0.0 0.0.0.255 10.40.0.0 0.0.255.255
> access-list 101 remark CCP_ACL Category=2
> access-list 101 remark IPSec Rule
> access-list 101 deny ip 10.43.0.0 0.0.0.255 10.40.0.0 0.0.255.255
> access-list 101 permit ip 10.43.0.0 0.0.0.255 any
> !
> !
> route-map SDM_RMAP_1 permit 1
> match ip address 101
> !
> !
> !
> control-plane
> !
> !
> line con 0
> password class
> login local
> line aux 0
> line vty 0 4
> privilege level 15
> password edo
> login local
> transport input telnet ssh
> !
> scheduler allocate 20000 1000
>
> !
> webvpn cef
> !
> end
> asa
> hostname Hop-ASA
> domain-name class.com
>
> !
> interface GigabitEthernet0/0
> nameif inside
> security-level 100
> ip address 10.40.129.1 255.255.255.252
> !
> interface GigabitEthernet0/1
> nameif outside
> security-level 0
> ip address #####.252 255.255.255.240
> !
> interface GigabitEthernet0/2
> nameif DMZ
> security-level 100
> ip address 10.40.128.1 255.255.255.0
> !
> interface GigabitEthernet0/3
> nameif CHQWAN
> security-level 50
> ip address 10.40.129.5 255.255.255.252
> !
> interface Management0/0
> nameif management
> security-level 100
> ip address 192.168.1.1 255.255.255.0
> management-only
> !
> ftp mode passive
> dns server-group DefaultDNS
> domain-name class.com
> same-security-traffic permit inter-interface
> object network OUTSIDEIP
> host #####.252
> object network NETWORK_OBJ_10.40.0.0_16
> subnet 10.40.0.0 255.255.0.0
> object network NETWORK_OBJ_10.45.0.0_24
> subnet 10.45.0.0 255.255.255.0
> object network NETWORK_OBJ_10.41.0.0_
> subnet 10.41.0.0 255.255.255.0
> object network NETWORK_OBJ_10.42.0.0_
> subnet 10.42.0.0 255.255.255.0
> object network NETWORK_OBJ_10.43.0.0_
> subnet 10.43.0.0 255.255.255.0
> object network NETWORK_OBJ_10.44.0.0_
> subnet 10.44.0.0 255.255.255.0
> object network NETWORK_OBJ_10.0.0.0_
> subnet 10.0.0.0 255.248.0.0
> description ben
> object network obj-mailsrv_realip
> host 10.40.128.2
> object network obj-mailsrv_publicip
> host 83.229.2.251
> object network obj-phone_realip
> host 10.40.1.69
> object network obj-phone_publicip
> host 83.229.2.253
> object-group network DM_INLINE_NETWORK_1
> network-object 10.41.0.0 255.255.255.0
> network-object 10.42.0.0 255.255.255.0
> network-object 10.43.0.0 255.255.255.0
> network-object 10.44.0.0 255.255.255.0
> network-object 10.45.0.0 255.255.255.0
> object-group network DM_INLINE_NETWORK_2
> network-object 10.41.0.0 255.255.255.0
> network-object 10.42.0.0 255.255.255.0
> network-object 10.43.0.0 255.255.255.0
> network-object 10.44.0.0 255.255.255.0
> network-object 10.45.0.0 255.255.255.0
> object-group network DM_INLINE_NETWORK_3
> network-object 10.41.0.0 255.255.255.0
> network-object 10.42.0.0 255.255.255.0
> network-object 10.43.0.0 255.255.255.0
> network-object 10.44.0.0 255.255.255.0
> network-object 10.45.0.0 255.255.255.0
> object-group service DM_INLINE_SERVICE_1
> service-object tcp destination eq www
> service-object tcp destination eq https
> service-object tcp destination eq pop2
> service-object tcp destination eq pop3
> service-object tcp destination eq smtp
> service-object tcp destination eq ssh
> service-object udp destination eq sip
> service-object tcp destination eq h323
> object-group network DM_INLINE_NETWORK_5
> network-object 10.0.0.0 255.248.0.0
> network-object 10.41.0.0 255.255.255.0
> network-object 10.42.0.0 255.255.255.0
> network-object 10.43.0.0 255.255.255.0
> network-object 10.44.0.0 255.255.255.0
> network-object 10.45.0.0 255.255.255.0
> object-group network DM_INLINE_NETWORK_4
> network-object object NETWORK_OBJ_10.0.0.0_
