A Site with IPsec without restoring a new tunnel

Similar Questions

• I had to completely restore my computer with a F10 restore now it wont let me not put my software on without XP Service Pack 2 when I try to load SP2 it says that there is an error__ of cryptographic

  I had to completely restore my computer with a F10 restore now it wont let me not put my software on without XP Service Pack 2 when I try to load SP2 it says that there is a cryptographic error

  Any ideas?

  See...

  Cleaning a compromised system
       http://TechNet.Microsoft.com/en-us/library/cc700813.aspx

  Follow the instructions in this post of mine in another forum (to-the-letter & in order!) to restore your computer to a State course: http://aumha.net/viewtopic.php?f=62&t=44636

  If you need additional assistance with the clean install, please start a new thread in this forum: http://social.answers.microsoft.com/Forums/en-US/xprepair/threads

  ~ Robear Dyer (PA Bear) ~ MS MVP (that is to say, mail, security, Windows & Update Services) since 2002 ~ WARNING: MS MVPs represent or work for Microsoft

• Need help with the configuration of the Site with crossed on Cisco ASA5510 8.2 IPSec VPN Client (1)

  Need urgent help in the configuration of the Client VPN IPSec Site with crossed on Cisco ASA5510 - 8.2 (1).

  Here is the presentation:

  

  There are two leased lines for Internet access - a route 1.1.1.1 and 2.2.2.2, the latter being the default Standard, old East for backup.

  I was able to configure the Client VPN IPSec Site

  (1) with access to the outside so that the internal network (172.16.0.0/24) behind the asa

  (2) with Split tunnel with simultaneous assess internal LAN and Internet on the outside.

  But I was not able to make the tradiotional model Hairpinng to work in this scenario.

  I followed every possible suggestions made on this subject in many topics of Discussion but still no luck. Can someone help me here please?

  Here is the race-Conf with Normal Client to Site IPSec VPN configured with no access boarding:

  LIMITATION: Cannot boot into any other image ios for unavoidable reasons, must use 8.2 (1)

  race-conf - Site VPN Customer normal work without internet access/split tunnel

  : ASA Version 8.2 (1) ! ciscoasa hostname domain cisco.campus.com enable the encrypted password xxxxxxxxxxxxxx XXXXXXXXXXXXXX encrypted passwd names of ! interface GigabitEthernet0/0 nameif outside internet1 security-level 0 IP 1.1.1.1 255.255.255.240 ! interface GigabitEthernet0/1 nameif outside internet2 security-level 0 IP address 2.2.2.2 255.255.255.224 ! interface GigabitEthernet0/2 nameif dmz interface security-level 0 IP 10.0.1.1 255.255.255.0 ! interface GigabitEthernet0/3 nameif campus-lan security-level 0 IP 172.16.0.1 255.255.0.0 ! interface Management0/0 nameif CSC-MGMT security-level 100 the IP 10.0.0.4 address 255.255.255.0 ! boot system Disk0: / asa821 - k8.bin boot system Disk0: / asa843 - k8.bin passive FTP mode DNS server-group DefaultDNS domain cisco.campus.com permit same-security-traffic inter-interface permit same-security-traffic intra-interface object-group network cmps-lan the object-group CSC - ip network object-group network www-Interior object-group network www-outside object-group service tcp-80 object-group service udp-53 object-group service https object-group service pop3 object-group service smtp object-group service tcp80 object-group service http-s object-group service pop3-110 object-group service smtp25 object-group service udp53 object-group service ssh object-group service tcp-port port udp-object-group service object-group service ftp object-group service ftp - data object-group network csc1-ip object-group service all-tcp-udp access list INTERNET1-IN extended permit ip host 1.2.2.2 2.2.2.3 access-list extended SCC-OUT permit ip host 10.0.0.5 everything list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq www list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any https eq list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq ssh list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 no matter what eq ftp list of access CAMPUS-LAN extended permitted udp 172.16.0.0 255.255.0.0 no matter what eq field list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq smtp list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq pop3 access CAMPUS-wide LAN ip allowed list a whole access-list CSC - acl note scan web and mail traffic access-list CSC - acl extended permit tcp any any eq smtp access-list CSC - acl extended permit tcp any any eq pop3 access-list CSC - acl note scan web and mail traffic access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 993 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq imap4 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 465

