A Site is at 5505, 5510

I've been struggling with this problem for a while know...

I made so many changes, I'm afraid, I have things to my config, I really need...

But in any case here's how I'm trying to implement...

  • Information the seat...
    static ip 111.111.111.111 address
    IP address of 192.168.10.0 inside - 192.168.10.24 of network devices
    IP address of the server 192.168.10.3
  • #2 remote desktop
    static IP 222.222.222.222
    the IP address of the inside of 192.168.20.0 - 192.168.20.24 of network devices
  • #3 Remote Desktop

STATICE ip 333.333.333.333

the IP address of the inside of 192.168.30.0 - 192.168.30.24 of network devices

I think that once I get a vpn set up for a desktop remote added offices 3, 4 and 5 should / would be the same.  Just a matter of change/addition of the different IP offices.

I used the VPN Wizard to try to set up the vpn for office #2 and #3... then it wouldn't work so I found some stuff line cmd on the cisco Web site, so I tried which... It seemed to work a little better, but still missing something...

Here is some info, you can see...

  • ASA 5510 (main office)
  • Sh run nat
    NAT (inside) 0-list of access inside_nat0_outbound_1
    NAT (inside) 101 0.0.0.0 0.0.0.0
  • Output from the command: 'sh run access-list '.
  • inside_mpc list extended access permit tcp any any idle state
    permit inside_nat0_outbound_1 to access extended list ip 192.168.10.0 255.255.255.0 host 222.222.222.222
    permit inside_nat0_outbound_1 to access extended list ip 192.168.10.0 255.255.255.0 192.168.30.0 255.255.255.0
    permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 any
    permit outside_2_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 192.168.30.0 255.255.255.0
    permit access ip host 111.111.111.111 extended list outside_cryptomap_3 222.222.222.222
    permit 121_list to access extended list ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
    121_list to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

Output of the command: "sh run crypto.

  • Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    card crypto outside_map 2 match address outside_2_cryptomap
    card crypto outside_map 2 pfs Group1 set
    peer set card crypto outside_map 2 333.333.333.333
    card crypto outside_map 2 game of transformation-ESP-3DES-SHA
    card crypto outside_map 3 match address outside_cryptomap_3
    card crypto outside_map pfs Group1 3 set
    peer set card crypto outside_map 3 222.222.222.222
    card crypto outside_map 3 game of transformation-ESP-AES-128-SHA
    card crypto mcmap 1 match address 121_list
    card crypto mcmap 1 set peer 222.222.222.222
    card crypto mcmap 1 set of transformation-FirstSet
    mcmap interface card crypto outside
    crypto ISAKMP allow outside
    crypto ISAKMP policy 1
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
  • Output of the command: "sh run tunnel-group.
  • IPSec-attributes tunnel-group DefaultL2LGroup
    pre-shared-key *.
    tunnel-group 222.222.222.222 type ipsec-l2l
    IPSec-attributes tunnel-group 222.222.222.222
    pre-shared-key *.
    tunnel-group 333.333.333.333 type ipsec-l2l
    IPSec-attributes tunnel-group 333.333.333.333
    pre-shared-key *.

ASA 5505 (#2 remote desktop)
Output of the command: "sh run nat".
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 0.0.0.0 0.0.0.0

Output from the command: 'sh run access-list '.
outside_1_cryptomap to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0
inside_nat0_outbound to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0
outside_cryptomap_2 to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0
121_list to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

permit 121_list to access extended list ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0

Output of the command: "sh run crypto.
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet
card crypto outside_map 1 match address outside_1_cryptomap
card crypto outside_map 1 set pfs Group1
peer set card crypto outside_map 1 111.111.111.111
card crypto outside_map 1 set of transformation-ESP-3DES-SHA
card crypto outside_map 2 match address outside_cryptomap_2
card crypto outside_map 2 pfs Group1 set
outside_map 2 set counterpart 192.168.10.3 crypto card
card crypto outside_map 2 game of transformation-ESP-DES-SHA
card crypto macmap 1 match address 121_list
card crypto macmap 1 set peer 111.111.111.111
card crypto macmap 1 set of transformation-FirstSet
macmap outside crypto map interface
crypto ISAKMP allow outside
crypto ISAKMP policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 43200
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400

Output of the command: "sh run tunnel-group.
tunnel-group 111.111.111.111 type ipsec-l2l
IPSec-attributes tunnel-group 111.111.111.111
pre-shared-key *.
tunnel-group 222.222.222.222 type ipsec-l2l
IPSec-attributes tunnel-group 222.222.222.222
pre-shared-key *.

Thanks again for any help!

Hello

Some changes you need to do:

The ACL applied to the card encryption should specify the local LAN.
So, you should not have a line like this:
permit access ip host 111.111.111.111 extended list outside_cryptomap_3 222.222.222.222
Because with the foregoing, you say you want that traffic is encrypted between these two IP addresses.
You do not want the tunnel established between these two addresses, but you want traffic encrypted between the local networks at both ends.

In addition, you have the same traffic defined for two different tunnels.
outside_1_cryptomap to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0
outside_cryptomap_2 to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

You can't have the remote 192.168.10.0/24 set to two different tunnels, given that the ASA will not know what tunnel to use to achieve 192.168.10.0/24

I would say to adjust your ACL and let us know if you have any questions.

It will be useful.

Federico.

Tags: Cisco Security

Similar Questions

  • Impossible to establish vpn site to site between asa 5505 5510 year

    Hi all experts

    We are now plan to form an IPSec VPN tunnel from site to site between ASA 5505 (ASA Version 8.4) and ASA 5510 (ASA Version 8.0) but failed, would you please show me how to establish? A reference guide?

    Hugo

    Here are the links to the guides-cisco config:

    http://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/site2sit.html

    http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/vpn_site2site.html

    In addition to VPN, you need to consider in NAT exemption:

    http://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/cfgnat.html#wp1043541

    http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/nat_overview.html#wpxref25608

    http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/nat_rules.html#wp1232160

    And many examples:

    http://www.Cisco.com/en/us/products/ps6120/prod_configuration_examples_list.html

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • % 7-ASA-710005: request TCP thrown error in the Client VPN Site to CISCO ASA 5510

    Hi friends,

    I am trying to built customer to site VPN CISCO ASA 5510 8.4 (4) and get error below when connecting to a cisco VPN client software. Also, I'm below ASA, log. Please help me to reslove.

    Error in CISCO VPN Client software:

    Secure VPN connection terminated locally by the client.

    Reason: 414: unable to establish a TCP connection.

    Error in CISCO ASA 5510

    7-ASA-710005%: TCP request and eliminated from 49276 outward: 10000

    The ASA configuration:

    XYZ # sh run
    : Saved
    :
    ASA Version 8.4 (4)
    !
    hostname XYZ
    domain XYZ
    activate the password encrypted 3uLkVc9JwRA1/OXb N3
    activate the encrypted password of R/x90UjisGVJVlh2
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Ethernet0/0
    nameif outside_rim
    security-level 0
    IP 1.1.1.1 255.255.255.252
    !
    interface Ethernet0/1
    full duplex
    nameif XYZ_DMZ
    security-level 50
    IP 172.1.1.1 255.255.255.248
    !
    interface Ethernet0/2
    Speed 100
    full duplex
    nameif outside
    security-level 0
    IP address 2.2.2.2 255.255.255.252
    !
    interface Ethernet0/3
    Speed 100
    full duplex
    nameif inside
    security-level 100
    IP 3.3.3.3 255.255.255.224
    !
    interface Management0/0
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    boot system Disk0: / asa844 - k8.bin
    passive FTP mode
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    Server name xx.xx.xx.xx
    Server name xx.xx.xx.xx
    Server name xx.xx.xx.xx
    Server name xx.xx.xx.xx
    domain XYZ
    network object obj - 172.17.10.3
    Home 172.17.10.3
    network object obj - 10.1.134.0
    10.1.134.0 subnet 255.255.255.0
    network object obj - 208.75.237.0
    208.75.237.0 subnet 255.255.255.0
    network object obj - 10.7.0.0
    10.7.0.0 subnet 255.255.0.0
    network object obj - 172.17.2.0
    172.17.2.0 subnet 255.255.255.0
    network object obj - 172.17.3.0
    172.17.3.0 subnet 255.255.255.0
    network object obj - 172.19.2.0
    172.19.2.0 subnet 255.255.255.0
    network object obj - 172.19.3.0
    172.19.3.0 subnet 255.255.255.0
    network object obj - 172.19.7.0
    172.19.7.0 subnet 255.255.255.0
    network object obj - 10.1.0.0
    10.1.0.0 subnet 255.255.0.0
    network object obj - 10.2.0.0
    10.2.0.0 subnet 255.255.0.0
    network object obj - 10.3.0.0
    10.3.0.0 subnet 255.255.0.0
    network object obj - 10.4.0.0
    10.4.0.0 subnet 255.255.0.0
    network object obj - 10.6.0.0
    10.6.0.0 subnet 255.255.0.0
    network object obj - 10.9.0.0
    10.9.0.0 subnet 255.255.0.0
    network object obj - 10.11.0.0
    10.11.0.0 subnet 255.255.0.0
    network object obj - 10.12.0.0
    10.12.0.0 subnet 255.255.0.0
    network object obj - 172.19.1.0
    172.19.1.0 subnet 255.255.255.0
    network object obj - 172.21.2.0
    172.21.2.0 subnet 255.255.255.0
    network object obj - 172.16.2.0
    172.16.2.0 subnet 255.255.255.0
    network object obj - 10.19.130.201
    Home 10.19.130.201
    network object obj - 172.30.2.0
    172.30.2.0 subnet 255.255.255.0
    network object obj - 172.30.3.0
    172.30.3.0 subnet 255.255.255.0
    network object obj - 172.30.7.0
    172.30.7.0 subnet 255.255.255.0
    network object obj - 10.10.1.0
    10.10.1.0 subnet 255.255.255.0
    network object obj - 10.19.130.0
    10.19.130.0 subnet 255.255.255.0
    network of object obj-XXXXXXXX
    host XXXXXXXX
    network object obj - 145.248.194.0
    145.248.194.0 subnet 255.255.255.0
    network object obj - 10.1.134.100
    Home 10.1.134.100
    network object obj - 10.9.124.100
    Home 10.9.124.100
    network object obj - 10.1.134.101
    Home 10.1.134.101
    network object obj - 10.9.124.101
    Home 10.9.124.101
    network object obj - 10.1.134.102
    Home 10.1.134.102
    network object obj - 10.9.124.102
    Home 10.9.124.102
    network object obj - 115.111.99.133
    Home 115.111.99.133
    network object obj - 10.8.108.0
    10.8.108.0 subnet 255.255.255.0
    network object obj - 115.111.99.129
    Home 115.111.99.129
    network object obj - 195.254.159.133
    Home 195.254.159.133
    network object obj - 195.254.158.136
    Home 195.254.158.136
    network object obj - 209.164.192.0
    subnet 209.164.192.0 255.255.224.0
    network object obj - 209.164.208.19
    Home 209.164.208.19
    network object obj - 209.164.192.126
    Home 209.164.192.126
    network object obj - 10.8.100.128
    subnet 10.8.100.128 255.255.255.128
    network object obj - 115.111.99.130
    Home 115.111.99.130
    network object obj - 10.10.0.0
    subnet 10.10.0.0 255.255.0.0
    network object obj - 115.111.99.132
    Home 115.111.99.132
    network object obj - 10.10.1.45
    Home 10.10.1.45
    network object obj - 10.99.132.0
    10.99.132.0 subnet 255.255.255.0
    the Serversubnet object-group network
    object-network 10.10.1.0 255.255.255.0
    network-object 10.10.5.0 255.255.255.192
    the XYZ_destinations object-group network
    object-network 10.1.0.0 255.255.0.0
    object-network 10.2.0.0 255.255.0.0
    network-object 10.3.0.0 255.255.0.0
    network-object 10.4.0.0 255.255.0.0
    network-object 10.6.0.0 255.255.0.0
    network-object 10.7.0.0 255.255.0.0
    network-object 10.11.0.0 255.255.0.0
    object-network 10.12.0.0 255.255.0.0
    object-network 172.19.1.0 255.255.255.0
    object-network 172.19.2.0 255.255.255.0
    object-network 172.19.3.0 255.255.255.0
    object-network 172.19.7.0 255.255.255.0
    object-network 172.17.2.0 255.255.255.0
    object-network 172.17.3.0 255.255.255.0
    object-network 172.16.2.0 255.255.255.0
    object-network 172.16.3.0 255.255.255.0
    host of the object-Network 10.50.2.206
    the XYZ_us_admin object-group network
    network-object 10.3.1.245 255.255.255.255
    network-object 10.5.33.7 255.255.255.255
    network-object 10.211.5.7 255.255.255.255
    network-object 10.3.33.7 255.255.255.255
    network-object 10.211.3.7 255.255.255.255
    the XYZ_blr_networkdevices object-group network
    object-network 10.200.10.0 255.255.255.0
    access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 145.248.194.0 255.255.255.0
    access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host 172.16.2.21
    access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host 172.16.2.22
    access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host XXXXXXXX
    Access extensive list ip 10.19.130.0 XYZ_PAT allow 255.255.255.0 any
    Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 195.254.159.133
    Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 195.254.158.136
    Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 any
    Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 209.164.192.0 255.255.224.0
    Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 209.164.208.19
    Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 209.164.192.126
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 208.75.237.0 255.255.255.0
    Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.7.0.0 255.255.0.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.17.2.0 255.255.255.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.17.3.0 255.255.255.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.2.0 255.255.255.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.3.0 255.255.255.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.7.0 255.255.255.0
    10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.1.0.0 255.255.0.0
    10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.2.0.0 255.255.0.0
    Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.3.0.0 255.255.0.0
    10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.4.0.0 255.255.0.0
    10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.6.0.0 255.255.0.0
    Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.9.0.0 255.255.0.0
    Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.11.0.0 255.255.0.0
    10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.12.0.0 255.255.0.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.1.0 255.255.255.0
    IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.21.2.0 255.255.255.0
    10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 172.16.2.0 255.255.255.0
    access-list extended sheep allowed host ip 10.19.130.201 172.30.2.0 255.255.255.0
    access-list extended sheep allowed host ip 10.19.130.201 172.30.3.0 255.255.255.0
    access-list extended sheep allowed host ip 10.19.130.201 172.30.7.0 255.255.255.0
    access-list extended sheep allowed ip object-group Serversubnet-group of objects XYZ_destinations
    10.10.1.0 IP Access-list extended sheep 255.255.255.0 allow 10.2.0.0 255.255.0.0
    10.19.130.0 IP Access-list extended sheep 255.255.255.0 allow host XXXXXXXX
    IP 10.19.130.0 allow Access-list extended sheep 255.255.255.0 145.248.194.0 255.255.255.0
    Access extensive list ip 10.8.108.0 Guest_PAT allow 255.255.255.0 any
    CACIB list extended access permitted ip 10.8.100.128 255.255.255.128 145.248.194.0 255.255.255.0
    Access extensive list ip 10.8.100.128 Cacib_PAT allow 255.255.255.128 all
    Access extensive list ip 10.1.134.0 New_Edge allow 255.255.255.0 208.75.237.0 255.255.255.0
    Allow XYZ_global to access extended list ip 10.7.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.7.0.0 255.255.0.0
    Access extensive list ip 172.17.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 172.17.3.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 172.19.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 172.19.3.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 172.19.7.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 10.1.0.0 XYZ_global allow 255.255.0.0 10.1.134.0 255.255.255.0
    Access extensive list 10.2.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
    Allow XYZ_global to access extended list ip 10.3.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    Access extensive list 10.4.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
    Access extensive list 10.6.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
    Access extensive list ip 10.9.0.0 XYZ_global allow 255.255.0.0 10.1.134.0 255.255.255.0
    Allow XYZ_global to access extended list ip 10.11.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    Access extensive list 10.12.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
    Access extensive list ip 172.19.1.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 172.21.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.17.2.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.17.3.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.2.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.3.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.7.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.1.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.2.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.3.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.4.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.6.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.9.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.11.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.12.0.0 255.255.0.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.1.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.21.2.0 255.255.255.0
    XYZ_global to access extended list ip 172.16.2.0 allow 255.255.255.0 10.1.134.0 255.255.255.0
    Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.16.2.0 255.255.255.0
    Access extensive list ip 172.30.2.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
    XYZ_global list extended access allowed host ip 10.19.130.201 172.30.2.0 255.255.255.0
    Access extensive list ip 172.30.3.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
    XYZ_global list extended access allowed host ip 10.19.130.201 172.30.3.0 255.255.255.0
    Access extensive list ip 172.30.7.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
    XYZ_global list extended access allowed host ip 10.19.130.201 172.30.7.0 255.255.255.0
    XYZ_global list extended access permitted ip object-group Serversubnet-group of objects XYZ_destinations
    XYZ_global list extended access permitted ip object-group XYZ_destinations-group of objects Serversubnet
    ML_VPN list extended access allowed host ip 115.111.99.129 209.164.192.0 255.255.224.0
    permit access list extended ip host 115.111.99.129 ML_VPN 209.164.208.19
    permit access list extended ip host 115.111.99.129 ML_VPN 209.164.192.126
    permit access list extended ip host 10.9.124.100 Da_VPN 10.125.81.88
    permit access list extended ip host 10.9.124.101 Da_VPN 10.125.81.88
    permit access list extended ip host 10.9.124.102 Da_VPN 10.125.81.88
    Da_VPN list extended access allowed host ip 10.9.124.100 10.125.81.0 255.255.255.0
