Alternative ACS 5 ip local pool

Similar Questions

• How can I specify a default gateway for users of AnyConnect with a local pool of IP?

  Hi all

  This question relates to my ASA5510 8.0 software (4) running.

  For many of my AnyConnect group strategies, I use a local pool of IP to assign addresses to remote clients.  The pool is 10.1.50.1 - 10.1.50.250.  The problem is that when clients connect, they get a default gateway 10.1.0.1 it would be OK in a properly configured network, but it's not really one of those.

  I don't think there is any place where I can specify the default gateway value, is there?  What is the right way to work around this problem?

  Thanks in advance,

  -Steve

  Hello

  Find out what...

  Cisco AnyConnect VPN Client connection Ethernet card:

  The connection-specific DNS suffix. : vcnynt.com

  ... Description: Miniport Adapter virtual cisco AnyConnect VPN for Windows

  Physical address.... : 00-05-9A-3C-7A-00

  DHCP active...: No.

  ... The IP address: 10.1.50.1

  ... Subnet mask: 255.255.0.0.< subnet="" mask="" is="">

  ... Default gateway. : 10.1.0.1.

  10.1.50.1 is a part of 10.1.0.0 subnet. By design, to make the client VPN routing compatible with machines Vista. We had changed the functions of IPs for the DG on the client. It had been noticed that if you have the same DG ip address as the ip address of the virtual card it will not work. So what you see is good behavior.

  In other words, Anyconnect will show the first ip address in the subnet as the DG which in your case is 10.1.0.1.

  HTH...

  Concerning

  M

  PS: To all users whenever you post your questions and the solution given to you, work, please make sure that note you. Helping other users with the same query to get their answers in less time rather post a new thread for the same thing and waiting for responses. This saves time for the author and the person who answers to him.

• Can the NAT of ASA configuration for vpn local pool

  We have a group of tunnel remote ipsec, clients address pool use 172.18.33.0/24 which setup from command "ip local pool. The remote cliens must use full ipsec tunnel.

  Because of IP overlap or route number, we would like to NAT this local basin of 172.18.33.0 to 192.168.3.0 subnet when vpn users access certain servers or subnet via external interface of the ASA.  I have nat mapping address command from an interface to another interface of Armi. The pool local vpn is not behind any physical interface of the ASA. My question is can ASA policy NAT configuration for vpn local pool.  If so, how to set up this NAT.

  Thank you

  Haiying

  Elijah,

  NAT_VPNClients ip 172.18.33.0 access list allow 255.255.255.0 10.1.1.0 255.255.255.0

  public static 192.168.33.0 (external, outside) - NAT_VPNClients access list

  The above configuration will be NAT 172.18.33.0/24 to 192.168.33.0/24 when you go to 10.1.1.0/24 (assuming that 10.1.1.0/24 is your subnet of servers).

  To allow the ASA to redirect rewritten traffic the same interface in which he receive, you must also order:

  permit same-security-traffic intra-interface

  Federico.

• VPN client, ip local pool &amp; mask

  Hello

  I use cisco with a 7206VXR vpn client.

  I set up a "local ip pool" that gives us the ip address for each connected client.

  The pool is set up like this:

  pool of IP local pool-Z 10.3.1.1 10.3.1.254

  and we use it like this:

  Configuration group customer crypto isakmp ZHANG

  key AKEY

  pool pool-Z

  ACL ACL - Z

  The problem I have is that we get an IP with a 8 mask but the mask I want to use should be 16.

  Where I specify the network mask?

  Thank you

  Hi Benoit

  You must specify the NETWORK mask in client configuration group

  Configuration group customer crypto isakmp ZHANG

  key AKEY

  pool pool-Z

  ACL ACL - Z

  subnet mask 255.255.0.0

  M.

  Hope that the rates of assistance if she

• Local pool IP VPN

  We are testing the upgrade to version 8.2 to 8.4 on the ASA 5505 and ran into a problem. For VPN connections, we created pools. Some of the pools were limited to a single IP address. After the upgrade, the ASA rejects the pools which had only an IP address instead of a range. In the command line if you type a question mark after typing in the "local ip pool (pool keyword)' in config mode it says" specify an IP address or a range of IP addresses: start [-end] ' by the word 'or' sounds as it should, except a single IP address, but it doesn't. The error is "Please enter a valid IP range."