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq www

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq https

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq smtp

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq pop3

  access-list extended INTERNET2-IN permit ip any host 1.1.1.2

  access-list sheep extended ip 172.16.0.0 allow 255.255.0.0 172.16.0.0 255.255.0.0

  access list DNS-inspect extended permit tcp any any eq field

  access list DNS-inspect extended permit udp any any eq field

  access-list extended capin permit ip host 172.16.1.234 all

  access-list extended capin permit ip host 172.16.1.52 all

  access-list extended capin permit ip any host 172.16.1.52

  Capin list extended access permit ip host 172.16.0.82 172.16.0.61

  Capin list extended access permit ip host 172.16.0.61 172.16.0.82

  access-list extended capout permit ip host 2.2.2.2 everything

  access-list extended capout permit ip any host 2.2.2.2

  Access campus-lan_nat0_outbound extended ip 172.16.0.0 list allow 255.255.0.0 192.168.150.0 255.255.255.0

  pager lines 24

  Enable logging

  debug logging in buffered memory

  asdm of logging of information

  Internet1-outside of MTU 1500

  Internet2-outside of MTU 1500

  interface-dmz MTU 1500

  Campus-lan of MTU 1500

  MTU 1500 CSC-MGMT

  IP local pool 192.168.150.2 - 192.168.150.250 mask 255.255.255.0 vpnpool1

  IP check path reverse interface internet2-outside

  IP check path reverse interface interface-dmz

  IP check path opposite campus-lan interface

  IP check path reverse interface CSC-MGMT

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 621.bin

  don't allow no asdm history

  ARP timeout 14400

  interface of global (internet1-outside) 1

  interface of global (internet2-outside) 1

  NAT (campus-lan) 0-campus-lan_nat0_outbound access list

  NAT (campus-lan) 1 0.0.0.0 0.0.0.0

  NAT (CSC-MGMT) 1 10.0.0.5 255.255.255.255

  static (CSC-MGMT, internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255

  Access-group INTERNET2-IN interface internet1-outside

  group-access INTERNET1-IN interface internet2-outside

  group-access CAMPUS-LAN in campus-lan interface

  CSC-OUT access-group in SCC-MGMT interface

  Internet2-outside route 0.0.0.0 0.0.0.0 2.2.2.5 1

  Route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  AAA authentication enable LOCAL console

  Enable http server

  http 10.0.0.2 255.255.255.255 CSC-MGMT

  http 10.0.0.8 255.255.255.255 CSC-MGMT

  HTTP 1.2.2.2 255.255.255.255 internet2-outside

  HTTP 1.2.2.2 255.255.255.255 internet1-outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs set group5

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  Crypto map internet2-outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  crypto internet2-outside_map outside internet2 network interface card

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as

  quit smoking

  ISAKMP crypto enable internet2-outside

  crypto ISAKMP policy 10

  preshared authentication

  aes encryption

  md5 hash

  Group 2

  life 86400

  Telnet 10.0.0.2 255.255.255.255 CSC-MGMT

  Telnet 10.0.0.8 255.255.255.255 CSC-MGMT

  Telnet timeout 5

  SSH 1.2.3.3 255.255.255.240 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet2-outside

  SSH timeout 5

  Console timeout 0

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal VPN_TG_1 group policy

  VPN_TG_1 group policy attributes

  Protocol-tunnel-VPN IPSec

  username ssochelpdesk encrypted password privilege 15 xxxxxxxxxxxxxx

  privilege of encrypted password username administrator 15 xxxxxxxxxxxxxx

  username vpnuser1 encrypted password privilege 0 xxxxxxxxxxxxxx

  username vpnuser1 attributes

  VPN-group-policy VPN_TG_1

  type tunnel-group VPN_TG_1 remote access

  attributes global-tunnel-group VPN_TG_1

  address vpnpool1 pool

  Group Policy - by default-VPN_TG_1

  IPSec-attributes tunnel-group VPN_TG_1

  pre-shared-key *.

