ASA 5505 in router Mode can implement the MAC ACL

Hi all:

My client request can the Cisco ASA 5505 implement MAC ACL in Cisco ASA 5505, who is now running in router Mode.

Can anyone help answer this?

I tried to search the document and also tried the ASDM in the Cisco ASA 5505 but couldn't see a way to do the ACL by MAC address.

At the same time can also help me find the command line using the ASA 5505 able to run MAC ACL in router mode?

Thank you very much!

Warm greetings,

TangSuan Tan

MAC ACL is not supported in Routed mode, only in Transparent mode.

Here is the command for your reference:

http://www.Cisco.com/en/us/docs/security/ASA/asa84/command/reference/A1.html#wp1598101

And here is the ethertype supported:

http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/access_rules.html#wp1083699

Tags: Cisco Security

Similar Questions

ASA-6-110003: routing could not locate the next hop

Hello

I have a problem with our ASA firewall. I have a firewall that's inside, outside and DMZ interface. I have VPN clients that connect correctly and can access the internal network. However, for profiles that I have configured to connect via VPN to the DMZ network fails with the following messages.

ASA-6-110003: routing could not locate the next hop

&

ASA-6-302014: disassembly of the TCP connection... No contiguity valid

I have connections in the DMZ, but aren't VPN via internal and external interfaces without problem.

The routing table has a route to this network and I have a nat in place - I'm quite puzzled by the present.

Thank you

Ed

Hello Ed,

Well, Nat seems good but you can do the following for me please:

network of the DMZ_subnet object

10.1.213.0 subnet 255.255.255.0

network of the VPN_Subnet object

subnet 255.255.x.x x.x.x.x

public static DMZ_subnet DMZ_subnet destination NAT source (dmz - 2 outside) public static VPN_Subnet VPN_Subnet

Kind regards

Julio

my cc to photoshop updated to 2014.2.0 in text only mode can type the top case. can not lowercase

my cc to photoshop updated to 2014.2.0 in text only mode can type the top case. can not lowercase
my windows 7 pro 64-bit
someone had this case? and help
Thank you

Check the character Panel. Is "all caps" (TT) on?

ASA 5505 VPN established, cannot access inside the network

Hi, I recently got an ASA 5505, and I spent weeks to find a way to set up a VPN on it.

After a few days, I finally found the solution to connect to my ASA with a VPN client yet and cannot access devices that are connected to the ASA.

Here is my config:

ASA Version 8.2 (5)
!
hostname asa01
domain kevinasa01.net
activate 8Ry2YjIyt7RRXU24 encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
switchport access vlan 5
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address dhcp setroute
!
interface Vlan5
No nameif
security-level 50
IP 172.16.1.1 255.255.255.0
!
passive FTP mode
DNS server-group DefaultDNS
domain kevinasa01.net
permit same-security-traffic intra-interface
Remote_Kevin_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.254.0 255.255.255.240
inside_nat0_outbound list of allowed ip extended access all 192.168.254.0 255.255.255.0
inside_nat0_outbound list of allowed ip extended access entire 192.168.1.0 255.255.255.0
sheep - in extended Access-list allow IP 192.168.254.0 255.255.255.0 192.168.1.0 255.255.255.0
access extensive list ip 192.168.254.0 outside_access_in allow 255.255.255.0 any
access extensive list ip 192.168.254.0 inside_access_in allow 255.255.255.0 any
pager lines 24
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
pool pool 192.168.254.1 - 192.168.254.10 255.255.255.0 IP mask
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (outside) 1 192.168.254.0 255.255.255.0
NAT (inside) 0 access-list sheep - in
NAT (inside) 1 192.168.1.0 255.255.255.0
NAT (inside) 1 0.0.0.0 0.0.0.0
Access-group outside_access_in in interface outside
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
management-access inside
dhcpd outside auto_config
!
dhcpd address 192.168.1.5 - 192.168.1.36 inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal Remote_Kevin group strategy
attributes of Group Policy Remote_Kevin
value of server DNS 192.168.1.12 192.168.1.13
VPN - connections 3
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list Remote_Kevin_splitTunnelAcl
kevinasa01.NET value by default-field
username kevin mz6JxJib/sQqvsw9 password encrypted privilege 0
username kevin attributes
VPN-group-policy Remote_Kevin
type tunnel-group Remote_Kevin remote access
attributes global-tunnel-group Remote_Kevin
address-pool
Group Policy - by default-Remote_Kevin
IPSec-attributes tunnel-group Remote_Kevin
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp
inspect the icmp error
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
Cryptochecksum:2bb1da52d1993eb9b13c2f6dc97c16cd
: end

Thank you

Hello

I read your message quickly through my cell phone. I don't know why you have spent your config twice. Maybe a typo issue.

I see the acl sheep in the wrong way. I mean 192.168.254 are your pool VPN and 192.168.1.0 your local LAN.

The acl must be:

sheep - in extended access-list permit ip 192.168.1.0 255.255.255.0 192.168.254.0 255.255.255.0

For nat (inside), you have 2 lines:

NAT (inside) 1 192.168.1.0 255.255.255.0 ==> it is redundant as the 1 below does the same thing with more networks if there is inside side. You can delete it.
NAT (inside) 1 0.0.0.0 0.0.0.0

Why are you doing this nat (outside)?

NAT (outside) 1 192.168.254.0 255.255.255.0

Here are the first questions that I have seen by reading through my mobile. Let's change this and let me know. I'll take a look later with a computer (tonight or tomorrow)

Thank you.

PS: Please do not forget to rate and score as good response if this solves your problem.

Cisco SG300 / ASA 5505 intervlan routing problem

Dear all

I have a problem with the configuration correctly sg300 layer 3 behind the ASA 5505 switch (incl. license more security)

The configuration is the following:

CISCO SG300 is configured as a layer 3 switch

VLAN native 1: 192.168.1.254, default route ip address (inside interface ASA 192.168.1.1)

VLAN defined additional switch

VLAN 100 with 192.168.100.0/24, default gateway 192.168.100.254

VLAN 110 with 192.168.110.0/24, default gateway 192.168.110.254

VLAN 120 with 172.16.0.0/16, default gateway 172.16.10.254

Of the VLANS (100,110,120) different, I am able to connect to all devices on the other VIRTUAL local networks (with the exception of Native VLAN 1; is not the ping requests)

From the switch cli I can ping my firewall (192.168.1.1) and all the other gateways of VLANs and vlan (VLAN1, 100, 110, 120) devices

Asa cli I can only ping my switch (192.168.1.254) port, but no other devices in other VLAN

My question is this. What should I change or installation in the switch configuration or asa so that other VLANs to access the Internet through the ASA. I will not use the ASA as intervlan routing device, because the switch does this for me

I tried to change the asa int e0/1 in trunkport (uplink port switch also), to enable all the VLANS, but as soon as I do that, I can not ping 192.168.1.254 ASA cli more.

Any help is greatly appreciated

Concerning

Edwin

Hi Edwin, because the switch is layer 3, the only necessary behavior is to ensure that default gateways to the computer are set on the SVI interface connection to the switch to make sure that the switch is transfer traffic wished to the ASA.

The configuration between the ASA and the switch must stay true by dot1q, such as the vlan all other, unidentified native VLAN tagged.

Also, if I'm not wrong, on the SAA you must set the security level of the port to 100.

-Tom
Please evaluate the useful messages

EzVPN between Cisco ASA 5505 (with NEM mode) and Ciscoo 881 Roure

Hi friends,

I configured the Cisco ASA 5505 and Cisco router with DMVPN 881. 3 offices works very well but one office remains failure. I did the same configuration for all facilities but this router does not work. Any ideas?

Please find below the exit of 881 router Cisco:

YF2_Tbilisi_router #.
* 4 August 09:31:26.793: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:31:26.793 4 August: ISAKMP (0): increment the count of errors on his, try 4 out 5: retransmit the phase 1
* 4 August 09:31:26.793: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:31:26.793: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:31:26.793 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:31:36.793: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:31:36.793 4 August: ISAKMP (0): increment the count of errors on his, try 5 of 5: retransmit the phase 1
* 4 August 09:31:36.793: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:31:36.793: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:31:36.793 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 09:31:44.929 4 August: ISAKMP: (0): serving SA., its is 88961 B 34, delme is 88961 B 34
* 4 August 09:31:46.793: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:31:46.793 4 August: ISAKMP: (0): the peer is not paranoid KeepAlive.