  Does anyone know the soultion to this problem as well as increase the range?

  Thanks for your comments.

  The syntax below worked for me on 5505 with ver 8.3

  test mask 192.168.10.1 IP 255.255.255.255 local pool

  Check if it works for you.

  HTH

  MS

• ACS 4.0 Local firewall devices

  All,

  I just read a message labeled "ACS 4.0 firewall" and he talked about opening 2004 for 5000 ports to access the ACS server that is behind the firewall. My question is this same range of ports apply if you try to access and authenticate on a device that is behind a firewall. When I try to access one of my devices located behind the firewall I can't authenticate via the GBA so I find myself using the local username and password. Can someone tell me what are the ports I need to open the firewall to allow the authetication return to the ACS server. Thank you

  Hello

  GANYMEDE + authentication service between network devices and AAA server is running on TCP 49. The port 2004-5000 range applies only if you need to access the ACS server (for the purposes of management) from the outside / internet. In your case, if you want to access your devices behind the firewall from external network, what you need is to map your internal network with the public IP devices and open the port of ddesired service, for example SSH (tcp 22) on your Firewall outside interface ACL to allow incoming access.

  For your internal devices, you must have the configuration appropriate AAA that point to ACS (e.g. GANYMEDE +). In your GBA, set these devices as customer AAA and set up appropriate IP, key secret and using GANYMEDE +.

  Before testing ssh access internet/external network, test your SSH access locally. He must succeed in getting AAA to authenticate your request of SSH connection.

  http://www.Cisco.com/en/us/partner/products/sw/secursw/ps2086/products_user_guide_chapter09186a008052e996.html

  I hope this helps.

  Rgds,

  AK

• ASA VPN cannot ping ip local pool

  Hello

  We have ASA 5510 a device be deployed for a period of time. Everything works fine except customers local VPN cannot ping local customer VPN which get their IP address to the local swimming pool. They can ping anywhere on the local network of company, but not each other. I don't know there's a logical explantion for this because of an ACL but all appreciated the advice...

  Thanks in advance

  Keith

  Hi Keith,

  I think that, in order to allow a customer VPN reach another VPN client, the SAA should turn the VPN traffic (because it will receive the traffic of a VPN tunnel and re - again to send another tunnel.)

  Can you add "same-security-traffic intra-interface permits" and try again?

  Federico.

• ACS 5.3 should consider a local database, if the ad is inaccessible

  Dear support team

  We have ACS 5.x, integrated with AD and members are authenticated using AD user name or local user name

  configured on ACS.

  is it possible that ACS checks the local database only when AD is unreachable, customer doesn't want local database ACS to use as long as AD is available. It's the accounting requirements of their Department system.

  Thanks in advance for your time.

  Ahad

  You're right about everything except the last part, device Admin 1 and 2 are "Selection rules", so they'll be mapped according to their Conditions, if applications authentication is rule Eric the device Admin 1 then the ACS will stay with this service regardless of whether or not the DB is down, ACS will not return to the device Admin 2.

  The only option to use a second database where the primary is down is with identity store sequence, but this option will also use the second database if the primary DB is unable to find the user.

  Unfortunately, there is not an option at the moment to accomplish this objective with specific detail you need.

  Rate if this can help.

• ACS any Version with Windows Server 2008 R2 64-bit domain controller

  Hi all

  Is there any version of ACS is currently working with Windows Server 2008 R2 domain controllers?

  Our server controls has recently upgraded domain controllers to 2008r2 and off 2003 servers. This did not our ACS 4.1.4 really happy.

  I read now serveral messages about problems with the ACS and Server 2008r2 and hope to find a solution (not to mention that switching to LDAP, yukk).

  Thank you

  Pato

  ACS currently cannot be installed on a server running Windows 2008 R2.

