Re: Pix doesn't respond after a while

Kindy Sylla <[email protected]> Fri, 12 May 2006 17:12:44 +0200 (CEST)
Newsgroups gmane.comp.security.vpn
Message-ID <[email protected]>
--===============1605434733==
Content-Type: multipart/alternative; boundary="0-710741500-1147446764=:73801"
Content-Transfer-Encoding: 7bit

--0-710741500-1147446764=:73801
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


I enabled the logging and i can see incoming ICMP trame coming from the r=
emote VPN on the console. this help a lot thanks!=20
  However, i have probleme to configure the syslog server. I am getting t=
his error :
  syslogd: restarted.
Debugging disabled, SIGUSR1 to turn on debugging.
 any idea???
  cheers,
  =20
  Kindy
 =20
Meidinger Chris <[email protected]> a =E9crit :
  this is the logging conf on an ASA5520 cluster of mine:

logging enable
logging timestamp
logging standby
logging asdm-buffer-size 300
logging console critical
logging buffered informational
logging flash-bufferwrap
logging flash-minimum-free 6152
logging flash-maximum-allocation 10240

to get persistant logs, send them to a syslog server of ftp. At a conf pr=
ompt do help logging for the syntax.

Cheers,

Chris

> -----Original Message-----
> From: [email protected]=20
> [mailto:[email protected]
> ] On Behalf Of Kindy Sylla
> Sent: Wednesday, May 10, 2006 5:25 PM
> To: Meidinger Chris; [email protected]
> Subject: [VPN] Re: Pix doesn't respond after a while
>=20
> Can you please tell me how to get the information you are=20
> requesting. Specially how to get the log from the pix..
>=20
> Thanks!=20
> Meidinger Chris a =E9crit :
>=20
>=20
> is a lot of data traversing the tunnel? maybe there is=20
> a size limit on one side?
>=20
> can you post a log from the pix during while ping is=20
> not working?
>=20
> also, can you get a log from the remote peer at that same time?
>=20
> Chris
>=20
> -----Original Message-----
> From: Kindy Sylla [mailto:[email protected]]
> Sent: Wed 10-May-06 12:14
> To: Meidinger Chris; [email protected]
> Subject: RE: [VPN] Pix doesn't respond after a while
>=20
> Hi Chris,
>=20
> Thanks for the suggestion.
>=20
> I verify and the otherside has the same lifetime value.
>=20
> Any other idea? Any help would be great!!!
>=20
> Kindy
>=20
> Meidinger Chris a =E9crit :
> Hi Kindy,
>=20
> It sounds like the tunnel lifetimes are not the same.
>=20
> You have 'isakmp policy 9 lifetime 86400' which means=20
> that the tunnel will be torn down and renegotiated after=20
> 86400 seconds. Does the other side have the same lifetime? If=20
> not, the peer gateway won't be ready to reneg the tunnel and=20
> will (probably) spit out a Bad SPI log message for each of=20
> your side's negotiation attempts.
>=20
> That's definately the first thing to check!
>=20
> HTH,
>=20
> Chris
>=20
> -----Original Message-----
> From:=20
> [email protected] on=20
> behalf of Kindy Sylla
> Sent: Tue 09-May-06 10:55
> To: [email protected]
> Subject: [VPN] Pix doesn't respond after a while
>=20
> Hi,
>=20
> I am having a strange behaviour with a Cisco PIX=20
> Firewall Version 6.3(5). The configuration is done , the VPN=20
> are created between the 2 differents sites. The probl=E8me is=20
> after 5 to 6 hours of running, the ping to the remote hosts=20
> doesn't go through. When i try to ping a remote host, I see=20
> the followings line in the debug icmp trace:
>=20
> -request from inside:10.102.158.152 to 10.5.113.142=20
> ID=3D512 seq=3D5376 length=3D40
> 44: ICMP echo-request: translating=20
> inside:10.102.158.152 to outside:10.102.158.152
> 45: ICMP echo-request from inside:10.102.158.152 to=20
> 10.5.113.142 ID=3D512 seq=3D5632 length=3D40
> 46: ICMP echo-request: translating=20
> inside:10.102.158.152 to outside:10.102.158.152
>=20
> And When remote host try to ping a local machine, i=20
> can see the request coming without any reply.