> network-object object NETWORK_OBJ_10.41.0.0
> network-object object NETWORK_OBJ_10.42.0.0
> network-object object NETWORK_OBJ_10.43.0.0
> network-object object NETWORK_OBJ_10.44.0.0
> network-object object NETWORK_OBJ_10.45.0.0
> object-group service DM_INLINE_SERVICE_2
> service-object tcp destination range 135 netbios-ssn
> service-object tcp destination eq 3389
> service-object tcp destination eq 445
> service-object tcp destination eq ssh
> service-object udp destination range 135 139
> service-object udp destination eq 445
> object-group service DM_INLINE_SERVICE_3
> service-object tcp-udp destination eq sip
> service-object tcp destination eq ftp
> service-object tcp destination eq ftp-data
> service-object tcp destination eq h323
> object-group network DM_INLINE_NETWORK_6
> network-object 10.0.0.0 255.248.0.0
> network-object 10.41.0.0 255.255.255.0
> network-object 10.42.0.0 255.255.255.0
> network-object 10.43.0.0 255.255.255.0
> network-object 10.44.0.0 255.255.255.0
> object-group network DM_INLINE_NETWORK_7
> network-object object NETWORK_OBJ_10.0.0.0_
> network-object object NETWORK_OBJ_10.40.0.0_16
> object-group network DM_INLINE_NETWORK_8
> network-object object NETWORK_OBJ_10.0.0.0_
> network-object object NETWORK_OBJ_10.41.0.0_
> network-object object NETWORK_OBJ_10.42.0.0_
> network-object object NETWORK_OBJ_10.43.0.0
> network-object object NETWORK_OBJ_10.44.0.0
> access-list from_outside extended permit icmp any interface outside
> access-list from_outside extended permit object-group DM_INLINE_SERVICE_3
> object-group DM_INLINE_NETWORK_1 10.40.0.0 255.255.0.0
> access-list from_outside extended permit object-group DM_INLINE_SERVICE_1
> object-group DM_INLINE_NETWORK_2 10.40.0.0 255.255.0.0
> access-list from_outside extended permit ip any any
> access-list from_outside extended permit object-group DM_INLINE_SERVICE_2
> object-group DM_INLINE_NETWORK_3 10.40.0.0 255.255.0.0
> access-list from_outside extended permit icmp any any echo
> access-list from_outside extended permit tcp object NETWORK_OBJ_10.0.0.0_
> range 3230 3270 object-group DM_INLINE_NETWORK_5
> access-list from_outside extended permit tcp object
> NETWORK_OBJ_10.40.0.0_16 eq h323 object-group DM_INLINE_NETWORK_6
> access-list from_outside extended permit udp object-group
> DM_INLINE_NETWORK_7 range 3230 3277 object-group DM_INLINE_NETWORK_8
> access-list outside_cryptomap extended permit ip object
> NETWORK_OBJ_10.40.0.0_16 object NETWORK_OBJ_10.41.0.
> access-list outside_cryptomap_1 extended permit ip object
> NETWORK_OBJ_10.40.0.0_16 object NETWORK_OBJ_10.43.0
> access-list outside_cryptomap_3 extended permit ip object
> NETWORK_OBJ_10.40.0.0_16 object NETWORK_OBJ_10.42.0.
> access-list outside_cryptomap_4 extended permit ip object
> NETWORK_OBJ_10.40.0.0_16 object NETWORK_OBJ_10.44.0.
> access-list outside_cryptomap_5 extended permit ip object
> NETWORK_OBJ_10.40.0.0_16 object NETWORK_OBJ_10.0.0.0
> pager lines 24
> logging enable
> logging asdm informational
> mtu inside 1500
> mtu outside 1460
> mtu DMZ 1500
> mtu CHQWAN 1500
> mtu management 1500
> no failover
> icmp unreachable rate-limit 1 burst-size 1
> icmp permit any echo inside
> icmp permit any echo-reply inside
> icmp permit any echo-reply outside
> icmp permit any echo outside
> asdm image disk0:/asdm-631.bin
> no asdm history enable
> arp timeout 14400
> nat (inside,outside) source static NETWORK_OBJ_10.40.0.0_16
> NETWORK_OBJ_10.40.0.0_16 destination static DM_INLINE_NETWORK_4
> DM_INLINE_NETWORK_4
> nat (DMZ,outside) source static obj-mailsrv_realip obj-mailsrv_publicip
> !