  As an alternative, you can install ACS on a member server.  Authentication

  ACS uses the local machine net API authentication both compared to a 2008

  R2 domain will work.  The Remote Agent can also be installed on a 2008 R2

  Server if you use devices.

  If you install ACS on a member instead server here is how to configure services

  to authenticate properly with the domain:

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/installation/guide/Windows/postin.html#wp1041304

  -Jesse

• Cisco Security Manager integration with Cisco ACS troubleshooting

  Hi all!

  I have a problem with the integration between Cisco Security Manager and ACS. I've done the integration, but the identity of the user system doesn't have enough privileges. I know what the problem is, but I don't know how I can change the login of the ACS to the local MSC?

  I found a file that specifies the following:

  Q.

  Is there a backend script or command line interface options to change the ACS to local CicsoWorks connection module?

  A.

  To restore the server LMS ACS local user mode mode, stop the CiscoWorks

  demons and run the following script:

  NMSROOT/bin/perl ResetLoginModule.pl

  (for Solaris)

  NMSROOT\bin\perl ResetLoginModule.pl

  (for Windows)

  Then, restart the daemon.

  I did it, but does not work, any idea?

  Hello

  I guess you can try to go through the question on WSC and GBA integration troubleshooting:

  http://www.Cisco.com/en/us/docs/security/security_management/cisco_security_manager/security_manager/3.0/troubleshooting/guide/rbacts.html#wp1043629

  Few things might have gone wrong:

  1 - this command must be run on the server MCS cmd prompt (make sure that you are not on the client computer)

  2 - NMSROOT is the directory were MSC Server is installed. Is usually c:\Progra~1\CSCOpx

  3. you must stop the deamon Manager before performing this action (and restart)

  For example if the directory is the one above to reset the connection locally, you can try the following:

  net stop crmdmgtd---> that stops the daemon Manager (can be done by the services window)

  c:\Progra~1\CSCOpx\bin\perl c:\Progra~1\CSCOpx\bin\ ResetLoginModule.pl---> restores local authentication

  net start crmdmgtd---> restart the Daemon Manager

  Can you maybe try again and let me know how it goes?

  Thank you

• AnyConnect client can not access local network

  Hello

  I have a problem with the Cisco anyconnect. Once clients are connected they cannot access anything whatsoever, including their default gateway.

  Pool of the VPN client is on the same subnet as the LAN (139.16.1.x/24). Local network clients can access DMZ, VPN clients can ping computers on the local network, but they cannot access the DMZ.

  I guess that any rule providing that traffic is absent but I m new with Cisco ASA and I m totally lost. I read as much as I could on this topic, but I do not understand which rule is necessary.

  Thank you very much in advance for your support.

