ASA 5505 - crypto isakmp nat-traversal is missing?
I can't understand it. I have an ASA5505 at home that I use for VPN access. Sometimes when I connect I can't ping anything. I check the config and it shows:
No encryption isakmp nat-traversal
I have configured "crypto isakmp nat-traversal" so many times before, and somehow it is still deleted. Seems to happen at random, as well as when the device is restarted. (Yes, the config has been saved). I would say that what is happening at least 2 - 3 times a week.
Any ideas? I am running the 8.0.2 version code.
This is a bug. Set the value on something other than the default value of 20. This will fix the problem.
Cryto isakmp nat-traversal 21
Tags: Cisco Security
Similar Questions
-
How can I get the engine working in the ASA 5505 Crypto
I bought a brand new ASA 5505 to connect to the Cisco 3640 and I can not yet set up the tunnel. I have tried to change the set of transformation to just but know luck. I recently put a VPN using DMVPN and Cisco 501 in a site-to-site, but it has been wondering what happens.
The router (3640 executes code 12.4) seems ok and I don't think I have a problem with the router with Cisco 501 great work.
This is a laboratory environment.
This is the function defined on the ASA 5505
The devices allowed for this platform:
The maximum physical Interfaces: 8
VLAN: 3, restricted DMZ
Internal guests: 10
Failover: disabled
VPN - A: enabled
VPN-3DES-AES: enabled
Peer VPN: 10
WebVPN peers: 2
Double ISP: disabled
Junction ports VLAN: 0
AnyConnect for Mobile: disabled
AnyConnect for Linksys phone: disabled
Assessment of Advanced endpoint: disabled
This platform includes a basic license.
This is a ping from 10.3.4.10 to 10.1.1.1. He said nothing about IPSEC or ISAKMP.
That's what I get when I do the: show crypto ipsec his
ASA5505 (config) # show crypto ipsec his
There is no ipsec security associations
ASA5505 (config) # show crypto isakmp his
There is no isakmp sas
Debug crypto isakmp 10
entry packets within the icmp 10.3.4.10 8 0 10.1.1.1 detail
I have worked on it for a week and don't really know if I have a bad ASA5505. Since the normal stuff like browsing the Internet works and I can ping to the outside and inside, I don't know what to think. See attachments.
"Do what you asked has worked.
Nice to hear that your problem is solved.
"My question is can I use the transform-set ESP-3DES-SHA instead of MD5?"
Of course you can.
Kind regards.
Please do not forget to note the useful messages and check "Solved my problem", if the post has solved your problem.
-
Issue of Cisco ASA 5505 Anyconnect Client NAT'ing
Hello
We have a split_tunnel RA Vpn configuration in a branch that works very well in all areas except the destinged of traffic for a specific website using https. This provider does not allow HTTPS connections to bring some outside IP addresses.
Essentially, this should work like this:
RAVPN_client (10.4.4.0/27)--> https request to the (208.x.x.x) vendor_ip---> ASA55XX--> NAT_to_outside_ip--> to the vendor_ip (208.x.x.x) https request
I need to understand how you would approach from ONLY this https traffic specific to the RA VPN without having to change the installer otherwise.
Internal hosts (aka behind the ASA physically) have not any question at this site, as would his nat ip address outside that we expect.
Here is what we use for the NAT Exemption it list 10.2.2.x, 192.168.100.x, and 172.23.2.x are other remote sites we have. The 10.4.4.0/27 RA VPN users don't have no problems connecting to them, regardless of the Protocol:
Note to inside_nat0_outbound access-list of things that should not be Nat would
access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 10.2.2.0 255.255.255.0
access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.100.0 255.255.255.0
access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 172.23.2.0 255.255.255.0
access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 10.4.4.0 255.255.255.224
access extensive list ip 10.4.4.0 inside_nat0_outbound allow 255.255.255.224 192.168.100.0 255.255.255.0
access extensive list ip 10.4.4.0 inside_nat0_outbound allow 255.255.255.224 10.2.2.0 255.255.255.0
access extensive list ip 10.4.4.0 inside_nat0_outbound allow 255.255.255.224 172.23.2.0 255.255.255.192
Here is the list of interesting traffic that we push to the customers through the tunnel of the VPN connection.
VPN_splitunnel to access extended list ip 192.168.100.0 allow 255.255.255.0 any
VPN_splitunnel of access list scope 10.2.2.0 ip allow 255.255.255.0 any
Access extensive list ip 10.12.1.0 VPN_splitunnel allow 255.255.255.0 any
Access extensive list ip 172.23.2.0 VPN_splitunnel allow 255.255.255.192 all
Access extensive list ip 10.4.4.0 VPN_splitunnel allow 255.255.255.224 all
VPN_splitunnel list extended access permit ip host 208.x.x.x any newspaper<- this="" is="" the="" vendors="" external="" ip="" address="" (obfuscated="" for="" security="" but="" you="" get="" the="">->
Here's the rest of the nat configuration:
NAT-control
Overall 101 (external) interface
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 101 0.0.0.0 0.0.0.0
Configuring VPN RA:
IP mask 255.255.255.224 local pool VPNPool 10.4.4.5 - 10.4.4.30
WebVPN
allow outside
AnyConnect essentials
SVC disk0:/anyconnect-dart-win-2.5.0217-k9.pkg 1 image
SVC disk0:/anyconnect-macosx-i386-2.5.2001-k9.pkg.zip 2 image
enable SVC
tunnel-group-list activate
internal RAVPN group policy
RAVPN group policy attributes
value no unauthorized access to banner
value of banner that all connections and controls are saved
banner of value this system is the property of MYCOMPANY
banner value disconnect IMMEDIATELY if you are not an authorized user.
value of server WINS 10.12.1.11 10.2.2.11
value of 10.12.1.11 DNS server 10.2.2.11
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list VPN_splitunnel
type tunnel-group RAVPN remote access
attributes global-tunnel-group RAVPN
address pool VPNPool
authentication-server-group NHCGRPAD
Group Policy - by default-RAVPN
tunnel-group RAVPN webvpn-attributes
enable RAVPN group-alias
Can someone ' a Please direct me as to what I'm doing wrong? I was assuming that since I don't have Ip 208.x.x.x address in the list of inside_nat0_outbound that it would be NAT had, but appears not to be the case (out of packet - trace below)
Packet-trace entry outside tcp 10.4.4.6 34567 208.x.x.x detailed https
*****************************************************************************
Phase: 1
Type:-ROUTE SEARCH
Subtype: entry
Result: ALLOW
Config:
Additional information:
in 0.0.0.0 0.0.0.0 outdoors
Phase: 2
Type: ACCESS-LIST
Subtype: Journal
Result: ALLOW
Config:
Access-group outside_access_in in interface outside
outside_access_in list extended access permitted ip VPN_ips 255.255.255.224 host 208.x.x.x Journal
Additional information:
Direct flow from returns search rule:
ID = 0xd7bd3b20, priority = 12, area = allowed, deny = false
Hits = 2, user_data is 0xd613bf80, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
SRC ip = VPN_ips, mask is 255.255.255.224, port = 0
IP = 208.x.x.x DST, mask = 255.255.255.255, port = 0, dscp = 0 x 0
Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xd7df8fa0, priority = 0, sector = inspect-ip-options, deny = true
hits = 2256686, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =
DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0
Phase: 4
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xd87c8fc8, priority = 12, area = ipsec-tunnel-flow, deny = true
hits = 550, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =
DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0
Phase: 5
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xd7dfbd28, priority = 0, domain = host-limit, deny = false
hits = 1194, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =
DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional information:
Reverse flow from returns search rule:
ID = 0xd7df8fa0, priority = 0, sector = inspect-ip-options, deny = true
hits = 2256688, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =
DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0
Phase: 7
Type: CREATING STREAMS
Subtype:
Result: ALLOW
Config:
Additional information:
New workflow created with the 2380213 id, package sent to the next module
Information module for forward flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Information for reverse flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input interface: outdoors
entry status: to the top
entry-line-status: to the top
output interface: outside
the status of the output: to the top
output-line-status: to the top
Action: allow
*****************************************************************************
Thank you
Jason
You are on the right track with you divided the tunnel configuration. You need to add is the pool of Client VPN to be coordinated to your external ip address, IE: same as your local users of the ASA when he tries to access the intellectual property of the provider (208.x.x.x), allowing more traffic in and out of the same interface for traffic of U-turn.