>=20
> To get the ping work , we have to reload it.
>=20
> Do you have any idea?
>=20
> Please find below my config file :
> PIX Version 6.3(5)
> interface ethernet0 auto
> interface ethernet1 auto
> nameif ethernet0 outside security0
> nameif ethernet1 inside security100
> enable password N7FecZuSHJlVZC2P encrypted
> passwd N7FecZuSHJlVZC2P encrypted
> hostname pixbenin
> domain-name boabenin.bj
> fixup protocol dns maximum-length 512
> fixup protocol ftp 21
> fixup protocol h323 h225 1720
> fixup protocol h323 ras 1718-1719
> fixup protocol http 80
> fixup protocol rsh 514
> fixup protocol rtsp 554
> fixup protocol sip 5060
> fixup protocol sip udp 5060
> fixup protocol skinny 2000
> fixup protocol smtp 25
> fixup protocol sqlnet 1521
> fixup protocol http 80
> fixup protocol rsh 514
> fixup protocol rtsp 554
> fixup protocol sip 5060
> fixup protocol sip udp 5060
> fixup protocol skinny 2000
> fixup protocol smtp 25
> fixup protocol sqlnet 1521
> fixup protocol tftp 69
> names
> access-list acl_vpn permit icmp 10.102.156.0=20
> 255.255.252.0 192.168.0.0 255.255.255.0
> access-list acl_vpn permit ip 10.102.156.0=20
> 255.255.252.0 192.168.0.0 255.255.255.0
> access-list acl_blgo permit icmp 10.102.156.0=20
> 255.255.252.0 10.5.113.128 255.255.255.224
> access-list acl_blgo permit ip 10.102.156.0=20
> 255.255.252.0 10.5.113.128 255.255.255.224
> access-list acl_blgo permit icmp 10.102.156.0=20
> 255.255.252.0 10.102.128.0 255.255.254.0
> access-list acl_blgo permit ip 10.102.156.0=20
> 255.255.252.0 10.102.128.0 255.255.254.0
> access-list acl_blgo permit icmp 10.102.156.0=20
> 255.255.252.0 10.102.130.0 255.255.255.128
> access-list acl_blgo permit ip 10.102.156.0=20
> 255.255.252.0 10.102.130.0 255.255.255.128
> pager lines 24
> mtu outside 500
> mtu inside 1500
> ip address outside 81.91.235.147 255.255.255.192
> ip address inside 10.102.155.135 255.255.255.128
> ip audit info action alarm
> ip audit attack action alarm
> pdm history enable
> arp timeout 14400
> nat (inside) 0 10.102.156.0 255.255.252.0 0 0
> route outside 0.0.0.0 0.0.0.0 81.91.235.129 1
> route inside 10.102.156.0 255.255.252.0 10.102.155.129 1
> timeout xlate 3:00:00
> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00=20
> rpc 0:10:00 h225 1:00:00
> ip audit attack action alarm
> pdm history enable
> arp timeout 14400
> nat (inside) 0 10.102.156.0 255.255.252.0 0 0
> route outside 0.0.0.0 0.0.0.0 81.91.235.129 1
> route inside 10.102.156.0 255.255.252.0 10.102.155.129 1
> timeout xlate 3:00:00
> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00=20
> rpc 0:10:00 h225 1:00:00
> timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
> timeout sip-disconnect 0:02:00 sip-invite 0:03:00
> timeout uauth 0:05:00 absolute
> aaa-server TACACS+ protocol tacacs+
> aaa-server TACACS+ max-failed-attempts 3
> aaa-server TACACS+ deadtime 10
> aaa-server RADIUS protocol radius
> aaa-server RADIUS max-failed-attempts 3
> aaa-server RADIUS deadtime 10
