text:
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
Local controller to master over internet
07-14-2016 05:42 AM - edited 07-14-2016 05:44 AM
I´m setting up a lab scenario with a central controller with UDP 4500 only port forwarded to it from the public facing firewall and a branch office controller with internet only access that should connect as a local to the central master. I think I´m missing something simple so please help me take an extra look :)
Configuration on master:
local-factory-cert local-mac "00:0b:86:xx:xx:xx"
controller-ip 192.168.230.3 (this one has UDP 4500 port forwarded to it from 22.214.171.124)
crypto isakmp udpencap-behind-natdevice enable
Configuration on brach local:
masterip 18.104.22.168 ipsec-factory-cert master-mac-1 00:0b:86:yy:yy:yy
interface vlan 4094 (internetfacing accessport)
ip address dhcp-client
ip nat outside
interface vlan 5
ip address 172.22.5.10 255.255.255.0
ip nat inside
controller-ip vlan 5
I can see successful isapmp SA and ipsec SA on both controllers and the routes are successfully implemented in the IPSEC maps.
On Master:
C 172.22.5.10/32 is an ipsec map default-local-master-ipsecmap-00:0b:86:xx:xx:xx
On Local:
C 192.168.230.3/32 is an ipsec map default-local-master-ipsecmap
If I ping from the master to 172.22.5.10 I can see this in the datapath session table of the local:
192.168.230.3 172.22.5.10 1 55 2048 0/0 0 0 1 tunnel 10 8 1 120 FSCI
172.22.5.10 18.104.22.168 1 58 0 0/0 0 0 1 tunnel 10 6 1 120 FNI
(Also in the datapath I see the local trying to answer PAPI traffic back to the public IP of 184.108.40.206 instead of the masters controller-ip which I think it should be)
If I ping from the local to the 192.168.230.3 address I see nothing in the datapath of the master.
In the logs of the local I just see that it tries to send things directly to the public IP of the master, shouldn´t it understand that it needs to communicate through the tunnel?
Jul 14 15:33:21 cfgm[3468]: <307025> <DBUG> |cfgm| local:Sending heartbeat message to MMS
Jul 14 15:33:21 cfgm[3468]: <307103> <INFO> |cfgm| send_tcp_hb_master 196 Connection to the master failed, Will retry socket ID 20 state CONFIG_SOCKET_NOTCONNECTED
Jul 14 15:33:21 cfgm[3468]: <307240> <DBUG> |cfgm| Connecting the Local CFGM socket, state 1
Jul 14 15:33:21 cfgm[3468]: <307242> <INFO> |cfgm| Failed to connect to the Master (188.8.131.52),Configuration socket will try again: Connection timed out
Jul 14 15:33:21 cfgm[3468]: <399814> <DBUG> |cfgm| Checking if the regulatory file is modified
Jul 14 15:33:21 cfgm[3468]: <399814> <DBUG> |cfgm| Sending the heartbeat message. Not Responding counter=7
Jul 14 15:33:21 cfgm[3468]: <399815> <INFO> |cfgm| Cannot connect to the master 22.214.171.124 error Connection timed out errno 145 socket id 20
I´ve also put up a local using certificate based authentication on the same subnet as the master and it works like a charm. I´d like this to work with only the UDP4500 port forward.
Please help me put some extra eyes on this dear Airheaders :) I´m running ArubaOS 188.8.131.52
Aruba Partner Ambassador
Aruba: ACMX #537 ACCP ACDP | CWNP: CWNE #306
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator


text:
The energy value of most polymers is of the same order as that of oil. Even though mechanical recycling is also preferable, there is a limit as to how many times a material can be recycled, as each lifecycle with reprocessing and use involves some contamination and decomposition of the material.
As a final step, there is always energy recovery as a possibility. Packaging which is appropriate for recycling in the form of energy recovery shall be combustible and give an energy surplus. It can be determined, for example, in accordance with the EN 13431 standard.
Phone: +46 10 516 53 05

subset: commoncrawl


text: It's going to be a tough year. V.A.T. rises to 20% on New Year's Day. The prices of food, electricity and gas have just been increased. Wages and pensions remain fixed. Gloom and doom are all around in abundance! What can we do? For everyone on low incomes, for those living on the streets, the … Continue reading What should we look for in 2011?