Here's what you need to set up:
permit same-security-traffic intra-interface
nat-to-vendor ip 10.4.4.0 access list permit 255.255.255.224 host 208.x.x.x
NAT (outside) 101-list of nat-to-vendor access
The foregoing will allow VPN pool to be coordinated to your ASA outside the ip address of the interface when accessing the seller (208.x.x.x).
1 small correction to your ACL split tunnel:
-The following line is incorrect and should be deleted in the tunnel of split ACL:
Access extensive list ip 10.4.4.0 VPN_splitunnel allow 255.255.255.224 all
(As 10.4.4.0/27 is your pool of Client VPN, you do not add these subnet to your list of split tunnel. List of Split tunnel are only the network that you are difficult to access and sent through your VPN tunnel).
Hope that helps.
-
"no nat-traversal crypto isakmp" after restart
Hello
With the version of the Software ASA 8.0, we noticed that whenever restart us tha device, the configuration line:
No encryption isakmp nat-traversal
appears in the configuration.
It is very annoying, because this NAT - T obviously does not work.
Any of you noticed that too?
Ideas?
Thank you very much.
Marco Pizzi.
Hi Marco,.
This is a bug in the version of the ASA 8.x software and there are workarounds:
CSCsj52581 Details of bug
No inconsistent configuration of nat-traversal isakmp crypto after reboot
Symptom:
After a restart of the ASA at the global order "no isakmp encryption".
NAT-traversal.
appears in the running-config even it is not available in the
startup-config.
Conditions:
None
Steps to reproduce:
BSNs-ASA5505-1 (config) # nat-traversal crypto isakmp
BSNs-ASA5505-1 (config) # copy run start
BSNs-ASA5505-1 (config) # sh run all | NAT Inc
Crypto isakmp nat-traversal 20
BSNs-ASA5505-1 (config) # sh start | NAT Inc
BSNs-ASA5505-1 (config) #.
After reloading of the ASA:
BSNs-asa5505-1 # sh run all | NAT Inc
No encryption isakmp nat-traversal
BSNs-asa5505-1 # sh start | NAT Inc
asa5505-BSNs-1 #.
Workaround solution:
(1) use a default value, for example, "crypto isakmp nat-traversal 21.
(2) to activate the "crypto isakmp nat-traversal" after the restart of the ASA if you
You can use the default value. The default value is: crypto isakmp
NAT-traversal 20
Radim
-
On ASA 5505 VPN cannot access remote (LAN)
I have an ASA 5505 upward and running, all static NAT statements I need to forward ports to the internal services such as smtp, desktop remotely and it works very well, however I have set up an IPSEC vpn connection that authenticates to our DC and part works. However, after I connect and cannot ping anything on the local network or access services. I don't know what a NAT statement I have corrected. Here is the config. I really need to get this up and going tomorrow. Thanks for any help.
Tyler
Just remove the line of nat (outside) and ACL outside_nat0_outbound.
And talk about these statements:
IPSec-1 sysopt connection permit... (If it is disabled, you can check with sh run sysopt).
2, crypto isakmp nat traversal 10 or 20
3 no NAT ACL, mention your local subnets as the source and vpn client as the destination.
4, create the other ACL (ST) with different name and source and destination like no nat ACL.
5, then type nat (inside) 0 access-list sheep
6, in the dwgavpn group policy, talk to splittunnel tunnelspecified and mention the tunnel split ACL (ST).
Concerning
-
ASA 5505 - remote access VPN to access various internal networks
Hi all
A customer has an ASA 5505 with a remote access vpn. They are moving their internal network to a new regime and that you would be the users who come on the vpn to access the existing and new networks. Currently can only access the existing. When users connect to access remote vpn, the asa gave them the address 192.168.199.x. The current internal network is 200.190.1.x and that they would reach their new network of 10.120.110.x.
Here is the config:
:
ASA Version 8.2 (5)
!
ciscoasa hostname
enable encrypted password xxx
XXX encrypted passwd
names of
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 200.190.1.15 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address 255.255.255.0 xxxxxxx
!
exec banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED
connection of the banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED
banner asdm the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED
passive FTP mode
access extensive list ip 200.190.1.0 inside_access_in allow 255.255.255.0 any
outside_access_in list extended access permit icmp any external interface
access extensive list ip 192.168.199.0 outside_access_in allow 255.255.255.192 host 10.120.110.0
Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 200.190.1.0 255.255.255.0
MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0
access extensive list ip 200.190.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192
inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
mask 192.168.199.10 - 192.168.199.50 255.255.255.0 IP local pool Remote_IPSEC_VPN_Pool
IP verify reverse path to the outside interface
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 200.190.1.0 255.255.255.0
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 190.213.43.1 1
Route inside 10.120.110.0 255.255.255.0 200.190.1.50 1
Route inside 192.168.50.0 255.255.255.0 200.190.1.56 1
Route inside 192.168.60.0 255.255.255.0 200.190.1.56 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
http server enable 10443
http server idle-timeout 5
Server of http session-timeout 30
HTTP 200.190.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
Crypto ca trustpoint _SmartCallHome_ServerCA
Configure CRL
Crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
(omitted)
quit smoking
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Crypto isakmp nat-traversal 3600
Telnet timeout 5
SSH 200.190.1.0 255.255.255.0 inside
SSH timeout 5
SSH version 2
Console timeout 5
dhcpd outside auto_config
!
a basic threat threat detection
scanning-threat shun threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
allow outside
internal MD_SSL_Gp_Pol group strategy
attributes of Group Policy MD_SSL_Gp_Pol
VPN-tunnel-Protocol webvpn
WebVPN
list of URLS no
disable the port forward
hidden actions no
disable file entry
exploration of the disable files
disable the input URL
internal MD_IPSEC_Tun_Gp group strategy
attributes of Group Policy MD_IPSEC_Tun_Gp
value of banner welcome to remote VPN
VPN - connections 1
VPN-idle-timeout 5
Protocol-tunnel-VPN IPSec webvpn
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list MD_IPSEC_Tun_Gp_splitTunnelAcl
the address value Remote_IPSEC_VPN_Pool pools
WebVPN
value of the RDP URL-list
attributes of username (omitted)
VPN-group-policy MD_IPSEC_Tun_Gp
type of remote access service
type tunnel-group MD_SSL_Profile remote access
attributes global-tunnel-group MD_SSL_Profile
Group Policy - by default-MD_SSL_Gp_Pol
type tunnel-group MD_IPSEC_Tun_Gp remote access
attributes global-tunnel-group MD_IPSEC_Tun_Gp
address pool Remote_IPSEC_VPN_Pool
Group Policy - by default-MD_IPSEC_Tun_Gp
IPSec-attributes tunnel-group MD_IPSEC_Tun_Gp
pre-shared key *.
!
!
context of prompt hostname
: end
The following ACL and NAT exemption ACL split tunnel is incorrect:
MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0
inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192
It should have been:
Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 10.120.110.0 255.255.255.0
access extensive list ip 10.120.110.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192
Then 'clear xlate' and reconnect with the VPN Client.
Hope that helps.
-
Cisco ASA 5505 Dual-ISP backup VPN
I am creating a tunnel of an ASA 5505 to a pix 501 backup in the case of the failure of main Internet service provider. The external face of Pix will remain the same, but not quite how I can create a new card encryption and it use backup ISP interface without down the main tunnel.
My first thought was to add the following encryption to the configuration below card:
card crypto outside_map 2 match address outside_1_cryptomap
peer set card crypto outside_map 2 9.3.21.13
card outside_map 2 game of transformation-ESP-DES-MD5 crypto
card crypto outside_map interface backupisp--> but that would break the current tunnel.NYASA # sh run
: Saved
:
ASA Version 7.2 (4)
!
