ASA 5505 problem getting started

Hello

New on the firewall:

I set the ASA to factory default using the default configuration. Then, I plugged my PC on port 7 and Comcast modem into port 0 and got a 192.168.1.2 ip address of my PC. In addition, configured the dhcp protocol to give the dns addresses. Changed the address of the external interface to my static address has been assigned, but still cannot ping the outside interface or Google from PC. Oh, also, between the bulkhead firewall I can ping the address of the gateway-Comcast but no further.

Where should I start to get this thing working?

Thank you, Pat.

Hello

To be honest, I have not tried.

I also have an ASA 5505 with Base license at home but I have no need of a DMZ in my network so I have not tried.

You can always make a list of your INSIDE interface access and manage traffic with it. Its the most frequent way atleast.

You could basically make following simple configurations

Note to INTERIOR-IN access list block inside the DMZ traffic

access list for the INTERIOR-IN deny ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

Note to access the INSIDE-IN list allow other traffic

access list for the INTERIOR-IN permit ip 192.168.1.0 255.255.255.0 any

group-access INTERIOR-IN in the interface inside

The foregoing indicates the following things:

INTERIOR-IN is the name of the access list
Lines of comments in the list to just provide a brief description of the rule below
- You can insert these comments (or lines to permit/deny) in different locations using the 'line' after the name of the access list
- For example ' Access-list INTERIOR-IN line 1 note ' add a comment line at the top of the list.
- On the CLI, the line numbers are visible when you issue the 'show access-list '. 'show access-list of execution' will not show line numbers
The line deny stipulates that all TCP/UDP traffic from INSIDE network to the DMZ network range range is denied at the entrance to the interface of the firewall to the inside
The line permit allows all traffic from INSIDE network to any other network range. (Essentially allow all traffic to the OUTSIDE interface that all traffic to the DMZ has been refused right on the previous line in the access list.
The Access-group line attaches to the access list named INTERIOR-IN to the interface inside
- The parameter and indicates the direction of the access list is applied
- In this case its traffic that enters the inside interface

-Jouni

Tags: Cisco Security

Similar Questions

Problem getting started

So, it's a little awkward for me, I've been a professional programmer for almost a decade now, but I'm unable to start even with developing my first plugin. I'll try to be as complete as possible in my description, in which case the problem is in the version of VS, misconfiguration, or like that stupid user error. Is the short version of my problem: I can't even generates the famous skeleton project.
I have AE CS3, so which is the SDK I downloaded and I develop on Win 7 64 using Visual Studio 2010 Express Edition.
I copied the project skeleton and renamed all the files (changin skeleton in my name of the project), then do a case sensitive search-replace ProjectName skeleton and SKELETON of PROJECTNAME. I did the renaming via Visual Studio find and replace, without a solution open, looking across *. * in the Projname directory. Then I opened the sln file and it improved the format VS 7.1 to 10 VS.
I then looked in the parameters of the project and concluded that the other directories Include several entries in the form of "... /.. '. /.. ' / Include '. I had put my copy of the skeleton in a directory where I normally keep my programming projects (IE, not in the SDK directory), so I changed all these entries to absolute paths. Then, to be double sure, I added the SDK directories "Include" and "Useful" for "Directories Include" project.
When I Isaiah to compile, I get two errors, saying: he can not build the PiPL.r and PiPL.rrc files (I don't remember the file name right something like ProjectName_PiPL.*) because it can't find the specified files. The caviggia file exists, but not the file .rrc (a .rc file done, but not a .rrc). In addition, I can't find anything on a .rrc file in the documentation and cannot find any information on basic information of type "How do I Setup build the SDK in Visual Studio" in the documentation or on the web. I also looked for the custom build steps that are trying to build these files, but cannot find them. Before each file, the output window says something like "Building the PiPLs" and when I search for this text, it is in the project file, but when I check the steps custom build and events sections in the properties, they are all empty.
I was able to create the effect that I desired for most using expressions in AE, but I could do better as a plugin, and I am really angry that I can't solve this fundamental problem.
Thanks for listening!

Usually, the PiPLs have directories of the different path and they are built using the custom build tool. If you get an error "Betty file is missing", then right-click on the PiPL.r file and go to step (I'm not on a machine windows at the moment, so not sure that one) command line generation / custom and then you can see the arguments that are used to compile the PiPL. So to change paths according to your directory structure and rebuild the project.

In addition, it is not at all advantageous to use absolute paths. Once your project is complicated, there are a lot of hell of a trouble to arrange things. I just copy the entire folder of the SDK for my programming 'place' and work from there. Hope that helps.

Problem getting started with Exportpdf

Hello
Subscribed only to Exportpdf, confirmation that you receive. Once in the program I can get my pdf. file to appear. I check the box. Now what should I do? It's surprisingly not at all intuitive. Not good if you're in a hurry, who I am. The tutorial video showed a different move that I don't see on my screen. Help, please.

Wrong forum.

ExportPDF, as one of the offered Adobe Document Services Acrobat.com subscription has its user forum at:

Document PDF of Cloud services

Be well...

Problem getting started with creative cloud

After the end of my trial, I started a subscription to creative cloud. Various applications see the they are to day, but where are the downloaded apps? I can't find one any of them to start. The trial has been so easy.

Which operating system are you on?

Under Windows, you should be able to launch programs from the start menu. On Mac OS X, you should be able to launch programs from the Applications folder. Links to launch in Adobe Application Manager (AAM) are just a convenience link to use after the initial install. These links disappear after reboot of AAM.

Problems getting started using Variables and data sets

Hello
I am new to this forum and new with scripts in Illustrator and scripts in general.
I have an XML file that contains a number of data sets each composed of a number of text variables that I want to use to create a trading card game.
Each trading card consists of a text field for the title of the map and a number of icons, which are instances of different symbols
I wrote a script to create each map and I can load variables in my using javascript: newCard.importVariables (news leader (xmlPath));
Now, I need to access the data in the data sets to power the card.
To provide some context, it's a picture of one of the cards with the art of the placeholder:
Currently, for the icon in the upper right corner (the PHASE icon), I use the following code:
phase = "night";
phaseIcon = newCard.symbols.getByName (phase);
phaseIcon1 = newCard.symbolItems.add (phaseIcon);
phaseIcon1.top = 232;
phaseIcon1.left = 140;
I want to be able to do, is to shoot the value during the phase of <>< / phase > TextVariable my dataset XML and insert that into the script, but I don't know how. This is where I'm stuck on how to proceed. Any help is greatly appreciated.
Thank you
Nick