* 09:31:46.793 4 August: ISAKMP: (0): removal of reason ITS status of 'Death by retransmission P1' (I) AG_INIT_EXCH (peer 1.1.1.1)
* 09:31:46.793 4 August: % CRYPTO-6-EZVPN_CONNECTION_DOWN: user (customer) = group = Youth_Facility_2 Server_public_addr = 1.1.1.1
* 4 August 09:31:46.793: ISAKMP:isadb_key_addr_delete: no key for address 1.1.1.1 (root NULL)
* 09:31:46.793 4 August: ISAKMP: (0): removal of reason ITS status of 'Death by retransmission P1' (I) AG_INIT_EXCH (peer 1.1.1.1)
* 09:31:46.793 4 August: ISAKMP: Unlocking counterpart struct 0x8AA90C50 for isadb_mark_sa_deleted(), count 0
* 09:31:46.793 4 August: ISAKMP: delete peer node by peer_reap for 1.1.1.1: 8AA90C50
* 09:31:46.793 4 August: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
* 09:31:46.793 4 August: ISAKMP: (0): former State = new State IKE_I_AM1 = IKE_DEST_SA

* 4 August 09:31:47.805: del_node 2.2.2.2 src dst 1.1.1.1:500 fvrf 0 x 0, ivrf 0 x 0
* 09:31:47.805 4 August: ISAKMP: (0): the peer is not paranoid KeepAlive.

* 4 August 09:31:47.805: ISAKMP: (0): profile of THE request is (NULL)
* 09:31:47.805 4 August: ISAKMP: created a struct peer 1.1.1.1, peer port 500
* 09:31:47.805 4 August: ISAKMP: new created position = 0x8AA90C50 peer_handle = 0 x 80004819
* 09:31:47.805 4 August: ISAKMP: lock struct 0x8AA90C50, refcount 1 to peer isakmp_initiator
* 09:31:47.805 4 August: ISAKMP: (0): client configuration parameters 87531228 adjustment
* 09:31:47.805 4 August: ISAKMP: 500 local port, remote port 500
* 09:31:47.805 4 August: ISAKMP: find a dup her to the tree during his B 88961, 34 = isadb_insert call BVA
* 4 August 09:31:47.805: ISAKMP: (0): set up client mode.
* 4 August 09:31:47.805: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
* 4 August 09:31:47.805: ISAKMP: (0): built the seller-07 ID NAT - t
* 4 August 09:31:47.805: ISAKMP: (0): built of NAT - T of the seller-03 ID
* 4 August 09:31:47.805: ISAKMP: (0): built the seller-02 ID NAT - t
* 4 August 09:31:47.805: ISKAMP: more send buffer from 1024 to 3072
* 09:31:47.805 4 August: ISAKMP: (0): ITS been pre-shared key and XAUTH authentication using id ID_KEY_ID type
* 09:31:47.805 4 August: ISAKMP (0): payload ID
next payload: 13
type: 11
Group ID: Youth_Facility_2
Protocol: 17
Port: 0
Length: 24
* 09:31:47.805 4 August: ISAKMP: (0): the total payload length: 24
* 09:31:47.809 4 August: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_AM
* 09:31:47.809 4 August: ISAKMP: (0): former State = new State IKE_READY = IKE_I_AM1

* 4 August 09:31:47.809: ISAKMP: (0): Beginner aggressive Mode Exchange
* 4 August 09:31:47.809: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:31:47.809 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:31:57.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:31:57.809 4 August: ISAKMP (0): increment the count of errors on his, try 1 5: retransmit the phase 1
* 4 August 09:31:57.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:31:57.809: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:31:57.809 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:32:07.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:32:07.809 4 August: ISAKMP (0): increment the count of errors on his, try 2 of 5: retransmit the phase 1
* 4 August 09:32:07.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:32:07.809: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:32:07.809 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:32:17.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:32:17.809 4 August: ISAKMP (0): increment the count of errors on his, try 3 of 5: retransmit the phase 1
* 4 August 09:32:17.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:32:17.809: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:32:17.809 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:32:27.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:32:27.809 4 August: ISAKMP (0): increment the count of errors on his, try 4 out 5: retransmit the phase 1
* 4 August 09:32:27.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:32:27.809: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:32:27.809 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:32:37.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:32:37.809 4 August: ISAKMP (0): increment the count of errors on his, try 5 of 5: retransmit the phase 1
* 4 August 09:32:37.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:32:37.809: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:32:37.809 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 09:32:46.793 4 August: ISAKMP: (0): serving SA., his is 872E1504, delme is 872E1504
* 4 August 09:32:47.809: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:32:47.809 4 August: ISAKMP: (0): the peer is not paranoid KeepAlive.

* 09:32:47.809 4 August: ISAKMP: (0): removal of reason ITS status of 'Death by retransmission P1' (I) AG_INIT_EXCH (peer 1.1.1.1)
* 09:32:47.809 4 August: % CRYPTO-6-EZVPN_CONNECTION_DOWN: user (customer) = group = Youth_Facility_2 Server_public_addr = 1.1.1.1
* 4 August 09:32:47.809: ISAKMP:isadb_key_addr_delete: no key for address 1.1.1.1 (root NULL)
* 09:32:47.809 4 August: ISAKMP: (0): removal of reason ITS status of 'Death by retransmission P1' (I) AG_INIT_EXCH (peer 1.1.1.1)
* 09:32:47.809 4 August: ISAKMP: Unlocking counterpart struct 0x8AA90C50 for isadb_mark_sa_deleted(), count 0
* 09:32:47.809 4 August: ISAKMP: delete peer node by peer_reap for 1.1.1.1: 8AA90C50
* 09:32:47.809 4 August: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
* 09:32:47.809 4 August: ISAKMP: (0): former State = new State IKE_I_AM1 = IKE_DEST_SA

* 4 August 09:32:48.909: del_node src 2.2.2.2:500 dst 1.1.1.1:500 fvrf 0 x 0, ivrf 0 x 0
* 09:32:48.909 4 August: ISAKMP: (0): the peer is not paranoid KeepAlive.

* 4 August 09:32:48.909: ISAKMP: (0): profile of THE request is (NULL)
* 09:32:48.909 4 August: ISAKMP: created a struct peer 1.1.1.1, peer port 500
* 09:32:48.909 4 August: ISAKMP: new created position = 0x8AA90C50 peer_handle = 0 x 80004818
* 09:32:48.909 4 August: ISAKMP: lock struct 0x8AA90C50, refcount 1 to peer isakmp_initiator
* 09:32:48.909 4 August: ISAKMP: (0): client setting Configuration parameters 88C05A48
* 09:32:48.909 4 August: ISAKMP: 500 local port, remote port 500
* 09:32:48.909 4 August: ISAKMP: find a dup her to the tree during the isadb_insert his 87B57D38 = call BVA
* 4 August 09:32:48.909: ISAKMP: (0): set up client mode.
* 4 August 09:32:48.909: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
* 4 August 09:32:48.909: ISAKMP: (0): built the seller-07 ID NAT - t
* 4 August 09:32:48.909: ISAKMP: (0): built of NAT - T of the seller-03 ID
* 4 August 09:32:48.909: ISAKMP: (0): built the seller-02 ID NAT - t
* 4 August 09:32:48.909: ISKAMP: more send buffer from 1024 to 3072
* 09:32:48.913 4 August: ISAKMP: (0): ITS been pre-shared key and XAUTH authentication using id ID_KEY_ID type
* 09:32:48.913 4 August: ISAKMP (0): payload ID
next payload: 13
type: 11
Group ID: Youth_Facility_2
Protocol: 17
Port: 0
Length: 24
* 09:32:48.913 4 August: ISAKMP: (0): the total payload length: 24
* 09:32:48.913 4 August: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_AM
* 09:32:48.913 4 August: ISAKMP: (0): former State = new State IKE_READY = IKE_I_AM1