NYASA hostname
domain girls.org
activate the encrypted password of CHwdJ2WMUcjxIIm8
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Vlan1
nameif inside
security-level 100
10.1.2.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP 9.17.5.8 255.255.255.240
!
interface Vlan3
Description backup ISP
nameif backupisp
security-level 0
IP 6.27.9.5 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
DNS server-group DefaultDNSoutside_access_in list extended access permit icmp any any echo response
outside_access_in list extended access permit icmp any any source-quench
outside_access_in list extended access allow all unreachable icmp
outside_access_in list extended access permit icmp any one time exceed
outside_access_in list extended access permit icmp any one
inside_nat0_outbound to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.1.0 255.255.255.0
inside_nat0_outbound to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.100.0 255.255.255.0
outside_1_cryptomap to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.1.0 255.255.255.0
outside_1_cryptomap to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.100.0 255.255.255.0
access-list extended 150 permit ip any host 10.1.2.27
access-list 150 extended allow host ip 10.1.2.27 all
pager lines 24
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
backupisp MTU 1500
no failover
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 524.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
interface of global (backupisp) 1
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 0.0.0.0 0.0.0.0
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 9.17.5.7 1 track 1
Route 0.0.0.0 backupisp 0.0.0.0 6.27.9.1 254
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
the ssh LOCAL console AAA authentication
Enable http server
http 10.1.2.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
ALS 10 monitor
type echo protocol ipIcmpEcho 4.2.2.2 outside interface
NUM-package of 3
timeout of 1000
frequency 3
Annex monitor SLA 10 life never start-time now
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
card crypto outside_map 1 match address outside_1_cryptomap
peer set card crypto outside_map 1 9.3.21.13
map outside_map 1 set of transformation-ESP-DES-MD5 crypto
outside_map interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
the Encryption
md5 hash
Group 2
life 86400
Crypto isakmp nat-traversal 20
!
track 1 rtr 10 accessibility
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 60
Console timeout 0
management-access insideptiadmin encrypted BtOLil2gR0VaUjfX privilege 15 password username
tunnel-group 9.4.21.13 type ipsec-l2l
IPSec-attributes tunnel-Group 9.4.21.13
pre-shared-key *.
!
!
context of prompt hostname
Cryptochecksum:22bb60b07c4c1805b89eb2376683f861
: end
NYASA #.Thanks in advance.
In this case is the PIX in need of two peers (to the ASA).
The ASA is it requires the card encryption to be applied to the interface of backup as well (as you mentioned)
card crypto outside_map interface backupisp--> but that would break the current tunnel.
The command above should not break the current tunnel (if the road to reach the other end goes out through the main interface).
In addition, you must IP SLA configured in the ASA to allow him to use the primary connection and aid for the connection of accumulation relief tunnel (both to reuse the primary interface when she recovers).
Federico.
-
ASA 5505 VPN cannot access inside hosts
I set up VPN on the using 5505 ASDM and I am able to connect to the 5505 and the customer is also getting an IP address from the configured pool.
The Cisco VPN client displays an error in the log: AddRoute cannot add a route: code 87
Cisco
You may need to nat traversal lit. Try to add crypto isakmp nat-traversal 3600
-
Cisco ASA 5505 VPN L2TP cannot access the internal network
Hello
I'm trying to configure Cisco VPN L2TP to my office. After a successful login, I can't access the internal network.
Can you jhelp me to find the problem?
I have Cisco ASA:
within the network - 192.168.1.0
VPN - 192.168.168.0 network
I have the router to 192.168.1.2 and I cannot ping or access this router.
Here is my config:
ASA Version 8.4 (3)
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP 198.X.X.A 255.255.255.248
!
passive FTP mode
permit same-security-traffic intra-interface
the net-all purpose network
subnet 0.0.0.0 0.0.0.0
network vpn_local object
192.168.168.0 subnet 255.255.255.0
network inside_nw object
subnet 192.168.1.0 255.255.255.0
outside_access_in list extended access permit icmp any any echo response
outside_access_in list extended access deny ip any any newspaper
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
IP local pool sales_addresses 192.168.168.1 - 192.168.168.254
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
NAT dynamic interface of net-all source (indoor, outdoor)
NAT (inside, outside) source inside_nw destination inside_nw static static vpn_local vpn_local
NAT (exterior, Interior) source vpn_local destination vpn_local static static inside_nw inside_nw-route search
!
network vpn_local object
dynamic NAT interface (outdoors, outdoor)
network inside_nw object
NAT dynamic interface (indoor, outdoor)
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 198.X.X.B 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
AAA authentication enable LOCAL console
the ssh LOCAL console AAA authentication
AAA authentication http LOCAL console
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
IKEv1 crypto ipsec transform-set my-transform-set-ikev1 esp-3des esp-sha-hmac
transport in transform-set my-transform-set-ikev1 ikev1 crypto ipsec mode
Crypto-map Dynamics dyno 10 set transform-set my-transformation-set-ikev1 ikev1
card crypto 20-isakmp ipsec vpn Dynamics dyno
vpn outside crypto map interface
Crypto isakmp nat-traversal 3600
Crypto ikev1 allow outside
IKEv1 crypto policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH 192.168.1.0 255.255.255.0 inside
SSH timeout 30
Console timeout 0
management-access inside
dhcpd address 192.168.1.5 - 192.168.1.132 inside
dhcpd dns 75.75.75.75 76.76.76.76 interface inside
dhcpd allow inside
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal sales_policy group policy
attributes of the strategy of group sales_policy
Server DNS 75.75.75.75 value 76.76.76.76
Protocol-tunnel-VPN l2tp ipsec
user name-
user name-
attributes global-tunnel-group DefaultRAGroup
address sales_addresses pool
Group Policy - by default-sales_policy
IPSec-attributes tunnel-group DefaultRAGroup
IKEv1 pre-shared-key *.
tunnel-group DefaultRAGroup ppp-attributes
ms-chap-v2 authentication
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
Cryptochecksum:5d1fc9409c87ecdc1e06f06980de6c13
: end
Thanks for your help.
You must test with 'real' traffic on 192.168.1.2 and if you use ping, you must add icmp-inspection:
Policy-map global_policy
class inspection_default
inspect the icmp
--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni -
Problem VPN ASA 5505 8.3 (1) a site
Hello
My problem is with VPN site-to-site. It's between ASA5505 8.3 (1) and Pix 501 6.3 (5). The tunnel is created between them and it's good, here you have the results to see the crypto ipsec's and isakmp his
ciscoasa # sh crypto isakmp his
ITS enabled: 1
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 1
1 peer IKE: 91.X.X.57
Type: L2L role: initiator
Generate a new key: no State: MM_ACTIVE
ciscoasa # sh crypto ipsec his
Interface: outside
Tag crypto map: outside_map, seq num: 1, local addr: 79.X.X.2
list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.11.0/255.255.255.0/0/0)
current_peer: 91.X.X.57
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 3757, #pkts decrypt: 3757, #pkts check: 3757
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0
local crypto endpt. : 79.X.X.2/0, remote Start crypto. : 91.X.X.57/0
Path mtu 1500, fresh ipsec generals 74, media, mtu 1500
current outbound SPI: F1C2FD46
current inbound SPI: 1BCF8C49
SAS of the esp on arrival:
SPI: 0x1BCF8C49 (466586697)
transform: aes-256-esp esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 376832, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (4373665/20348)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0xF1C2FD46 (4056087878)
transform: aes-256-esp esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 376832, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (4374000/20348)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
But the problem is, as you can see in a show crypto ipsec sa, there is now traffic to a remote network of ASA
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
I have a single device on the remote network sends data to a sysloger on the local network and it works fine, all received messages but not other way to traffic.