> aaa-server LOCAL protocol local
> no snmp-server location
> no snmp-server contact
> snmp-server community public
> no snmp-server enable traps
> floodguard enable
> sysopt connection permit-ipsec
> crypto ipsec transform-set strong esp-3des esp-sha-hmac
> crypto dynamic-map dynmap 30 set transform-set strong
> crypto map toX 20 ipsec-isakmp
> crypto map toX 20 match address acl_vpn
> crypto map toX 20 set peer 196.200.82.35
> crypto map toX 20 set transform-set strong
> crypto map toX 30 ipsec-isakmp
> crypto map toX 30 match address acl_blgo
> crypto ipsec transform-set strong esp-3des esp-sha-hmac
> crypto dynamic-map dynmap 30 set transform-set strong
> crypto map toX 20 ipsec-isakmp
> crypto map toX 20 match address acl_vpn
> crypto map toX 20 set peer 196.200.82.35
> crypto map toX 20 set transform-set strong
> crypto map toX 30 ipsec-isakmp
> crypto map toX 30 match address acl_blgo
> crypto map toX 30 set peer 194.78.211.130
> crypto map toX 30 set transform-set strong
> crypto map toX 9990 ipsec-isakmp dynamic dynmap
> crypto map toX interface outside
> isakmp enable outside
> isakmp key ******** address 196.200.82.35 netmask=20
> 255.255.255.255
> isakmp key ******** address 194.78.211.130 netmask=20
> 255.255.255.255
> isakmp identity address
> isakmp policy 9 authentication pre-share
> isakmp policy 9 encryption 3des
> isakmp policy 9 hash sha
> isakmp policy 9 group 1
> isakmp policy 9 lifetime 86400
> isakmp policy 19 authentication pre-share
> isakmp policy 19 encryption 3des
> isakmp policy 19 hash sha
> isakmp policy 19 group 2
> isakmp policy 19 lifetime 86400
> telnet timeout 5
> ssh 194.7.174.162 255.255.255.255 outside
> ssh 194.7.174.163 255.255.255.255 outside
> ssh 10.102.156.0 255.255.252.0 inside
> ssh 10.102.155.0 255.255.255.0 inside
> ssh timeout 5
> console timeout 0
> terminal width 80
> Cryptochecksum:7458b1b938134f7d52ed82d4e2003210
>=20
> Regrds,
>=20
> Kindy
>=20
>=20
>=20
> ---------------------------------
> Faites de Yahoo! votre page d'accueil sur le web pour=20
> retrouver directement vos services pr=E9f=E9r=E9s : v=E9rifiez vos=20
> nouveaux mails, lancez vos recherches et suivez l'actualit=E9=20
> en temps r=E9el. Cliquez ici.
>=20
>=20
>=20
>=20
>=20
> ---------------------------------
> Faites de Yahoo! votre page d'accueil sur le web pour=20
> retrouver directement vos services pr=E9f=E9r=E9s : v=E9rifiez vos=20
> nouveaux mails, lancez vos recherches et suivez l'actualit=E9=20
> en temps r=E9el. Cliquez ici.
>=20
>=20
>=20
>=20
> ________________________________
>=20
> Yahoo! Mail r=E9invente le mail ! D=E9couvrez le nouveau Yahoo!=20
> Mail=20
> > com/mail/nouveaumail.html> et son interface r=E9volutionnaire.=20
>=20
_______________________________________________
VPN mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/vpn


	=09
---------------------------------
 Yahoo! Mail r=E9invente le mail ! D=E9couvrez le nouveau Yahoo! Mail et =
son interface r=E9volutionnaire.