> nat (inside,outside) after-auto source dynamic NETWORK_OBJ_10.40.0.0_16
> interface
> route outside 0.0.0.0 0.0.0.0 ####.249 1
> route inside 10.40.0.0 255.255.128.0 10.40.129.2 1
> timeout xlate 3:00:00
> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
> timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat
> 0:05:00
> timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect
> 0:02:00
> timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
> timeout tcp-proxy-reassembly 0:01:00
> dynamic-access-policy-record DfltAccessPolicy
> aaa authentication ssh console LOCAL
> http server enable
> http 192.168.1.0 255.255.255.0 management
> http 0.0.0.0 0.0.0.0 management
> http 0.0.0.0 0.0.0.0 inside
> http 0.0.0.0 0.0.0.0 outside
> no snmp-server location
> no snmp-server contact
> snmp-server enable traps snmp authentication linkup linkdown coldstart
> sysopt connection tcpmss 1242
> crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
> crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
> crypto ipsec security-association lifetime seconds 28800
> crypto ipsec security-association lifetime kilobytes 4608000
> crypto ipsec df-bit clear-df outside
> crypto map outside_map1 1 match address outside_cryptomap
> crypto map outside_map1 1 set peer ####.42
> crypto map outside_map1 1 set transform-set ESP-3DES-SHA
> crypto map outside_map1 2 match address outside_cryptomap_1
> crypto map outside_map1 2 set peer ####.26
> crypto map outside_map1 2 set transform-set ESP-3DES-SHA
> crypto map outside_map1 4 match address outside_cryptomap_3
> crypto map outside_map1 4 set peer ####.202
> crypto map outside_map1 4 set transform-set ESP-3DES-SHA
> crypto map outside_map1 5 match address outside_cryptomap_4
> crypto map outside_map1 5 set peer ####.34
> crypto map outside_map1 5 set transform-set ESP-3DES-SHA
> crypto map outside_map1 6 match address outside_cryptomap_5
> crypto map outside_map1 6 set peer ####.4
> crypto map outside_map1 6 set transform-set ESP-DES-SHA
> crypto map outside_map1 interface outside
> crypto isakmp enable outside
> crypto isakmp policy 10
> authentication pre-share
> encryption 3des
> hash sha
> group 2
> lifetime 86400
> crypto isakmp policy 11
> authentication pre-share
> encryption des
> hash sha
> group 2
> lifetime 86400
> crypto isakmp policy 65535
> authentication pre-share
> encryption 3des
> hash sha
> group 2
> lifetime 86400
> telnet timeout 5
> ssh 0.0.0.0 0.0.0.0 outside
> ssh timeout 5
> console timeout 0
> management-access inside
> dhcpd address 192.168.1.2-192.168.1.254 management
> dhcpd enable management
> !
> threat-detection basic-threat
> threat-detection statistics access-list
> no threat-detection statistics tcp-intercept
> webvpn
> group-policy DfltGrpPolicy attributes
> vpn-filter value from_outside
> group-policy Policy1 internal
> group-policy Policy1 attributes
> vpn-tunnel-protocol IPSec l2tp-ipsec
> group-policy policy2 internal
> group-policy policy2 attributes
> vpn-tunnel-protocol IPSec
> username ##################
> tunnel-group ####.42 type ipsec-l2l
> tunnel-group ####.42 general-attributes
> default-group-policy policy2
> tunnel-group ####.42 ipsec-attributes
> pre-shared-key *****
> tunnel-group ####.26 type ipsec-l2l
> tunnel-group ####.26 general-attributes
> default-group-policy Policy1
> tunnel-group ####.26 ipsec-attributes
> pre-shared-key *****
> tunnel-group ####.202 type ipsec-l2l
> tunnel-group ####.202 general-attributes
> default-group-policy Policy1
> tunnel-group #### ipsec-attributes
> pre-shared-key *****
> tunnel-group #### type ipsec-l2l
> tunnel-group #### general-attributes
> default-group-policy Policy1
> tunnel-group #### ipsec-attributes
> pre-shared-key *****
> tunnel-group #### type ipsec-l2l
> tunnel-group #### general-attributes
> default-group-policy Policy1
> tunnel-group ##### ipsec-attributes
> pre-shared-key *****
> no tunnel-group-map enable ou
> !