  ASA release 9.4 (1)
  !
  ciscoasa hostname
  activate the encrypted password of WmlxhdtfAnw9XbcA
  TA.qizy4R//ChqQH encrypted passwd
  names of
  mask 139.16.1.50 - 139.16.1.80 255.255.255.0 IP local pool Pool_139
  !
  interface GigabitEthernet1/1
  nameif outside
  security-level 0
  192.168.1.100 IP address 255.255.255.0
  !
  interface GigabitEthernet1/2
  nameif inside
  security-level 100
  IP 139.16.1.1 255.255.255.0
  !
  interface GigabitEthernet1/3
  nameif DMZ
  security-level 50
  IP 172.16.1.1 255.255.255.0
  !
  interface GigabitEthernet1/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet1/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet1/6
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet1/7
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet1/8
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  Management1/1 interface
  management only
  nameif management
  security-level 100
  11.11.11.11 IP address 255.255.255.0
  !
  passive FTP mode
  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  internal subnet object-
  139.16.1.0 subnet 255.255.255.0
  network dmz subnet object
  subnet 172.16.1.0 255.255.255.0
  wialon Server external ip network object
  Home 192.168.1.132
  wialon-Server network objects
  Home 172.16.1.69
  Wialon-service-TCP object service
  destination tcp source between 1 65535 21999 20100 service range
  Wialon-service-UDP object service
  destination service udp source between 0 65535 21999 20100 range
  network of the NETWORK_OBJ_139.16.1.0_25 object
  subnet 139.16.1.0 255.255.255.128
  outside_acl list extended access permit tcp any object wialon-Server eq www
  outside_acl list extended access allowed object Wialon-service-TCP any wialon-server object
  outside_acl list extended access allowed object Wialon-service-UDP any wialon-server object
  pager lines 24
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 DMZ
  management of MTU 1500
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source any any static destination NETWORK_OBJ_139.16.1.0_25 NETWORK_OBJ_139.16.1.0_25 non-proxy-arp-search to itinerary
  !
  network obj_any object
  dynamic NAT (all, outside) interface
  internal subnet object-
  NAT dynamic interface (indoor, outdoor)
  wialon-Server network objects
  NAT (DMZ, external) service wialon Server external ip static tcp www www
  Access-group outside_acl in interface outside
  Route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  identity of the user by default-domain LOCAL
  Enable http server
  http 11.11.11.0 255.255.255.0 management
  http 139.16.1.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  service sw-reset button
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  Crypto ca trustpoint ASDM_TrustPoint0
  registration auto
  domain name full ciscoasa.srdongato.null
  E-mail [email protected] / * /
  name of the object CN = srdongato
  Serial number
  Proxy-loc-transmitter
  Configure CRL
  Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
  registration auto
  full domain name no
  name of the object CN = 139.16.1.1, CN = ciscoasa
  ASDM_LAUNCHER key pair
  Configure CRL
  trustpool crypto ca policy
  string encryption ca ASDM_TrustPoint0 certificates
  certificate 09836256
  30820381 30820269 a0030201 02020409 83625630 0d06092a 864886f7 0d 010105
  05003050 31123010 06035504 03130973 72646f6e 6761746f 313 has 3012 06035504
  05130b4a a 41443139 32323033 34343024 06092, 86 01090216 17636973 4886f70d
  636f6173 612e7372 646f6e67 61746f2e 6e756c6c 31353132 30353036 301e170d
  5a170d32 33333535 35313230 32303633 3335355a 30503112 30100603 55040313
  09737264 6f6e6761 30120603 55040513 31393232 30333434 0b4a4144 746f313a
  2a 864886 30240609 f70d0109 6973636f 02161763 6173612e 7372646f 6e676174
  6f2e6e75 6c6c3082 0122300d 06092 has 86 01010105 00038201 0f003082 4886f70d
  010a 0282 010100d 2 295e679c 153e8b6a d3f6131d 8ea646e3 aa0a5fa9 20e49259
  ca895563 7e818047 033a4e8f 57f619e9 fa93bfd5 6c44141f b0abf2c0 8b86334e
  bac63f41 99e6d676 c689dcf7 080f2715 038a8e1b 694a00de 7124565e a1948f09
  8dbeffab c7c8a028 741c5b10 d0ede5e9 599f38fe 5b88f678 4decdc4b b 353, 6708
  cfa2fbce f58be06e 18feba56 4b2b04a1 77773ec6 5c58d2ed d7ca4f17 980f0353
  138bfe65 1b1165e6 7b6f94bb ab4d4286 e900178c 147a6dba 2427f38e e225030f
  0a66d1eb 5075c57e 6d77e5bb 247f5bc3 8d3530f0 49dedf2d 21a24b5f daa08d98
  690183cf e82a6b8d 5e489956 c5eecdbc 7fc2365c b629a52b 126b51e2 18590ed5