* 4 August 09:32:48.913: ISAKMP: (0): Beginner aggressive Mode Exchange
* 4 August 09:32:48.913: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:32:48.913 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:32:58.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:32:58.913 4 August: ISAKMP (0): increment the count of errors on his, try 1 5: retransmit the phase 1
* 4 August 09:32:58.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:32:58.913: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:32:58.913 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:33:08.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:33:08.913 4 August: ISAKMP (0): increment the count of errors on his, try 2 of 5: retransmit the phase 1
* 4 August 09:33:08.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:33:08.913: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:33:08.913 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:33:18.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:33:18.913 4 August: ISAKMP (0): increment the count of errors on his, try 3 of 5: retransmit the phase 1
* 4 August 09:33:18.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:33:18.913: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:33:18.913 4 August: ISAKMP: (0): sending a packet IPv4 IKE.
* 4 August 09:33:28.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH...
* 09:33:28.913 4 August: ISAKMP (0): increment the count of errors on his, try 4 out 5: retransmit the phase 1
* 4 August 09:33:28.913: ISAKMP: (0): transmit phase 1 AG_INIT_EXCH
* 4 August 09:33:28.913: ISAKMP: (0): 1.1.1.1 package sending 500 peer_port 500 (I) my_port AG_INIT_EXCH
* 09:33:28.913 4 August: ISAKMP: (0): sending a packet IPv4 IKE.

There is no DMVPN on the SAA. All that you have configured, is not compatible with the ASA or something another DMVPN then. At least debugging shows that there are some EzVPN involved.

The debug version, it seems that there is no communication on UDP/500 possible between devices. Maybe something is blocking who?

Cisco ASA 5505 site for multiple subnet of the site.

Hello. I need help to configure my cisco asa 5505.

I set up a VPN between two ASA 5505 tunnel

Site 1:

Subnet 192.168.77.0

Site 2:

Have multiple VLANs and now the tunnel goes to vlan400 - 192.168.1.0

What I need help:

Site 1, I need to be able to reach a different virtual LAN on site 2. vlan480 - 192.168.20.0

And 1 site I have to reach 192.168.77.0 subnet of vlan480 - 192.168.20.0

Vlan480 is used for phones. In vlan480, we have a PABX.

Is this possible to do?

Any help would be much appreciated!

Config site 2:

: Saved

:

ASA Version 7.2 (2)

!

ciscoasa hostname

domain default.domain.invalid

activate the password encrypted x

names of

name 192.168.1.250 DomeneServer

name of 192.168.1.10 NotesServer

name 192.168.1.90 Steadyily

name 192.168.1.97 TerminalServer

name 192.168.1.98 eyeshare w8

name 192.168.50.10 w8-print

name 192.168.1.94 w8 - app

name 192.168.1.89 FonnaFlyMedia

!

interface Vlan1

nameif Vlan1

security-level 100

IP 192.168.200.100 255.255.255.0

OSPF cost 10

!

interface Vlan2

nameif outside

security-level 0

IP address 79.x.x.226 255.255.255.224

OSPF cost 10

!

interface Vlan400

nameif vlan400

security-level 100

IP 192.168.1.1 255.255.255.0

OSPF cost 10

!

interface Vlan450

nameif Vlan450

security-level 100

IP 192.168.210.1 255.255.255.0

OSPF cost 10

!

interface Vlan460

nameif Vlan460-SuldalHotell

security-level 100

IP 192.168.2.1 255.255.255.0

OSPF cost 10

!

interface Vlan461

nameif Vlan461-SuldalHotellGjest

security-level 100

address 192.168.3.1 IP 255.255.255.0

OSPF cost 10

!

interface Vlan462

Vlan462-Suldalsposten nameif

security-level 100

192.168.4.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan470

nameif vlan470-Kyrkjekontoret

security-level 100

IP 192.168.202.1 255.255.255.0

OSPF cost 10

!

interface Vlan480

nameif vlan480 Telefoni

security-level 100

address 192.168.20.1 255.255.255.0

OSPF cost 10

!

interface Vlan490

nameif Vlan490-QNapBackup

security-level 100

IP 192.168.10.1 255.255.255.0

OSPF cost 10

!

interface Vlan500

nameif Vlan500-HellandBadlands

security-level 100

192.168.30.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan510

Vlan510-IsTak nameif

security-level 100

192.168.40.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan600

nameif Vlan600-SafeQ

security-level 100

192.168.50.1 IP address 255.255.255.0

OSPF cost 10

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 500

switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610

switchport mode trunk

!

interface Ethernet0/3

switchport access vlan 490

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd encrypted x

passive FTP mode

clock timezone WAT 1

DNS server-group DefaultDNS

domain default.domain.invalid

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

Lotus_Notes_Utgaaande tcp service object-group

UT og Frim Notes Description til alle

area of port-object eq

port-object eq ftp

port-object eq www

EQ object of the https port

port-object eq lotusnotes

EQ Port pop3 object

EQ pptp Port object

EQ smtp port object

Lotus_Notes_inn tcp service object-group

Description of the inn og alle til Notes

port-object eq www

port-object eq lotusnotes

EQ Port pop3 object

EQ smtp port object

object-group service Reisebyraa tcp - udp

3702 3702 object-port Beach

5500 5500 object-port Beach

range of object-port 9876 9876

object-group service Remote_Desktop tcp - udp

Description Tilgang til Remote Desktop

3389 3389 port-object range

object-group service Sand_Servicenter_50000 tcp - udp

Description program tilgang til sand service AS

object-port range 50000 50000

VNC_Remote_Admin tcp service object-group

Description Fra ¥ oss til alle

5900 5900 port-object range

object-group service Printer_Accept tcp - udp

9100 9100 port-object range

port-object eq echo

ICMP-type of object-group Echo_Ping

echo ICMP-object

response to echo ICMP-object

object-group service Print tcp

9100 9100 port-object range

FTP_NADA tcp service object-group

Suldalsposten NADA tilgang description

port-object eq ftp

port-object eq ftp - data

Telefonsentral tcp service object-group

Hoftun description

port-object eq ftp

port-object eq ftp - data

port-object eq www

EQ object of the https port

port-object eq telnet

Printer_inn_800 tcp service object-group

Fra 800 thought-out og inn til 400 port 7777 description

range of object-port 7777 7777

Suldalsposten tcp service object-group

Description send av mail hav Mac Mail at - Ã ¥ nrep smtp

EQ Port pop3 object

EQ smtp port object

http2 tcp service object-group

Beach of port-object 81 81

object-group service DMZ_FTP_PASSIVE tcp - udp

55536 56559 object-port Beach

object-group service DMZ_FTP tcp - udp

20 21 object-port Beach

object-group service DMZ_HTTPS tcp - udp

Beach of port-object 443 443

object-group service DMZ_HTTP tcp - udp

8080 8080 port-object range

DNS_Query tcp service object-group

of domain object from the beach

object-group service DUETT_SQL_PORT tcp - udp

Description for a mellom andre og duett Server nett

54659 54659 object-port Beach

outside_access_in of access allowed any ip an extended list

outside_access_out of access allowed any ip an extended list

vlan400_access_in list extended access deny ip any host 149.20.56.34

vlan400_access_in list extended access deny ip any host 149.20.56.32

vlan400_access_in of access allowed any ip an extended list

Vlan450_access_in list extended access deny ip any host 149.20.56.34

Vlan450_access_in list extended access deny ip any host 149.20.56.32

Vlan450_access_in of access allowed any ip an extended list

Vlan460_access_in list extended access deny ip any host 149.20.56.34

Vlan460_access_in list extended access deny ip any host 149.20.56.32

Vlan460_access_in of access allowed any ip an extended list

vlan400_access_out list extended access permit icmp any any Echo_Ping object-group

vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande

vlan400_access_out list extended access permit tcp any host DomeneServer object-group Remote_Desktop

vlan400_access_out list extended access permit tcp any host TerminalServer object-group Remote_Desktop

vlan400_access_out list extended access permit tcp any host http2 object-group Steadyily

vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_inn

vlan400_access_out list extended access permit tcp any host NotesServer object-group Remote_Desktop

vlan400_access_out allowed extended access list tcp any host w8-eyeshare object-group Remote_Desktop

vlan400_access_out allowed extended access list tcp any host w8 - app object-group Remote_Desktop

vlan400_access_out list extended access permit tcp any host FonnaFlyMedia range 8400-8600

vlan400_access_out list extended access permit udp any host FonnaFlyMedia 9000 9001 range

vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host DomeneServer

vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host w8 - app object-group DUETT_SQL_PORT