  !

  class-map cmap-DNS

  matches the access list DNS-inspect

  CCS-class class-map

  corresponds to the CSC - acl access list

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  CCS category

  CSC help

  cmap-DNS class

  inspect the preset_dns_map dns

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y

  : end

  Adding dynamic NAT for 192.168.150.0/24 on the external interface works, or works the sysopt connection permit VPN

  Please tell what to do here, to pin all of the traffic Internet from VPN Clients.

  That is, that I need clients connected via VPN tunnel, when connected to the internet, should have their addresses IP NAT'ted against the address of outside internet2 network 2.2.2.2 interface, as it happens for the customers of Campus (172.16.0.0/16)

  I am well aware of all involved in here, so please be elaborative in your answers. Please let me know if you need more information about this configuration to respond to my request.

  Thank you & best regards

  MAXS

  
  

  Hello

  If possible, I'd like to see that a TCP connection attempt (e.g. http://www.google.com) in the ASDM logging of the VPN Client when you set up the dynamic NAT for the VPN Pool also.

  I'll try also the command "packet - trace" on the SAA, while the VPN Client is connected to the ASA.

  The command format is

  packet-tracer intput tcp

  That should tell what the SAA for this kind of package entering its "input" interface

  Still can not see something wrong with the configuration (other than the statement of "nat" missing Dynamics PAT)

  -Jouni

• I can restore a new Macbook Pro with a 128 MB flash usung a drive backup time Machine 1 TB?

  My Macbook Pro 2009 with a 1 TB drive is dead. I bought a new Macbook Pro 13 "early 2015 with 128 MB of memory Flash.

  How can I use the 1 TB time machine backup restore the new MAC?

  Yes, but most likely you can not restore everything and will need to be selective about what should be restored because very probably a full restoration would take more than 100 GB and you need a free storage space so that you can not fill up the drive

• I've recently updated my firefox to my laptop. No longer can I do a search with Google without getting a message that the address of the site/is not secure. How to cancel?

  I've recently updated my firefox to my laptop. No longer can I do a search with Google without getting a message that the address of the site/is not secure. How to cancel? The only search that allows me to see whatever it is is Yahoo that I prefer not to use. In addition, I have to click through a series of tabs to make sure that I know that Yahoo does not feel that the site is secure before it connects. I must tell you that I have strongly dislikes this upgrade and want to return to the old Firefox.

  What is you receive the exact error message? Did you check your date and time? Refreshed Firefox? Refresh Firefox – reset the parameters and modules

• I just got an iPhone 6 and when I plugged in my laptop, he asked if I wanted to restore my new phone. I said yes! But unfortunately chose the wrong backup restore with. Is there a way I can go back to how my phone was before?

  I just got an iPhone 6 and when I plugged in my laptop, he asked if I wanted to restore my new phone. I said yes! But unfortunately chose the wrong backup restore with. Is there a way I can go back to how my phone was before?

  Yes, you can as long as you understand that you will lose everything that is currently on the phone.

  (1) settings > General > reset > erase content and settings

  That will make the iPhone as new.  Then, during the installation process it again once will ask you if you want to restore from an existing backup.  You can then restore the scheduled backup.

• How I made a gateway computer with windows xp without restore discs?

  How I made a gateway computer with windows xp without restore discs?

  http://support.gateway.com/s/manuals/desktops/9532287.PDF

• How to reset the default mail program? When I click to send e-mail to a box of 'Contact us' site web or excel sheet spread with addresses e-mail, a new msn email opens.