  c9da8503 a639f102 03010001 a3633061 300f0603 551d 1301 01ff0405 30030101
  ff300e06 03551d0f 0101ff04 86301f06 04030201 23 04183016 80143468 03551d
  dec79103 0a91b530 1ada7e47 7e27b16d 4186301d 0603551d 0e041604 143468de
  c791030a 91b5301a da7e477e 27b16d41 86300d 86f70d01 01050500 06 092 a 8648
  003cdb04 03820101 8ef5ed31 c05c684b ad2b0062 96bfd39a ecb0a3fe 547aebe5
  14b753e7 89f55827 3d4e0aa8 b8674e45 80d4c023 8e99a7b4 0907d 347 060a2fe4
  fa6e0c2f 3b9cd708 a539c09f 7022d2ee fb6e2cf6 82b0e861 a2839a71 1512b3ec
  e28664e9 732270c 9 d1c679d9 1eaf2ad5 31c3ff97 09aae869 88677a3d b 007, 5699
  ecb3032e 2dd0f74f 81f9a8fb 79f30809 723bbdbf dfef4154 5ad6b012 a8f37093
  481fa678 b44b0290 23390036 042828f3 5eefdc43 ebe52d26 78934455 9b4234a9
  4146 166e5adc b431f12f 8d0fbf16 46306228 731c bfeebc43 34 76984 d2e6ebbc
  88ca120a 96838694 d4f32884 963e7385 987ec6b0 dfa28d49 05ba5fa8 641bcfc7
  ff92ac3c 52
  quit smoking
  string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
  Certificate 0 is 836256
  308202cc a0030201 0202040a 0d06092a 83625630 864886f7 0d 010105 308201b 4
  05003028 06035504 03130863 61736131 13301106 03550403 6973636f 3111300f
  130a 3133 392e3136 2e312e31 31353132 30353036 35363236 5a170d32 301e170d
  35313230 32303635 3632365a 30283111 55040313 08636973 636f6173 300f0603
  61311330 11060355 0403130 3133392e 31362e31 2e313082 0122300d 06092 has 86
  4886f70d 01010105 00038201 0f003082 010 has 0282 010100e7 a5c16e86 16c15a10
  e018b868 bac7271a 30f1a3f8 ecb9c6b8 3ed4b1ad c9468f5e 287f2a7a 644f1496
  c43a061e da927d09 a755b53e ed7c6a66 f2f1fb1e f944345c 86e08ce0 891c99b3
  13101ab3 04963fad f91f987f 99f22a89 cd1e8c5a 5e4c026d 2cadd7b7 6620bbd1
  b4a5135b 24ec886f fa061a06 dd536e96 1e483730 756c 4101 23f83a8d 944a7fbe
  93c51d56 32ac0d17 ceb75f63 0ae24f07 f2c54e83 5b84ff00 16b0b899 c925c737
  1765b 066 23 b 54645 bc419684 d09dd130 c1479949 68b0a779 df39b078 6fb0deb9
  758b14c3 f0801faf f0ad60e1 a018ffba d769f867 3fe8e5fc 88ccc5b2 2319f5d4
  617a78c4 74e7a64b 5c68276c 06ea57c1 d0ffce4b 358c4d02 03010001 300 d 0609
  2a 864886 05050003 82010100 dff97c9f 4256fd47 8eb661fd d22ecea4 f70d0101
  589eff09 958e01f1 a435a20e 5ed1cf19 af42e54d d61fc0ab cb2ee7ac 7fcb4513
  1a44cc86 1e020d72 3a3f78d2 4 d 225177 857093d 9 f5fcf3c7 6e656d2b 54a0c522
  f636b8cf 33c5ae34 ea340f32 85dff4c1 50165e7a e94de10b ced15752 0b3a76c1
  2a50777b 20291106 a1a8a214 a 8 003716 680c15d4 ac3f7cc7 378f8f5f 38e3403f
  f958c095 e549c8ed 4baf8cc5 bdcd230e 260754ea 953c3a4c eb01fef5 62b97e01
  9f82ce6b f479dbdd 000c45af 8758b35f b4a958ee 32c4db3f 2ddc7385 dc05b0e3
  78b609ba a9280841 2433ae87 5dd7a7c2 d5691068 1dc0eddc c23f99c5 3df8b1a5
  aadbd82a 423f4ba8 563142bf 742771c 3
  quit smoking
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 activate out of service the customer port 443
  Crypto ikev2 access remote trustpoint ASDM_TrustPoint0
  Telnet 139.16.1.0 255.255.255.0 inside
  Telnet 11.11.11.0 255.255.255.0 management
  Telnet timeout 5
  without ssh stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  dhcpd outside auto_config
  !
  dhcpd address 172.16.1.69 - DMZ 172.16.1.69
  dhcpd dns 87.216.1.65 87.216.1.66 DMZ interface
  dhcpd option 3 ip 172.16.1.1 DMZ interface
  dhcpd enable DMZ
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL-trust outside ASDM_TrustPoint0 point
  SSL-trust ASDM_Launcher_Access_TrustPoint_0 inside point
  Trust ASDM_Launcher_Access_TrustPoint_0 inside the vpnlb-ip SSL-point
  WebVPN
  allow outside
  AnyConnect image disk0:/anyconnect-win-3.1.12020-k9.pkg 1
  AnyConnect profiles Wialon_client_profile disk0: / Wialon_client_profile.xml
  AnyConnect enable
  tunnel-group-list activate
  Disable error recovery
  internal GroupPolicy_Wialon group strategy
  attributes of Group Policy GroupPolicy_Wialon
  WINS server no
  value of 192.168.1.1 DNS server
  client ssl-VPN-tunnel-Protocol ikev2
  by default no
  WebVPN
  AnyConnect value Wialon_client_profile type user profiles
  dynamic-access-policy-registration DfltAccessPolicy
  wialon_1 Wy2aFpAQTXQavfJD username encrypted password
  wialon_2 4STJ9bvyWxOTxIyH encrypted password username
  remote access to Wialon tunnel-group type
  attributes global-tunnel-group Wialon
  address pool Pool_139
  Group Policy - by default-GroupPolicy_Wialon
  tunnel-group Wialon webvpn-attributes
  enable Wialon group-alias
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:447ec315ae30818a98f705fb1bf3fd75