Vlan500_access_in list extended access deny ip any host 149.20.56.34

Vlan500_access_in list extended access deny ip any host 149.20.56.32

Vlan500_access_in of access allowed any ip an extended list

vlan470_access_in list extended access deny ip any host 149.20.56.34

vlan470_access_in list extended access deny ip any host 149.20.56.32

vlan470_access_in of access allowed any ip an extended list

Vlan490_access_in list extended access deny ip any host 149.20.56.34

Vlan490_access_in list extended access deny ip any host 149.20.56.32

Vlan490_access_in of access allowed any ip an extended list

Vlan450_access_out list extended access permit icmp any any Echo_Ping object-group

Vlan1_access_out of access allowed any ip an extended list

Vlan1_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

Vlan1_access_out deny ip extended access list a whole

Vlan1_access_out list extended access permit icmp any any echo response

Vlan460_access_out list extended access permit icmp any any Echo_Ping object-group

Vlan490_access_out list extended access permit icmp any any Echo_Ping object-group

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTPS

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTP

Vlan500_access_out list extended access permit icmp any any Echo_Ping object-group

vlan470_access_out list extended access permit icmp any any Echo_Ping object-group

vlan470_access_out list extended access permit tcp any host 192.168.202.10 - group Remote_Desktop object

Vlan510_access_out list extended access permit icmp any any Echo_Ping object-group

vlan480_access_out of access allowed any ip an extended list

Vlan510_access_in of access allowed any ip an extended list

Vlan600_access_in of access allowed any ip an extended list

Vlan600_access_out list extended access permit icmp any one

Vlan600_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

Vlan600_access_out list extended access permitted tcp 192.168.1.0 255.255.255.0 host w8-printing eq www

Vlan600_access_out list extended access permitted tcp 192.168.202.0 255.255.255.0 host w8-printing eq www

Vlan600_access_out list extended access permitted tcp 192.168.210.0 255.255.255.0 host w8-printing eq www

Vlan600_access_in_1 of access allowed any ip an extended list

Vlan461_access_in of access allowed any ip an extended list

Vlan461_access_out list extended access permit icmp any any Echo_Ping object-group

vlan400_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

outside_20_cryptomap_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

outside_20_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

access-list Vlan462-Suldalsposten_access_in extended ip allowed any one

access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo response

access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo response

access-list Vlan462-Suldalsposten_access_in_1 extended ip allowed any one

pager lines 24

Enable logging

asdm of logging of information

MTU 1500 Vlan1

Outside 1500 MTU

vlan400 MTU 1500

MTU 1500 Vlan450

MTU 1500 Vlan460-SuldalHotell

MTU 1500 Vlan461-SuldalHotellGjest

vlan470-Kyrkjekontoret MTU 1500

MTU 1500 vlan480-Telefoni

MTU 1500 Vlan490-QNapBackup

MTU 1500 Vlan500-HellandBadlands

MTU 1500 Vlan510-IsTak

MTU 1500 Vlan600-SafeQ

MTU 1500 Vlan462-Suldalsposten

no failover

Monitor-interface Vlan1

interface of the monitor to the outside

the interface of the monitor vlan400

the interface of the monitor Vlan450

the interface of the Vlan460-SuldalHotell monitor

the interface of the Vlan461-SuldalHotellGjest monitor

the interface of the vlan470-Kyrkjekontoret monitor

Monitor-interface vlan480-Telefoni

the interface of the Vlan490-QNapBackup monitor

the interface of the Vlan500-HellandBadlands monitor

Monitor-interface Vlan510-IsTak

Monitor-interface Vlan600-SafeQ

the interface of the monitor Vlan462-Suldalsposten

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 522.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

vlan400_nat0_outbound (vlan400) NAT 0 access list

NAT (vlan400) 1 0.0.0.0 0.0.0.0 dns

NAT (Vlan450) 1 0.0.0.0 0.0.0.0 dns

NAT (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0

NAT (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0

NAT (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0

NAT (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns

NAT (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0

NAT (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0

NAT (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0

NAT (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0

static (vlan400, external) 79.x.x.x DomeneServer netmask 255.255.255.255

static (vlan470-Kyrkjekontoret, external) 79.x.x.x 192.168.202.10 netmask 255.255.255.255

static (vlan400, external) 79.x.x.x NotesServer netmask 255.255.255.255 dns

static (vlan400, external) 79.x.x.231 netmask 255.255.255.255 TerminalServer

static (vlan400, external) 79.x.x.234 Steadyily netmask 255.255.255.255

static (vlan400, outside) w8-eyeshare netmask 255.255.255.255 79.x.x.232

static (Vlan490-QNapBackup, external) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns

static (Vlan600-SafeQ, external) 79.x.x.235 w8 - print subnet mask 255.255.255.255

static (vlan400, outside) w8 - app netmask 255.255.255.255 79.x.x.236

static (Vlan450, vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

(Vlan500-HellandBadlands, vlan400) static 192.168.30.0 192.168.30.0 netmask 255.255.255.0

(vlan400, Vlan500-HellandBadlands) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

(vlan400, Vlan450) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

static (vlan400, external) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255

static (Vlan462-Suldalsposten, vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0

static (vlan400, Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

static (vlan400, Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

static (Vlan600-SafeQ, vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

static (Vlan600-SafeQ, Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

static (Vlan600-SafeQ, vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

static (Vlan450, Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

static (vlan470-Kyrkjekontoret, Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0

Access-group interface Vlan1 Vlan1_access_out

Access-group outside_access_in in interface outside

Access-group outside_access_out outside interface

Access-group vlan400_access_in in the vlan400 interface

vlan400_access_out group access to the interface vlan400

Access-group Vlan450_access_in in the Vlan450 interface

Access-group interface Vlan450 Vlan450_access_out

Access-group interface Vlan460-SuldalHotell Vlan460_access_in

Access-group interface Vlan460-SuldalHotell Vlan460_access_out

Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_in

Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_out

Access-group vlan470_access_in in interface vlan470-Kyrkjekontoret

vlan470_access_out access to the interface vlan470-Kyrkjekontoret group

access to the interface vlan480-Telefoni, vlan480_access_out group

Access-group interface Vlan490-QNapBackup Vlan490_access_in

Access-group interface Vlan490-QNapBackup Vlan490_access_out

Access-group interface Vlan500-HellandBadlands Vlan500_access_in

Access-group interface Vlan500-HellandBadlands Vlan500_access_out

Access-group interface Vlan510-IsTak Vlan510_access_in

Access-group interface Vlan510-IsTak Vlan510_access_out

Access-group Vlan600_access_in_1 interface Vlan600-SafeQ

Access-group Vlan600_access_out interface Vlan600-SafeQ

Access-group Vlan462-Suldalsposten_access_in_1 Vlan462-Suldalsposten interface

Access-group Vlan462-Suldalsposten_access_out_1 Vlan462-Suldalsposten interface

Route outside 0.0.0.0 0.0.0.0 79.x.x.225 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

x x encrypted privilege 15 password username

the ssh LOCAL console AAA authentication

Enable http server

http 192.168.210.0 255.255.255.0 Vlan450

http 192.168.200.0 255.255.255.0 Vlan1

http 192.168.1.0 255.255.255.0 vlan400

No snmp server location

No snmp Server contact

SNMP-Server Community public

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

card crypto outside_map 20 match address outside_20_cryptomap_1

card crypto outside_map 20 set pfs

peer set card crypto outside_map 20 62.92.159.137

outside_map crypto 20 card value transform-set ESP-3DES-SHA

outside_map interface card crypto outside

crypto ISAKMP allow outside

ISAKMP crypto enable vlan400

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

tunnel-group 62.92.159.137 type ipsec-l2l

IPSec-attributes tunnel-group 62.92.159.137

pre-shared-key *.

Telnet 192.168.200.0 255.255.255.0 Vlan1

Telnet 192.168.1.0 255.255.255.0 vlan400

Telnet timeout 5

SSH 171.68.225.216 255.255.255.255 outside

SSH timeout 5

Console timeout 0

dhcpd update dns both

!