To make sure that I go see the Nat and packet - trace entry inside tcp 192.168.10.7 1024 192.168.11.250 80 and looks like SHEEP works very well and traffic is allowed, but still once anything gets into the tunnel of local network
Results
ciscoasa # sh nat
Manual NAT policies (Section 1)
1 (one) to (all) source static sheep sheep sheep destination static sheep
translate_hits = 0, untranslate_hits = 38770
2 (inside) for the service public static obj - the source (on the outside) TCP1433 TCP1433 79.X.X.5 192.168.10.7
translate_hits = 0, untranslate_hits = 95
3 (inside) to the source (external) static obj - 192.168.10.7 interface service zzz zzz
translate_hits = 0, untranslate_hits = 19
4 (inside) of the (whole) source static obj - 10.0.0.0 obj - 10.0.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0
translate_hits = 17, untranslate_hits = 0
5 (inside) of the (whole) source static obj - obj - static 192.168.10.0 192.168.10.0 obj - obj-destination 10.1.1.1 10.1.1.1
translate_hits = 134, untranslate_hits = 0
6 (inside) to the (whole) source static obj - 10.1.1.1 obj - 10.1.1.1 destination static obj - 192.168.10.0 obj - 192.168.10.0
translate_hits = 0, untranslate_hits = 0
7 (inside) of the (whole) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0
translate_hits = 172, untranslate_hits = 53
Auto NAT policies (Section 2)
1 (inside) (outside) source static obj - 192.168.10.3 service TCP 3389 3389 79.X.X.5
translate_hits = 12, untranslate_hits = 4823
2 (inside) (outside) source static obj - 192.168.10.5 79.X.X.3 DNS
translate_hits = 341869, untranslate_hits = 41531
3 (inside) (outside) source static obj - 192.168.10.3 - 01 79.X.X.5 service TCP 444 444
translate_hits = 0, untranslate_hits = 0
4 (inside) to the source (external) static obj - 192.168.10.7 tcp 3389 3389 service interface
translate_hits = 21, untranslate_hits = 751
5 (inside) (outside) source static obj - 192.168.10.7 - 02 interface tcp 8080 https service
translate_hits = 0, untranslate_hits = 100
6 (inside) (outside) source static obj - 192.168.10.11 79.X.X.5 TCP smtp smtp service
translate_hits = 2, untranslate_hits = 18838
7 (inside) (outside) source static obj - 192.168.10.11 - 01 udp 443 443 service 79.X.X.5
translate_hits = 0, untranslate_hits = 0
8 (inside) (outside) source static obj - 192.168.10.11 - 02 79.X.X.5 tcp https https service
translate_hits = 221, untranslate_hits = 9770
9 (inside) (outside) source static obj - 192.168.10.11 - 03 79.X.X.5 tcp https https service
translate_hits = 0, untranslate_hits = 0
10 (inside) (outside) source static obj - 192.168.10.15 79.X.X.5 service tcp www 81
translate_hits = 0, untranslate_hits = 34
11 (inside) (outside) source static obj - 192.168.10.26 79.X.X.5 service TCP 8080 8080
translate_hits = 9, untranslate_hits = 4407
12 (inside) (outside) source static obj - 192.168.10.26 - 01 79.X.X.5 tcp 8080 www service
translate_hits = 0, untranslate_hits = 578
13 (inside) (outside) source static obj - 192.168.10.220 79.X.X.6 service TCP 3389 3389
translate_hits = 0, untranslate_hits = 41
14 (inside) (outside) source static obj - 192.168.10.220 - 1 79.X.X.6 tcp https https service
translate_hits = 0, untranslate_hits = 3
15 (inside) to the obj_any interface dynamic source (external)
translate_hits = 410005, untranslate_hits = 144489
16 (invited) to dynamic interface of the source (outside) obj_any-01
translate_hits = 19712, untranslate_hits = 4490
ciscoasa # packet - trace entry inside tcp 192.168.10.7 1024 192.168.11.250 80
Phase: 1
Type: UN - NAT
Subtype: static
Result: ALLOW
Config:
NAT (any, any) source static sheep sheep sheep destination static sheep
Additional information:
NAT divert on exit to the outside interface
Untranslate 192.168.11.250/80 to 192.168.11.250/80
Phase: 2
Type: ACCESS-LIST
Subtype: Journal
Result: ALLOW
Config:
Access-group inside_out in interface inside
access-list extended inside_out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
Additional information:
Direct flow from returns search rule:
ID = 0xd9886ae8, priority = 13, area = allowed, deny = false
hits = 18503, user_data = 0xd6581290, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0
input_ifc = output_ifc = any to inside,
Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xd80c87c8, priority = 0, sector = inspect-ip-options, deny = true
hits = 1047092, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0
input_ifc = output_ifc = any to inside,
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
NAT (any, any) source static sheep sheep sheep destination static sheep
Additional information:
Direct flow from returns search rule:
ID = 0xd9859830, priority = 6, area = nat, deny = false
hits = 2107, user_data = 0xd83a9b48, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0
input_ifc = none, output_ifc = any
Phase: 5
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xd8114d98, priority = 0, domain = host-limit, deny = false
hits = 674350, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0
input_ifc = output_ifc = any to inside,
Phase: 6
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xd83a9960, priority = 70, domain = encrypt, deny = false
hits = 26732, user_data = 0xce165c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0
input_ifc = none, output_ifc = external
Phase: 7
Type: NAT
Subtype: rpf check
Result: ALLOW
Config:
NAT (any, any) source static sheep sheep sheep destination static sheep
Additional information:
Direct flow from returns search rule:
ID = 0xd98d1d70, priority = 6, area = nat-reversed, deny = false
hits = 1419, user_data = 0xd83a9b48, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0
input_ifc = none, output_ifc = any
Phase: 8
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional information:
Reverse flow from returns search rule:
ID = 0xd9bda388, priority = 69 = ipsec-tunnel-flow area, deny = false
hits = 486, user_data is 0x13492cc, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.11.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.10.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0
input_ifc = out, output_ifc = any
Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional information:
Reverse flow from returns search rule:
ID = 0xd8192ab0, priority = 0, sector = inspect-ip-options, deny = true
hits = 1169899, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0
input_ifc = out, output_ifc = any
Phase: 10
Type: CREATING STREAMS
Subtype:
Result: ALLOW
Config:
Additional information:
New workflow created with the 1293619 id, package sent to the next module
Information module for forward flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat
Information for reverse flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_ipsec_tunnel_flow
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input interface: inside
entry status: to the top
entry-line-status: to the top
output interface: outside
the status of the output: to the top
output-line-status: to the top
Action: allow
It is a complete config for ASA
VPN
Network local 192.168.10.0/24
remote network 192.168.11.0/24
Config
:
ASA Version 8.3 (1)
!
ciscoasa hostname
domain.com domain name
activate the password * encrypted
passwd * encrypted
names of
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.10.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP 79.X.X.2 255.255.255.248
!
interface Vlan12
prior to interface Vlan1
nameif comments
security-level 80
192.168.4.1 IP address 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
switchport access vlan 2
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 12
!