    Da_VPN list extended access allowed host ip 10.9.124.101 10.125.81.0 255.255.255.0
    Da_VPN list extended access allowed host ip 10.9.124.102 10.125.81.0 255.255.255.0
    Sr_PAT to access extended list ip 10.10.0.0 allow 255.255.0.0 any
    Da_Pd_VPN list extended access allowed host ip 10.9.124.100 10.125.80.64 255.255.255.192
    Da_Pd_VPN list extended access allowed host ip 10.9.124.100 10.125.64.0 255.255.240.0
    permit access list extended ip host 10.9.124.100 Da_Pd_VPN 10.125.85.46
    permit access list extended ip host 10.9.124.100 Da_Pd_VPN 10.125.86.46
    Da_Pd_VPN list extended access allowed host ip 10.9.124.101 10.125.80.64 255.255.255.192
    Da_Pd_VPN list extended access allowed host ip 10.9.124.101 10.125.64.0 255.255.240.0
    permit access list extended ip host 10.9.124.101 Da_Pd_VPN 10.125.85.46
    permit access list extended ip host 10.9.124.101 Da_Pd_VPN 10.125.86.46
    Da_Pd_VPN list extended access allowed host ip 10.9.124.102 10.125.80.64 255.255.255.192
    Da_Pd_VPN list extended access allowed host ip 10.9.124.102 10.125.64.0 255.255.240.0
    permit access list extended ip host 10.9.124.102 Da_Pd_VPN 10.125.85.46
    permit access list extended ip host 10.9.124.102 Da_Pd_VPN 10.125.86.46
    Access extensive list ip 10.19.130.0 XYZ_reliance allow 255.255.255.0 145.248.194.0 255.255.255.0
    access-list coextended permit ip host 2.2.2.2 XXXXXXXX
    access-list coextended allow the host ip XXXXXXXXhost 2.2.2.2
    permitted this access list extended ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    permitted this access list extended ip 208.75.237.0 255.255.255.0 10.1.134.0 255.255.255.0
    access list acl-outside extended permit ip host 57.66.81.159 172.17.10.3
    access list acl-outside extended permit ip host 80.169.223.179 172.17.10.3
    access list acl-outside scope permit ip any host 172.17.10.3
    access list acl-outside extended permitted tcp any host 10.10.1.45 eq https
    access list acl-outside extended permit tcp any any eq 10000
    access list acl-outside extended deny ip any any newspaper
    pager lines 10
    Enable logging
    debug logging in buffered memory
    outside_rim MTU 1500
    MTU 1500 XYZ_DMZ
    Outside 1500 MTU
    Within 1500 MTU
    IP pool local XYZ_c2s_vpn_pool 172.30.10.51 - 172.30.10.254
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow all outside
    ICMP allow any inside
    don't allow no asdm history
    ARP timeout 14400
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 208.75.237.0 obj - 208.75.237.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.7.0.0 obj - 10.7.0.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.17.2.0 obj - 172.17.2.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.17.3.0 obj - 172.17.3.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.2.0 obj - 172.19.2.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.3.0 obj - 172.19.3.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.7.0 obj - 172.19.7.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.1.0.0 obj - 10.1.0.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.2.0.0 obj - 10.2.0.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.3.0.0 obj - 10.3.0.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.4.0.0 obj - 10.4.0.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.6.0.0 obj - 10.6.0.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.9.0.0 obj - 10.9.0.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.11.0.0 obj - 10.11.0.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.12.0.0 obj - 10.12.0.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.1.0 obj - 172.19.1.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.21.2.0 obj - 172.21.2.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.16.2.0 obj - 172.16.2.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.2.0 obj - 172.30.2.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.3.0 obj - 172.30.3.0 no-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.7.0 obj - 172.30.7.0 no-proxy-arp-search to itinerary
    NAT (inside, all) static source Serversubnet Serversubnet XYZ_destinations XYZ_destinations non-proxy-arp-search of route static destination
    NAT (inside, all) source static obj - 10.10.1.0 obj - 10.10.1.0 destination static obj - 10.2.0.0 obj - 10.2.0.0 non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.19.130.0 obj - 10.19.130.0 destination static obj-XXXXXXXX XXXXXXXX - obj non-proxy-arp-search to itinerary
    NAT (inside, all) source static obj - 10.19.130.0 obj - 10.19.130.0 destination static obj - 145.248.194.0 obj - 145.248.194.0 no-proxy-arp-search to itinerary
    NAT source (indoor, outdoor), obj static obj - 10.1.134.100 - 10.9.124.100
    NAT source (indoor, outdoor), obj static obj - 10.1.134.101 - 10.9.124.101
    NAT source (indoor, outdoor), obj static obj - 10.1.134.102 - 10.9.124.102
    NAT interface dynamic obj - 10.8.108.0 source (indoor, outdoor)
    NAT (inside, outside) source dynamic obj - 10.19.130.0 obj - 115.111.99.129
    NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 195.254.159.133 obj - 195.254.159.133
    NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 195.254.158.136 obj - 195.254.158.136
    NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129
    NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.192.0 obj - 209.164.192.0
    NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.208.19 obj - 209.164.208.19
    NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.192.126 obj - 209.164.192.126
    NAT (inside, outside) source dynamic obj - 10.8.100.128 obj - 115.111.99.130
    NAT (inside, outside) source dynamic obj - 10.10.0.0 obj - 115.111.99.132
    NAT source (indoor, outdoor), obj static obj - 10.10.1.45 - 115.111.99.133
    NAT (inside, outside) source dynamic obj - 10.99.132.0 obj - 115.111.99.129
    !
    network object obj - 172.17.10.3
    NAT (XYZ_DMZ, outside) static 115.111.99.134
    Access-group acl-outside in external interface
    Route outside 0.0.0.0 0.0.0.0 115.111.23.129 1
    Route outside 0.0.0.0 0.0.0.0 115.254.127.130 10
    Route inside 10.10.0.0 255.255.0.0 10.8.100.1 1
    Route inside 10.10.1.0 255.255.255.0 10.8.100.1 1
    Route inside 10.10.5.0 255.255.255.192 10.8.100.1 1
    Route inside 10.8.100.128 255.255.255.128 10.8.100.1 1
    Route inside 10.8.108.0 255.255.255.0 10.8.100.1 1
    Route inside 10.19.130.0 255.255.255.0 10.8.100.1 1
    Route inside 10.99.4.0 255.255.255.0 10.99.130.254 1
    Route inside 10.99.132.0 255.255.255.0 10.8.100.1 1
    Route inside 10.1.134.0 255.255.255.0 10.8.100.1 1
    Route outside 208.75.237.0 255.255.255.0 115.111.23.129 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication LOCAL telnet console
    LOCAL AAA authorization command
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn2
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-md5-hmac vpn6
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn5
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-md5-hmac vpn7
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn4
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn1
    Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn_reliance
    Crypto ipsec transform-set esp-3des esp-md5-hmac ikev1 c2s_vpn
    86400 seconds, duration of life crypto ipsec security association
    Crypto-map dynamic dyn1 ikev1 transform-set c2s_vpn 1 set
    Crypto-map dynamic dyn1 1jeu reverse-road
    card crypto vpn 1 corresponds to the address XYZ
    card 1 set of peer XYZ Peer IP vpn crypto
    1 set transform-set vpn1 ikev1 vpn crypto card
    card crypto vpn 1 lifetime of security set association, 3600 seconds
    card crypto vpn 1 set security-association life kilobytes 4608000
    correspondence vpn crypto card address 2 DON'T
    2 peer NE_Peer IP vpn crypto card game
    2 set transform-set vpn2 ikev1 vpn crypto card
    3600 seconds, duration of life card crypto vpn 2 set security-association
    card crypto vpn 2 set security-association life kilobytes 4608000
    card crypto vpn 4 corresponds to the address ML_VPN
    card crypto vpn 4 set pfs
    vpn crypto card game 4 peers ML_Peer IP
    4 set transform-set vpn4 ikev1 vpn crypto card
    3600 seconds, duration of life card crypto vpn 4 set - the security association
    card crypto vpn 4 set security-association life kilobytes 4608000
    vpn crypto card 5 corresponds to the address XYZ_global
    vpn crypto card game 5 peers XYZ_globa_Peer IP
    5 set transform-set vpn5 ikev1 vpn crypto card
    3600 seconds, duration of life card crypto vpn 5 set - the security association
    card 5 security-association life set vpn crypto kilobytes 4608000
    vpn crypto card 6 corresponds to the address Da_VPN
    vpn crypto card game 6 peers Da_VPN_Peer IP
    6 set transform-set vpn6 ikev1 vpn crypto card
    3600 seconds, duration of life card crypto vpn 6 set - the security association
    card crypto vpn 6 set security-association life kilobytes 4608000
    vpn crypto card 7 corresponds to the address Da_Pd_VPN
    7 peer Da_Pd_VPN_Peer IP vpn crypto card game
    7 set transform-set vpn6 ikev1 vpn crypto card
    3600 seconds, duration of life card crypto vpn 7 set - the security association
    card crypto vpn 7 set security-association life kilobytes 4608000
    vpn outside crypto map interface
    crypto map vpn_reliance 1 corresponds to the address XYZ_rim
    card crypto vpn_reliance 1 set of peer XYZ_rim_Peer IP
    card crypto 1 ikev1 transform-set vpn_reliance set vpn_reliance
    vpn_reliance card crypto 1 lifetime of security set association, 3600 seconds
    card crypto vpn_reliance 1 set security-association life kilobytes 4608000
    card crypto vpn_reliance interface outside_rim
    dynamic mymap 1 dyn1 ipsec-isakmp crypto map
    crypto isakmp identity address
    No encryption isakmp nat-traversal
    Crypto ikev1 enable outside_rim
    Crypto ikev1 allow outside
    IKEv1 crypto policy 1
    preshared authentication
    aes-256 encryption
    sha hash
    Group 5
    lifetime 28800
    IKEv1 crypto policy 2
    preshared authentication
    aes-256 encryption
    sha hash
    Group 5
    life 86400
    IKEv1 crypto policy 4
    preshared authentication
    aes-256 encryption
    sha hash
    Group 5
    life 28000
    IKEv1 crypto policy 5
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 43200
    IKEv1 crypto policy 65535
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet 10.8.100.0 255.255.255.224 inside
    Telnet timeout 5
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    no basic threat threat detection
    no statistical access list - a threat detection
    no statistical threat detection tcp-interception
    internal XYZ_c2s_vpn group strategy
    username testadmin encrypted password oFJjANE3QKoA206w
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group ipsec-attributes XXXXXXXX
    IKEv1 pre-shared-key *.
    tunnel-group XXXXXXXXtype ipsec-l2l
    tunnel-group XXXXXXXXipsec-attributes
    IKEv1 pre-shared-key *.
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group ipsec-attributes XXXXXXXX
    IKEv1 pre-shared-key *.
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group ipsec-attributes XXXXXXXX
    IKEv1 pre-shared-key *.
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group ipsec-attributes XXXXXXXX
    IKEv1 pre-shared-key *.
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group ipsec-attributes XXXXXXXX
    IKEv1 pre-shared-key *.
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group ipsec-attributes XXXXXXXX
    IKEv1 pre-shared-key *.
    type tunnel-group XYZ_c2s_vpn remote access
    attributes global-tunnel-group XYZ_c2s_vpn
    address pool XYZ_c2s_vpn_pool
    IPSec-attributes tunnel-group XYZ_c2s_vpn
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the netbios
    inspect the rsh
    inspect the rtsp
    inspect the skinny
    inspect esmtp
    inspect sqlnet
    inspect sunrpc
    inspect the tftp
    inspect the sip
    inspect xdmcp
    inspect the icmp
    Review the ip options
    !
    global service-policy global_policy
    level 3 privilege see the running-config command exec mode
    logging of orders privilege see the level 3 exec mode
    privilege see the level 3 exec mode command crypto
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:caa7476cd348ed89b95d37d4e3c9e1d8
    : end