> class-map inspection_default
> match default-inspection-traffic
> !
> !
> policy-map type inspect dns preset_dns_map
> parameters
> message-length maximum client auto
> message-length maximum 512
> policy-map global_policy
> class inspection_default
> inspect dns preset_dns_map
> inspect ftp
> inspect h323 h225
> inspect h323 ras
> inspect ip-options
> inspect netbios
> inspect rsh
> inspect rtsp
> inspect skinny
> inspect esmtp
> inspect sqlnet
> inspect sunrpc
> inspect tftp
> inspect sip
> inspect xdmcp
> inspect icmp
> inspect ipsec-pass-thru
> !
> service-policy global_policy global
> prompt hostname context
> call-home
> profile CiscoTAC-1
> no active
> destination address http
> https://tools.cisco.com/its/service/oddce/services/DDCEService
> destination address email callhome at cisco.com
> destination transport-method http
> subscribe-to-alert-group diagnostic
> subscribe-to-alert-group environment
> subscribe-to-alert-group inventory periodic monthly
> subscribe-to-alert-group configuration periodic monthly
> subscribe-to-alert-group telemetry periodic daily
> Cryptochecksum:85f5d7fae2b60f34eb6e501fc8a3e2af
> : end
> asdm image disk0:/asdm-631.bin
> no asdm history enable
>
> *God be with u all*
> *A true friend is someone who reaches for your hand and touches your heart
> *.
>
> ------------------------------
> *From:* Seun Ojedeji <seun.ojedeji at gmail.com>
> *To:* afnog at afnog.org
> *Sent:* Friday, August 3, 2012 11:01 PM
> *Subject:* Re: [afnog] Delivery Status Notification (Failure)
>
> Hello Emmanuel,
>
> For some unknown reason my PM to you don't get delivered.....so yeah make
> it local if symptom persists...(was about saying consult your doctor :-) )
> post your running config....
>
> Cheers!
>
> On Fri, Aug 3, 2012 at 10:56 PM, Mail Delivery Subsystem <
> mailer-daemon at googlemail.com> wrote:
>
> Delivery to the following recipient failed permanently:
>
> eonowojo at yahoo.com
>
> Technical details of permanent failure:
> Google tried to deliver your message, but it was rejected by the recipient
> domain. We recommend contacting the other email provider for further
> information about the cause of this error. The error that the other server
> returned was: 554 554 delivery error: dd This user doesn't have a
> yahoo.com account (eonowojo at yahoo.com) [0] - mta1388.mail.mud.yahoo.com(state 17).
>
> ----- Original message -----
>
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> d=gmail.com; s=20120113;
>
> h=mime-version:in-reply-to:references:date:message-id:subject:from:to
> :content-type;
> bh=l9IalKBWsIX2xpcdM5CXG05qX9CWy3GjcFUmBV49fCc=;
>
> b=ME2L083aKWYeIA++EjFPMz+4QoQ+UL/cTReJCKHN/rFBi28US4j5K687iaPhA06clP
>
> y2rAMFWDtVlKywSM7eBFrszb+SmfoiU6SNAHE5qrPVT7DdNK0h+o28NZMpfBshL2u6DH
>
> Ak6puWSVaMJVCswAiC58zV6gq0sZpz5X8vuu5x19e8fv0NhEAGgJpeYjsZtlPCe7T4qp
>
> zAZi1LhntdOULHDHc6Owq8VTTCJRSgmcsxJBIeDrdXjvI1Q4VSB/arXmx/wDfBUPT6AA
>
> +9Kz32MnVV7N0cbmjizdQ197wSRn/xSF+4uwmo1BgWCgdiOz2VRfWkdZfqEMb1o22fzy
> ZvgQ==
> MIME-Version: 1.0
> Received: by 10.204.128.65 with SMTP id j1mr1216589bks.93.1344030999482;
> Fri,
> 03 Aug 2012 14:56:39 -0700 (PDT)
> Received: by 10.204.225.133 with HTTP; Fri, 3 Aug 2012 14:56:39 -0700 (PDT)
> In-Reply-To: <1344029570.67538.YahooMailNeo at web140702.mail.bf1.yahoo.com>
> References: <4059366D-34BE-4484-8583-CE4A957D7ABC at gmail.com>
> <AAABB2DA-8DC9-4333-9CD7-9D12098B23BC at afrinic.net>
> <
> CAD_dc6hMYZ+yJ79FLmkr8oj4SwO5zUaTNBijoJMh2XgSY_vWQg at mail.gmail.com>