OK, so it takes data sets to be able to get the data of type string, right? This has proved not to be as easy as it seemed

-----------------

then to get string data that you used the XML to the file instead, your last sample seems fine, I did the same thing then you posted your sample, I used the xml file
```
var xmlfile = File.openDialog("Select a valid XML file","XML:*.xml", false);
if(xmlfile != null) {
    xmlfile.open("r");
    var xmlstring = xmlfile.read();
    xmlfile.close();
    xmlfile = null;
} else {
alert("Error opening XML file.");
}
var wolfCardsXML = new XML (xmlstring);
var currentCard = wolfCardsXML.card[0];
var phaseValue = currentCard.phase.toString();

alert(phaseValue);
```

Problem with ASA 5505 VPN remote access

After about 1 year to have the VPN Client from Cisco connection to an ASA 5505 with no problems, all of a sudden one day it stops working. The customer is able to get a connection to the ASA and browse the local network for only about 30 seconds after the connection. After that, no access is available to the network behind the ASA. I have tried everything I can think of to try to solve the problem, but at this point, I'm just banging my head against a wall. Anyone know what could cause this?

Here is the cfg running of the ASA

----------------------------------------------------------------------------------------

: Saved

:

ASA Version 8.4 (1)

!

hostname NCHCO

enable encrypted password xxxxxxxxxxxxxxx

xxxxxxxxxxx encrypted passwd

names of

description of NCHCO name 192.168.2.0 City offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address **. ***. 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

boot system Disk0: / asa841 - k8.bin

passive FTP mode

network of the NCHCO object

Subnet 192.168.2.0 255.255.255.0

network object obj - 192.168.1.0

subnet 192.168.1.0 255.255.255.0

network object obj - 192.168.2.64

subnet 192.168.2.64 255.255.255.224

network object obj - 0.0.0.0

subnet 0.0.0.0 255.255.255.0

network obj_any object

subnet 0.0.0.0 0.0.0.0

the Web server object network

the FINX object network

Home 192.168.2.11

rdp service object

source between 1-65535 destination eq 3389 tcp service

Rdp description

outside_nat0_outbound extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

outside_nat0_outbound extended access list permit ip object NCHCO 192.168.2.0 255.255.255.0

inside_nat0_outbound extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

inside_nat0_outbound list of allowed ip extended access all 192.168.2.64 255.255.255.224

permit access list extended ip 0.0.0.0 inside_nat0_outbound 255.255.255.0 192.168.2.64 255.255.255.224

outside_1_cryptomap extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

outside_1_cryptomap_1 extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

LAN_Access list standard access allowed 192.168.2.0 255.255.255.0

LAN_Access list standard access allowed 0.0.0.0 255.255.255.0

NCHCO_splitTunnelAcl_1 list standard access allowed 192.168.2.0 255.255.255.0

AnyConnect_Client_Local_Print deny ip extended access list a whole

AnyConnect_Client_Local_Print list extended access permit tcp any any eq lpd

Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 631

print the access-list AnyConnect_Client_Local_Print Note Windows port

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

AnyConnect_Client_Local_Print list extended access permit udp any host 224.0.0.251 eq 5353

AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

AnyConnect_Client_Local_Print list extended access permit udp any host 224.0.0.252 eq 5355

Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 137

AnyConnect_Client_Local_Print list extended access udp allowed any any eq netbios-ns

outside_access_in list extended access permit tcp any object FINX eq 3389

outside_access_in_1 list extended access allowed object rdp any object FINX

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

mask of VPN_Pool VPN_Start VPN_End of local pool IP 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 649.bin

don't allow no asdm history

ARP timeout 14400

NAT (inside, all) static source NCHCO destination NCHCO static obj - 192.168.1.0 obj - 192.168.1.0

NAT (inside, all) static source any any destination static obj - 192.168.2.64 obj - 192.168.2.64

NAT (inside, all) source static obj - 0.0.0.0 0.0.0.0 - obj destination static obj - 192.168.2.64 obj - 192.168.2.64

!

network obj_any object

NAT dynamic interface (indoor, outdoor)

the FINX object network

NAT (inside, outside) interface static service tcp 3389 3389

Access-group outside_access_in_1 in interface outside

Route outside 0.0.0.0 0.0.0.0 69.61.228.177 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

network-acl outside_nat0_outbound

WebVPN

SVC request to enable default svc

Enable http server

http 192.168.1.0 255.255.255.0 inside

http *. **. ***. 255.255.255.255 outside

http *. **. ***. 255.255.255.255 outside

http NCHCO 255.255.255.0 inside

http 96.11.251.186 255.255.255.255 outside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac ikev1 l2tp-transform

IKEv1 crypto ipsec transform-set l2tp-transformation mode transit

Crypto ipsec transform-set vpn-transform ikev1 esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA ikev1

transport mode encryption ipsec transform-set TRANS_ESP_3DES_SHA ikev1

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5 ikev1

transport mode encryption ipsec transform-set TRANS_ESP_3DES_MD5 ikev1

Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set pfs Group1

crypto dynamic-map dyn-map 10 set transform-set l2tp vpn-transform processing ikev1

dynamic-map encryption dyn-map 10 value reverse-road

Crypto-map dynamic outside_dyn_map 20 set transform-set ESP-3DES-SHA ikev1

Crypto-map dynamic outside_dyn_map 20 the value reverse-road

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs Group1

peer set card crypto outside_map 1 74.219.208.50

card crypto outside_map 1 set transform-set ESP-3DES-SHA ikev1

map outside_map 20-isakmp ipsec crypto dynamic outside_dyn_map

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

inside crypto map inside_map interface

card crypto vpn-map 1 match address outside_1_cryptomap_1

card crypto vpn-card 1 set pfs Group1

set vpn-card crypto map peer 1 74.219.208.50

card crypto 1 set transform-set ESP-3DES-SHA ikev1 vpn-map

dynamic vpn-map 10 dyn-map ipsec isakmp crypto map

crypto isakmp identity address

Crypto ikev1 allow inside

Crypto ikev1 allow outside

IKEv1 crypto ipsec-over-tcp port 10000

IKEv1 crypto policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

IKEv1 crypto policy 15

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

IKEv1 crypto policy 35

preshared authentication

3des encryption

sha hash

Group 2

life 86400

enable client-implementation to date

Telnet 192.168.1.0 255.255.255.0 inside

Telnet NCHCO 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH NCHCO 255.255.255.0 inside