  How to reset the default mail program? Got msn.com. Now, I went to q.com. When I click to send e-mail to a box of 'Contact us' site web or excel sheet spread with addresses e-mail, a new msn email opens. Now, I get an error message: rundll32.exe - bad Image, followed by a message the the appklication or the DLL C:\Program FIles\MSN\MSNSharedFIles\MAILMAPI. DLL is not a valid Windows image. Please check against oyur installatiion diskette. I have msn unisnstalled.

  I can access my e-mail through hotmail msn, but no linger to subscribe to msn premium.

  original title: default e-mail program

  Hi PAULKRISSEL,

  This function is not supported natively in Windows. You may may find a third of the program that will change the default to q.com.
  
  WARNING: Microsoft provides no assurance or warranty, implied or otherwise and is not responsible for the download you receive from the sites of third parties or support related to the download or the downloaded technology. If you need assistance dealing with third party technology, please contact directly the manufacturer.

• Site to site VPN question: passing a public IP with IPSEC

  Hi all

  I need to create a VPN tunnel site to site using IPSEC between two offices on the Internet. The offices belong to two different companies.

  They gave me a series of 16 public IP addresses. One of these IP addresses is used on the ISP router and this is the next hop for my router. Another IP in the range is used on my router? s external interface (which is a Cisco 851) and he is also my site VPN endpoint. So far so good...

  Here's my problem: the IP source of encrypted traffic, is a public address from within the IPs public 16 I (not the one on my router interface). The actual application that needs to send the encrypted data is a server in my local network, and it has a private IP address. The other site, expects to receive data, however, the public IP address. I used NAT between the private IP address of the server and its public IP address, but no data goes through the tunnel. Moreover, the tunnel between the two end points established without problem. The problem is that the source of my encrypted data is the public IP address and I don't know how to get through the tunnel. I enclose my router configuration.

  Any help is appreciated.

  The access list "natted-traffic" should say:

  extended traffic natted IP access list

  deny ip host 192.168.0.160 BB. ABM ABM BD

  deny ip host 192.168.0.160 BB. ABM BB.BE

  output

  I hope this helps.

  -Kanishka

• Replace a current site with a new

  Is it now possible to replace a current BC site with a new? I have a customer who wants a redone site but still has almost a year left on their hosting of BC. So I want to rethink on a temp site and then replace it. Is it possible at this time?

  If Yes, what is the procedure to follow. Summer off Business Catalyst for awhile.

  Hi Brad,

  You must replace the files on the existing site. You could start another site, but don't transfer of billing.

  Best option is to redesign the site a site of BC. Then upload all the new files on the old site and update IDs, forms/modules etc when you publish the changes.

  Lynda

• New Adobe Muse site with existing Business Catalyst modules - URGENT!

  I desperately need help with this problem.

  A customer asked me to redo their site and I wonder if someone can tell me if you can insert old BC modules like Blogs, forms, etc. in a newly created Web of Adobe Muse site.

  The new site will replace the former site of BC once completed.

  Thanks heaps!

  This can be done in 2 ways:

  -Use your login client to publish the window and select the url of the site that was previously used.

  -Publish the new site at this url will ensure that the url of the site is the same and CMS/CRM previously created content can be used in the form of modules in the pages of Muse.

  or

  -Create new site and publish it as a new site

  -Create modules, modules etc blogs > add to the page of Muse

  -Remove the domain from the old site and add it to your new site

  Thank you

  Sanjit

• Hi, is it possible to export the site with system fonts without turning the police to the image?

  Hi, is it possible to export the site with system fonts without turning the police to the image?

  I arrived to the police system in Hebrew ('David' & "Aharoni") and I don't want to turn into picture when im exporting.

  is this possible?

  You'll want to consider using a 'Hosted Web Font. There are many free and commercial Web fonts. To use a font with Muse Web, you will need both the system/print the police and the Web. See web fonts self-hosted Add | Muse CC tutorials Adobe> for a quick video demo of the use of Web fonts.

• Change all the templates in a site with a new model

  Dear all,
  My site have similar models. I just rewrite a new model that is available for all models. Could you tell me how to replace all models in my site (all .html files) with a new model?
  Thanks in advance.