> <1344027080.42580.YahooMailNeo at web140701.mail.bf1.yahoo.com>
> <
> CAD_dc6im5e+4pQq+WS8O4QvNMpWKoFZmSn4ujAgNfopUMMufxQ at mail.gmail.com>
> <1344029570.67538.YahooMailNeo at web140702.mail.bf1.yahoo.com>
> Date: Fri, 3 Aug 2012 22:56:39 +0100
> Message-ID: <CAD_dc6iGxrwk=rR75KjFS-zcV=
> LLQOp63o4E0LZXah-0Wb6W+Q at mail.gmail.com>
> Subject: Re: [afnog] VPN mtu
> From: Seun Ojedeji <seun.ojedeji at gmail.com>
> To: "Onowojo E." <eonowojo at yahoo.com>
> Content-Type: multipart/alternative; boundary=0015174be3024a90c404c6639a2c
>
> Hello Emma,
> On Fri, Aug 3, 2012 at 10:32 PM, Onowojo E. <onowojemma at yahoo.com> wrote:
>
> > Thanks for your reply Seun i did it on the interface connecting to the
> > Internet (outside interface)
> >
> Could you run it on your local interface.
>
> Cheers!
>
> >
> > *God be with u all*
> > *A true friend is someone who reaches for your hand and touches your
> heart
> > *.
> >
> > ------------------------------
> > *From:* Seun Ojedeji <seun.ojedeji at gmail.com>
> > *To:* Onowojo E. <eonowojo at yahoo.com>
> > *Cc:* Nigeria Nog <afnog at afnog.org>
> > *Sent:* Friday, August 3, 2012 10:26 PM
> >
> > *Subject:* Re: [afnog] VPN mtu
> >
> > Hello Emmanuel,
> >
> > On which interface did you do the reduction? trust its on the local side
> > of the link? and you used something similar to below:
> >
> > ip tcp adjust-mss 1300
> >
> > Perhaps you could check packet size that goes through and then configure
> > with that, you can use the following(i am using debian): ping <other
> side
> > url>-s 1300 (increase or reduce the MTU untill you get a perfect one
> and
> > then apply the command above)
> >
> > Cheers!
> > On Fri, Aug 3, 2012 at 9:51 PM, Onowojo E. <onowojemma at yahoo.com> wrote:
> >
> > Hello all,
> > i just configure an ipsec site to site vpn between Asa and a cisco 2811
> > router using cisco ASDM and CCP ,but the tunnel comes up when i did and
> > extended ping and after a while it goes down i try use cisco
> configuration
> > professional (ccp ) to trouble shoot the link and it bring out this
> error "A
> > ping with data size of this VPN interface MTU size and 'Do not Fragment'
> > bit set to the other end VPN device is failing. This may happen if there
> > is a lesser MTU network which drops the 'Do not fragment' packets."
> > CCp suggests I can use crypto ipsec df-bit clear to resolve this or
> > contact our ISP to resolve
> > i have reduce the mtu on the ASA and the router to 1300,1460, 1400 and
> > 1480 but still the network is slow and the tunnel will just go off
> when
> > more user use the network and the tunnel goes down.
>
>
>
>
> --
> ------------------------------------------------------------------------
>
> *Seun Ojedeji,
> Federal University Oye-Ekiti
> web: http://www.fuoye.edu.ng
> Mobile: +2348035233535
> **alt email: <http://goog_1872880453/>seun.ojedeji at fuoye.edu.ng*
>
>
>
>
> _______________________________________________
> afnog mailing list
> http://afnog.org/mailman/listinfo/afnog
>
>
--
------------------------------------------------------------------------
*Seun Ojedeji,
Federal University Oye-Ekiti
web: http://www.fuoye.edu.ng
Mobile: +2348035233535
**alt email: <http://goog_1872880453>seun.ojedeji at fuoye.edu.ng*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://afnog.org/pipermail/afnog/attachments/20120803/043d3cb7/attachment-0001.html>
More information about the afnog
mailing list