SSH timeout 5

Console timeout 0

dhcpd address 192.168.2.150 - 192.168.2.225 inside

dhcpd dns 216.68.4.10 216.68.5.10 interface inside

lease interface 64000 dhcpd inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server DNS 192.168.2.1

L2TP ipsec VPN-tunnel-Protocol ikev1

nchco.local value by default-field

attributes of Group Policy DfltGrpPolicy

value of server DNS 192.168.2.1

L2TP ipsec VPN-tunnel-Protocol ikev1 ssl-clientless ssl-client

allow password-storage

enable IPSec-udp

enable dhcp Intercept 255.255.255.0

the address value VPN_Pool pools

internal NCHCO group policy

NCHCO group policy attributes

value of 192.168.2.1 DNS Server 8.8.8.8

Ikev1 VPN-tunnel-Protocol

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list NCHCO_splitTunnelAcl_1

value by default-field NCHCO.local

admin LbMiJuAJjDaFb2uw encrypted privilege 15 password username

username privilege 15 encrypted password yB1lHEVmHZGj5C2Z 8njferg

username NCHvpn99 password dhn. JzttvRmMbHsP encrypted

attributes global-tunnel-group DefaultRAGroup

address (inside) VPN_Pool pool

address pool VPN_Pool

authentication-server-group (inside) LOCAL

authentication-server-group (outside LOCAL)

LOCAL authority-server-group

authorization-server-group (inside) LOCAL

authorization-server-group (outside LOCAL)

Group Policy - by default-DefaultRAGroup

band-Kingdom

band-band

IPSec-attributes tunnel-group DefaultRAGroup

IKEv1 pre-shared-key *.

NOCHECK Peer-id-validate

tunnel-group DefaultRAGroup ppp-attributes

No chap authentication

no authentication ms-chap-v1

ms-chap-v2 authentication

tunnel-group DefaultWEBVPNGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

tunnel-group 74.219.208.50 type ipsec-l2l

IPSec-attributes tunnel-group 74.219.208.50

IKEv1 pre-shared-key *.

type tunnel-group NCHCO remote access

attributes global-tunnel-group NCHCO

address pool VPN_Pool

Group Policy - by default-NCHCO

IPSec-attributes tunnel-group NCHCO

IKEv1 pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

call-home

Profile of CiscoTAC-1

no active account

http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

email address of destination [email protected] / * /

destination-mode http transport

Subscribe to alert-group diagnosis

Subscribe to alert-group environment

Subscribe to alert-group monthly periodic inventory

monthly periodicals to subscribe to alert-group configuration

daily periodic subscribe to alert-group telemetry

Cryptochecksum:a2110206e1af06974c858fb40c6de2fc

: end

ASDM image disk0: / asdm - 649.bin

ASDM VPN_Start 255.255.255.255 inside location

ASDM VPN_End 255.255.255.255 inside location

don't allow no asdm history

---------------------------------------------------------------------------------------------------------------

And here are the logs of the Cisco VPN Client when sailing, then is unable to browse the network behind the ASA:

---------------------------------------------------------------------------------------------------------------

Cisco Systems VPN Client Version 5.0.07.0440

Copyright (C) 1998-2010 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.1.7601 Service Pack 1

Config files directory: C:\Program Files (x 86) \Cisco Systems\VPN Client\

1 09:44:55.677 01/10/13 Sev = Info/6 CERT / 0 x 63600026

Try to find a certificate using hash Serial.

2 09:44:55.677 01/10/13 Sev = Info/6 CERT / 0 x 63600027

Found a certificate using hash Serial.

3 09:44:55.693 01/10/13 Sev = Info/6 GUI/0x63B00011

RELOADED successfully certificates in all certificate stores.

4 09:45:02.802 10/01/13 Sev = Info/4 CM / 0 x 63100002

Start the login process

5 09:45:02.802 01/10/13 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

6 09:45:02.802 01/10/13 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "*." **. ***. *** »

7 09:45:02.802 10/01/13 Sev = Info/6 IKE/0x6300003B

Try to establish a connection with *. **. ***. ***.

8 09:45:02.818 10/01/13 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

9 09:45:02.865 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) to *. **. ***. ***

10 09:45:02.896 10/01/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

11 09:45:02.896 10/01/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

12 09:45:02.896 10/01/13 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

13 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

14 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

15 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

16 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

17 09:45:02.927 01/10/13 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

18 09:45:02.927 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) to *. **. ***. ***

19 09:45:02.927 01/10/13 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xDD3B, Remote Port = 0x01F4

20 09:45:02.927 01/10/13 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is NOT behind a NAT device

21 09:45:02.927 01/10/13 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

22 09:45:02.943 10/01/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

23 09:45:02.943 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

24 09:45:02.943 01/10/13 Sev = Info/4 CM / 0 x 63100015

Launch application xAuth

25 09:45:03.037 01/10/13 Sev = Info/6 GUI/0x63B00012

Attributes of the authentication request is 6: 00.

26 09:45:03.037 01/10/13 Sev = Info/4 CM / 0 x 63100017

xAuth application returned

27 09:45:03.037 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

28 09:45:03.037 10/01/13 Sev = Info/4 IPSEC / 0 x 63700008

IPSec driver started successfully

29 09:45:03.037 01/10/13 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

30 09:45:03.083 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

31 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

32 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

33 09:45:03.083 01/10/13 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

34 09:45:03.083 01/10/13 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

35 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

36 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

37 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="" **.**.***.***="" isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

38 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 192.168.2.70

39 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.255.0

40 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 192.168.2.1

41 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 8.8.8.8

42 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000001

43 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

44 09:45:03.146 10/01/13 Sev = Info/5 IKE/0x6300000F

SPLIT_NET #1

= 192.168.2.0 subnet

mask = 255.255.255.0

Protocol = 0

SRC port = 0

port dest = 0

45 09:45:03.146 10/01/13 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = NCHCO.local

46 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_UDP_NAT_PORT, value = 0 x 00002710

47 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

48 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = 8.4 (1) Cisco systems, Inc. ASA5505 Version built by manufacturers on Tuesday, January 31, 11 02:11

49 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

50 09:45:03.146 01/10/13 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

51 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 192.168.2.70, GW IP = *. **. ***. remote IP address = 0.0.0.0

52 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to *. **. ***. ***

53 09:45:03.177 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

54 09:45:03.177 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

55 09:45:03.177 01/10/13 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

56 09:45:03.177 01/10/13 Sev = Info/5 IKE / 0 x 63000047

This SA was already alive for 1 second, expiration of adjustment to 86399 seconds now