    XYZ #.

    Good news

    Follow these steps:

    network object obj - 172.30.10.0_24

    172.30.10.0 subnet 255.255.255.0

    !

    the LOCAL_NETWORKS_VPN object-group network

    object-network 1.1.1.0 255.255.255.0

    !

    NAT (inside, outside) 1 static source LOCAL_NETWORKS_VPN destination LOCAL_NETWORKS_VPN static obj - 172.30.10.0_24 obj - 172.30.10.0_24 - route search

    * Where 1.1.1.0/24 is the internal network that you want to reach through the tunnel.

    Keep me posted.

    Thank you.

    Please note all messages that will be useful.

  • VPN SITE-TO-SITE BETWEEN ASA 5505 ASN 5510 DISORDERS

    Hello everyone, I have a problem with my vpn between two ASAs, I will review the configuration of the two devices running, but I couldn't see anything out of the normal.

    As you can see in the image, that the VPN is upward, but in the ASA 5510 I bytes of Rx (ZERO), I tried to config ASAs yet but I have the same problem, I don't know what I can do, please help me...

    Hello

    You should make sure that

    • Remote ends of NAT configurations are correct

      • NAT0 or another type of translation is not configured
      • A NAT rule is the substitution of the rule that you have configured for the VPN L2L?
    • Make sure that you have allowed the circulation/connection you are trying
      • VPN traffic is allowed to bypass the 'external' ACL interface on the remote end or the traffic should be allowed in the 'outer' interface ACL?
    • Make sure that the remote host responds to the same type of its local network connection attempt before trying the same thing from a remote location through VPN L2L
      • If a tested service does not work, try another. For example ICMP is not always the best thing to test connections.

    Can you also give us additional context information.

    • This VPN L2L worked, or did it stop working at some point?
    • I assume that you have administrator access to two ASA? Can you perhaps share some configurations
    • What kind of connections you attempt by the L2L VPN?
      • TCP/UDP/ICMP?
      • IP source and destination?
    • You monitor the newspapers of the SAA through the ASDM on the other end? The device at the remote end which does not send anything back on the L2L VPN connection.

    And as a last post a very common configuration that is absent of configurations of ASA during the test with ICMP

    Make sure you two ASAs have below "icmp inspect" configured

    Policy-map global_policy

    class inspection_default

    inspect the icmp

    -Jouni

  • Site to Site IPSEC tunnel (5505 at 5505) blocking certain ports?

    I have problems with the traffic between two connected 5505 at 5505 sites (lan to lan) ipsec tunnel.  feature of 99% of the traffic on the tunnel seems good with one exception.  When a pc on Site A tries to access a mangagment base tool (java embedded) web for an IP_PBX to the site B, part of the traffic does not result in an odd error.  The client pc can ping and hit port 80 to prompt the web GUI, gets invited to download java and load the java web application embedded.  The java application itself (a terminal CLI to replicate if you were just Telnet to) gives an error as it cannot successfully connect to the IP_PBX.  We have other sites where the ipsec tunnel is between two 2800's, and there is NO problem.  The provider IP_PBX suggest that we open port 2000.  Personally I'm not familiar with the ASA to uderstand why he would block only certain ports on an ipsec tunnel.  I'm particularly confused because there is no NAT'ing involved in trafficking through this tunnel ipsec 5505 to 5505.

    Any suggestions would be greatly appreciated,

    BH

    I can post configs if necessary, but thought someone might be already familiar with this issue.

    Thanks again.

    Ok.

    What is stable with the ACL I mentioned:

    test2000 list access permitted tcp/udp any host x.x.x.x eq 2000

    test2000 ip access list allow a whole

    Access-group interface inside test2000

    The idea is to check if the ASA transfers traffic x.x.x.x on port 2000 coming out to the inside network.

    If you see hitcounts on the first statement, the ASA transfers the packets and the problem is maybe with the server itelf or return circulation.

    Federico.

  • Site to Site VPN ASA 5505

    I set up a site to Site VPN using ASA 5505, but when I submit the order

    "sh crypto ipsec his ' it says 'there are no ipsec security associations.

    I have attached the configurations.

    Hello

    I saw you nat nat of entry (inside) 2-list of access limenat, would you change to, nat (inside) 0-list of access limenat. See which make all the difference.

    Do you want to take a capture of packets when the remote IP address ping?

    course list (Local subnet) host (remote subnet) host allowed access

    Cap list of allowed access host host (remote subnet) (Local subnet)

    Course access-list in hidden inside

    Show Cap Hat

    Now you can see the list of access capture

    Debug crypto isakmp 200

    Debug crypto ipsec 200

  • VPN site-to-site between ASA 5505 and 2911

    Hi all

    I'm trying to setup VPN S2S. A.a.a.a of ip for the router 2911 office, remote office ASA 5505 8.4 (3) with ip b.b.b.b, but no luck.

    2911 config:

    !

    version 15.2

    horodateurs service debug datetime msec

    Log service timestamps datetime msec

    encryption password service

    !

    host name 2911

    !

    boot-start-marker

    Boot system flash c2900-universalk9-mz. Spa. 152 - 2.T.bin

    boot-end-marker

    !

    !

    Min-length 10 Security passwords

    logging buffered 51200 warnings

    !

    No aaa new-model

    !

    !

    min-threshold queue spd IPv6 62

    Max-threshold queue spd IPv6 63

    No ipv6 cef

    the 5 IP auth-proxy max-login-attempts

    max-login-attempts of the IP 5 admission

    !

    !

    !

    DHCP excluded-address IP 192.168.10.1 192.168.10.99

    DHCP excluded-address IP 192.168.22.1 192.168.22.99

    DHCP excluded-address IP 192.168.33.1 192.168.33.99

    DHCP excluded-address IP 192.168.44.1 192.168.44.99

    DHCP excluded-address IP 192.168.55.1 192.168.55.99

    192.168.10.240 IP dhcp excluded-address 192.168.10.254

    DHCP excluded-address IP 192.168.22.240 192.168.22.254

    DHCP excluded-address IP 192.168.33.240 192.168.33.254

    DHCP excluded-address IP 192.168.44.240 192.168.44.254

    DHCP excluded-address IP 192.168.55.240 192.168.55.254

    !

    desktop IP dhcp pool

    import all

    network 192.168.33.0 255.255.255.0

    router by default - 192.168.33.254

    192.168.10.10 DNS server 202.50.246.41 202.50.246.42

    local domain name

    -192.168.10.10 NetBIOS name server

    h-node NetBIOS node type

    !

    wi - fi IP dhcp pool

    import all

    network 192.168.44.0 255.255.255.0

    192.168.10.10 DNS server 202.50.246.41 202.50.246.42

    local domain name

    router by default - 192.168.44.254

    -192.168.10.10 NetBIOS name server

    h-node NetBIOS node type

    !

    DMZ IP dhcp pool

    import all

    network 192.168.55.0 255.255.255.0

    192.168.10.10 DNS server 202.50.246.41 202.50.246.42

    local domain name

    router by default - 192.168.55.254

    -192.168.10.10 NetBIOS name server

    h-node NetBIOS node type

    !

    IP dhcp pool voip

    import all

    network 192.168.22.0 255.255.255.0

    192.168.10.10 DNS server 202.50.246.41 202.50.246.42

    local domain name

    router by default - 192.168.22.254

    -192.168.10.10 NetBIOS name server

    h-node NetBIOS node type

    !

    IP dhcp pool servers

    import all

    network 192.168.10.0 255.255.255.0

    default router 192.168.10.254

    192.168.10.10 DNS server 202.50.246.41 202.50.246.42

    local domain name

    -192.168.10.10 NetBIOS name server

    h-node NetBIOS node type

    !

    !

    IP domain name of domain

    name-server IP 192.168.10.10

    IP cef

    connection-for block 180 tent 3-180

    Timeout 10

    VLAN ifdescr detail

    !

    Authenticated MultiLink bundle-name Panel

    !

    !

    Crypto pki token removal timeout default 0

    !

    Crypto pki trustpoint TP-self-signed-3956567439

    enrollment selfsigned

    name of the object cn = IOS - Self - signed - certificate - 3956567439

    revocation checking no

    rsakeypair TP-self-signed-3956567439

    !