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1

!

dhcpd option 6 ip 81.167.36.3 81.167.36.11 outside interface

!

dhcpd address 192.168.1.100 - 192.168.1.225 vlan400

dhcpd option ip 6 DomeneServer 81.167.36.11 interface vlan400

dhcpd option 3 ip 192.168.1.1 interface vlan400

vlan400 enable dhcpd

!

dhcpd address 192.168.210.100 - 192.168.210.200 Vlan450

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450

dhcpd ip interface 192.168.210.1 option 3 Vlan450

enable Vlan450 dhcpd

!

dhcpd address 192.168.2.100 - 192.168.2.150 Vlan460-SuldalHotell

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell

dhcpd 192.168.2.1 ip interface option 3 Vlan460-SuldalHotell

dhcpd enable Vlan460-SuldalHotell

!

dhcpd address 192.168.3.100 - 192.168.3.200 Vlan461-SuldalHotellGjest

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest

dhcpd ip interface 192.168.3.1 option 3 Vlan461-SuldalHotellGjest

dhcpd enable Vlan461-SuldalHotellGjest

!

dhcpd address 192.168.202.100 - 192.168.202.199 vlan470-Kyrkjekontoret

interface of dhcpd option 3 ip 192.168.202.1 vlan470-Kyrkjekontoret

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret

dhcpd enable vlan470-Kyrkjekontoret

!

dhcpd option 3 192.168.20.1 ip interface vlan480-Telefoni

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni

!

dhcpd address 192.168.10.80 - 192.168.10.90 Vlan490-QNapBackup

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup

dhcpd 192.168.10.1 ip interface option 3 Vlan490-QNapBackup

!

dhcpd address 192.168.30.100 - 192.168.30.199 Vlan500-HellandBadlands

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands

dhcpd ip interface 192.168.30.1 option 3 Vlan500-HellandBadlands

dhcpd enable Vlan500-HellandBadlands

!

dhcpd address 192.168.40.100 - 192.168.40.150 Vlan510-IsTak

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak

dhcpd 3 ip Vlan510-IsTak 192.168.40.1 option interface

Vlan510-IsTak enable dhcpd

!

dhcpd address 192.168.50.150 - 192.168.50.199 Vlan600-SafeQ

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ

Vlan600-SafeQ enable dhcpd

!

dhcpd address 192.168.4.100 - 192.168.4.150 Vlan462-Suldalsposten

interface option 6 ip DomeneServer 81.167.36.11 Vlan462-Suldalsposten dhcpd

interface ip dhcpd option 3 Vlan462-Suldalsposten 192.168.4.1

Vlan462-Suldalsposten enable dhcpd

!

!

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

!

context of prompt hostname

Cryptochecksum:x

: end

Site 1 config:

: Saved

:

ASA Version 7.2 (4)

!

ciscoasa hostname

domain default.domain.invalid

activate the password encrypted x

passwd encrypted x

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.77.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

PPPoE Telenor customer vpdn group

IP address pppoe setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 15

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

DNS server-group DefaultDNS

domain default.domain.invalid

outside_access_in list extended access permit icmp any any disable log echo-reply

access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0

access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 524.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Access-group outside_access_in in interface outside

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

Enable http server

http 192.168.77.0 255.255.255.0 inside

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs

peer set card crypto outside_map 1 79.160.252.226

card crypto outside_map 1 set of transformation-ESP-3DES-SHA

outside_map interface card crypto outside

crypto ISAKMP allow inside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet 192.168.77.0 255.255.255.0 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

VPDN group Telenor request dialout pppoe

VPDN group Telenor localname x

VPDN group Telenor ppp authentication chap

VPDN x x local store password username

dhcpd outside auto_config

!

dhcpd address 192.168.77.100 - 192.168.77.130 inside

dhcpd dns 192.168.77.1 on the inside interface

dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside

dhcpd allow inside

!

dhcpd option 6 ip 130.67.15.198 193.213.112.4 outside interface

!

tunnel-group 79.160.252.226 type ipsec-l2l

IPSec-attributes tunnel-group 79.160.252.226

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:x

: end

Hello

The addition of a new network to the existing VPN L2L should be a fairly simple process.

Essentially, you need to add the network of the Crypto present ACL configurations "crypto map" . You also need to configure the NAT0 configuration for it in the appropriate interfaces of the SAA. These configurations are all made on both ends of the VPN L2L connection.

Looking at your configurations above it would appear that you need to the following configurations

SITE 1
- We add the new network at the same time the crypto ACL and ACL NAT0
access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.20.0 255.255.255.0

access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.20.0 255.255.255.0

SITE 2
- We add new ACL crypto network
- We create a new NAT0 configuration for interface Vlan480 because there is no previous NAT0 configuration
outside_20_cryptomap_1 to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

Comment by VLAN480-NAT0 NAT0 for VPN access-list

access-list VLAN480-NAT0 ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

NAT 0 access-list VLAN480-NAT0 (vlan480-Telefoni)

These configurations should pretty much do the trick.

Let me know if it worked

-Jouni

Please give index on configuring vpn site to site on 881 to ASA 5505 cisco router

Earlier my boss asked me to prepare to implement the VPN site-to site on router Cisco 881 Integrated Services to ASA 5505 router, which is now running on the side of HQ. Someone please give me a hint. I am now learning the pdf file from Cisco that mention how to configure VPN site to site between 1812 Cisco IOS router and router of the ASA 5505 using ASDM V6.1 and SDM V2.5. Cannot find the book for the Cisco 881 device.

Someone please please suggest me something as soon as POSSIBLE.

Thank you

CLI version:

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

ASDM and SDM Version:

http://www.Cisco.com/en/us/partner/products/ps5855/products_configuration_example09186a0080a9a7a3.shtml

ASA 5505 AnyConnect 8.2 - Can't access and inside services

Hello

I have configured AnyConnect to use a subnet of 10.0.7.0/24 for its DHCP pool. I can connect to the ASA very well, but I can't access internal services on my subnet 10.0.5.0/24 which is my INNER interface vlan subnet. I configure NAT for exemption rule:

allowed to Access-list inside_nat0_outbound line 2 extended 10.0.5.0 ip 255.255.255.0 Any-Connect-Pool-10-0-7-0 object-group

AnyConnect is set to ignore all the ACL rules through the sysopt permit vpn connection.

I don't know if I'm supposed to create another path to the VPN subnet or what exactly. When I ping my VPN subnet to a client on the subnet of the INTERIOR, I see ICMP traffic flowing through the FW, but I didn't get any answer. I do not split-tunnleing and I can not connect to internet either after establishing a VPN connection.

Thanks in advance for the help.

Hello

You must ensure that the following setting is enabled

permit same-security-traffic intra-interface

You should also make sure PAT configured for your Pool of VPN Dynamics

If your current dynamic PAT for internal users would

Global 1 interface (outside)

NAT (inside) 1 10.0.5.0 255.255.255.0

Then you must add

NAT (outside) 1 10.0.7.0 255.255.255.0

Hope this helps

Remember to mark a reply as the answer if it answered your question.

Feel free to ask more if necessary

-Jouni

Feature request: Advanced mode to display the MAC address of the network card

When a virtual machine has multiple network cards, and when it is not easy to get/know MAC address within o/s comments, it would be nice if there is a way of GUI for the MAC address for any individual network adapter. I don't mind if this function is in some "advanced only user" box, as long as it is available.
I know that it is also possible to open the .vmx file for this information, but if there is a sort of GUI, why not?

Just came across this old post of mine, let me answer myself

Requested, accessible functionality in the Advanced... button, is available in the Workstation 8 and later versionsand 12 player (at least).

Thank you VMware!

Cannot find the next jump - ASA 5505 VPN routing l2l

We have a 5505 (soon to be replaced by two 5515-x) firewall with two VPN l2l.

"Were trying to allow a remote site traffic flow through the other remote site but the syslog shows."