57 09:45:03.193 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

58 09:45:03.193 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" qm="" *(hash,="" sa,="" non,="" id,="" id,="" notify:status_resp_lifetime)="" from="">

59 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify is set to 28800 seconds

60 09:45:03.193 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH) to *. **. ***. ***

61 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000059

IPsec Security Association of loading (MsgID = SPI OUTBOUND SPI INCOMING = 0x3EBEBFC5 0xAAAF4C1C = 967A3C93)

62 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000025

OUTGOING ESP SPI support: 0xAAAF4C1C

63 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000026

Charges INBOUND ESP SPI: 0x3EBEBFC5

64 09:45:03.193 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

65 09:45:03.521 01/10/13 Sev = Info/6 CVPND / 0 x 63400001

Launch VAInst64 for controlling IPSec virtual card

66 09:45:03.896 01/10/13 Sev = Info/4 CM / 0 x 63100034

The virtual card has been activated:

IP=192.168.2.70/255.255.255.0

DNS = 192.168.2.1, 8.8.8.8

WINS = 0.0.0.0 0.0.0.0

Domain = NCHCO.local

Split = DNS names

67 09:45:03.912 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 0.0.0.0 0.0.0.0 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 0.0.0.0 0.0.0.0 261

68 09:45:07.912 01/10/13 Sev = Info/4 CM / 0 x 63100038

Were saved successfully road to file changes.

69 09:45:07.912 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

**. **. ***. 255.255.255.255 96.11.251.1 96.11.251.149 100

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.2.0 255.255.255.0 192.168.2.70 192.168.2.70 261

192.168.2.0 255.255.255.0 192.168.2.1 192.168.2.70 100

192.168.2.70 255.255.255.255 192.168.2.70 192.168.2.70 261

192.168.2.255 255.255.255.255 192.168.2.70 192.168.2.70 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 192.168.2.70 192.168.2.70 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 192.168.2.70 192.168.2.70 261

70 09:45:07.912 01/10/13 Sev = Info/6 CM / 0 x 63100036

The routing table has been updated for the virtual card

71 09:45:07.912 01/10/13 Sev = Info/4 CM/0x6310001A

A secure connection established

72 09:45:07.943 01/10/13 Sev = Info/4 CM/0x6310003B

Look at address added to 96.11.251.149. Current host name: psaserver, current address (s): 192.168.2.70, 96.11.251.149, 192.168.1.3.

73 09:45:07.943 01/10/13 Sev = Info/4 CM/0x6310003B

Look at address added to 192.168.2.70. Current host name: psaserver, current address (s): 192.168.2.70, 96.11.251.149, 192.168.1.3.

74 09:45:07.943 01/10/13 Sev = Info/5 CM / 0 x 63100001

Did not find the smart card to watch for removal

75 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

76 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700010

Creates a new key structure

77 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370000F

Adding key with SPI = 0x1c4cafaa in the list of keys

78 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700010

Creates a new key structure

79 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370000F

Adding key with SPI = 0xc5bfbe3e in the list of keys

80 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370002F

Assigned WILL interface private addr 192.168.2.70

81 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700037

Configure the public interface: 96.11.251.149. SG: **.**.***.***

82 09:45:07.943 10/01/13 Sev = Info/6 CM / 0 x 63100046

Define indicator tunnel set up in the registry to 1.

83 09:45:13.459 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

84 09:45:13.459 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205276

85 09:45:13.474 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

86 09:45:13.474 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

87 09:45:13.474 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205276, seq # expected is 107205276

88 09:45:15.959 01/10/13 Sev = Info/4 IPSEC / 0 x 63700019

Activate key dating SPI = 0x1c4cafaa key with SPI = 0xc5bfbe3e

89 09:46:00.947 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

90 09:46:00.947 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205277

91 09:46:01.529 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

92 09:46:01.529 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

93 09:46:01.529 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205277, seq # expected is 107205277

94 09:46:11.952 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

95 09:46:11.952 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205278

96 09:46:11.979 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

97 09:46:11.979 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

98 09:46:11.979 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205278, seq # expected is 107205278

---------------------------------------------------------------------------------------------------------------

Any help would be appreciated, thanks!

try to refuse the ACL (access-list AnyConnect_Client_Local_Print extended deny ip any one) at the end of the ACL.

How can I get the engine working in the ASA 5505 Crypto

I bought a brand new ASA 5505 to connect to the Cisco 3640 and I can not yet set up the tunnel. I have tried to change the set of transformation to just but know luck. I recently put a VPN using DMVPN and Cisco 501 in a site-to-site, but it has been wondering what happens.

The router (3640 executes code 12.4) seems ok and I don't think I have a problem with the router with Cisco 501 great work.

This is a laboratory environment.

This is the function defined on the ASA 5505

The devices allowed for this platform:

The maximum physical Interfaces: 8

VLAN: 3, restricted DMZ

Internal guests: 10

Failover: disabled

VPN - A: enabled

VPN-3DES-AES: enabled

Peer VPN: 10

WebVPN peers: 2

Double ISP: disabled

Junction ports VLAN: 0

AnyConnect for Mobile: disabled

AnyConnect for Linksys phone: disabled

Assessment of Advanced endpoint: disabled

This platform includes a basic license.

This is a ping from 10.3.4.10 to 10.1.1.1. He said nothing about IPSEC or ISAKMP.

That's what I get when I do the: show crypto ipsec his

ASA5505 (config) # show crypto ipsec his

There is no ipsec security associations

ASA5505 (config) # show crypto isakmp his

There is no isakmp sas

Debug crypto isakmp 10

entry packets within the icmp 10.3.4.10 8 0 10.1.1.1 detail

I have worked on it for a week and don't really know if I have a bad ASA5505. Since the normal stuff like browsing the Internet works and I can ping to the outside and inside, I don't know what to think. See attachments.

"Do what you asked has worked.

Nice to hear that your problem is solved.

"My question is can I use the transform-set ESP-3DES-SHA instead of MD5?"

Of course you can.

Kind regards.

Please do not forget to note the useful messages and check "Solved my problem", if the post has solved your problem.

ASA 5505 VPN Ping problems

Hi all

First of all, I apologize if this is something that I can google. My knowledge of the administration of the network is all self-taught, so if there is a guide that I missed please point me in the right direction, it is often difficult to Google the terms for troubleshooting when your jargon is not the height.

The main problem is that when ping devices internal when you are connected to the results are very inconsistent.