    !

    TP-self-signed-3956567439 crypto pki certificate chain

    certificate self-signed 01 nvram:IOS - Self-Sig #1.cer

    license udi pid sn CISCO2911/K9

    !

    !

    the FULL_NET object-group network

    full range of the network Description

    192.168.10.0 255.255.255.0

    192.168.11.0 255.255.255.0

    192.168.22.0 255.255.255.0

    192.168.33.0 255.255.255.0

    192.168.44.0 255.255.255.0

    !

    object-group network limited

    description without servers and router network

    192.168.22.0 255.255.255.0

    192.168.33.0 255.255.255.0

    192.168.44.0 255.255.255.0

    !

    VTP version 2

    password username admin privilege 0 password 7

    !

    redundancy

    !

    !

    !

    !

    !

    no passive ftp ip

    !

    !

    crypto ISAKMP policy 10

    BA aes 256

    sha512 hash

    preshared authentication

    ISAKMP crypto key admin address b.b.b.b

    invalid-spi-recovery crypto ISAKMP

    !

    !

    Crypto ipsec transform-set esp - aes esp-sha-hmac SET

    !

    !

    !

    10 map ipsec-isakmp crypto map

    the value of b.b.b.b peer

    Set transform-set

    match address 160

    !

    !

    !

    !

    !

    Interface Port - Channel 1

    no ip address

    waiting-150 to

    !

    Interface Port - channel1.1

    encapsulation dot1Q 1 native

    IP 192.168.11.254 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    !

    Interface Port - channel1.10

    encapsulation dot1Q 10

    IP address 192.168.10.254 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    !

    Interface Port - channel1.22

    encapsulation dot1Q 22

    IP 192.168.22.254 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    !

    Interface Port - channel1.33

    encapsulation dot1Q 33

    IP 192.168.33.254 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    !

    Interface Port - channel1.44

    encapsulation dot1Q 44

    IP 192.168.44.254 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    !

    Interface Port - channel1.55

    encapsulation dot1Q 55

    IP 192.168.55.254 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    !

    the Embedded-Service-Engine0/0 interface

    no ip address

    Shutdown

    !

    interface GigabitEthernet0/0

    Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE $ 0/0

    no ip address

    Shutdown

    automatic duplex

    automatic speed

    !

    interface GigabitEthernet0/1

    no ip address

    automatic duplex

    automatic speed

    channel-group 1

    !

    interface GigabitEthernet0/2

    Description $ES_LAN$

    no ip address

    automatic duplex

    automatic speed

    channel-group 1

    !

    interface GigabitEthernet0/0/0

    IP address a.a.a.a 255.255.255.224

    NAT outside IP

    IP virtual-reassembly in

    automatic duplex

    automatic speed

    crypto map

    !

    IP forward-Protocol ND

    !

    no ip address of the http server

    23 class IP http access

    local IP http authentication

    IP http secure server

    IP http timeout policy slowed down 60 life 86400 request 10000

    !

    overload of IP nat inside source list NAT_INTERNET interface GigabitEthernet0/0/0

    IP nat inside source udp 500 interface GigabitEthernet0/0/0 500 a.a.a.a static

    IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx

    !

    NAT_INTERNET extended IP access list

    refuse the object-group ip FULL_NET 192.168.17.0 0.0.0.255

    refuse the object-group ip FULL_NET 192.168.1.0 0.0.0.255

    permit ip FULL_NET object-group everything

    !

    access-list 1 permit 192.168.44.100

    access-list 23 allow 192.168.10.7

    access-list 23 permit 192.168.44.0 0.0.0.255

    access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

    access-list 160 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

    !

    !

    !

    control plan

    !

    !

    !

    Line con 0

    password password 7

    opening of session

    line to 0

    line 2

    no activation-character

    No exec

    preferred no transport

    transport of entry all

    transport output pad rlogin lapb - your MOP v120 udptn ssh telnet

    StopBits 1

    line vty 0 4

    access-class 23 in

    privilege level 15

    local connection

    entry ssh transport

    line vty 5 15

    access-class 23 in

    privilege level 15

    local connection

    entry ssh transport

    !

    Scheduler allocate 20000 1000

    !

    end

    The ASA config:

    : Saved : ASA Version 8.4(3) ! hostname C domain-name domain enable password password encrypted passwd passwd encrypted names ! interface Ethernet0/0 ! interface Ethernet0/1 shutdown ! interface Ethernet0/2 shutdown ! interface Ethernet0/3 shutdown ! interface Ethernet0/4 shutdown ! interface Ethernet0/5 switchport access vlan 100 ! interface Ethernet0/6 switchport trunk allowed vlan 2,6 switchport mode trunk ! interface Ethernet0/7 shutdown ! interface Vlan1 description INTERNET mac-address 1234.5678.0001 nameif WAN security-level 0 ip address b.b.b.b 255.255.255.248 standby c.c.c.c ospf cost 10 ! interface Vlan2 description OLD-PRIVATE mac-address 1234.5678.0102 nameif OLD-Private security-level 100 ip address 192.168.17.2 255.255.255.0 standby 192.168.17.3 ospf cost 10 ! interface Vlan6 description MANAGEMENT mac-address 1234.5678.0106 nameif Management security-level 100 ip address 192.168.1.2 255.255.255.0 standby 192.168.1.3 ospf cost 10 ! interface Vlan100 description LAN Failover Interface ! boot system disk0:/asa843-k8.bin ftp mode passive clock timezone NZST 12 clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 2:00 dns domain-lookup WAN dns server-group DefaultDNS name-server 208.67.222.222 domain-name domain same-security-traffic permit intra-interface object network obj-192.168.17.0 subnet 192.168.17.0 255.255.255.0 object network obj-192.168.10.0 subnet 192.168.10.0 255.255.255.0 object network obj-192.168.2.0 subnet 192.168.2.0 255.255.255.0 object network obj-192.168.9.0 subnet 192.168.9.0 255.255.255.0 object network obj-192.168.33.0 subnet 192.168.33.0 255.255.255.0 object network obj-192.168.44.0 subnet 192.168.44.0 255.255.255.0 object network obj_any object network obj_any-01 object network NETWORK_OBJ_192.168.10.0_24 subnet 192.168.10.0 255.255.255.0 object network NETWORK_OBJ_192.168.17.0_24 subnet 192.168.17.0 255.255.255.0 object network subnet-00 subnet 0.0.0.0 0.0.0.0 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service RDP tcp description RDP port-object eq 3389 object-group network DM_INLINE_NETWORK_1 network-object 192.168.17.0 255.255.255.0 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network DM_INLINE_NETWORK_2 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network subnet-17 network-object 192.168.17.0 255.255.255.0 object-group network subnet-2 network-object 192.168.2.0 255.255.255.0 object-group network subnet-9 network-object 192.168.9.0 255.255.255.0 object-group network subnet-10 network-object 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP standard permit 192.168.17.0 255.255.255.0 access-list WAN_access_in extended permit ip any any log debugging access-list WAN_access_in extended permit tcp any object-group RDP any object-group RDP log debugging access-list WAN_access_in extended permit icmp x.x.x.x 255.255.255.248 192.168.10.0 255.255.255.0 access-list MANAGEMENT_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit icmp any object-group DM_INLINE_NETWORK_1 access-list 101 extended permit tcp host 192.168.10.7 any eq 3389 log debugging access-list WAN_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_1_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list CiscoVPNClient_splitTunnelAcl standard permit 192.168.17.0 255.255.255.0 access-list LAN_access_in extended permit ip any any log debugging access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP_inbound standard permit 192.168.10.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 access-list vpnusers_splitTunnelAcl extended permit ip 192.168.17.0 255.255.255.0 any access-list nonat-in extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 52000 logging monitor informational logging trap informational logging asdm informational logging from-address syslog logging recipient-address admin level errors logging host OLD-Private 192.168.17.110 format emblem logging debug-trace logging permit-hostdown mtu WAN 1500 mtu OLD-Private 1500 mtu Management 1500 ip local pool VPN_Admin_IP 192.168.1.150-192.168.1.199 mask 255.255.255.0 ip local pool vpnclient 192.168.2.1-192.168.2.5 mask 255.255.255.0 failover failover lan unit primary failover lan interface failover Vlan100 failover polltime interface 15 holdtime 75 failover key ***** failover interface ip failover 192.168.100.1 255.255.255.0 standby 192.168.100.2 icmp unreachable rate-limit 1 burst-size 1 icmp permit 192.168.10.0 255.255.255.0 WAN icmp permit host x.x.x.x WAN icmp permit 192.168.17.0 255.255.255.0 WAN icmp permit host c.c.c.c WAN icmp permit host a.a.a.a WAN icmp deny any WAN icmp permit 192.168.10.0 255.255.255.0 OLD-Private icmp permit 192.168.17.0 255.255.255.0 OLD-Private icmp permit host a.a.a.a OLD-Private icmp permit host 192.168.10.0 Management icmp permit host 192.168.17.138 Management icmp permit 192.168.1.0 255.255.255.0 Management icmp permit host 192.168.1.26 Management icmp permit host a.a.a.a Management asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-10 subnet-10 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-2 subnet-2 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-9 subnet-9 no-proxy-arp nat (Management,WAN) source static NETWORK_OBJ_192.168.17.0_24 NETWORK_OBJ_192.168.17.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup ! object network subnet-00 nat (OLD-Private,WAN) dynamic interface access-group WAN_access_in in interface WAN access-group OLD-PRIVATE_access_in in interface OLD-Private access-group MANAGEMENT_access_in in interface Management route WAN 0.0.0.0 0.0.0.0 x.x.x.x 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa local authentication attempts max-fail 10 http server enable http b.b.b.b 255.255.255.255 WAN http 0.0.0.0 0.0.0.0 WAN no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart service resetoutside crypto ipsec ikev1 transform-set OFFICE esp-aes esp-sha-hmac crypto map WAN_map 1 match address WAN_1_cryptomap crypto map WAN_map 1 set pfs crypto map WAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map Office 2 match address WAN_1_cryptomap crypto map Office 2 set peer a.a.a.a crypto map Office interface WAN crypto map MAP 10 set peer a.a.a.a crypto map MAP 10 set ikev1 transform-set OFFICE crypto ikev2 enable WAN crypto ikev1 enable WAN crypto ikev1 policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption des hash sha group 1 lifetime 86400 telnet timeout 5 ssh a.a.a.a 255.255.255.255 WAN ssh timeout 30 ssh version 2 console timeout 0 dhcpd auto_config OLD-Private ! threat-detection basic-threat threat-detection statistics host threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 129.6.15.28 source WAN prefer webvpn group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ssl-client ssl-clientless group-policy admin internal group-policy admin attributes dns-server value 208.67.222.222 156.154.70.1 vpn-tunnel-protocol ikev1 group-policy GroupPolicy_a.a.a.a internal group-policy GroupPolicy_a.a.a.a attributes vpn-tunnel-protocol ikev1 ikev2 group-policy CiscoVPNClient internal group-policy CiscoVPNClient attributes vpn-idle-timeout 30 vpn-session-timeout none vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value CiscoVPNClient_splitTunnelAcl username admin password password encrypted privilege 15 tunnel-group admin type remote-access tunnel-group admin general-attributes address-pool vpnclient authorization-server-group LOCAL default-group-policy admin tunnel-group a.a.a.a type ipsec-l2l tunnel-group a.a.a.a general-attributes default-group-policy GroupPolicy_a.a.a.a tunnel-group a.a.a.a ipsec-attributes ikev1 pre-shared-key ***** ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** tunnel-group CiscoVPNClient type remote-access tunnel-group CiscoVPNClient general-attributes address-pool vpnclient default-group-policy CiscoVPNClient tunnel-group CiscoVPNClient ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp ! service-policy global_policy global smtp-server 192.168.17.10 prompt hostname context no call-home reporting anonymous call-home contact-email-addr admin contact-name admin profile CiscoTAC-1   no active : end asdm image disk0:/asdm-647.bin asdm location c.c.c.c 255.255.255.255 WAN asdm location 192.168.17.2 255.255.255.255 WAN asdm location a.a.a.a 255.255.255.255 OLD-Private no asdm history enable