  Hello

  You don't have NAT exemption the DMZ network to the pool of VPN traffic.

  Please try to add the following statement to run:

  nat (DMZ,outside) 1  source static any any destination static NETWORK_OBJ_139.16.1.0_25 NETWORK_OBJ_139.16.1.0_25 route-lookup

  Also please delete the existing instruction manual nat "non-proxy-arp" statement, because it can cause problems like you the ip subnet address pool is identical to that of the Interior of the network.

  no nat (inside,outside) source static any any destination static NETWORK_OBJ_139.16.1.0_25 NETWORK_OBJ_139.16.1.0_25 no-proxy-arp route-lookup
  
  nat (inside,outside) 1 source static any any destination static NETWORK_OBJ_139.16.1.0_25 NETWORK_OBJ_139.16.1.0_25 route-lookup
  
  

  Cordially Véronique

• AAA &amp; local connection

  Hello

  I have a curious problem.

  If I use the following line in my configs:

  AAA authentication login default group Ganymede + local

  and a usernam and password locally configured as follows:

  test username password abc123

  the ACS server will authenticate the connection ok request each time. But if you try and connect you with the local user name he fails. If you disconnect server ACS then the local username and password will work.

  Probably the ACS server sees that there is no user name that corresponds to this local failure of the attempt.

  Is there a way to make it back to the router and use the local username?

  Thanks for your help.

  Ray

  Ray,

  In fact, it is by design. The router will return only in the case when there is no response from the acs server.

  If acs can't locate any user, it will say "user not found" to the router, then the router will not check its database.

  If there is no response from the acs, router will get 'error' as return value, so it then checks its local database for this user.

  Hope that helps!

  Kind regards

  ~ JG

  Note the useful messages

• I can't ping or join the local network internal

  I can't reach or ping my network when I connect via VPN. The connection works fine, everything must be connected to the ASA and users is accepted through RADIUS

  Jørgen,

  I recommend you to use different network RA pool to be separated from your inside of the network number, this strategy troubleshooting efforts ease down the road that say to questions of troutbleshooting of the Interior can still function 192.168.0.0/24 and RA POOL 192.168.0.0/24, however, using the same network.

  I corrected a few things in your config file.

  You have allocated dhcpd for inside the host from 192.168.0.2 - 192.168.0.129

  and your pool of vpn RA is set from 192.168.0.60 - 192.168.0.75, your RA pool allocation must be 192.168.0.130 - 192.168.0.145 to have a few consistentcy.

  You must also add to your config "crypto isakmp nat-traversal" and customer RA try again

  If all above is not the thing, keep in your config nat-traversal crypto isakmp and re - create new network for your POOL of RA.