boot system Disk0: / asa831 - k8.bin
passive FTP mode
clock timezone GMT/UTC 0
summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00
DNS domain-lookup outside
DNS server-group DefaultDNS
Server name 192.168.10.11
domain.com domain name
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
network object obj - 192.168.0.0
Subnet 192.168.0.0 255.255.0.0
network object obj - 192.168.2.0
Subnet 192.168.2.0 255.255.255.128
network object obj - 10.0.0.0
subnet 10.0.0.0 255.0.0.0
network object obj - 192.168.10.2
host 192.168.10.2
network object obj - 192.168.10.2 - 01
host 192.168.10.2
network object obj - 192.168.10.3
host 192.168.10.3
network object obj - 192.168.10.2 - 02
host 192.168.10.2
network object obj - 192.168.10.2 - 03
host 192.168.10.2
network object obj - 192.168.10.3 - 01
Home 192.168.10.7
network object obj - 192.168.10.5
host 192.168.10.5
newserver network object
Home 192.168.10.7
New SQL Server description
network object obj - 192.168.10.7
Home 192.168.10.7
network of the A_79.X.X.6 object
Home 79.X.X.6
network of the PublicServer_NAT1 object
Home 192.168.10.7
zzz service object
service source eq 1 65535 udp syslog destination range
Syslog description
purpose of the 79.X.X.5 network
Home 79.X.X.5
service of the TCP1433 object
destination service tcp source eq 1433 1 65535 range
Description TCP1433
network object obj - 192.168.10.220
Home 192.168.10.220
network object obj - 192.168.10.220 - 1
Home 192.168.10.220
network object obj - 192.168.10.222
Home 192.168.10.222
network object obj - 192.168.10.2 - 04
host 192.168.10.2
network object obj - 192.168.10.7 - 02
Home 192.168.10.7
network object obj - 192.168.10.11
Home 192.168.10.11
network object obj - 192.168.10.11 - 01
Home 192.168.10.11
network object obj - 192.168.10.11 - 02
Home 192.168.10.11
network object obj - 192.168.10.11 - 03
Home 192.168.10.11
network object obj - 192.168.10.26
Home 192.168.10.26
network object obj - 192.168.10.26 - 01
Home 192.168.10.26
network object obj - 192.168.10.15
Home 192.168.10.15
network object obj - 192.168.10.11 - 04
Home 192.168.10.11
network object obj - 10.1.1.1
host 10.1.1.1
network object obj - 192.168.10.0
192.168.10.0 subnet 255.255.255.0
network object obj - 192.168.10.220 - 2
Home 192.168.10.220
network vpn-local object
192.168.10.0 subnet 255.255.255.0
object network vpn - ru
subnet 192.168.11.0 255.255.255.0
network obj_any object
subnet 0.0.0.0 0.0.0.0
network obj_any-01 object
subnet 0.0.0.0 0.0.0.0
object-group service syslog udp
Service Description syslog group
port-object eq syslog
object-group service udp zzzz
port-object eq syslog
object-group service sss udp
port-object eq syslog
object-group network sheep
object-network 192.168.10.0 255.255.255.0
object-network 192.168.11.0 255.255.255.0
object-network 192.168.3.0 255.255.255.0
outside_all of access allowed any ip an extended list
VPN_splitTunnelAcl list standard access allowed 192.168.0.0 255.255.0.0
VPN_splitTunnelAcl list standard access allowed 10.0.0.0 255.0.0.0
permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.2.0 255.255.255.128
inside_nat0_outbound to access ip 10.0.0.0 scope list allow 255.0.0.0 192.168.2.0 255.255.255.128
access-list extended inside_out allow ip 192.168.11.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list extended inside_out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
scope of the inside_out to the list of permitted any one ip access
inside_out to the access list extended 192.168.11.0 allowed any ip 255.255.255.0
inside_out to the list of access permit tcp host 192.168.10.2 any eq smtp
inside_out to the list of access permit tcp any any eq smtp
access-list extended inside_out allow udp 192.168.10.0 255.255.255.0 host 10.1.1.1
access-list extended inside_out permit udp host 10.1.1.1 192.168.10.0 255.255.255.0
inside_out to the list of allowed extensive access icmp host 192.168.10.7 all
inside_out to the list of allowed extensive access a whole icmp
outside_zzz list of allowed ip extended access any external interface
outside_zzz list extended access permit tcp host 87.X.X.73 host 79.X.X.5 eq 1433
outside_zzz tcp extended access list refuse any host 79.X.X.5 eq 1433
outside_zzz list extended access permitted tcp 207.126.144.0 255.255.240.0 eq 79.X.X.5 the smtp host
outside_zzz tcp extended access list refuse any host 79.X.X.5 eq smtp
outside_zzz access-list extended permit ip any host 79.X.X.5
outside_zzz of access allowed any ip an extended list
permit access list extended ip 192.168.10.0 outside_in 255.255.255.0 192.168.11.0 255.255.255.0
access extensive list ip 192.168.11.0 outside_in allow 255.255.255.0 192.168.10.0 255.255.255.0
access extensive list ip 192.168.11.0 outside_in allow 255.255.255.0 any
outside_in list extended access permit tcp any host 192.168.10.15 eq 81
outside_in list extended access permit ip any host 192.168.10.5
access-list outside_in extended permit ip any host 79.X.X.4
outside_in list extended access permit tcp host 82.X.X.166 host 192.168.10.7 eq 1433
outside_in list extended access permit tcp host 84.X.X.30 host 192.168.10.7 eq 1433
outside_in list extended access tcp refuse any host 192.168.10.7 eq 1433
outside_in list extended access permit tcp any host 192.168.10.3 eq 444
outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 host 192.168.10.11 eq 444
outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 eq smtp host 192.168.10.11
outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 host 192.168.10.2 eq smtp
outside_in list extended access tcp refuse any host 192.168.10.11 eq smtp
outside_in list extended access tcp refuse any host 192.168.10.2 eq smtp
outside_in list extended access permit tcp any host 192.168.10.2 eq smtp
outside_in list extended access permit udp any host 192.168.10.2 eq 443
outside_in list extended access permit tcp any host 192.168.10.3 eq 3389
outside_in list extended access permit tcp any host 192.168.10.2 eq 4125
outside_in list extended access permit tcp any host 192.168.10.11 eq https
outside_in list extended access permit tcp any host 192.168.10.2 eq https
outside_in list extended access allowed esp all the host 91.X.X.57
outside_in list extended access permit tcp any host 192.168.10.3 eq 1433
access-list extended outside_in permit ip host 91.X.X.57 all
access-list outside_in extended permit ip any host 79.X.X.5
access-list outside_in extended permit ip any host 79.X.X.2
outside_in list extended access permit tcp any host 79.X.X.6 eq 3389
outside_in list extended access permit tcp any host 192.168.10.220 eq 3389
outside_in list extended access permit tcp any host 79.X.X.5 eq 81
access extensive list permits all ip a outside_in
outside_in list extended access permit tcp host 91.X.X.178 host 192.168.10.7 eq 1433
outside_in list extended access permit tcp host 87.X.X.73 host 192.168.10.7 eq 1433
access-list extended qnap permit ip host 192.168.10.26 all
access-list extended qnap permit ip any host 192.168.10.26
phone_bypass list extended access allowed host 10.1.1.1 ip 192.168.10.0 255.255.255.0
permit phone_bypass to access extended list ip 192.168.10.0 255.255.255.0 host 10.1.1.1
phone_bypass list extended access allowed host 10.1.1.1 ip 192.168.2.0 255.255.255.0
phone_bypass to access extended list ip 192.168.2.0 allow 255.255.255.0 host 10.1.1.1
list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
extended vpn 192.168.11.0 ip access list allow 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
Enable logging
exploitation forest-size of the buffer 1024000
logging asdm-buffer-size 512
logging buffered information
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
Comments of MTU 1500
mask of local pool RemoteVPN 192.168.2.20 - 192.168.2.100 IP 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM image disk0: / asdm - 631.bin
enable ASDM history
ARP timeout 14400
NAT (any, any) source static sheep sheep sheep destination static sheep
NAT source service (Interior, exterior) static obj - 192.168.10.7 79.X.X.5 TCP1433 TCP1433
NAT (inside, outside) source static obj - 192.168.10.7 interface service zzz zzz
NAT (inside, all) source static obj - 10.0.0.0 obj - 10.0.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0
NAT (inside, all) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 10.1.1.1 obj - 10.1.1.1
NAT (inside, all) source static obj - 10.1.1.1 obj - 10.1.1.1 destination static obj - 192.168.10.0 obj - 192.168.10.0
NAT (inside, all) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0
!
network object obj - 192.168.10.3
NAT (inside, outside) static service tcp 3389 3389 79.X.X.5
network object obj - 192.168.10.3 - 01
NAT (inside, outside) static 79.X.X.5 tcp 444 444 service
network object obj - 192.168.10.5
NAT (inside, outside) public static dns 79.X.X.3
network object obj - 192.168.10.7
NAT (inside, outside) interface static service tcp 3389 3389
network object obj - 192.168.10.220
NAT (inside, outside) static service tcp 3389 3389 79.X.X.6
network object obj - 192.168.10.220 - 1
NAT (inside, outside) static 79.X.X.6 tcp https https service
network object obj - 192.168.10.7 - 02
NAT (inside, outside) interface static tcp 8080 https service
network object obj - 192.168.10.11
NAT (inside, outside) static 79.X.X.5 tcp smtp smtp service
network object obj - 192.168.10.11 - 01
NAT (inside, outside) udp 443 443 service 79.X.X.5 static
network object obj - 192.168.10.11 - 02
NAT (inside, outside) static 79.X.X.5 tcp https https service
network object obj - 192.168.10.11 - 03
NAT (inside, outside) static 79.X.X.5 tcp https https service
network object obj - 192.168.10.26
NAT (inside, outside) static 79.X.X.5 8080 8080 tcp service
network object obj - 192.168.10.26 - 01
NAT (inside, outside) static 79.X.X.5 tcp 8080 www service
network object obj - 192.168.10.15
NAT (inside, outside) static 79.X.X.5 tcp 81 www service
network obj_any object
NAT dynamic interface (indoor, outdoor)
network obj_any-01 object
NAT dynamic interface (guest, outdoor)
Access-group inside_out in interface inside
Access-group outside_in in external interface
Route outside 0.0.0.0 0.0.0.0 79.X.X.1 1
Route inside 10.0.0.0 255.0.0.0 192.168.10.4 1
Route outside 10.1.1.1 255.255.255.255 192.168.10.4 1
Route outside 192.168.11.0 255.255.255.0 79.X.X.2 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
RADIUS Protocol RADIUS AAA server
reactivation impoverishment deadtime mode 1
AAA-server RADIUS (inside) host 192.168.10.7
key *.