    ASA:

    # show crypto ipsec his

    There is no ipsec security associations

    # show crypto isakmp his

    There are no SAs IKEv1

    There are no SAs IKEv2

    2911:

    #show crypto ipsec his

    Interface: GigabitEthernet0/0/0

    Tag crypto map: map, addr a.a.a.a local

    protégé of the vrf: (none)

    local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

    Remote ident (addr, mask, prot, port): (192.168.17.0/255.255.255.0/0/0)

    current_peer b.b.b.b port 500

    LICENCE, flags is {origin_is_acl},

    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

    compressed #pkts: 0, unzipped #pkts: 0

    #pkts uncompressed: 0, #pkts compr. has failed: 0

    #pkts not unpacked: 0, #pkts decompress failed: 0

    Errors of #send 4, #recv errors 0

    local crypto endpt. : a.a.a.a, remote Start crypto. : b.b.b.b

    Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0/0

    current outbound SPI: 0x0 (0)

    PFS (Y/N): N, Diffie-Hellman group: no

    SAS of the esp on arrival:

    -Other - arrival ah sas:

    -More-

    -More - CFP sas on arrival:

    -More-

    -More - outgoing esp sas:

    -More-

    -More - out ah sas:

    -More-

    -More - out CFP sas:

    Thanks for your time,

    Nick

    Please add

    map Office 2 set transform-set OFFICE ikev1 crypto

    If it is not helpful, please enable debug crypto ipsec 255 and paste here.
    

    HTH. Please rate if it was helpful. "Correct answer" will be also pleasant.

  • ASA 5505 and ASA 5510 Site to Site VPN Tunnel cannot be established

    Hi all experts

    We are now plan to form an IPSec VPN tunnel from site to site between ASA 5505 (ASA Version 8.4) and ASA 5510 (ASA Version 8.0) but failed, would you please show me how to establish? A reference guide?

    I got error syslog 713902 and 713903, how to fix?

    I got the following, when I type "sh crypto isakmp his."

    Type: user role: initiator

    Generate a new key: no State: MM_WAIT_MSG2

    Hugo

    Hello

    This State is reached when the policies of the phase 1 do not correspond to the two ends.

    Please confirm that you have the same settings of phase 1 on both sides with the following commands:

    See the isakmp crypto race

    See the race ikev1 crypto

    Also make sure that port UDP 500 and 4500 are open for communication between your device and the remote peer.

    Finally, make sure you have a route suitable for the remote VPN endpoint device.

    Hope that helps.

    Kind regards

    Dinesh Moudgil

  • Rookie of the ASA 5505 - cannot ping remote site or vice versa

    Hi, I am trying configure an ipsec to an ASA 5505 (8.4) for a Sophos UTM (9.2)

    Internet, etc. is in place and accessible. IPSec tunnel is also but I can't pass the traffic through it.

    I get this message in the logs:

    3 August 5, 2014 22:38:52   81.111.111.156   82.222.222.38   Refuse the Protocol entering 50 CBC outdoor: 81.111.111.156 outside dst: 82.222.222.38

    SITE has (ASA 5505) = 82.222.222.38
    SITE B (UTM 9) = 81.111.111.156

    Pointers would be good because it's the first time I tried this. Thank you.

    Running config below:

    ciscoasa hostname
    activate 8Ry2YjIyt7RRXU24 encrypted password
    volatile xlate deny tcp any4 any4
    volatile xlate deny tcp any4 any6
    volatile xlate deny tcp any6 any4
    volatile xlate deny tcp any6 any6
    volatile xlate deny udp any4 any4 eq field
    volatile xlate deny udp any4 any6 eq field
    volatile xlate deny udp any6 any4 eq field
    volatile xlate deny udp any6 any6 eq field
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    Description Internet Zen
    nameif outside
    security-level 0
    Customer vpdn group PPPoE Zen
    82.222.222.38 255.255.255.255 IP address pppoe setroute
    !
    boot system Disk0: / asa922 - k8.bin
    passive FTP mode
    DNS lookup field inside
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    Name-Server 8.8.8.8
    network obj_any object
    subnet 0.0.0.0 0.0.0.0
    the object of MY - LAN network
    subnet 192.168.1.0 255.255.255.0
    the object of THIER-LAN network
    192.168.30.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.30.0_24 object
    192.168.30.0 subnet 255.255.255.0
    network of the THIER_VPN object
    Home 81.111.111.156
    THIER VPN description
    service of the Sophos_Admin object
    Service tcp destination eq 4444
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-protocol esp
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-protocol esp
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    object-protocol esp
    object-group service DM_INLINE_SERVICE_1
    ICMP service object
    area of service-object udp destination eq
    service-object, object Sophos_Admin
    the purpose of the service tcp destination eq www
    the purpose of the tcp destination eq https service
    ESP service object
    object-group service DM_INLINE_SERVICE_2
    ICMP service object
    service-object, object Sophos_Admin
    ESP service object
    response to echo icmp service object
    object-group service DM_INLINE_SERVICE_3
    the purpose of the ip service
    ESP service object
    response to echo icmp service object
    object-group service DM_INLINE_SERVICE_4
    service-object, object Sophos_Admin
    the purpose of the echo icmp message service
    response to echo icmp service object
    outside_cryptomap list extended access allow object-group DM_INLINE_PROTOCOL_3 MY - LAN LAN THIER object object
    outside_cryptomap_1 list extended access allow object-group DM_INLINE_PROTOCOL_2 MY - LAN LAN THIER object object
    inside_cryptomap list extended access allow THIER-LAN MY - LAN object object DM_INLINE_PROTOCOL_1 object-group
    outside_access_out list extended access allowed object-group DM_INLINE_SERVICE_3 object THIER_VPN host 82.222.222.38
    outside_access_out list extended access allow DM_INLINE_SERVICE_1 of object-group a
    outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_2 object THIER_VPN host 82.222.222.38
    inside_access_out list extended access allow object-group DM_INLINE_SERVICE_4 MY - LAN LAN THIER object object
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 722.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    !
    network obj_any object
    NAT dynamic interface (indoor, outdoor)
    Access-group interface inside inside_access_out
    Access-group outside_access_in in interface outside
    Access-group outside_access_out outside interface
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    the ssh LOCAL console AAA authentication
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto outside_map 1 match address outside_cryptomap
    card crypto outside_map 1 set pfs
    peer set card crypto outside_map 1 81.111.111.156
    card crypto outside_map 1 set transform-set ESP-AES-128-SHA ikev1
    outside_map map 1 set ikev2 proposal ipsec crypto AES
    card crypto outside_map 2 match address outside_cryptomap_1
    card crypto outside_map 2 set pfs
    peer set card crypto outside_map 2 81.111.111.156
    card crypto outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 2 set AES AES192 AES256 3DES ipsec-proposal ikev2
    outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2
    FRP sha
    second life 7800
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 7800
    Telnet timeout 5
    SSH enable ibou
    SSH stricthostkeycheck
    SSH 192.168.1.0 255.255.255.0 inside
    SSH timeout 30
    SSH version 2
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    VPDN group Zen request dialout pppoe
    VPDN group Zen localname [email protected] / * /
    VPDN group Zen ppp authentication chap
    VPDN username [email protected] / * / password * local store

    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.5 - 192.168.1.36 inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    enable dynamic filters updater-customer
    use of data Dynamics-based filters
    smart filters enable external interface
    interface of blacklist of decline in dynamic filters outside
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_81.111.111.156 group strategy
    attributes of Group Policy GroupPolicy_81.111.111.156
    Ikev1 VPN-tunnel-Protocol
    JsE9Hv42G/zRUcG4 admin password user name encrypted privilege 15
    username bob lTKS32e90Yo5l2L password / encrypted
    tunnel-group 81.111.111.156 type ipsec-l2l
    tunnel-group 81.111.111.156 General-attributes
    Group - default policy - GroupPolicy_81.111.111.156
    IPSec-attributes tunnel-group 81.111.111.156
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the dns dynamic-filter-snoop preset_dns_map
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    HPM topN enable
    Cryptochecksum:9430c8a44d330d2b55f981274599a67e
    : end
    ciscoasa #.