text: When McLaren said it was building the MP4-12C, I knew it had to be good. We're talking about a successor to the incomparable McLaren F1, after all. With that kind of family DNA, how could it not be good? So when McLaren gave me a chance two years ago to be among the first in the world to see the new car, I leapt. It was really impressive, from the clean lines to the carbon fiber tub to the fact that the guys at Woking designed their own engine. I decided right then, right there, that I must have one. I placed my order. I finally got it, just in time for Christmas. How good is the McLaren MP4-12C, you ask? So good I put 1,000 miles on the clock the first week I had it.This being McLaren, a company synonymous with Formula 1, the MP4-12C was designed to make quick work of a track. To prove it, McLaren invited me across the pond last year for a driving lesson with Chief Test Driver Chris Goodwin. We put the car through its paces around the Top Gear track at Dunsfold. It was great. But I use the car on the street, with occasional sorties into the hills above Los Angeles. It's actually quite nice on the street. Put the car in "normal" mode it rides like a sedan. It's polite, almost docile. This is the only supercar I've owned where I don't scrape the bodywork going up the driveway. Flip the switch to track mode, though, you feel it hunker down and get tight. Above: Jay Leno with his McLaren F1 and his McLaren MP4-12C.There are some cars people just beat the hell out of. Porsches and Corvettes come to mind. There are others, which I won't name, that people tend to treat carefully, as if handling fine china. The McLaren is not one of those cars. It was meant to be driven, and hard. You can put it away wet. McLarens are road cars with race car performance, not race cars diluted for the street. The McLaren F1 was an excellent example, and probably the last car you could drive to Le Mans, win the race and drive home again. Anyone who takes the MP4-12C racing should do quite well.For all the focus on performance, though, the McLaren is remarkably efficient for what it is. It doesn't even have a gas guzzler tax. I took it on the freeway the other day and averaged 23 mpg – in a car with close to 600 horsepower. Granted, you're probably using just 10 percent of that at freeway speed, but that's a remarkable figure for something this fast. The sound of the 3.8-liter twin-turbo V8 is intoxicating. So is the acceleration. Sixty mph arrives in 3 seconds and you can do the quarter in less than 11. There are two turbos but no lag. You'd think you're driving a normally aspirated car. It's got amazing torque, everywhere.Now, anyone who drives – really drives – knows the real thrill comes between 40 mph and 120 mph. Top speed is about little more than marketing, even if the MP4-12C does top out at 205. Frankly, I'm a little tired of the supercar top speed war, where one company says, "Hey, ours can do 258 mph" and another says, "Yeah? Well ours can do 259." Those numbers are meaningless on the street. You can't use them. And if you do, you ought to be in prison. The numbers between 40 and 120 mph are where everything happens. And it all happens so beautifully in the MP4-12C.So the inevitable question is how does it compare to the F1? It's hard to say and, frankly, not a fair question because they're entirely different tools for entirely different jobs. The F1 is more than a car, it's an experience. But for real-world, everyday driving, I prefer the 12C. When the F1 appeared in 1992, it was the ultimate expression of the automobile, the very best it could be. For me, the 12C is the modern equivalent. http://www.youtube.com/embed/ZhnDOiDKDtkPhotos and video: incword.com


text:
Marshall: 'A bed, a bunker and a dishka. What more can a man want?'
Third in a series.
U.S. Rep. Jim Marshall of Macon was embedded with a Special Forces A Team, the weekend of July 20. This is his log of the experiences.
Sunday, July 22, 2007: Besides those finishing their night shift, Scrappy and Dog were the only two coalition members up and about this morning as I wandered around Fire Base Chamkani at daybreak. Dog feigned an attack on some of the Afghan help. Maybe the A Team is right about the usefulness of these two Afghan mutts. In many third world countries, barking dogs inform strangers when they get too close to their owner's property. Scrappy and Dog do not bark at Americans within the perimeter, only Afghans.
Breakfast was scheduled from six to eight with a team briefing to follow. That left plenty of time for some exercise. So I walked to the highest bunker on the outer perimeter, joined by my Special Operations military escort, Special Forces Col. Ray Helton with his sidearm hidden under his shirt. At the top, I found Afghan security guard Sher Agha who is a member of the Stanakzai tribe, according to his U.S.-issued identification card.
He was sitting outside his bunker on a plywood bed eating breakfast and drinking tea, a Russian dishka machine gun wrapped in blue plastic behind him. We arm the ASG force with Russian weapons and munitions scarfed from caches. When you have little, you waste little.
I took a picture and showed it to Sher Agha. He was pleased and offered us tea. We accepted despite worries about Montezuma's Revenge, although in this part of the world it probably has a different name. Later, seeing the picture, one of the A team members commented "A bed, a bunker and a dishka. What more can a man want?"
We returned to this topmost bunker later in the day so the A team could show me the lay of the land and give me a formal meeting with the commander of this ASG force. Team members call him Gun Doctor or GD. He has been a mujhadin since the age of 13. I'm told he is now 33, which seems far too young for his striking features. But the average life expectancy in Afghanistan is one of the lowest in the world. Afghanistan's poverty, wars and harsh environment are utterly unforgiving.
During the meeting and later, through an interpreter, I spent a fair amount of time talking with GD and recalled Gen. Abizaid's quip that "Afghanistan is moving rapidly into the 15th century." Actually its social fabric and mores seem a mixture of many centuries. The culture clash is quite pronounced.
Individuals can't survive in these Afghan and Pakistani mountains conquered only by Alexander the Great. Individuals must ally themselves with a tribe. Tribe is everything. The system is feudal, France and England circa 1200 A.D.
Like knights and yeomen, young tribal men are expected to serve the security needs of the tribe as determined by tribal leaders. It's a matter of meeting a social obligation in order to continue to enjoy esteem in the tribal society. GD knows combat. But even more so, he knows survival. His allegiance can change with the tribe's.
We can't get out today. When the weather is good, no helicopters are available. They are called to more important duty - reinforcements in a firefight, medical evacuations, critical resupply. This part of Afghanistan is hot. One A team member says "Chamkani is actually in the Bermuda Triangle. When you come here, you can't get out."
I will miss votes. But I insist no one whines about it on my behalf. My business pales in comparison, and I don't want Special Operation Command (SOCOM) or Department of Defense (DoD) to have another reason to be reluctant about front line embeds.
One of our outposts, an Afghan Border Patrol checkpoint some three miles toward Pakistan, was hit that night with RPGs (Soviet shoulder-fired rocket propelled grenade) and small arms fire. We watched the fight from the op center roof and I was heartened when listening to the A team members discussing what to do.
The outpost called for help. GD came by with an additional request. But team members were reluctant to do so. One said "We need to let them take care of this piss-ant little stuff or they will never build capacity." The others agreed. GD asked for at least some illumination rounds. The A team fired three, reluctantly, from their 120 mm mortar.
Spec. Dan Love, a young photographer with 7th Special Forces Group, got a great picture of one of the mortar illumination rounds being launched. I was watching the fight, not the mortar crew.
Jim Marshall represents the 8th Congressional District in Georgia.