Ping 192.168.15.102 with 32 bytes of data:

Reply from 192.168.15.102: bytes = 32 time = 112ms TTL = 128

Request timed out.

Request timed out.

Request timed out.

We have implemented an IPSec VPN connection to a remote Cisco ASA 5505. There is no connection problems, connection seems constant, etc. good packages. At this stage, I can only assume I have configuration problems, but I was watching this while if long and pair with my inexperience configuration of these settings I have no idea where to start. My first impressions are that LAN devices I'm ping do not send their response back or the ASA does not know how to route packets back?

Here is a dump of the configuration:

Output of the command: "show config".

: Saved

: Written by enable_15 to the 12:40:06.114 CDT MON Sep 9 2013

!

ASA Version 8.2 (5)

!

hostname VPN_Test

activate the encrypted password of D37rIydCZ/bnf1uj

2KFQnbNIdI.2KYOU encrypted passwd

names of

192.168.15.0 - internal network name

DDNS update method DDNS_Update

DDNS both

maximum interval 0 4 0 0

!

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

Description VLAN internal guests

nameif inside

security-level 100

DDNS update hostname 0.0.0.0

DDNS update DDNS_Update

DHCP client updated dns server time

192.168.15.1 IP address 255.255.255.0

!

interface Vlan2

Description of VLAN external to the internet

nameif outside

security-level 0

address IP xx.xx.xx.xx 255.255.255.248

!

passive FTP mode

clock timezone CST - 6

clock to summer time recurring CDT

DNS server-group DefaultDNS

Server name 216.221.96.37

Name-Server 8.8.8.8

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

DM_INLINE_TCP_1 tcp service object-group

port-object eq www

EQ object of the https port

outside_access_in list extended access permit icmp any one

outside_access_in list extended access deny interface icmp outside interface inside

access extensive list ip 192.168.15.192 outside_access_in allow 255.255.255.192 all

Remote_splitTunnelAcl list standard allowed internal-network access 255.255.255.0

inside_nat0_outbound list extended access allowed internal-network ip, 255.255.255.0 192.168.15.192 255.255.255.192

Note to inside_access_in to access list blocking Internet traffic

access extensive list ip 192.168.15.192 inside_access_in allow 255.255.255.192 all

Note to inside_access_in to access list blocking Internet traffic

inside_access_in extended access list allow interface ip inside the interface inside

inside_access_in list of allowed ip extended access all 192.168.15.192 255.255.255.192

Note to inside_access_in to access list blocking Internet traffic

access extensive list ip 192.168.15.192 inside_nat0_outbound_1 allow 255.255.255.192 all

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

mask 192.168.15.200 - 192.168.15.250 255.255.255.0 IP local pool VPN_IP_Pool

inside_access_ipv6_in list of access allowed IPv6 interface ip inside the interface inside

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ICMP allow any response of echo outdoors

ICMP allow all outside

don't allow no asdm history

ARP timeout 14400

NAT-control

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

NAT (inside) 1 192.168.15.192 255.255.255.192

NAT (inside) 1 0.0.0.0 0.0.0.0

inside_access_in access to the interface inside group

inside_access_ipv6_in access to the interface inside group

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.1.0 255.255.255.0 inside

255.255.255.0 inside internal network http

http yy.yy.yy.yy 255.255.255.255 outside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Sysopt connection timewait

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

management-access inside

dhcpd outside auto_config

!

dhcpd address 192.168.15.200 - 192.168.15.250 inside

dhcpd allow inside

!

a basic threat threat detection

Statistics-list of access threat detection

a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

NTP server 192.168.15.101 source inside

prefer NTP server 192.168.15.100 source inside

WebVPN

internal remote group strategy

Group remote attributes policy

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list Remote_splitTunnelAcl

username StockUser encrypted password privilege 0 t6a0Nv8HUfWtUdKz

username StockUser attributes

Strategy-Group-VPN remote

tunnel-group type remote access remotely

tunnel-group remote General attributes

address pool VPN_IP_Pool

Group Policy - by default-remote control

tunnel-group remote ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

inspect the icmp

!

global service-policy global_policy

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:f4271785b86e45dd3a17bab8f60cd2f3

Hi Graham,

My first question is do you have a site to site VPN and VPN remote access client.

After checking your configuration, I see you don't have any Site to SIte VPN configuration, so I'm assuming you ara facing issue with the VPN client.

And if I understand you are able to connect VPN client, but you not able to access internal resources properly.

I recommend tey and make the following changes.

First remove the following configuration:

NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

NAT (inside) 1 192.168.15.192 255.255.255.192

You don't need the 1st one and I do not understand the reason for the second

Second, one is your pool IP subnet (192.168.15.200 - 192.168.15.250) and I don't know why you added this NAT.

If possible change your subnet pool all together because we do not recommend to use th ip POOL that is similar to your local network.

Try the changes described above and let me know in case if you have any problem.

Thank you

Jeet Kumar

Problem with remote access VPN on ASA 5505

I currently have a problem of an ASA 5505 configuration to connect via VPN remote access by using the Cisco VPN Client 5.0.07.0440 under Windows 8 Pro x 64. The VPN client will prompt you for the user name and password during the connection process, but fails soon after.

The VPN client connects is as follows:

---------------------------------------------------------------------------------------------------------------------------------------

Cisco Systems VPN Client Version 5.0.07.0440

Copyright (C) 1998-2010 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.2.9200

2 15:09:21.240 11/12/12 Sev = Info/4 CM / 0 x 63100002

Start the login process

3 15:09:21.287 11/12/12 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

4 15:09:21.287 11/12/12 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "*." **. ***. *** »

5 15:09:21.287 11/12/12 Sev = Info/6 IKE/0x6300003B

Try to establish a connection with *. **. ***. ***.

6 15:09:21.287 11/12/12 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

7 15:09:21.303 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) to *. **. ***. ***

8 15:09:21.365 11/12/12 Sev = Info/6 GUI/0x63B00012

Attributes of the authentication request is 6: 00.