  Here's the easy script

  remove network RA POOL

  no local pool VPN_IMH 192.168.0.60 - 255.255.255.0 ip 192.168.0.75 mask

  create a new network POOL guess (172.16.1.0)

  local pool VPN_IMH 172.16.1.60 - 172.16.1.75 255.255.255.0 IP mask

  for your exempt nat acl add the following statement

  permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 172.16.1.0 255.255.255.0

  remove this rule

  no access list inside_nat0_outbound extended permits all ip 192.168.0.0 255.255.255.0

  Let us know how works to help

  Concerning

• Remote access VPN users unable to see local lan or internet

  We implement an ASA5510. Now our users can connect to the vpn but cannot access the internal Lan or internet.

  Here is the config. Any help or idea would be greatly appreciated. Thank you

  Cryptochecksum: dd11079f e4fe7597 4a8657ba 1e7b287f

  : Saved
  : Written by enable_15 at 11:04:57.005 UTC Wednesday, April 22, 2015
  !
  ASA Version 9.0 (3)
  !
  CP-ASA-TOR1 hostname
  activate m.EmhnDT1BILmiAY encrypted password
  names of
  local pool CPRAVPN 10.10.60.1 - 10.10.60.40 255.255.255.0 IP mask
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 63.250.109.211 255.255.255.248
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  10.10.10.254 IP address 255.255.255.0
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  passive FTP mode
  the local object of net network
  10.10.10.0 subnet 255.255.255.0
  net remote object network
  10.10.1.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_10.10.10.0_24 object
  10.10.10.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_10.10.60.0_26 object
  255.255.255.192 subnet 10.10.60.0
  Outside_1_cryptomap to access extended list ip 10.10.10.0 allow 255.255.255.0 net object / distance
  CPRemoteVPN_splitTunnelAcl list standard access allowed 10.10.10.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  management of MTU 1500
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm-731 - 101.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) local static source net net-local destination static net distance net-distance
  NAT (inside, outside) static source NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.60.0_26 NETWORK_OBJ_10.10.60.0_26 non-proxy-arp-search of route static destination
  !
  NAT (inside, outside) source after-service dynamic automatic one interface
  Route outside 0.0.0.0 0.0.0.0 63.250.109.209 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Enable http server
  http 192.168.1.0 255.255.255.0 management
  http 10.10.10.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 corresponds to the address Outside_1_cryptomap
  card crypto Outside_map 1 set pfs Group1
  card crypto Outside_map 1 set peer 209.171.34.91
  card crypto Outside_map 1 set transform-set ESP-3DES-SHA ikev1
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  card crypto Outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal CPRemoteVPN group strategy
  attributes of Group Policy CPRemoteVPN
  Server DNS 10.10.10.12 value
  L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
  value of Split-tunnel-network-list CPRemoteVPN_splitTunnelAcl
  carepath.local value by default-field
  Split-dns value carepath.ca
  activate dns split-tunnel-all
  no method of MSIE-proxy-proxy
  the address value CPRAVPN pools
  roys jjiV7E.dmZNdBlFQ encrypted password privilege 0 username
  roys username attributes
  VPN-group-policy CPRemoteVPN
  tunnel-group 209.171.34.91 type ipsec-l2l
  IPSec-attributes tunnel-group 209.171.34.91
  IKEv1 pre-shared-key *.
  type tunnel-group CPRemoteVPN remote access
  attributes global-tunnel-group CPRemoteVPN
  address CPRAVPN pool
  Group Policy - by default-CPRemoteVPN
  IPSec-attributes tunnel-group CPRemoteVPN
  IKEv1 pre-shared-key *
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:dd11079fe4fe75974a8657ba1e7b287f

  : end

  Hello

  A couple of things set this:

  -crypto isakmp nat-traversal 20

  -management-access inside

  Can you run a packet tracer and attach it here, to see what are the phases that crosses the package.