--0-710741500-1147446764=:73801
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<div><BR>I enabled the logging and i can see incoming ICMP trame coming f=
rom the remote VPN on the console. this help a lot thanks! </div>  <div>H=
owever, i have probleme to configure the syslog server. I am getting this=
 error :</div>  <div>syslogd: restarted.<BR>Debugging disabled, SIGUSR1 t=
o turn on debugging.<BR>&nbsp;any idea???</div>  <div>cheers,</div>  <div=
>&nbsp;</div>  <div>Kindy</div>  <div><BR><B><I>Meidinger Chris &lt;chris=
[email protected]&gt;</I></B> a =E9crit&nbsp;:</div>  <BLOCKQUOTE cla=
ss=3Dreplbq style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1=
010ff 2px solid">this is the logging conf on an ASA5520 cluster of mine:<=
BR><BR>logging enable<BR>logging timestamp<BR>logging standby<BR>logging =
asdm-buffer-size 300<BR>logging console critical<BR>logging buffered info=
rmational<BR>logging flash-bufferwrap<BR>logging flash-minimum-free 6152<=
BR>logging flash-maximum-allocation 10240<BR><BR>to get persistant logs, =
send them to a syslog server of ftp. At a
 conf prompt do help logging for the syntax.<BR><BR>Cheers,<BR><BR>Chris<=
BR><BR>&gt; -----Original Message-----<BR>&gt; From: vpn-bounces+chris.me=
[email protected] <BR>&gt; [mailto:vpn-bounces+chris.m=
[email protected]<BR>&gt; ] On Behalf Of Kindy Sylla<=
BR>&gt; Sent: Wednesday, May 10, 2006 5:25 PM<BR>&gt; To: Meidinger Chris=
; [email protected]<BR>&gt; Subject: [VPN] Re: Pix doesn't respond afte=
r a while<BR>&gt; <BR>&gt; Can you please tell me how to get the informat=
ion you are <BR>&gt; requesting. Specially how to get the log from the pi=
x..<BR>&gt; <BR>&gt; Thanks! <BR>&gt; Meidinger Chris <CHRIS.MEIDINGER@BA=
DENIT.DE>a =E9crit :<BR>&gt; <BR>&gt; <BR>&gt; is a lot of data traversin=
g the tunnel? maybe there is <BR>&gt; a size limit on one side?<BR>&gt; <=
BR>&gt; can you post a log from the pix during while ping is <BR>&gt; not=
 working?<BR>&gt; <BR>&gt; also, can you get a log from the remote peer a=
t that same time?<BR>&gt; <BR>&gt;
 Chris<BR>&gt; <BR>&gt; -----Original Message-----<BR>&gt; From: Kindy Sy=
lla [mailto:[email protected]]<BR>&gt; Sent: Wed 10-May-06 12:14<BR>&gt; T=
o: Meidinger Chris; [email protected]<BR>&gt; Subject: RE: [VPN] Pix do=
esn't respond after a while<BR>&gt; <BR>&gt; Hi Chris,<BR>&gt; <BR>&gt; T=
hanks for the suggestion.<BR>&gt; <BR>&gt; I verify and the otherside has=
 the same lifetime value.<BR>&gt; <BR>&gt; Any other idea? Any help would=
 be great!!!<BR>&gt; <BR>&gt; Kindy<BR>&gt; <BR>&gt; Meidinger Chris <CHR=
[email protected]>a =E9crit :<BR>&gt; Hi Kindy,<BR>&gt; <BR>&gt; It=
 sounds like the tunnel lifetimes are not the same.<BR>&gt; <BR>&gt; You =
have 'isakmp policy 9 lifetime 86400' which means <BR>&gt; that the tunne=
l will be torn down and renegotiated after <BR>&gt; 86400 seconds. Does t=
he other side have the same lifetime? If <BR>&gt; not, the peer gateway w=
on't be ready to reneg the tunnel and <BR>&gt; will (probably) spit out a=