AAA authentication http LOCAL console
the ssh LOCAL console AAA authentication
LOCAL AAA authorization command
http server enable 444
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outdoors
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
No vpn sysopt connection permit
Service resetoutside
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-AES-SHA 256 - aes - esp esp-md5-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic outside_dyn_map pfs set 20 Group1
Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA
card crypto outside_map 1 match for vpn
outside_map game 1 card crypto peer 91.X.X.57
card crypto outside_map 1 set of transformation-ESP-AES-SHA
outside_map map 1 lifetime of security association set seconds 28800 crypto
card crypto outside_map 1 set security-association life kilobytes 4608000
map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
outside_map interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
lifetime 28800
Crypto isakmp nat-traversal 3600
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 inside
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 30
Console timeout 0
dhcpd dns 83.X.X.8 83.X.X.10
dhcpd outside auto_config
!
dhcpd address 192.168.10.50 - 192.168.10.100 inside
dhcpd dns 83.X.X.8 83.X.X.10 interface inside
dhcpd lease interface 600 inside
dhcpd interface to domain.com domain inside
!
Reviews of dhcpd address 192.168.4.50 - 192.168.4.100
Dhcpd lease 600 interface comments
Comments enable dhcpd
!
priority queue inside
priority-queue outdoors
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP 93.170.32.1 Server
NTP 93.170.32.2 Server
NTP 89.145.68.17 Server prefer
WebVPN
allow outside
SVC image disk0:/anyconnect-win-2.4.1012-k9.pkg 1 regex 'Windows NT'
SVC image disk0:/anyconnect-wince-ARMv4I-2.4.1012-k9.pkg 2 regex "Windows CE"
enable SVC
Auto-signon allow ip 192.168.0.0 255.255.0.0 basic auth-type
internal l2l group policy
attributes of the l2l group policy
VPN-idle-timeout no
Protocol-tunnel-VPN IPSec
attributes of Group Policy DfltGrpPolicy
value of server DNS 192.168.10.11
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list VPN_splitTunnelAcl
value by default-field DOMAINl.local
internal VPNv group strategy
attributes of Group Policy VPNv
value of server DNS 192.168.10.11
Protocol-tunnel-VPN IPSec webvpn
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list VPN_splitTunnelAcl
field default value domain.com
password username test * encrypted privilege 0
username test attributes
VPN-group-policy VPNv
ID password cisco * encrypted
roger password username * encrypted privilege 15
attributes global-tunnel-group DefaultRAGroup
address pool RemoteVPN
attributes global-tunnel-group DefaultWEBVPNGroup
address pool RemoteVPN
Group-LOCAL RADIUS authentication server
type tunnel-group VPNv remote access
attributes global-tunnel-group VPNv
address pool RemoteVPN
Group-LOCAL RADIUS authentication server
Group Policy - by default-VPNv
IPSec-attributes tunnel-group VPNv
pre-shared key *.
tunnel-group testgroup type remote access
tunnel-group testgroup General attributes
management of the password password-expire-to-days 90
tunnel-group 91.X.X.57 type ipsec-l2l
IPSec-attributes tunnel-group 91.X.X.57
pre-shared key *.
!
Global class-card class
match default-inspection-traffic
class-map qnap_band
corresponds to the list of access qnap
The class-card phone
corresponds to the phone_bypass access list
!
!
Policy-map global_policy
Global category
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Policy-map qnap_access
class qnap_band
512000 64000 police entry
512000 64000 release of police
phone class
set the advanced options of the tcp-State-bypass connection
World-Policy policy-map
Global category
inspect the dns
inspect the ftp
inspect the pptp
inspect the rtsp
inspect the sip
inspect the skinny
Policy-map phone_bypass_policy
phone class
set the advanced options of the tcp-State-bypass connection
!
service-policy-international policy global
service-policy qnap_access to the inside interface
privilege level 3 mode exec cmd command perfmon
privilege level 3 mode exec cmd ping command
mode privileged exec command cmd level 3
logging of the privilege level 3 mode exec cmd commands
privilege level 3 exec command failover mode cmd
privilege level 3 mode exec command packet cmd - draw
privilege level 5 see fashion exec running-config command
order of privilege show level 3 exec mode reload
privilege level 3 exec mode control fashion show
privilege see the level 3 exec firewall command mode
privilege see the level 3 exec mode command ASP.
processor mode privileged exec command to see the level 3
privilege command shell see the level 3 exec mode
privilege show level 3 exec command clock mode
privilege exec mode level 3 dns-hosts command show
privilege see the level 3 exec command access-list mode
logging of orders privilege see the level 3 exec mode
privilege, level 3 see the exec command mode vlan
privilege show level 3 exec command ip mode
privilege, level 3 see fashion exec command ipv6
privilege, level 3 see the exec command failover mode
privilege, level 3 see fashion exec command asdm
exec mode privilege see the level 3 command arp
command routing privilege see the level 3 exec mode
privilege, level 3 see fashion exec command ospf
privilege, level 3 see the exec command in aaa-server mode
AAA mode privileged exec command to see the level 3
privilege see the level 3 exec mode command crypto
privilege, level 3 see fashion exec command vpn-sessiondb
privilege level 3 exec mode command ssh show
privilege, level 3 see fashion exec command dhcpd
privilege, level 3 see the vpnclient command exec mode
privilege, level 3 see fashion exec command vpn
privilege level see the 3 blocks from exec mode command
privilege, level 3 see fashion exec command wccp
privilege, level 3 see the exec command in webvpn mode
privilege control module see the level 3 exec mode
privilege, level 3 see fashion exec command uauth
privilege see the level 3 exec command compression mode
level 3 for the show privilege mode configure the command interface
level 3 for the show privilege mode set clock command
level 3 for the show privilege mode configure the access-list command
level 3 for the show privilege mode set up the registration of the order
level 3 for the show privilege mode configure ip command
level 3 for the show privilege mode configure command failover
level 5 mode see the privilege set up command asdm
level 3 for the show privilege mode configure arp command
level 3 for the show privilege mode configure the command routing
level 3 for the show privilege mode configure aaa-order server
level mode 3 privilege see the command configure aaa
level 3 for the show privilege mode configure command crypto
level 3 for the show privilege mode configure ssh command
level 3 for the show privilege mode configure command dhcpd
level 5 mode see the privilege set privilege to command
privilege level clear 3 mode exec command dns host
logging of the privilege clear level 3 exec mode commands
clear level 3 arp command mode privileged exec
AAA-server of privilege clear level 3 exec mode command
privilege clear level 3 exec mode command crypto
level 3 for the privilege cmd mode configure command failover
clear level 3 privilege mode set the logging of command
privilege mode clear level 3 Configure arp command
clear level 3 privilege mode configure command crypto
clear level 3 privilege mode configure aaa-order server
context of prompt hostname
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
Thanks in advance for any help.