10.5.25.4

172.16.10.10

Could not locate the next hop for ICMP outside:10.5.25.4/1 to inside:172.16.10.10/0 routing

Config is less than

ASA Version 8.4 (3)

names of

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

<--- more="" ---="">

interface Ethernet0/7

switchport access vlan 10

interface Vlan1

nameif inside

security-level 100

allow-ssc-mgmt

IP 10.5.19.254 255.255.255.0

interface Vlan2

WIMAX Interface Description

nameif outside

security-level 0

IP address x.247.x.18 255.255.255.248

passive FTP mode

clock timezone GMT 1

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

network obj_any object

subnet 0.0.0.0 0.0.0.0

network guestwifi object

10.1.110.0 subnet 255.255.255.0

<--- more="" ---="">

network of the NETWORK_OBJ_10.5.19.0_24 object

10.5.19.0 subnet 255.255.255.0

network of the NETWORK_OBJ_10.5.31.0_24 object

10.5.31.0 subnet 255.255.255.0

network of the NETWORK_OBJ_172.16.0.0_16 object

subnet 172.16.0.0 255.255.0.0

the object DS365-Cloud network

172.16.10.0 subnet 255.255.255.0

Description DS365-Cloud

network of the object to the inside-network-16

10.5.0.0 subnet 255.255.0.0

atanta network object

10.5.16.0 subnet 255.255.255.0

Atanta description

network guest_dyn_nat object

10.5.29.0 subnet 255.255.255.0

network of the NETWORK_OBJ_172.16.254.0_25 object

subnet 172.16.254.0 255.255.255.128

network of the NETWORK_OBJ_10.5.16.0_20 object

subnet 10.5.16.0 255.255.240.0

network of the NETWORK_OBJ_10.5.16.0_26 object

255.255.255.192 subnet 10.5.16.0

network of the LDAP_DC7 object

Home 10.5.21.1

<--- more="" ---="">

LDAP description

network c2si object

range 10.5.21.180 10.5.21.200

network of the NETWORK_OBJ_10.5.25.0_24 object

10.5.25.0 subnet 255.255.255.0

object-group network rfc1918

object-network 192.168.0.0 255.255.0.0

object-network 172.16.0.0 255.255.240.0

object-network 10.0.0.0 255.0.0.0

the DM_INLINE_NETWORK_1 object-group network

object-network 10.5.19.0 255.255.255.0

network-object 10.5.20.0 255.255.254.0

object-network 10.5.22.0 255.255.255.0

object-network 10.5.30.0 255.255.255.0

object-network 192.168.100.0 255.255.255.0

the Sure_Signal object-group network

network-object x.183.x.128 255.255.255.192

network-host x.183.133.177 object

network-host x.183.133.178 object

network-host x.183.133.179 object

network-host x.183.133.181 object

network-host x.183.133.182 object

the LDAP_source_networks object-group network

network-object 135.196.24.192 255.255.255.240

<--- more="" ---="">

object-network 195.130.x.0 255.255.255.0

network-object x.2.3.128 255.255.255.192

network-object 213.235.63.64 255.255.255.192

object-network 91.220.42.0 255.255.255.0

object-network 94.x.240.0 255.255.255.0

object-network 94.x.x.0 255.255.255.0

the c2si_Allow object-group network

host of the object-Network 10.5.16.1

host of the object-Network 10.5.21.1

network-object object c2si

the DM_INLINE_NETWORK_2 object-group network

network-object 10.5.20.0 255.255.254.0

object-network 10.5.21.0 255.255.255.0

object-network 10.5.22.0 255.255.255.0

object-network 10.5.29.0 255.255.255.0

network-object, object NETWORK_OBJ_10.5.19.0_24

the DM_INLINE_NETWORK_3 object-group network

object-network 10.5.19.0 255.255.255.0

network-object 10.5.20.0 255.255.254.0

object-network 10.5.21.0 255.255.255.0

object-network 10.5.22.0 255.255.255.0

atanta network-object

the DM_INLINE_NETWORK_4 object-group network

network-object 10.5.20.0 255.255.254.0

<--- more="" ---="">

object-network 10.5.21.0 255.255.255.0

object-network 10.5.22.0 255.255.255.0

object-network 10.5.23.0 255.255.255.0

object-network 10.5.30.0 255.255.255.0

network-object, object NETWORK_OBJ_10.5.19.0_24

atanta network-object

network-object DS365-Cloud

inside_access_in list extended access permit tcp any eq 50 Sure_Signal object-group

inside_access_in list extended access permit tcp any object-group Sure_Signal eq pptp

inside_access_in list extended access permits will all object-group Sure_Signal

inside_access_in list extended access permit udp any eq ntp Sure_Signal object-group

inside_access_in access list extended icmp permitted no echo of Sure_Signal object-group

inside_access_in list extended access permit udp any eq 50 Sure_Signal object-group

inside_access_in list extended access permit udp any eq Sure_Signal object-group 4500

inside_access_in list extended access permit udp any eq isakmp Sure_Signal object-group

inside_access_in of access allowed any ip an extended list

255.255.0.0 allow access list extended ip 10.5.0.0 clientvpn 10.5.30.0 255.255.255.0

access-list extended BerkeleyAdmin-clientvpn ip 10.5.0.0 allow 255.255.0.0 10.5.30.0 255.255.255.0

IP 10.5.21.0 allow to Access-list BerkeleyUser-clientvpn extended 255.255.255.0 10.5.30.0 255.255.255.0

outside_cryptomap extended access list permit ip object inside-network-16 10.5.25.0 255.255.255.0

access extensive list ip 10.5.29.0 guest_access_in allow 255.255.255.0 any

state_bypass allowed extended access list tcp 192.168.100.0 255.255.255.0 10.5.30.0 255.255.255.0 connect

state_bypass allowed extended access list tcp 10.5.30.0 255.255.255.0 192.168.100.0 255.255.255.0 connect

state_bypass allowed extended access list tcp 10.5.29.0 255.255.255.0 10.5.30.0 255.255.255.0 connect

<--- more="" ---="">

state_bypass allowed extended access list tcp 10.5.30.0 255.255.255.0 10.5.29.0 255.255.255.0 connect

outside_access_in list extended access permit icmp any one

access extensive list ip 10.5.16.0 outside_cryptomap_1 allow 255.255.240.0 10.5.16.0 255.255.255.192

access-list extended global_access permitted tcp object-group LDAP_source_networks host 10.5.21.1 eq ldap

access extensive list 10.5.0.0 ip outside_cryptomap_2 255.255.0.0 allow object DS365-Cloud

outside_cryptomap_3 list extended access allowed object-group ip DM_INLINE_NETWORK_4 10.5.25.0 255.255.255.0

pager lines 24

Enable logging

exploitation forest-size of the buffer of 100000

recording of debug console

debug logging in buffered memory

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

IP local pool clientvpn 10.5.30.1 - 10.5.30.100

mask 172.16.254.1 - 172.16.254.100 255.255.255.0 IP local pool VPN_IP_Pool

no failover

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ICMP allow all outside

don't allow no asdm history

ARP timeout 14400

NAT (inside, outside) source static rfc1918 rfc1918 destination rfc1918 static rfc1918

NAT (inside, outside) static source NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.31.0_24 NETWORK_OBJ_10.5.31.0_24 non-proxy-arp-search of route static destination

<--- more="" ---="">

NAT (inside, outside) static source NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 non-proxy-arp-search of route static destination

NAT (inside, outside) static source to the static inside-network-16 inside-network-16 destination DS365-DS365-cloud no-proxy-arp-route search

NAT (inside, outside) static source DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 NETWORK_OBJ_172.16.254.0_25 NETWORK_OBJ_172.16.254.0_25 non-proxy-arp-search of route static destination

NAT (inside, outside) static source NETWORK_OBJ_10.5.16.0_20 NETWORK_OBJ_10.5.16.0_20 NETWORK_OBJ_10.5.16.0_26 NETWORK_OBJ_10.5.16.0_26 non-proxy-arp-search of route static destination

NAT (inside, outside) source static c2si_Allow c2si_Allow NETWORK_OBJ_172.16.254.0_25 NETWORK_OBJ_172.16.254.0_25 non-proxy-arp-search of route static destination

NAT (inside, outside) source static atanta atanta static destination NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search to itinerary

NAT (inside, outside) static source DS365-DS365-cloud static destination NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search to itinerary

NAT (inside, outside) static source DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search of route static destination

NAT (inside, outside) static source NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 static destination DS365-DS365-cloud no-proxy-arp-route search

NAT (inside, outside) static source DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3 static destination DS365-DS365-cloud no-proxy-arp-route search

NAT (inside, outside) static source to the inside-network-16 inside-network-16 destination static NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search to itinerary

NAT (inside, outside) static source DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search of route static destination

network obj_any object

NAT dynamic interface (indoor, outdoor)

network of the LDAP_DC7 object

NAT 194.247.x.19 static (inside, outside) tcp ldap ldap service

inside_access_in access to the interface inside group

Access-group outside_access_in in interface outside

Access-Group global global_access

Router eigrp 143

No Auto-resume

Network 10.5.19.0 255.255.255.0

<--- more="" ---="">

Network 10.5.29.0 255.255.255.0

Network 10.5.30.0 255.255.255.0

redistribute static

Route outside 0.0.0.0 0.0.0.0 194.247.x.17 1 track 1

Route inside 10.5.16.0 255.255.255.0 10.5.19.252 1

Timeout xlate 03:00

Pat-xlate timeout 0:00:30

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

RADIUS protocol for AAA-server group

AAA (inside) 10.5.21.1 host server group

key *.