 Bad SPI log message for each of <BR>&gt;
 your side's negotiation attempts.<BR>&gt; <BR>&gt; That's definately the=
 first thing to check!<BR>&gt; <BR>&gt; HTH,<BR>&gt; <BR>&gt; Chris<BR>&g=
t; <BR>&gt; -----Original Message-----<BR>&gt; From: <BR>&gt; vpn-bounces=
[email protected] on <BR>&gt; behalf of Kindy=
 Sylla<BR>&gt; Sent: Tue 09-May-06 10:55<BR>&gt; To: [email protected]<=
BR>&gt; Subject: [VPN] Pix doesn't respond after a while<BR>&gt; <BR>&gt;=
 Hi,<BR>&gt; <BR>&gt; I am having a strange behaviour with a Cisco PIX <B=
R>&gt; Firewall Version 6.3(5). The configuration is done , the VPN <BR>&=
gt; are created between the 2 differents sites. The probl=E8me is <BR>&gt=
; after 5 to 6 hours of running, the ping to the remote hosts <BR>&gt; do=
esn't go through. When i try to ping a remote host, I see <BR>&gt; the fo=
llowings line in the debug icmp trace:<BR>&gt; <BR>&gt; -request from ins=
ide:10.102.158.152 to 10.5.113.142 <BR>&gt; ID=3D512 seq=3D5376 length=3D=
40<BR>&gt; 44: ICMP echo-request: translating
 <BR>&gt; inside:10.102.158.152 to outside:10.102.158.152<BR>&gt; 45: ICM=
P echo-request from inside:10.102.158.152 to <BR>&gt; 10.5.113.142 ID=3D5=
12 seq=3D5632 length=3D40<BR>&gt; 46: ICMP echo-request: translating <BR>=
&gt; inside:10.102.158.152 to outside:10.102.158.152<BR>&gt; <BR>&gt; And=
 When remote host try to ping a local machine, i <BR>&gt; can see the req=
uest coming without any reply.<BR>&gt; <BR>&gt; To get the ping work , we=
 have to reload it.<BR>&gt; <BR>&gt; Do you have any idea?<BR>&gt; <BR>&g=
t; Please find below my config file :<BR>&gt; PIX Version 6.3(5)<BR>&gt; =
interface ethernet0 auto<BR>&gt; interface ethernet1 auto<BR>&gt; nameif =
ethernet0 outside security0<BR>&gt; nameif ethernet1 inside security100<B=
R>&gt; enable password N7FecZuSHJlVZC2P encrypted<BR>&gt; passwd N7FecZuS=
HJlVZC2P encrypted<BR>&gt; hostname pixbenin<BR>&gt; domain-name boabenin=
.bj<BR>&gt; fixup protocol dns maximum-length 512<BR>&gt; fixup protocol =
ftp 21<BR>&gt; fixup protocol h323 h225
 1720<BR>&gt; fixup protocol h323 ras 1718-1719<BR>&gt; fixup protocol ht=
tp 80<BR>&gt; fixup protocol rsh 514<BR>&gt; fixup protocol rtsp 554<BR>&=
gt; fixup protocol sip 5060<BR>&gt; fixup protocol sip udp 5060<BR>&gt; f=
ixup protocol skinny 2000<BR>&gt; fixup protocol smtp 25<BR>&gt; fixup pr=
otocol sqlnet 1521<BR>&gt; fixup protocol http 80<BR>&gt; fixup protocol =
rsh 514<BR>&gt; fixup protocol rtsp 554<BR>&gt; fixup protocol sip 5060<B=
R>&gt; fixup protocol sip udp 5060<BR>&gt; fixup protocol skinny 2000<BR>=
&gt; fixup protocol smtp 25<BR>&gt; fixup protocol sqlnet 1521<BR>&gt; fi=
xup protocol tftp 69<BR>&gt; names<BR>&gt; access-list acl_vpn permit icm=
p 10.102.156.0 <BR>&gt; 255.255.252.0 192.168.0.0 255.255.255.0<BR>&gt; a=
ccess-list acl_vpn permit ip 10.102.156.0 <BR>&gt; 255.255.252.0 192.168.=
0.0 255.255.255.0<BR>&gt; access-list acl_blgo permit icmp 10.102.156.0 <=