Wojciech salvation,
Based on this info, I think that you can run in CSCtb53186, this bug has affected many versions before 8.3 and when fixed DEVs they were always be some details in waiting, and they created CSCtd36473 to these outstanding issues. CSCtd36473 is fixed on 8.3.1.1 intermediate version however is not fixed on 8.3.1 so I suggest you spend at least 8.3.2
Read this:
Interface: outside
Tag crypto map: outside_map, seq num: 1, local addr: 79.X.X.2list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.11.0/255.255.255.0/0/0)
current_peer: 91.Y.Y.57#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 502, #pkts decrypt: 502, #pkts check: 502
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0outgoing esp sas:
SPI: 0xDE50E6EA (3729843946)
transform: aes-256-esp esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 425984, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (4374000/28234)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
VPN CTX = 0x015F913C
By peer IP = 192.168.11.0
Pointer = 0xD98CACD0
State = upwards
Flags = BA + ESP
ITS = 0X019235E7
SPI = 0xDE50E6EA
Group = 0
Pkts = 0
Pkts bad = 0
Incorrect SPI = 0
Parody = 0
Bad crypto = 0
Redial Pkt = 0
Call redial = 0
VPN = filterhits = 0, user_data is0x15f913c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0hits = 44437, user_data is0xce165c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0As you can see above we are a different context to encrypt the traffic (not used with the spi of the sh cry ipsec his)
If you do the same packet tracer, but this time with the details of the key words at the end probs you will get to see that we use 0xce165c.
Just looked at your configuration again and before you do the upgrade please correct this:
list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
extended vpn 192.168.11.0 ip access list allow 255.255.255.0 192.168.10.0 255.255.255.0
Just remove the second line:
no -access extended vpn ip 192.168.11.0 list allow 255.255.255.0 192.168.10.0 255.255.255.0
Also:
No outside_map interface card crypto outside
and then:
outside_map interface card crypto outside
See if that helps before perforrming upgrade,
Kind regards.
-
connect Cisco VPN client v5 to asa 5505
I have remote vpn configuration issues between ASA5505 and Cisco VPN client v5. Successfully, I can establish a connection between the client Vpn and ASA and receive the IP address of the ASA. Statistical customer VPN windows shows that packets are sent and encrypted but none of the packages is received/decrypted.
Cannot ping asa 5505
Any ideas on what I missed?
Try adding...
ISAKMP nat-traversal crypto
In addition, you cannot ping the inside interface of the ASA vpn without this command...
management-access inside
Please evaluate the useful messages.
-
Client VPN Cisco ASA 5505 Cisco 1841 router
Hello. I'm doing a connection during a cisco vpn client and a vpn on one server asa 5505 behind a 1841 router (internet adsl2 + and NAT router).
My topology is almost as follows
customer - tunnel - 1841 - ASA - PC
ASA is the endpoint vpn (outside interface) device. I forward udp port 500 and 4500 on my router to the ASA and the tunnel rises. I exempt nat'ting on the asa and the router to the IP in dhcp vpn pool. I can connect to my tunnel but I can't "see" anything in the internal network. I allowed all traffic from the outside inwards buy from the ip vpn pool and I still send packets through the tunnel and I get nothing. I take a look at the statistics on the vpn client and I 2597 bytes (ping traffic) and there are no bytes. Any idea?
Where you you logged in when you took the "crypto ipsec to show his"? If this isn't the case then try again, also this option allows IPSEC over UDP 4500 and it is disabled, enable it.
ISAKMP nat-traversal crypto
Just enter the command as it is, then try to connect again after activation of this option and get the same result to see the.
-
Site to Site VPN between Cisco ASA 5505 and Sonicwall TZ170
I'm trying to implement a VPN site-to site between our data center and office. The data center has a Cisco ASA 5505 and the Office has a Sonicwall TZ170. I managed to configure the two so that the vpn connects. Each of the firewall I ping the IP Address of the internet firewall on the other side and a desktop computer I can ping the IP Address of the firewall internal datacenter but I can't carry traffic between private subnets datacenter and desktop. Can anyone help?
The config below has had IPs/passwords has changed.
External Datacenter: 1.1.1.4
External office: 1.1.1.1
Internal data center: 10.5.0.1/24
Internal office: 10.10.0.1/24
: Saved
:
ASA Version 8.2 (1)
!
hostname datacenterfirewall
mydomain.tld domain name
activate thepassword encrypted
passwdencrypted
names of
name 10.10.0.0 OfficeNetwork
10.5.0.0 DatacenterNetwork name
!
interface Vlan1
nameif inside
security-level 100
10.5.0.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
1.1.1.4 IP address 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS server-group DefaultDNS
buydomains.com domain name
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
inside_access_in list extended access permit icmp any one
inside_access_in list extended access permitted tcp a whole
inside_access_in list extended access udp allowed a whole
inside_access_in of access allowed any ip an extended list
outside_access_in list extended access permit icmp any one
outside_access_in list extended access udp allowed any any eq isakmp
IP DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0
IP OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0
outside_cryptomap_66.1 list of allowed ip extended access all OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 ip OfficeNetwork 255.255.255.0 allowed extended access list all
outside_cryptomap_66.1 list extended access permit icmp any OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 list extended access allowed icmp OfficeNetwork 255.255.255.0 everything
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
IP verify reverse path to the outside interface
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 623.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route inside 0.0.0.0 0.0.0.0 1.1.1.1 1
Route OfficeNetwork 255.255.255.0 outside 1.1.1.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 10.5.0.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-aes-256 walthamoffice, esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto dynamic-map ciscopix 1 corresponds to the address outside_cryptomap_66.1
Crypto dynamic-map ciscopix 1 transform-set walthamoffice
Crypto dynamic-map ciscopix 1 the value reverse-road
map dynmaptosw 66-isakmp ipsec crypto dynamic ciscopix
dynmaptosw interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 13
preshared authentication
aes-256 encryption
sha hash
Group 2
lifetime 28800
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 10.5.0.0 255.255.255.0 inside
Telnet timeout 5
SSH 10.5.0.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
management-access inside
dhcpd address 10.5.0.2 - 10.5.0.254 inside
dhcpd allow inside
!a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 66.250.45.2 source outdoors
NTP server 72.18.205.157 source outdoors
NTP server 208.53.158.34 source outdoors
WebVPN
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
username admin passwordencrypted
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key *.
!
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
!
context of prompt hostname
Cryptochecksum:7f319172e5de9c0e550804a263f8e49e
: endMattew, obvious lack of education is the rule exempt from nat for your tunnel, your access list pixtosw is similar on this example, I assume that you have gone through this link, if it does not see the configs on both sides.
Add the statement of rule sheep in asa and try again.
NAT (inside) 0-list of access pixtosw
Concerning
-
ASA 5505 VPN Client Ipsec config problems
I configured the asa the wizard to Setup vpn, but this still does not work properly. Vpn connect without problem, but I can't access all the resources on the 192.168.1.x subnet. Don't know what I'm missing here, here's a copy of my config.
ASA Version 8.0 (3)
!
host name
domain name
activate the password
names of
!