AAA (inside) 10.5.16.1 host server group

key *.

identity of the user by default-domain LOCAL

the ssh LOCAL console AAA authentication

AAA authentication LOCAL telnet console

Enable http server

<--- more="" ---="">

http 192.168.1.0 255.255.255.0 inside

http 10.5.16.0 255.255.240.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

Sysopt connection tcpmss 1350

SLA 1 monitor

type echo protocol ipIcmpEcho 8.8.4.4 outside interface

SLA monitor Appendix 1 point of life to always start-time now

Crypto ipsec transform-set ikev1 strong-comp esp-aes-256 esp-sha-hmac

Crypto ipsec ikev1 transform-set strong aes-256-esp esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

Crypto ipsec ikev2 strong ipsec proposal

Protocol esp encryption aes-256

Esp integrity sha-1 protocol

<--- more="" ---="">

Crypto ipsec ikev2 AES256 ipsec-proposal

Protocol esp encryption aes-256

Esp integrity sha - 1, md5 Protocol

Crypto ipsec ikev2 ipsec-proposal AES192

Protocol esp encryption aes-192

Esp integrity sha - 1, md5 Protocol

Crypto ipsec ikev2 ipsec-proposal AES

Esp aes encryption protocol

Esp integrity sha - 1, md5 Protocol

Crypto ipsec ikev2 proposal ipsec 3DES

Esp 3des encryption protocol

Esp integrity sha - 1, md5 Protocol

Crypto ipsec ikev2 ipsec-proposal OF

encryption protocol esp

Esp integrity sha - 1, md5 Protocol

Crypto-map dynamic dyn1 1 set transform-set ikev1 strong

1 correspondence address outside_cryptomap_1 outside crypto map

crypto card outside pfs set 1

1 set 83.x.172.68 counterpart outside crypto map

Crypto card outside 1 set transform-set ESP-AES-256-SHA ikev1

1 set ikev2 AES256 ipsec-proposal outside crypto map

card crypto off game 2 address outside_cryptomap_3

map external crypto 2 peers set 23.100.x.177

card external crypto 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5

<--- more="" ---="">

map external crypto 2 set AES256 AES192 AES strong proposal ipsec ikev2

Crypto card outside 2 kilobytes of life of security association set 102400000

card crypto outside match 3 address outside_cryptomap_2

3 set pfs outside crypto map

map external crypto 3 peers set 91.x.3.39

crypto card outside ikev1 set 3 transform-set ESP-3DES-SHA

map external crypto 3 3DES ipsec-ikev2 set proposal

dynamic outdoor 100 dyn1 ipsec-isakmp crypto map

card crypto outside interface outside

Crypto ca trustpoint _SmartCallHome_ServerCA

Configure CRL

IKEv2 crypto policy 1

aes-256 encryption

integrity sha

Group 2

FRP sha

second life 86400

IKEv2 crypto policy 10

aes-192 encryption

integrity sha

Group 2 of 5

FRP sha

second life 86400

IKEv2 crypto policy 20

aes encryption

integrity sha

Group 2 of 5

FRP sha

second life 86400

IKEv2 crypto policy 30

3des encryption

integrity sha

Group 2 of 5

FRP sha

second life 86400

IKEv2 crypto policy 40

the Encryption

integrity sha

Group 2 of 5

FRP sha

second life 86400

Crypto ikev2 allow outside

Crypto ikev1 allow outside

IKEv1 crypto policy 1

preshared authentication

aes-256 encryption

sha hash

Group 2

lifetime 28800

IKEv1 crypto policy 2

preshared authentication

3des encryption

sha hash

Group 2

life 86400

track 1 rtr 1 accessibility

Telnet 10.5.16.0 255.255.240.0 inside

Telnet timeout 5

SSH 83.x.x.90 255.255.255.255 outside

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

dhcprelay Server 10.5.21.1 on the inside

time-out of 60 dhcprelay

a basic threat threat detection

statistical threat detection port

<--- more="" ---="">

Statistical threat detection Protocol

Statistics-list of access threat detection

no statistical threat detection tcp-interception

NTP 10.5.19.253 Server prefer

WebVPN

allow outside

AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

AnyConnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 2

AnyConnect enable

tunnel-group-list activate

attributes of Group Policy DfltGrpPolicy

Ikev1 VPN-tunnel-Protocol l2tp ipsec without ssl-client

internal GroupPolicy_c2si group strategy

attributes of Group Policy GroupPolicy_c2si

WINS server no

value of 10.5.16.1 DNS server 10.5.21.1

client ssl-VPN-tunnel-Protocol

by default no

internal GroupPolicy_91.x.3.39 group strategy

attributes of Group Policy GroupPolicy_91.x.3.39

VPN-tunnel-Protocol ikev1, ikev2

internal GroupPolicy_83.x.172.68 group strategy

attributes of Group Policy GroupPolicy_83.x.172.68

VPN-tunnel-Protocol ikev1, ikev2

<--- more="" ---="">

internal GroupPolicy_23.100.x.177 group strategy

attributes of Group Policy GroupPolicy_23.100.x.177

VPN-tunnel-Protocol ikev1, ikev2

internal GroupPolicy_user group strategy

attributes of Group Policy GroupPolicy_user

WINS server no

value of 10.5.21.1 DNS server 10.5.16.1

client ssl-VPN-tunnel-Protocol

Split-tunnel-policy tunnelspecified

Split-tunnel-network-list value BerkeleyAdmin-clientvpn

myberkeley.local value by default-field

internal GroupPolicy_23.101.x.122 group strategy

attributes of Group Policy GroupPolicy_23.101.x.122

VPN-tunnel-Protocol ikev1, ikev2

internal GroupPolicy1 group strategy

attributes of Group Policy GroupPolicy1

VPN-tunnel-Protocol ikev1, ikev2

internal BerkeleyUser group strategy

attributes of Group Policy BerkeleyUser

value of 10.5.21.1 DNS server 10.5.16.1

Split-tunnel-policy tunnelspecified

Split-tunnel-network-list value BerkeleyUser-clientvpn

myberkeley.local value by default-field

internal DS365 group policy

<--- more="" ---="">

DS365 group policy attributes

VPN-idle-timeout no

VPN-filter no

IPv6-vpn-filter no

VPN-tunnel-Protocol ikev1, ikev2

internal BerkeleyAdmin group strategy

attributes of Group Policy BerkeleyAdmin

value of 10.5.21.1 DNS server 10.5.16.1

Split-tunnel-policy tunnelspecified

Split-tunnel-network-list value BerkeleyAdmin-clientvpn

myberkeley.local value by default-field

acsadmin encrypted V6hUzNl366K37eiV privilege 15 password username

atlanta uxelpvEvM3I7tw.Z encrypted privilege 15 password username

username of berkeley Kj.RBvUp5dtyLw5T encrypted password

type tunnel-group BerkeleyUser remote access

attributes global-tunnel-group BerkeleyUser

address clientvpn pool

authentication-server-group

Group Policy - by default-BerkeleyUser

IPSec-attributes tunnel-group BerkeleyUser

IKEv1 pre-shared-key *.

type tunnel-group BerkeleyAdmin remote access

attributes global-tunnel-group BerkeleyAdmin

address clientvpn pool

<--- more="" ---="">

authentication-server-group

Group Policy - by default-BerkeleyAdmin

IPSec-attributes tunnel-group BerkeleyAdmin

IKEv1 pre-shared-key *.

type tunnel-group user remote access

tunnel-group user General attributes

address pool VPN_IP_Pool

authentication-server-group

Group Policy - by default-GroupPolicy_user

tunnel-group user webvpn-attributes

enable-alias of user group

type tunnel-group c2si remote access

tunnel-group c2si-global attributes

address pool VPN_IP_Pool

authentication-server-group

Group Policy - by default-GroupPolicy_c2si

tunnel-group c2si webvpn-attributes

Group-alias c2si enable

tunnel-group 83.x.172.68 type ipsec-l2l

tunnel-group 83.x.172.68 General-attributes

Group - default policy - GroupPolicy_83.x.172.68

83.x.172.68 group of tunnel ipsec-attributes

IKEv1 pre-shared-key *.

remote control-IKEv2 pre-shared-key authentication *.