9 15:09:21.334 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

10 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

11 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

12 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

13 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

14 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

15 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

16 15:09:21.334 11/12/12 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

17 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) to *. **. ***. ***

18 15:09:21.334 11/12/12 Sev = Info/6 IKE / 0 x 63000055

Sent a keepalive on the IPSec Security Association

19 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xFBCE, Remote Port = 0 x 1194

20 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is behind a NAT device

21 15:09:21.334 11/12/12 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

22 15:09:21.365 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

23 15:09:21.365 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

24 15:09:21.365 11/12/12 Sev = Info/4 CM / 0 x 63100015

Launch application xAuth

25 15:09:21.474 11/12/12 Sev = Info/4 IPSEC / 0 x 63700008

IPSec driver started successfully

26 15:09:21.474 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

27 15:09:27.319 11/12/12 Sev = Info/4 CM / 0 x 63100017

xAuth application returned

28 15:09:27.319 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

29 15:09:27.365 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

30 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

31 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

32 15:09:27.365 11/12/12 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

33 15:09:27.365 11/12/12 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

34 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

35 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

36 15:09:27.397 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

37 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 192.168.2.70

38 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.255.0

39 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 192.168.2.1

40 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 8.8.8.8

41 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000001

42 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = NCHCO

43 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

44 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc. ASA5505 Version 8.2 (5) built by manufacturers on Saturday, May 20, 11 16:00

45 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

46 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = received and by using the NAT - T port number, value = 0 x 00001194

47 15:09:27.397 11/12/12 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

48 15:09:27.412 11/12/12 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 192.168.2.70, GW IP = *. **. ***. remote IP address = 0.0.0.0

49 15:09:27.412 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to *. **. ***. ***

50 15:09:27.444 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

51 15:09:27.444 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

52 15:09:27.444 11/12/12 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

53 15:09:27.444 11/12/12 Sev = Info/5 IKE / 0 x 63000047

This SA was already alive for 6 seconds, setting expiration 86394 seconds now

54 15:09:27.459 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

55 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">

56 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO *(HASH, DEL) to *. **. ***. ***

57 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000049

IPsec security association negotiation made scrapped, MsgID = CE99A8A8

58 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000017

Marking of IKE SA delete (I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

59 15:09:27.459 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

60 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000058

Received an ISAKMP for a SA message no assets, I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924

61 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(dropped)="" from="">

62 15:09:27.490 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

63 15:09:30.475 11/12/12 Sev = Info/4 IKE/0x6300004B

IKE negotiation to throw HIS (I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

64 15:09:30.475 11/12/12 Sev = Info/4 CM / 0 x 63100012

ITS phase 1 deleted before first Phase 2 SA is caused by "DEL_REASON_IKE_NEG_FAILED". Crypto 0 Active IKE SA, 0 IKE SA authenticated user in the system

65 15:09:30.475 11/12/12 Sev = Info/5 CM / 0 x 63100025

Initializing CVPNDrv

66 15:09:30.475 11/12/12 Sev = Info/6 CM / 0 x 63100046

Set indicator established tunnel to register to 0.

67 15:09:30.475 11/12/12 Sev = Info/4 IKE / 0 x 63000001

Signal received IKE to complete the VPN connection

68 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

69 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

70 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

71 15:09:30.475 11/12/12 Sev = Info/4 IPSEC/0x6370000A

IPSec driver successfully stopped

---------------------------------------------------------------------------------------------------------------------------------------

The running configuration is the following (there is a VPN site-to-site set up as well at an another ASA 5505, but that works perfectly):

: Saved

:

ASA Version 8.2 (5)

!

hostname NCHCO

Select hTjwXz/V8EuTw9p9 of encrypted password

hTjwXz/V8EuTw9p9 of encrypted passwd

names of

description of NCHCO name 192.168.2.0 City offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address **. ***. 255.255.255.248

!

boot system Disk0: / asa825 - k8.bin

passive FTP mode

access extensive list ip NCHCO 255.255.255.0 outside_nat0_outbound allow 192.168.1.0 255.255.255.0

access extensive list ip NCHCO 255.255.255.0 inside_nat0_outbound allow 192.168.1.0 255.255.255.0

inside_nat0_outbound list of allowed ip extended access all 192.168.2.64 255.255.255.224

access extensive list ip NCHCO 255.255.255.0 outside_1_cryptomap allow 192.168.1.0 255.255.255.0

access extensive list ip NCHCO 255.255.255.0 outside_1_cryptomap_1 allow 192.168.1.0 255.255.255.0

Standard access list LAN_Access allow NCHCO 255.255.255.0

LAN_Access list standard access allowed 0.0.0.0 255.255.255.0

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

mask of VPN_Pool VPN_Start VPN_End of local pool IP 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 645.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (outside) 0-list of access outside_nat0_outbound

Route outside 0.0.0.0 0.0.0.0 74.219.208.49 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

network-acl outside_nat0_outbound

WebVPN

SVC request to enable default svc

Enable http server

http 192.168.1.0 255.255.255.0 inside

http *. **. ***. 255.255.255.255 outside

http 74.218.158.238 255.255.255.255 outside

http NCHCO 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac l2tp-transform

Crypto ipsec transform-set l2tp-transformation mode transit

Crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_MD5

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set pfs Group1

crypto dynamic-map dyn-map transform 10-set, vpn l2tp-transformation-transformation

dynamic-map encryption dyn-map 10 value reverse-road

Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS_ESP_3DES_MD5

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs Group1

peer set card crypto outside_map 1 74.219.208.50

card crypto outside_map 1 set of transformation-ESP-3DES-SHA

map outside_map 20-isakmp ipsec crypto dynamic outside_dyn_map

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

inside crypto map inside_map interface

card crypto vpn-map 1 match address outside_1_cryptomap_1

card crypto vpn-card 1 set pfs Group1

set vpn-card crypto map peer 1 74.219.208.50

card crypto vpn-card 1 set of transformation-ESP-3DES-SHA

dynamic vpn-map 10 dyn-map ipsec isakmp crypto map

crypto isakmp identity address

crypto ISAKMP allow inside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 15

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 35

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP ipsec-over-tcp port 10000

enable client-implementation to date

Telnet 192.168.1.0 255.255.255.0 inside

Telnet NCHCO 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH NCHCO 255.255.255.0 inside

SSH timeout 5

Console timeout 0

dhcpd address 192.168.2.150 - 192.168.2.225 inside

dhcpd dns 216.68.4.10 216.68.5.10 interface inside

lease interface 64000 dhcpd inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server DNS 192.168.2.1

Protocol-tunnel-VPN IPSec l2tp ipsec

nchco.local value by default-field

attributes of Group Policy DfltGrpPolicy

value of server DNS 192.168.2.1

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

allow password-storage

enable IPSec-udp

enable dhcp Intercept 255.255.255.0

the address value VPN_Pool pools

internal NCHVPN group policy

NCHVPN group policy attributes

value of 192.168.2.1 DNS Server 8.8.8.8

Protocol-tunnel-VPN IPSec l2tp ipsec

value by default-field NCHCO

admin LbMiJuAJjDaFb2uw encrypted privilege 15 password username

username privilege 15 encrypted password yB1lHEVmHZGj5C2Z 8njferg

username, encrypted NCHvpn99 QhZZtJfwbnowceB7 password

attributes global-tunnel-group DefaultRAGroup

address (inside) VPN_Pool pool

address pool VPN_Pool

authentication-server-group (inside) LOCAL

authentication-server-group (outside LOCAL)

LOCAL authority-server-group

authorization-server-group (inside) LOCAL

authorization-server-group (outside LOCAL)

Group Policy - by default-DefaultRAGroup

band-Kingdom

band-band

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared key *.