BR>&gt; 255.255.252.0 10.5.113.128 255.255.255.224<BR>&gt; access-list ac=
l_blgo permit ip 10.102.156.0 <BR>&gt;
 255.255.252.0 10.5.113.128 255.255.255.224<BR>&gt; access-list acl_blgo =
permit icmp 10.102.156.0 <BR>&gt; 255.255.252.0 10.102.128.0 255.255.254.=
0<BR>&gt; access-list acl_blgo permit ip 10.102.156.0 <BR>&gt; 255.255.25=
2.0 10.102.128.0 255.255.254.0<BR>&gt; access-list acl_blgo permit icmp 1=
0.102.156.0 <BR>&gt; 255.255.252.0 10.102.130.0 255.255.255.128<BR>&gt; a=
ccess-list acl_blgo permit ip 10.102.156.0 <BR>&gt; 255.255.252.0 10.102.=
130.0 255.255.255.128<BR>&gt; pager lines 24<BR>&gt; mtu outside 500<BR>&=
gt; mtu inside 1500<BR>&gt; ip address outside 81.91.235.147 255.255.255.=
192<BR>&gt; ip address inside 10.102.155.135 255.255.255.128<BR>&gt; ip a=
udit info action alarm<BR>&gt; ip audit attack action alarm<BR>&gt; pdm h=
istory enable<BR>&gt; arp timeout 14400<BR>&gt; nat (inside) 0 10.102.156=
.0 255.255.252.0 0 0<BR>&gt; route outside 0.0.0.0 0.0.0.0 81.91.235.129 =
1<BR>&gt; route inside 10.102.156.0 255.255.252.0 10.102.155.129 1<BR>&gt=
; timeout xlate 3:00:00<BR>&gt; timeout
 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 <BR>&gt; rpc 0:10:00 h225 1=
:00:00<BR>&gt; ip audit attack action alarm<BR>&gt; pdm history enable<BR=
>&gt; arp timeout 14400<BR>&gt; nat (inside) 0 10.102.156.0 255.255.252.0=
 0 0<BR>&gt; route outside 0.0.0.0 0.0.0.0 81.91.235.129 1<BR>&gt; route =
inside 10.102.156.0 255.255.252.0 10.102.155.129 1<BR>&gt; timeout xlate =
3:00:00<BR>&gt; timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 <BR>=
&gt; rpc 0:10:00 h225 1:00:00<BR>&gt; timeout h323 0:05:00 mgcp 0:05:00 s=
ip 0:30:00 sip_media 0:02:00<BR>&gt; timeout sip-disconnect 0:02:00 sip-i=
nvite 0:03:00<BR>&gt; timeout uauth 0:05:00 absolute<BR>&gt; aaa-server T=
ACACS+ protocol tacacs+<BR>&gt; aaa-server TACACS+ max-failed-attempts 3<=
BR>&gt; aaa-server TACACS+ deadtime 10<BR>&gt; aaa-server RADIUS protocol=
 radius<BR>&gt; aaa-server RADIUS max-failed-attempts 3<BR>&gt; aaa-serve=
r RADIUS deadtime 10<BR>&gt; aaa-server LOCAL protocol local<BR>&gt; no s=
nmp-server location<BR>&gt; no
 snmp-server contact<BR>&gt; snmp-server community public<BR>&gt; no snmp=
-server enable traps<BR>&gt; floodguard enable<BR>&gt; sysopt connection =
permit-ipsec<BR>&gt; crypto ipsec transform-set strong esp-3des esp-sha-h=
mac<BR>&gt; crypto dynamic-map dynmap 30 set transform-set strong<BR>&gt;=
 crypto map toX 20 ipsec-isakmp<BR>&gt; crypto map toX 20 match address a=
cl_vpn<BR>&gt; crypto map toX 20 set peer 196.200.82.35<BR>&gt; crypto ma=
p toX 20 set transform-set strong<BR>&gt; crypto map toX 30 ipsec-isakmp<=
BR>&gt; crypto map toX 30 match address acl_blgo<BR>&gt; crypto ipsec tra=
nsform-set strong esp-3des esp-sha-hmac<BR>&gt; crypto dynamic-map dynmap=
 30 set transform-set strong<BR>&gt; crypto map toX 20 ipsec-isakmp<BR>&g=
t; crypto map toX 20 match address acl_vpn<BR>&gt; crypto map toX 20 set =
peer 196.200.82.35<BR>&gt; crypto map toX 20 set transform-set strong<BR>=