    Hello

    Watching your sh crypto ipsec output... I can see packets are getting wrapped... average packets out of the peer 88.222.222.38 network and I do not see the package back from the site of the UTM 81.111.111.156 at the ASA... This means that the UTM Firewall either don't know the package or not able to get the return package... Exchange of routing is there... but you need to check LAN to another counterpart of site...

    Please check the card encryption (it must match on both ends), NAT (exemption should be there @ both ends) and referral to the ends of the LAN...

    I suggest you try with the crypto wthout specific port card... say source LAN to LAN with any port destination...

    allow cryptomap to access extended list ip

    Concerning

    Knockaert

    Concerning

    Knockaert

  • VPN site to Site ASA 5510 and 871 w / dynamic IP

    What is the best method of creating a VPN site-to site between an ASA 5510 and a router 871 where the 5510 has a static IP address and has 871, a dynamic IP address?

    My ASA is running ASA software version 7.0 (5) and I can't find how to create a tunnel for a dynamic IP address via the ASDM. I have currently a tunnel between these two arrangements in place, but it was done by specifying the remote IP address, even if it is dynamic.

    Any suggestions or pointers would be * very * appreciated.

    -Adam

    This can help but it does not show ASDM.

    http://Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

  • ASA 5505 AnyConnect 8.2 connect other subnets from site to site

    Hello

    I'm somehwat new Cisco and routing. I have an installation of two ASA 5505 that are configured for the site to site vpn and AnyConnect. The AnyConnect subnet can connect to inside VLANs to the SiteA but I can't for the remote to Site B subnet when you use AnyConnect. Any ideas? I have to add the subnet of 10.0.7.0/24 to the site to site policy? Do I need to set up several NAT rules? Details below.

    Site A: ASA 5505 8.2

    Outside: 173.X.X.X/30

    Inside: 10.0.5.0/24

    AnyConnect: 10.0.7.0/24

    Site b: ASA 5505 8.2

    Outsdie: 173.X.X.X/30

    Inside: 10.0.6.0/24

    The AnyConnect subnet cannot access the network of 10.0.6.0/24.

    Any help would be greatly appreciated! Thank you!

    Hello Kevin,

    You must go back to identity (outdoors, outdoor) identity NAT (essentially for two subnets (Anyconnect and Remote_IPSec).

    And of course to include traffic in the ACL for IPSec crypto and (if used) split with the Anyconnect tunnel.

    Note all useful posts!

    Kind regards

    Jcarvaja

    Follow me on http://laguiadelnetworking.com

  • ASA 5505 LAN - to - WAN site to site VPN

    Hello

    I need a VPN site-to site on ASA 5505 (ASA version 8.4) on a private IP range of addresses to a third party who use internet routable IP addresses for the Remote LAN.

    For example in the network settings protection

    LAN: 192.168.1.0/24

    Remote network: 1.1.1.0/24

    Is this possible?

    Thank you

    Julian

    Yes, it is possible, to use in the interesting traffic ACL (i.e. crypto ACL) identifier the remote destination address is a public address instead of a private address and address of the remote peer of your VPN is naturally sound if it goes on public cloud. You can have an ACL on the inside interface, control (LAN) access to the remote tunnel end.

    This configuration is very similar to the vpn tunning to banks on public cloud.

    Thank you

    Rizwan Muhammed.

  • site to site vpn - internal network even on both sides of the tunnel

    Hi all

    I have the following questions about the Site Site VPN using ASA 5510 and 5505

    Scenerio is

    1. we have five branches & headquarters

    2. we want to establish a vpn between branches & Head Office (VPN from Site to Site)

    3. all branches & head office using the same internal network (192.168.150.0 255.255.255.0)

    My question is

    How can I configure VPN site-to-site between branches & head office with the same internal network (192.168.150.0/24)

    Please help me with the configuration steps & explanation

    I have experience on setting up vpn site to site between branches with differnet internal network (for example: 192.168.1.0/24 and 192.168.2.0/24)

    Waiting for your valuable response

    Hello

    Here are a few links on policy nat

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9950.shtml

    http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008046f31a.shtml#T10

    http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807d2874.shtml

    Concerning

  • ASA 5510 using only the GB interfaces

    I am looking for should I use a 5510 to activate two interfaces for VPN connections broadband from only a few sites. Our 5505 s (I have dozens) can not manage speeds of more than 100 MB and I have now a few FIOS beyond that--150 to 300mpbs.  I want a 5510 basis who needs to manage a few voice / data sites and just use two interfaces. A basic 5510 allow 2 gigabytes or just ports FE interfaces?  I have to be able to use 2 GB interfaces and no one else. I don't know that the 5510 will probably support the same QOS settings that I use on the 5505 s... I just need more speed interface so that I'm not bottlenecking data (I know I could use several 5505 s and extend the charges but is not how I want to do it for other reasons). Thank you

    Hello

    To my knowledge the ASA5510 supports 2 x 1 Gbps interfaces when you the Security license for the SAA. The basic license counts 100Mbps interfaces.

    Take a look at this document for more information on licensing above

    http://www.Cisco.com/en/us/docs/security/ASA/asa82/license/license82.html#wp190732

    Its a document from the 8.2 version but its still even to 9.x on the license requirement more security get the 2 x 1 Gbps interfaces

    The documentation for ASA5500 series promises an 300Mbps for the ASA5510 model flow, but I guess that's a value of location. In the most recent document, two values of max flow max and Multiprotocol are given.

    Here's a link to the document

    http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80285492.PDF

    -Jouni

  • problem with users to access remote vpn site to site vpn network

    I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

    execution of the configuration of my asa 5510 is

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.4(2)
    
    !
    
    hostname asa5510
    
    domain-name dri.local
    
    enable password 8Ry2YjIyt7RRXU24 encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    !
    
    interface Ethernet0/0
    
    nameif outside
    
    security-level 0
    
    ip address x.x.x.178 255.255.255.248
    
    !
    
    interface Ethernet0/1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.10 255.255.255.0
    
    !
    
    interface Ethernet0/2
    
    description Mreza za virtualne masine- mail server, wsus....
    
    nameif DMZ
    
    security-level 50
    
    ip address 172.16.20.1 255.255.255.0
    
    !
    
    interface Ethernet0/3
    
    shutdown
    
    no nameif
    
    no security-level
    
    no ip address
    
    !
    
    interface Management0/0
    
    nameif management
    
    security-level 100
    
    ip address 192.168.1.1 255.255.255.0
    
    management-only
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    dns server-group DefaultDNS
    
    domain-name dri.local
    
    object network VPN-POOL
    
    subnet 192.168.50.0 255.255.255.0
    
    description VPN Client pool
    
    object network LAN-NETWORK
    
    subnet 192.168.0.0 255.255.255.0
    
    description LAN Network
    
    object network NETWORK_OBJ_192.168.0.0_24
    
    subnet 192.168.0.0 255.255.255.0
    
    object network 192.168.0.10
    
    host 192.168.0.10
    
    object service ssl
    
    service tcp destination eq 465
    
    object service tls
    
    service tcp destination eq 995
    
    object network mail_server
    
    host 172.16.20.201
    
    object service StartTLS
    
    service tcp destination eq 587
    
    object service admin_port
    
    service tcp destination eq 444
    
    object service ODMR
    
    service tcp destination eq 366
    
    object service SSL-IMAP
    
    service tcp destination eq 993
    
    object network remote
    
    host 172.16.20.200
    
    object network test
    
    host 192.168.0.22
    
    object network mail
    
    host 172.16.20.200
    
    object network DMZ
    
    host 172.16.20.200
    
    object network Inside_DMZ
    
    host 192.168.0.20
    
    object service rdp
    
    service tcp destination eq 3389
    
    object network DRI_PS99
    
    host 192.168.0.54
    
    object service microsoft_dc
    
    service tcp destination eq 445
    
    object service https448
    
    service tcp destination eq 448
    
    object network mail_server_internal
    
    host 172.16.20.201
    
    object service Acronis_remote
    
    service tcp destination eq 9876
    
    object service Acronis_25001
    
    service tcp destination eq 25001
    
    object service HTTP3000
    
    service tcp destination eq 3000
    
    object network VPNPOOL
    
    subnet 192.168.50.0 255.255.255.0
    
    object-group network PAT-SOURCE-NETWORKS
    
    description Source networks for PAT
    
    network-object 192.168.0.0 255.255.255.0
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object object admin_port
    
    service-object object ssl
    
    service-object object tls
    
    service-object object https448
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object object tls
    
    service-object tcp destination eq pop3
    
    service-object tcp destination eq smtp
    
    object-group service DM_INLINE_SERVICE_3
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object tcp destination eq smtp
    
    service-object object tls
    
    service-object object Acronis_remote
    
    service-object tcp destination eq www
    
    service-object object Acronis_25001
    
    service-object object microsoft_dc
    
    object-group protocol DM_INLINE_PROTOCOL_1
    
    protocol-object ip
    
    protocol-object tcp
    
    object-group service DM_INLINE_SERVICE_4
    
    service-object object Acronis_25001
    
    service-object object Acronis_remote
    
    service-object object microsoft_dc
    
    service-object tcp destination eq www
    
    service-object tcp
    
    service-object ip
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
    
    access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
    
    access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
    
    access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
    
    access-list DMZ extended deny tcp any any eq smtp
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    mtu outside 1500
    
    mtu inside 1500
    
    mtu DMZ 1500
    
    mtu management 1500
    
    ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
    
    !
    