NOCHECK Peer-id-validate

tunnel-group DefaultRAGroup ppp-attributes

No chap authentication

no authentication ms-chap-v1

ms-chap-v2 authentication

tunnel-group DefaultWEBVPNGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

tunnel-group 74.219.208.50 type ipsec-l2l

IPSec-attributes tunnel-group 74.219.208.50

pre-shared key *.

type tunnel-group NCHVPN remote access

attributes global-tunnel-group NCHVPN

address pool VPN_Pool

Group Policy - by default-NCHVPN

IPSec-attributes tunnel-group NCHVPN

pre-shared key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:15852745977ff159ba808c4a4feb61fa

: end

ASDM image disk0: / asdm - 645.bin

ASDM VPN_Start 255.255.255.255 inside location

ASDM VPN_End 255.255.255.255 inside location

don't allow no asdm history

Anyone have any idea why this is happening?

Thank you!

Add, crypto dynamic-map outside_dyn_map 20 value reverse-road.

With respect,

Safwan

Cisco SG300 / ASA 5505 intervlan routing problem

Dear all

I have a problem with the configuration correctly sg300 layer 3 behind the ASA 5505 switch (incl. license more security)

The configuration is the following:

CISCO SG300 is configured as a layer 3 switch

VLAN native 1: 192.168.1.254, default route ip address (inside interface ASA 192.168.1.1)

VLAN defined additional switch

VLAN 100 with 192.168.100.0/24, default gateway 192.168.100.254

VLAN 110 with 192.168.110.0/24, default gateway 192.168.110.254

VLAN 120 with 172.16.0.0/16, default gateway 172.16.10.254

Of the VLANS (100,110,120) different, I am able to connect to all devices on the other VIRTUAL local networks (with the exception of Native VLAN 1; is not the ping requests)

From the switch cli I can ping my firewall (192.168.1.1) and all the other gateways of VLANs and vlan (VLAN1, 100, 110, 120) devices

Asa cli I can only ping my switch (192.168.1.254) port, but no other devices in other VLAN

My question is this. What should I change or installation in the switch configuration or asa so that other VLANs to access the Internet through the ASA. I will not use the ASA as intervlan routing device, because the switch does this for me

I tried to change the asa int e0/1 in trunkport (uplink port switch also), to enable all the VLANS, but as soon as I do that, I can not ping 192.168.1.254 ASA cli more.

Any help is greatly appreciated

Concerning

Edwin

Hi Edwin, because the switch is layer 3, the only necessary behavior is to ensure that default gateways to the computer are set on the SVI interface connection to the switch to make sure that the switch is transfer traffic wished to the ASA.

The configuration between the ASA and the switch must stay true by dot1q, such as the vlan all other, unidentified native VLAN tagged.

Also, if I'm not wrong, on the SAA you must set the security level of the port to 100.

-Tom
Please evaluate the useful messages

ASA 5505 ASDM VPN connection problem

Hello

We are running a version of firewall ASA 5505 8.4 (4) 1. The ASDM version is 6.4 (9).

The problem is when the creation of remote access VPN connection, it works fine for about 2-3 days.

After that, the VPN client cannot connect more and gives the error code 789.

In this case, the VPN clients are clients of Windows 7 from different remote networks with the same problem scenario.

Windows 8.1 clients cannot connect at all and show the same error code...

All connections go through the keys defaultragroup and preshare match on both sides.

When the user to connect attemps I receive the following text in the log of the ASDM:

6 April 10, 2015 10:52:39 group = DefaultL2LGroup, IP = 5.240.31.116, P1 retransmit msg sent to the WSF MM

5 April 10, 2015 10:52:39 group = DefaultL2LGroup, IP = 5.240.31.116, in double Phase 1 detected package. Retransmit the last packet.

5 April 10, 2015 10:53:03 IP = 5.240.31.116, encrypted packet received with any HIS correspondent, drop

When I implemented the remote login through ASDM I followed the instructions according to the following link:

http://www.databasemart.com/HOWTO/Cisco_VPN_Remote_Access_Setup_ASA5500...

The steps were a little different, but almost the same, given that these instructions show an old version

I'm interested in trying the steps according to this link but not sure this will help me solve the problem id:

http://www.petenetlive.com/kb/article/0000571.htm

Any help would be appreciated!

Thank you

Hello

If you use local authentication (user name and password on the SAA), so why you would need this threshold?

tunnel-group DefaultRAGroup ppp-attributes
No chap authentication
ms-chap-v2 authentication
!

Remove it and try.

How can I get voice and data to work with the ASA 5505?

Here's the issue I'm having. Can I get a Cisco 7940 to work behind one site to another configured ASA 5505 and I can also get data to work behind it. However, when I try to create a separate Vlan for voice and data, it does not work. Our voice VLANs on our remote sites are 172.30 and data are 172.31, when I put the inside interface with 172.31 data will work and when I on it 172.30 voice will work. I upgraded to a security more license and tried vlan3 created as voice. I have the data to the top and work but I can't get vlan3 to work. Any help would be greatly appreciated. Thank you

Here is my current config:

hostname TESTvpn
activate the password xxxxx

passwd xxxxx

username admin password xxxxx privilege 15

name Corp_LAN 10.0.0.0
name 192.168.64.0 Corp_Voice
name 172.31.155.0 TESTvpn

object-group network SunVoyager
host of the object-Network 64.70.8.160
host of the object-Network 64.70.8.242

the Corp_Networks object-group network
network-object Corp_LAN 255.0.0.0
object-network Corp_Voice 255.255.255.0

interface vlan2
nameif outside
security-level 0
IP address dhcp setroute
No tap

interface vlan1
nameif inside
security-level 100
IP 172.31.155.1 255.255.255.0
No tap

interface vlan3
nameif Corp_Voice
security-level 100
IP 172.30.155.1 255.255.255.0
No tap

output
interface Ethernet0/0
switchport access vlan 2
No tap

interface Ethernet0/7
switchport access vlan 3
No tap

output

dhcpd allow inside
dhcpd address 172.31.155.10 - 172.31.155.30 inside
dhcpd dns 10.10.10.7 10.10.10.44 interface inside
dhcpd sun.ins area inside interface
dhcpd allow inside

enable Corp_Voice dhcpd
dhcpd address 172.30.155.10 - 172.30.155.30 Corp_Voice
dhcpd dns 10.10.10.7 10.10.10.44 interface Corp_Voice
dhcpd interface of sun.ins of the Corp_Voice domain
enable Corp_Voice dhcpd
dhcpd option 150 ip 192.168.64.4 192.168.64.3