  David Castro,

  Concerning

• remote VPN and vpn site to site vpn remote users unable to access the local network

  As per below config remote vpn and vpn site to site vpn remote users unable to access the local network please suggest me a required config

  The local 192.168.215.4 not able ping server IP this server connectivity remote vpn works fine but not able to ping to the local network vpn users.

  ASA Version 8.2 (2)
  !
  host name
  domain kunchevrolet
  activate r8xwsBuKsSP7kABz encrypted password
  r8xwsBuKsSP7kABz encrypted passwd
  names of
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  PPPoE client vpdn group dataone
  IP address pppoe
  !
  interface Ethernet0/1
  nameif inside
  security-level 50
  IP 192.168.215.2 255.255.255.0
  !
  interface Ethernet0/2
  nameif Internet
  security-level 0
  IP address dhcp setroute
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  management only
  !
  passive FTP mode
  clock timezone IST 5 30
  DNS server-group DefaultDNS
  domain kunchevrolet
  permit same-security-traffic intra-interface
  object-group network GM-DC-VPN-Gateway
  object-group, net-LAN
  access extensive list ip 192.168.215.0 sptnl allow 255.255.255.0 192.168.2.0 255.255.255.0
  192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0
  tunnel of splitting allowed access list standard 192.168.215.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 Internet
  IP local pool VPN_Users 192.168.2.1 - 192.168.2.250 mask 255.255.255.0
  ICMP unreachable rate-limit 1 burst-size 1
  enable ASDM history
  ARP timeout 14400
  NAT-control
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 59.90.214.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  the ssh LOCAL console AAA authentication
  AAA authentication LOCAL telnet console
  AAA authentication http LOCAL console
  AAA authentication enable LOCAL console
  LOCAL AAA authentication serial console
  Enable http server
  x.x.x.x 255.255.255.252 out http
  http 192.168.215.0 255.255.255.252 inside
  http 192.168.215.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic dynmap 65500 transform-set RIGHT
  card crypto 10 VPN ipsec-isakmp dynamic dynmap
  card crypto VPN outside interface
  card crypto 10 ASA-01 set peer 221.135.138.130
  card crypto 10 ASA - 01 the transform-set RIGHT value
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  the Encryption
  sha hash
  Group 2
  lifetime 28800
  Telnet 192.168.215.0 255.255.255.0 inside
  Telnet timeout 5
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH timeout 5
  Console timeout 0
  management-access inside
  VPDN group dataone request dialout pppoe
  VPDN group dataone localname bb4027654187_scdrid
  VPDN group dataone ppp authentication chap
  VPDN username bb4027654187_scdrid password * local store
  interface for identifying DHCP-client Internet customer
  dhcpd dns 218.248.255.141 218.248.245.1
  !
  dhcpd address 192.168.215.11 - 192.168.215.254 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  Des-sha1 encryption SSL
  WebVPN
  allow outside
  tunnel-group-list activate
  internal kun group policy
  kun group policy attributes
  VPN - connections 8
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value split tunnel
  kunchevrolet value by default-field
  test P4ttSyrm33SV8TYp encrypted password username
  username kunauto password bSHrKTGl8PUbvus / encrypted privilege 15
  username kunauto attributes
  Strategy Group-VPN-kun
  Protocol-tunnel-VPN IPSec
  tunnel-group vpngroup type remote access
  tunnel-group vpngroup General attributes
  address pool VPN_Users
  Group Policy - by default-kun
  tunnel-group vpngroup webvpn-attributes
  the vpngroup group alias activation
  vpngroup group tunnel ipsec-attributes
  pre-shared key *.
  type tunnel-group test remote access
  tunnel-group x.x.x.x type ipsec-l2l
  tunnel-group ipsec-attributes x.x.x.x
  pre-shared key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:0d2497e1280e41ab3875e77c6b184cf8
  : end
  kunauto #.

  Hello

  Looking at the configuration, there is an access list this nat exemption: -.

  192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0

  But it is not applied in the States of nat.

  Send the following command to the nat exemption to apply: -.

  NAT (inside) 0 access-list sheep

  Kind regards

  Dinesh Moudgil

  P.S. Please mark this message as 'Responded' If you find this information useful so that it brings goodness to other users of the community