  > all .html files

  Do you mean all the *.dwt files?

  If you * mean that, then do the following.

  1 perform a full backup of the site
  2. open DW, and then create a blank HTML page (I want this page to be the)
  single open page)
  3. Select this site in the list site in the files Panel
  4 do a find and replace to the site level to find each FORMER model name and
  Replace it with the NEW name of model
  5. open one of the child pages and use EDIT | Models > update all
  pages

  That should do it.

  --
  Murray - ICQ 71997575
  Adobe Community Expert
  (If you * MUST * write me, don't don't LAUGH when you do!)
  ==================
  http://www.projectseven.com/go - DW FAQs, tutorials & resources
  http://www.dwfaq.com - DW FAQs, tutorials & resources
  ==================

  "langtugiangho" wrote in message
  News:g1gkmm$IIT$1@forums. Macromedia.com...
  > Dear all,
  > My site have similar models. I just rewrite a new model that is
  > available for all models. Could you tell me how to replace all
  > model in
  > my site (all .html files) by a new model?
  > Thanks in advance.
  >

• My new site is done, now I do a phone and tablet version. How can I connect all the 3 sites with having duplicate content.

  Hi again.

  When I close my phone and tablet version on my site, I intend to have two large buttons at the top of the Web site that say "CLICK HERE for VERSION PHONE" AND "PRESS HERE for TABLET VERSION.

  How you launch the phone and tablet with making it duplicate content?

  ... Make articles to submit my site with 3 different versions?

  For example,.

  (1) see HumboldtPitBulls.Com for some of the best traditional dogs (goes to 'normal PC version' of the website)

  (2) If you are interested in seeing see some beautiful APBTs website (goes to 'version of phone' web site)

  (3) If you want to learn more about the history of the old Rednose Pitbull family discover our items (goes to version 'Tablet' on the website)

  Please tell me I didn't need on the 'market' all 3 versions separate. Looks like more work that simply "come see HumboldtPitBulls.Com".

  Thanks again!

  Hello

  You can create all three layouts of your site in a single file of Muse and publish/export/upload as required. Muse generates the code to detect the device used by the user and automatically redirects to relevant content... You only need to promote the "yourbusinessname.com" and Muse handles redirection to "yourbusinessname.com/phone/" or "yourbusinessname.com/tablet/" depending on what device you use to access the site.

  Please see a few resources around Muse: Designing for Devices.

  http://TV.Adobe.com/watch/Muse-feature-tour/Adobe-Muse-designing-for-mobile-devices/

  http://www.adobepress.com/articles/article.asp?p=2219864

  http://helpx.Adobe.com/Muse/using/creating-website-mobile-devices.html

  See you soon,.

  Vikas

• Site to Site with NATing

  Hi all

  I'm kind new to Cisco and I have no expertise CLI. I need to configure a VPN site-to site (IPsec tunnel) with NATing. I have already installed several L2L no need with ASDM without problem, NATing.  Here's the scenario:

  Site1 use 192.168.1.0/24 for all internal clients that need to connect to two hosts on the Site2.

  Site1 users need to access hosts Site2 namely 192.168.25.100 and 192.168.25.101

  Site2 already has a L2L with another configuration of the site for the 192.168.1.0/24 range, so they asked if I can NAT outgoing traffic on my memory of end of 172.10.25.0/24.

  So all customers on 192.168.1.0/24 connect via only this VPNtunnel of Site1 to Site2 should be coordinated to 172.10.25.0/24 (one?).  Now, I wonder if this can be done through ASDM and if so, how? I guess I need to do it in two steps, 1) installation of the L2L using 2) installation all necessary NAT and ACLs Wizard.   I'm under Cisco ASA 5510. ver. 7.2  If not, what are the exact commands for CLI?  Again once this NATing is for this VPN tunnel and I don't want Site1 (192.168.1.0/24) users to be assigned to other VPN L2L is already set up and everything related to internally.

  Thanks in advance for any help/suggestions.

  Yes, you are absolutely correct with all 3 instructions.