Re: [fw-wiz] ipsec communications with windows server

hi guys

i managed to get it up between the windows server and the cisco router
with alittle problem, first the configuration of the devices:
config of router:
ip:10.0.0.1
IKE:HMAC-SHA1,DH2,preshared
IPSec:transparent ESP-3DES-SHA1
DPD: 10 sec
acl of interesting traffic:
access-list 100 permit ip 10.0.0.1 10.0.0.2
accessl-list 100 permit ip 10.0.0.2 10.0.0.2
other functions of router: NAT, stateful Inspection firewall

config of windows
ip:10.0.0.2
IKE:HMAC-SHA1,DH2,preshared
IPSec:transparent ESP-3DES-SHA1
acl: any ip from 10.0.0.2 to 10.0.0.1 (mirrored)
services on windows: syslog server installed

10.0.0.1 is also the gateway for the management machine so all traffic
from the windows machine to the internet must pass first through that
router

it all worked fine except for one thing...after variable amount of
time the router seems not to be sending logs to the syslog server on
the windows machine until it first recieves packets from from the
windowshost...these packets could be a a dns request routed by router
to external dns....
in other words i keep recieving logs from the router to the syslog
server for say 8 hours...then i recieve nothing....if i started
windows update for example on the windows machine , the routers start
again sending syslog messages as "inspection rule allowed outbound dns
from 10.0.0.2"..and keep recieving syslog messages for a about 10
hours..and then stop recieving any syslog messages...and same thing
happens again and again...the time is not fixed but never got more
than 1 day of continous syslog messages recieving

does anyone have any suggestions?
thanks alot
regards,

Nad

On Feb 10, 2008 7:25 PM, Brett Cunningham <cssniper22@xxxxxxxxx> wrote:
What's the config on the router? Do you have xauth and config-mode disabled?


On 2/10/08, shadow floating <nadengine@xxxxxxxxxxxxxx> wrote:
Hi list,
i've been trying to get an IPSec communication channel to work between
a cisco 2811 router IOS 12.4 and a windows server that have ipsec
capabilities, have anyone tried this before and worked?
i want to have a secure communication between the windows management
host and the router via ipsec vpn
the ike phase one seems to be ok as but the quick mode always fails
though the same parameters are configured on both sides for a
trasparent mode vpn
any hints?

thanks alot
regards

Nad

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: Does Access Support Concurrent Users?
    ... Um, you may not need a dedicated Windows server to act as DNS, WINS ... your router would provide the ...
    (microsoft.public.access.gettingstarted)
  • Re: Fileserver question
    ... >> another box running both 9.0 and Windows. ... >> computers in the same room and connected to a router. ... otherwise you will need to run a DHCP server on one ... > of the machines, preferably the server, or give both machines static ...
    (alt.os.linux.suse)
  • Re: Network Design
    ... I think you should really consider using a Windows 2000 domain and use two domain ... would not worry about using a Windows 2000 machine as a router. ... A Windows 2000 Server should provide DHCP ... The domain controller needs to ...
    (microsoft.public.win2000.security)
  • Re: Windows 2003 Server loses connection to Public Network
    ... It is a Windows 2003 Server issue. ... We have changed NICs and rotated the three networks around all of the NICs with no effect. ... Pretty expensive to use them as a router, ...
    (microsoft.public.windows.server.networking)
  • >>>> LOG INTO <<<<
    ... Ip Refreshed Cannot Log Into Myspace ... Cannot Log Into Windows Nt ... How To Log Into Linksys Router ... Cant Log Into Yahoo Games Site ...
    (rec.sport.tennis)