Enable logging
exploitation forest buffer-size 10000
monitor debug logging
logging buffered information
asdm of logging of information

outside_access_in list extended access allow all unreachable icmp
outside_access_in list extended access permit icmp any any echo response
outside_access_in list extended access permit icmp any one time exceed
access extensive list ip 172.31.155.0 inside_access_in allow 255.255.255.0 any
inside_access_in list extended access allow icmp 172.31.155.0 255.255.255.0 any
Access extensive list ip 172.30.155.0 Corp_Voice_access_in allow 255.255.255.0 any
Corp_Voice_access_in list extended access allow icmp 172.30.155.0 255.255.255.0 any

VPN access list extended deny ip 172.31.155.0 255.255.255.0 object-group SunVoyager
extended VPN ip 172.31.155.0 access list allow 255.255.255.0 any

inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Access-group Corp_Voice_access_in in the Corp_Voice interface

Global 1 interface (outside)
NAT (inside) 0-list of access VPN
NAT (inside) 1 172.31.155.0 255.255.255.0

Enable http server
http 172.31.155.0 255.255.255.0 inside
http 172.30.155.0 255.255.255.0 Corp_Voice
http 192.168.64.0 255.255.255.0 Corp_Voice
http 10.0.0.0 255.0.0.0 inside
http 65.170.136.64 255.255.255.224 outside
SSH 10.0.0.0 255.0.0.0 inside
SSH 172.31.155.0 255.255.255.0 inside
SSH 65.170.136.64 255.255.255.224 outside
SSH timeout 20

management-access inside

dhcpd outside auto_config

Crypto ipsec transform-set esp-3des esp-md5-hmac VPN
crypto map outside_map 1 is the VPN address
peer set card crypto outside_map 1 66.170.136.65
card crypto outside_map 1 the value transform-set VPN
outside_map interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 1
preshared authentication
3des encryption
md5 hash
Group 2
lifetime 28800

tunnel-group 66.170.136.65 type ipsec-l2l
IPSec-attributes tunnel-group 66.170.136.65
pre-shared-key xxxxx

output
int eth 0/1
close
No tap
int eth 0/2
close
No tap
int eth 0/3
close
No tap
int eth 0/4
close
No tap
int eth 0/5
close
No tap
int eth 0/6
close
No tap
int eth 0/7
close
No tap

Peter,

Note that access list names are case-sensitive, so you've actually done something different from what I proposed.

Please do:

no nat (Corp_Voice) 0-list of access vpn

No list of vpn access extended permitted ip TESTvpn 255.255.255.0 everything
IP 172.30.155.0 255.255.255.0 extended vpn access do not allow any list all

extended VPN ip 172.30.155.0 access list allow 255.255.255.0 any

NAT (Corp_Voice) 0-list of access VPN

In the case where you did deliberately, for example to separate the 2 acl: note that acl VPN (upper case) is also used in the encryption card, where you cannot add a second LCD.

So if you want to separate you, you will need 3 access lists:

list of access data-vpn ip TESTvpn 255.255.255.0 allow one

voice-vpn ip 172.30.155.0 access list allow 255.255.255.0 any

access-list all - vpn ip TESTvpn 255.255.255.0 allow one

access-list all - vpn ip 172.30.155.0 allow 255.255.255.0 any

NAT (inside) 0-list of access vpn data

NAT (Corp_Voice) - access list 0 voice-vpn

outside_map 1 match address all vpn crypto card

Don't know if this was also clearly to my previous message, I recommend you to replace the "all" (in each of the ACL lines) to something more specific (i.e. a remote network, or group of objects that contain the remote networks).

HTH

Herbert

After I open a document using Adobe reader DC and want to save it with the help of Save as when I try to open this operation all I get is an empty windo saying save as. This problem just started, note I'm on Windows 7 Prof

After I open a document using Adobe reader DC and want to save it with the help of Save as when I try to open this operation all I get is an empty windo saying save as. This problem just started, note I'm on Windows 7 Prof

Hi sgodwin2468,

Make sure that Acrobat Reader DC is updated Release Notes | Adobe Acrobat, Reader.

If the problem persists, try the solution below.

The default "save under" Acrobat/Reader DC dialog box is different from the dialogue box you had in earlier versions of Acrobat/Reader, it also allows you to record in the clouds and previous locations that you saved the files. It is possible that when Acrobat/Reader tries to connect to the 'cloud', it runs into problems. You can try to disable this feature to see if this brings your backup in the back of the box: open Acrobat Preferences, then go to the "General" category and uncheck "show the online storage when you save files:

Kind regards

Nicos

Having problems downloading/getting started with Photoshop

Just bought the membership. Having problems download/getting started with Photoshop. Try once then maybe interfering. When I go into Photoshop, it says it has expired! Don't see how I can remedy this.

Hello Sharon,

In addition you can also consult the help below document:

Please check the help below document:

Applications creative Cloud back in test mode after an update until 2015 for CC

Kind regards

Sheena

Problem setting out by ASA 5505 VPN

While inside a network secured by an ASA 5505, I can't establish a PPTP VPN on. The ASA will connect the following:

09-2009 20:50:09 creating 305006 24.13.209.125 regular translation failed for the internal protocol 47 src: 192.168.132.108 dst outside:xxx.xxx.xxx.125

I looked at the msg of error in line, but for some reason, I'm just not understand what he says. How can I fix it? Let me know if you have any questions... Thank you guys!

Colombia-British

Hello

Enable pptp inspection

pixfirewall (config) #policy - map global_policy

pixfirewall(config-pmap) #class inspection_default

pixfirewall (config-pmap-c) #inspect pptp

Go to this link for the use of pptp/gre info background detail under various codes.

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080094a5a.shtml

Concerning

ASA 5505 problem getting started

Similar Questions

Maybe you are looking for