interface Vlan1
nameif inside
security-level 100
192.168.1.3 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
"Public ip" 255.255.255.0 IP address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd
passive FTP mode
DNS lookup field inside
DNS domain-lookup outside
DNS server-group DefaultDNS
Server name 192.168.1.28
domain fmrs.org
GroupVpn_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
vpngroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
outside_access_in list extended access permit tcp any any eq pptp
outside_access_in list extended access will permit a full
inside_nat0_outbound list of allowed ip extended access all 192.168.99.0 255.255.255.0
inside_nat0_outbound list of allowed ip extended access entire 192.168.1.0 255.255.255.0
inside_access_in to access ip 192.168.1.0 scope list allow 255.255.255.0 any
access extensive list ip 192.168.99.0 inside_access_in allow 255.255.255.0 any
inside_access_in list of allowed ip extended access all 192.168.99.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
mask 192.168.99.2 - 192.168.99.100 255.255.255.0 IP local pool GroupPool
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM image disk0: / asdm - 602.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 192.168.1.0 255.255.255.0
public static tcp (indoor, outdoor) interface 192.168.1.62 pptp pptp netmask 255.255.255.255
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 66.76.199.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout, uauth 0:05:00 absolute
dynamic-access-policy-registration DfltAccessPolicy
RADIUS protocol AAA-server fmrsdc
fmrsdc AAA-server 192.168.1.28
Timeout 5
fmrsasa key
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
crypto ISAKMP allow inside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
No vpn-addr-assign aaa
No dhcp vpn-addr-assign
Console timeout 0
dhcpd outside auto_config
!a basic threat threat detection
Statistics-list of access threat detection
GroupVpn internal group policy
GroupVpn group policy attributes
value of server WINS 192.168.1.28
value of server DNS 192.168.1.28
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list GroupVpn_splitTunnelAcl
FMRs.org value by default-field
ID password cisco
tunnel-group GroupVpn type remote access
attributes global-tunnel-group GroupVpn
address pool GroupPool
authentication-server-group fmrsdc
Group Policy - by default-GroupVpn
IPSec-attributes tunnel-group GroupVpn
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
inspect the pptp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:b5df903e690566360b38735b6d79e65e
: endPlease configure the following:
ISAKMP nat-traversal crypto
management-access inside
You should be able to ping of the SAA within the IP 192.168.1.3
-
I have a RV042 VPN router inside an ASA 5505 running version 7.2. I am trying to connect from the outside to the RV042. I have read for 2 days now and tried everything I found and had no success. I can connect from the network for the RV042 inside so I don't know which is configured correctly. I found links on several posts to the official Cisco support documents, but they have no meaning to me. It is my first experience with a Cisco Firewall.
We also have a network of security cameras which we can access outside and I managed to set up the port forwarding for that.
Here is my current setup running. Inside the RV042 ip address is 192.168.168.25. I had passed, GRE has opened, the port 1723 and have Setup PPTP inspection. I removed port forwarding at this time.
Can anyone help?
Thank you
Todd
Output from the command: 'show running-config '.
: Saved
:
ASA Version 7.2 (3)
!
suite host name
domain hivermont.com
activate vwiH3D2KQdqR57As encrypted password
names of
!
interface Vlan1
nameif inside
security-level 100
192.168.168.1 IP address 255.255.255.0
OSPF cost 10
!
interface Vlan2
nameif outside
security-level 0
IP 75.144.147.155 255.255.255.248
OSPF cost 10
!
interface Vlan3
Description reviews network
prior to interface Vlan1
nameif guestlan
security-level 50
IP 192.168.2.1 255.255.255.0
OSPF cost 10
!
interface Vlan13
network of Aloha description
nameif aloha
security-level 75
IP 192.168.1.1 255.255.255.0
OSPF cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
switchport access vlan 13
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
vwiH3D2KQdqR57As encrypted passwd
passive FTP mode
DNS server-group DefaultDNS
domain hivermont.com
network VPN - TCP object-group
host of the object-Network 192.168.168.25
network-object 75.144.147.152 255.255.255.248
object-group Protocol DM_INLINE_PROTOCOL_1
object-protocol gre
access extensive list ip 192.168.168.0 inside_nat0_outbound allow 255.255.255.0 192.168.167.0 255.255.255.0
outside_access_in list extended access permit tcp any interface outside eq 81
outside_access_in list extended access permit tcp any interface outside eq 6036
outside_access_in_1 list extended access allowed grateful if any host 192.168.168.25
Note to access list TCP VPN connection outside_access_in_1
Comment from outside_access_in_1-access VPN UDP connection list
Note to access list TCP VPN connection outside_access_in_1
Comment from outside_access_in_1-access VPN UDP connection list
inside_nat_outbound of access allowed any ip an extended list
pager lines 24
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
guestlan MTU 1500
Aloha 1500 MTU
IP local pool dial_pool 192.168.167.100 - 192.168.167.110
no failover
the monitor inside interface
interface of the monitor to the outside
the interface of the monitor guestlan
the aloha monitor interface
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 523.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 access-list inside_nat_outbound
NAT (guestlan) 1 0.0.0.0 0.0.0.0
NAT (aloha) 1 0.0.0.0 0.0.0.0
public static tcp (indoor, outdoor) interface 81 192.168.168.20 81 netmask 255.255.255.255
public static tcp (indoor, outdoor) interface 6036 192.168.168.20 6036 netmask 255.255.255.255
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 75.144.147.158 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout, uauth 0:05:00 absolute
Enable http server
http 192.168.1.0 255.255.255.0 inside
http 192.168.168.0 255.255.255.0 inside
http 192.168.167.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-sha-hmac dial_set
Crypto dial_map dynamic-map 10 transform-set dial_set
map vpn_map 65535-isakmp ipsec crypto dynamic dial_map
vpn_map interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
ISAKMP crypto 10 nat-traversal
Telnet 192.168.167.0 255.255.255.0 inside
Telnet timeout 5
SSH 192.168.168.0 255.255.255.0 inside
SSH 192.168.167.0 255.255.255.0 inside
SSH timeout 20
Console timeout 0
management-access inside
dhcpd address 192.168.2.100 - 192.168.2.199 guestlan
dhcpd dns 68.87.71.226 68.87.73.242 interface guestlan
dhcpd lease 14400 interface guestlan
guestlan enable dhcpd
!
priority queue inside
!
Global class-card class
match default-inspection-traffic
Interior-class class-map
match any
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
World-Policy policy-map
Global category
inspect the ctiqbe
inspect the dcerpc
inspect the dns
inspect esmtp
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the http
inspect the icmp
inspect the icmp error
inspect the they
inspect the amp-ipsec
inspect the mgcp
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the sip
inspect the skinny
inspect the snmp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the waas
inspect xdmcp
class inspection_default
inspect the pptp
political inner-political map
internal category
priority
!
service-policy-international policy global
service-policy domestic-policy interface inside
WebVPN
CSD image disk0:/securedesktop-asa-3.1.1.29-k9.pkg
enable CSD
internal remote group strategy
Group remote attributes policy
value of 68.87.71.226 DNS server 68.87.73.242
VPN-idle-timeout 30
Protocol-tunnel-VPN IPSec
username, encrypted Tbridges boO63YoQ/XbbOab8 password
username Tbridges attributes
Strategy-Group-VPN remote
todd YmIbsl9a0Do623E2Fipr5w password user name is nt encrypted privilege 15
IPSec-attributes tunnel-group DefaultRAGroup
ISAKMP retry threshold 10 keepalive 2
tunnel-group type remote ipsec-ra
tunnel-group remote General attributes
address dial_pool pool
tunnel-group remote ipsec-attributes
pre-shared-key *.
context of prompt hostname
Cryptochecksum:6aa5f44393e8771d4cd28186e18e5618
: end
Are you trying to connect to RV042 with PPTP VPN?
If you are, then here is the configuration:
public static tcp 1723 interface (inside, outside) 192.168.168.25 1723 netmask 255.255.255.255
outside_access_in list extended access permit tcp any interface outside eq 1723
and you have already the "inspect pptp" set up, it should be OK.
When you try to connect, it connects successfully but you cannot pass all the data, or you can't even connect? In addition, this error message do you receive?
Finally, if you do 'show access-list outside_access_in', you get any number of access on tcp/1723 line?
Maybe you are looking for
-
mfc45.dll in C++ Redistributable package
Re: XP SP3 and Vista SP2 and the file mfc45.dll Machines Recently, Hitman Pro 3.5.8 121 Bld stopped download mfc45.dll to the cloud for inspection, as it did for a year under XP SP3. My inspection of the property sheet for the file not revealed any i
-
Pavilion G6: Hp Pavilion G6
My laptop is coming up to engage with administrator password or power on password. The code after 3 attempts is 75228564. Can you help me?
-
Hello! I have a website (www.lundbeckconsulting.no) with a valid SSL certificate, but Firefox says "this website does not provide information on property. Then. How can I provide property information?
-
PS6210xs and PS6210x in the same pool?
Hello. We have a hybrid of PS6210XS and two models of PS6210X in a group. They are all current firmware 8.1.4, and they are all in separate categories. The XS is running accelerated RAID6 and X models are running RAID6. Together, these models will al
-
I want to extend my subscription
I want to extend my subscription, but I can't seem to update my my the New Zealand credit card payment information. I used to live in the United States and continues to ask me for my State and zip codes etc. We don't have those in New Zealand. Help?