<--- more="" ---="">

pre-shared-key authentication local IKEv2 *.

tunnel-group 23.101.x.122 type ipsec-l2l

tunnel-group 23.101.x.122 General-attributes

Group - default policy - GroupPolicy_23.101.x.122

23.101.x.122 group of tunnel ipsec-attributes

IKEv1 pre-shared-key *.

remote control-IKEv2 pre-shared-key authentication *.

pre-shared-key authentication local IKEv2 *.

tunnel-group 91.x.3.39 type ipsec-l2l

tunnel-group 91.x.3.39 general-attributes

Group - default policy - GroupPolicy_91.x.3.39

91.x.3.39 group of tunnel ipsec-attributes

IKEv1 pre-shared-key *.

remote control-IKEv2 pre-shared-key authentication *.

pre-shared-key authentication local IKEv2 *.

tunnel-group 23.100.x.177 type ipsec-l2l

tunnel-group 23.100.x.177 General-attributes

Group - default policy - GroupPolicy_23.100.63.177

23.100.x.177 group of tunnel ipsec-attributes

IKEv1 pre-shared-key *.

remote control-IKEv2 pre-shared-key authentication *.

pre-shared-key authentication local IKEv2 *.

class-map state_bypass

corresponds to the state_bypass access list

Policy-map state_bypass_policy

class state_bypass

set the advanced options of the tcp-State-bypass connection

service-policy state_bypass_policy to the inside interface

context of prompt hostname

anonymous reporting remote call

Cryptochecksum:bbc6f2ec2db9b09a1b6eb90270ddfeea

: end

PTB-ch-asa5505 #.

Ah OK I see now.

Your cryptomap for the cloud of DS365 is:

access extensive list 10.5.0.0 ip outside_cryptomap_2 255.255.0.0 allow object DS365-Cloud

so, which covers interesting traffic.

However, your NAT statement is:

NAT (inside, outside) static source NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 static destination DS365-DS365-cloud no-proxy-arp-route search

Network 10.5.25.0 is remote, then it will actually appear to be an "outside" network so I think you need this statement to begin "nat (outside, outside).

ASA (8.03) context single mode can support the limits on resources?

I have double ASA with v8.03 and I want to limit resources for SSH, telnet and ASDM sessions.

By checking the Cisoco document, I can handle test to limit the resources with the commands below. But they can't do that after you have enabled multiple context mode.

default class
limited resources all 0
SSH 2 resources
2 limit-resources of the ASDM
2 resources limit of Telnet

Can anyone help answer if we use "limit-resource" in the single context (without activating the mode multi context)? Or any other way to limit the resources?

Hello.

In simple mode, the limit is 5 maximum sessions. It is not possible to change.

Kind regards

Fadi.

Does that answer your question? If Yes please mark he replied.

ASA 5510 - possible to fill the 2 interfaces in routed mode

Cisco ASA 5510 with security more license, version 9.1 (5) running in routed mode.

I want to fill two interfaces for example: eth0/2 and 3/eth0 and configure an IP address / network while leaving the ASA 5510 in routed mode. I know that this is possible in transparent mode, but I need to keep this in routed mode. I know I could configure a single interface and connect a switch but my client does not want to do.

Otherwise, my only thought would be to configure each interface eth0/2 and eth0/3 as a network traffic and the route of subnet separate between the two.

Any help would be appreciated!

Thank you

Andrew

Andrew

That would help us answer you better if we understood more about what your client and you want to accomplish. But to answer the specific question you asked, I don't think it is possible in an ASA5510 in routed mode configuration Eth2 and Eth3 to share a single IP address.

Linking to Eth2 and linking to Eth3 Are they really the same subnet?

HTH

Rick

Block the specific IP traffic in ASA 5505

Hi, we have an ASA 5505 in transparent mode and run a web service online. However, we notice a number of attempts to intrution from China and Korea and we need to block these IP traffic can anyone help please?

config script is

transparent firewall

hostname xxyyASA

Select msi14F/SlH4ZLjHH of encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Ethernet0/0

Description - the Internet-

switchport access vlan 2

!

interface Ethernet0/1

Description - connected to the LAN-

!

interface Ethernet0/2

!

interface Ethernet0/3

Shutdown

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

Bridge-Group 1

security-level 100

!

interface Vlan2

nameif outside

Bridge-Group 1

security-level 0

!

interface BVI1

Description - for management only-

IP address xxx.yyy.zzz.uuu 255.255.xxx.yyy

!

passive FTP mode

network of the WWW-SERVER-OBJ object

Home xxx.yyy.zzz.jjj

Description - webserver-

WWW-SERVER-SERVICES-TCP-OBJ tcp service object-group

Description - Services published on the WEB server-

WWW-SERVER-SERVICES-UDP-OBJ udp service object-group

Description - Services published on the WEB server - UDP

Beach of port-object 221 225

1719-1740 object-port Beach

OUTSIDE-IN-ACL scope tcp access list deny any any eq 3306

OUTSIDE-IN-ACL scope tcp access list deny any any eq telnet

OUTSIDE-IN-ACL scopes allowed icmp an entire access list

OUTSIDE-IN-ACL scopes permitted tcp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-TCP-OBJ

access list OUTSIDE-IN-ACL scopes permit tcp host xxx.yyy.zzz.uuu object WWW-SERVER-OBJ eq 3306

OUTSIDE-IN-ACL scopes permitted udp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-UDP-OBJ

We need to block access of host say 64.15.152.208

Just need the best step to follow and block access, without affecting the service or other host

Thank you

Insert a line like:

OUTSIDE-IN-ACL scope access list deny host ip 64.15.152.208 all

in front of your 3rd line "... to enable icmp a whole."

If you have many of them, maybe do:

object-group network blacklist

host of the object-Network 64.15.152.208

network-host another.bad.ip.here object

object-network entire.dubious.subnet.here 255.255.255.0

...

OUTSIDE-IN-ACL scope object-group BLACKLIST ip deny access list all

If you want to take in scores of reputation on the outside, or the blacklist changes a lot, you might look into the Cisco ASA IPS module.

Note that fleeing bad hosts help with targeted attacks, but not with denial of service; only, he moves to point decline since the application for the firewall server, without much effect on the net on your uplink bandwidth consumption.

-Jim Leinweber, WI State Lab of hygiene

ASA 5505 TFTP to one subnet to another creates the empty file

Hello world

The Cisco ASA 5505 does not seem to allow the TFTP connection between 192.168.5.103/24 and 192.168.10.202/24. TFTP is normally used in the same subnet, but not in my case. I have a DHCP relay that works, but when I use the free tool from one side to the other tool TFTPD TFTPD, it creates an empty file. Anyone know what config I could be missing in my Cisco ASA?

Thank you in advance.

---

Nathan

Hi Jonathan,.

1. check that tftp server is using the correct interface of the given subnet. (under Server Interfaces on tftpd32)

2. check if the default gateway have a correct route to the TFTP server.

3 make sure that TFTP server can reach the subnet of the client.

HTH

ASA 5505 in router Mode can implement the MAC ACL

Similar Questions

Maybe you are looking for