&gt; crypto map toX 30 ipsec-isakmp<BR>&gt; crypto map toX 30 match addre=
ss acl_blgo<BR>&gt; crypto map toX 30
 set peer 194.78.211.130<BR>&gt; crypto map toX 30 set transform-set stro=
ng<BR>&gt; crypto map toX 9990 ipsec-isakmp dynamic dynmap<BR>&gt; crypto=
 map toX interface outside<BR>&gt; isakmp enable outside<BR>&gt; isakmp k=
ey ******** address 196.200.82.35 netmask <BR>&gt; 255.255.255.255<BR>&gt=
; isakmp key ******** address 194.78.211.130 netmask <BR>&gt; 255.255.255=
.255<BR>&gt; isakmp identity address<BR>&gt; isakmp policy 9 authenticati=
on pre-share<BR>&gt; isakmp policy 9 encryption 3des<BR>&gt; isakmp polic=
y 9 hash sha<BR>&gt; isakmp policy 9 group 1<BR>&gt; isakmp policy 9 life=
time 86400<BR>&gt; isakmp policy 19 authentication pre-share<BR>&gt; isak=
mp policy 19 encryption 3des<BR>&gt; isakmp policy 19 hash sha<BR>&gt; is=
akmp policy 19 group 2<BR>&gt; isakmp policy 19 lifetime 86400<BR>&gt; te=
lnet timeout 5<BR>&gt; ssh 194.7.174.162 255.255.255.255 outside<BR>&gt; =
ssh 194.7.174.163 255.255.255.255 outside<BR>&gt; ssh 10.102.156.0 255.25=
5.252.0 inside<BR>&gt; ssh 10.102.155.0
 255.255.255.0 inside<BR>&gt; ssh timeout 5<BR>&gt; console timeout 0<BR>=
&gt; terminal width 80<BR>&gt; Cryptochecksum:7458b1b938134f7d52ed82d4e20=
03210<BR>&gt; <BR>&gt; Regrds,<BR>&gt; <BR>&gt; Kindy<BR>&gt; <BR>&gt; <B=
R>&gt; <BR>&gt; ---------------------------------<BR>&gt; Faites de Yahoo=
! votre page d'accueil sur le web pour <BR>&gt; retrouver directement vos=
 services pr=E9f=E9r=E9s : v=E9rifiez vos <BR>&gt; nouveaux mails, lancez=
 vos recherches et suivez l'actualit=E9 <BR>&gt; en temps r=E9el. Cliquez=
 ici.<BR>&gt; <BR>&gt; <BR>&gt; <BR>&gt; <BR>&gt; <BR>&gt; --------------=
-------------------<BR>&gt; Faites de Yahoo! votre page d'accueil sur le =
web pour <BR>&gt; retrouver directement vos services pr=E9f=E9r=E9s : v=E9=
rifiez vos <BR>&gt; nouveaux mails, lancez vos recherches et suivez l'act=
ualit=E9 <BR>&gt; en temps r=E9el. Cliquez ici.<BR>&gt; <BR>&gt; <BR>&gt;=
 <BR>&gt; <BR>&gt; ________________________________<BR>&gt; <BR>&gt; Yaho=
o! Mail r=E9invente le mail ! D=E9couvrez le nouveau Yahoo!
 <BR>&gt; Mail <BR>&gt; <HTTP: evt=3D"40577/*http://fr.promotions.yahoo.<=
br" fr.rd.yahoo.com>&gt; com/mail/nouveaumail.html&gt; et son interface r=
=E9volutionnaire. <BR>&gt; <BR>__________________________________________=
_____<BR>VPN mailing list<BR>[email protected]<BR>http://lists.shmoo.co=
m/mailman/listinfo/vpn<BR></BLOCKQUOTE><BR><p>
		<hr size=3D"1">=20
<b>Yahoo! Mail r=E9invente le mail !</b> D=E9couvrez le <a href=3D"http:/=
/fr.rd.yahoo.com/evt=3D40577/*http://fr.promotions.yahoo.com/mail/nouveau=
mail.html=20
">nouveau Yahoo! Mail</a> et son interface r=E9volutionnaire.

--0-710741500-1147446764=:73801--

--===============1605434733==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
VPN mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/vpn
--===============1605434733==--