    object network mail_server
    
    nat (DMZ,outside) static x.x.x.179
    
    object network mail
    
    nat (DMZ,outside) static x.x.x.180
    
    access-group outside_access_in in interface outside
    
    access-group DMZ in interface DMZ
    
    route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    timeout floating-conn 0:00:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    action terminate
    
    dynamic-access-policy-record dripolisa
    
    aaa-server DRI protocol ldap
    
    aaa-server DRI (inside) host 192.168.0.20
    
    ldap-base-dn DC=dri,DC=local
    
    ldap-scope subtree
    
    ldap-naming-attribute sAMAccountName
    
    ldap-login-password *****
    
    ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
    
    server-type microsoft
    
    user-identity default-domain LOCAL
    
    aaa authentication enable console LOCAL
    
    aaa authentication http console LOCAL
    
    aaa authentication serial console LOCAL
    
    aaa authentication telnet console LOCAL
    
    aaa authorization command LOCAL
    
    http server enable
    
    http 192.168.1.0 255.255.255.0 management
    
    http 192.168.0.0 255.255.255.0 inside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    
    virtual telnet 192.168.1.12
    
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    
    crypto ipsec ikev2 ipsec-proposal DES
    
    protocol esp encryption des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal 3DES
    
    protocol esp encryption 3des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES
    
    protocol esp encryption aes
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES192
    
    protocol esp encryption aes-192
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES256
    
    protocol esp encryption aes-256
    
    protocol esp integrity sha-1 md5
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 match address outside_cryptomap
    
    crypto map outside_map 1 set peer 195.222.96.223
    
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    
    crypto map outside_map interface outside
    
    crypto ikev2 policy 1
    
    encryption aes-256
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 10
    
    encryption aes-192
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 20
    
    encryption aes
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 30
    
    encryption 3des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 40
    
    encryption des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 enable outside
    
    crypto ikev1 enable outside
    
    crypto ikev1 policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    
    dhcpd address 192.168.0.14-192.168.0.45 inside
    
    !
    
    dhcpd address 172.16.20.2-172.16.20.150 DMZ
    
    dhcpd dns x.x.x.177 interface DMZ
    
    dhcpd auto_config outside interface DMZ
    
    dhcpd option 6 ip x.x.x.177 interface DMZ
    
    dhcpd enable DMZ
    
    !
    
    dhcpd address 192.168.1.2-192.168.1.254 management
    
    dhcpd enable management
    
    !
    
    threat-detection basic-threat
    
    threat-detection statistics port
    
    threat-detection statistics protocol
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    group-policy GroupPolicy_x.x.x.223 internal
    
    group-policy GroupPolicy_x.x.x.223 attributes
    
    vpn-tunnel-protocol ikev1 ikev2
    
    group-policy drivpn internal
    
    group-policy drivpn attributes
    
    dns-server value 192.168.0.20 192.168.0.254
    
    vpn-simultaneous-logins 10
    
    vpn-idle-timeout 30
    
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    
    split-tunnel-network-list value Split_Tunnel_List
    
    default-domain value dri.local
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group drivpn type remote-access
    
    tunnel-group drivpn general-attributes
    
    address-pool vpnadrese
    
    authentication-server-group DRI
    
    default-group-policy drivpn
    
    tunnel-group drivpn ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    tunnel-group x.x.x.223 type ipsec-l2l
    
    tunnel-group x.x.x.223 general-attributes
    
    default-group-policy GroupPolicy_x.x.x.223
    
    tunnel-group x.x.x.223 ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    ikev2 remote-authentication pre-shared-key *****
    
    ikev2 local-authentication pre-shared-key *****
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum client auto
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect tftp
    
      inspect ip-options
    
      inspect netbios
    
      inspect icmp
    
      inspect http
    
    !
    
    service-policy global_policy global
    
    prompt hostname context
    
    no call-home reporting anonymous
    
    Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
    
    : end

    running config asa 5505

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.2(1)
    
    !
    
    hostname ciscoasa
    
    enable password csq7sfr0bQJqMGET encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    name 192.168.5.0 PALATA
    
    !
    
    interface Vlan1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.17 255.255.255.0
    
    !
    
    interface Vlan2
    
    nameif outside
    
    security-level 0
    
    ip address 10.13.74.33 255.255.255.0
    
    !
    
    interface Ethernet0/0
    
    switchport access vlan 2
    
    !
    
    interface Ethernet0/1
    
    !
    
    interface Ethernet0/2
    
    !
    
    interface Ethernet0/3
    
    !
    
    interface Ethernet0/4
    
    !
    
    interface Ethernet0/5
    
    !
    
    interface Ethernet0/6
    
    !
    
    interface Ethernet0/7
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object ip
    
    service-object tcp
    
    service-object icmp echo
    
    service-object icmp echo-reply
    
    service-object tcp eq domain
    
    service-object tcp eq ldap
    
    service-object tcp eq smtp
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object ip
    
    service-object tcp eq domain
    
    service-object tcp eq www
    
    service-object tcp eq https
    
    service-object tcp eq smtp
    
    object-group service Sharepoint8080 tcp
    
    port-object eq 8080
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
    
    access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
    
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    logging mail errors
    
    logging from-address
    
    logging recipient-address  level debugging
    
    mtu inside 1500
    
    mtu outside 1500
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    global (outside) 1 interface
    
    nat (inside) 0 access-list inside_nat0_outbound_1
    
    nat (inside) 1 192.168.0.0 255.255.255.0
    
    static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
    
    static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
    
    access-group inside_access_in in interface inside
    
    access-group outside_access_in in interface outside
    
    route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
    
    route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    aaa authentication telnet console LOCAL
    
    http server enable
    
    http 10.13.74.0 255.255.255.0 outside
    
    http 192.168.0.0 255.255.255.0 inside
    
    http 10.15.100.0 255.255.255.0 outside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    
    virtual telnet 192.168.0.53
    
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec security-association lifetime seconds 28800
    
    crypto ipsec security-association lifetime kilobytes 4608000
    
    crypto map outside_map 1 match address outside_2_cryptomap
    
    crypto map outside_map 1 set pfs
    
    crypto map outside_map 1 set peer 10.15.100.15
    
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    
    crypto map outside_map interface outside
    
    crypto isakmp enable outside
    
    crypto isakmp policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    

    threat-detection basic-threat
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group 10.15.100.15 type ipsec-l2l
    
    tunnel-group 10.15.100.15 ipsec-attributes
    
    pre-shared-key *
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect esmtp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect netbios
    
      inspect tftp
    
      inspect icmp
    
    !
    
    service-policy global_policy global
    
    smtp-server 173.194.79.109
    
    prompt hostname context
    
    Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
    
    : end

    Thank you

    Hello

    I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

    EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

    So you don't really have any of those.

    Please mark the question answers and/or assess response

    Ask more if necessary

    -Jouni

Maybe you are looking for

  • Sort by year by the artist album

    In AppleTV, I can choose an artist and then display all of their albums. It only sorts alphabetically. I would like to than the other sort by year. How? My AppleTV gets all his music in the cloud to Match iTunes, if that makes a difference.

  • How to remove SearchAnonymizeme from Google in Firefox

    The searchanonymize application installed and immediately judged unsatisfactory when searching with Google.Deleted everything which seemed to matter (registry entries, entries of startup files - prefetch, OCS file) - but the thing still in Google sea

  • 5660 envy: envy 5660 leaves the impression

    Use a desire 5660 for 5 months. It is connected to my network via a wireless connection, no USB cable. I have 4 Windows 10 computers that are on my home network and my first installation of the printer all worked very well. All PC were able to print.

  • 0x1A7102DF fpsane.cpp - Labview crashes

    Hello! I'm trying to run a vi which includes a 'Open FPGA VI Référence' function. However, an error and it says that "not compiled FPGA VI. When I try to compile the FPGA VI a message saying "The VI is broken". I try to run the FPGA and when appears

  • Problem in the analysis of XML response.

    Hello I want to parse the XML response like this: http://www.Google.co.in/imgres?imgurl=&imgrefurl=http%3A%2f%2Fwww.SimpleDNS.com%2Fkb.aspx%3Fkbid%3D1... Can someone help me?