ASA 5505 site to site VPN between A to site B, then B site MPLS network internal

Hi all

I'll put up the VPN site to site between two site A to site B. Two local site of A and B are connected correctly. However for my site B have an other intern MPLS to another site. The thin connection of LAN has completely to the LAN B MPLS router, but cannot connect to other site MPLS. If I did the SPLM traceroute on another site. Access internal router LAN B. Therefore, I'm confused what part of my setup to trick you and any document for my reference. Thank you very much.

Local area NETWORK a (ASA 5505)---(ASA 5505) Local LAN B - router internal B - B router MPLS - another site.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>xxxxxxxxxxxxxxx

Hello, Alan

After having crossed the configuration that I realized that the problem was with the main campus network was not in the list of nat step in the direction of the ASA. After you have added that, everthing works

Thank you

Please note the useful messages!

Harish

Tags: Cisco Security

Similar Questions

licenses for ASA 5505, site-to-site vpn

Hi, gang,

I've not worked on ASA for a few years, so a little rusty on the issuance of licenses. my client has 5 locations, a few computers at each location. 4 tunnels vpn site-to-site will be implemented, so that 1 Server @ main location of accounting is accessible from other. simple configuration. I wonder if I have to purchase additional licenses? This is the part number of the device that I'm aiming for:

ASA5505-BUN-K9
Cisco ASA 5505 Adaptive Security Appliance 8 ports Fast Ethernet Switch with 10 user licenses

Thank you!

Jonathan

Your license for the VPN is perfectly fine as the Base license supports 10 VPN-peers. The 10 user license is what could restrict more.

And if the 5505 is not yet bought, go directly to the ASA 5506 - X as the 5505 is a legacy device and will probably go little EOS.

Cisco ASA 5505 site for multiple subnet of the site.

Hello. I need help to configure my cisco asa 5505.

I set up a VPN between two ASA 5505 tunnel

Site 1:

Subnet 192.168.77.0

Site 2:

Have multiple VLANs and now the tunnel goes to vlan400 - 192.168.1.0

What I need help:

Site 1, I need to be able to reach a different virtual LAN on site 2. vlan480 - 192.168.20.0

And 1 site I have to reach 192.168.77.0 subnet of vlan480 - 192.168.20.0

Vlan480 is used for phones. In vlan480, we have a PABX.

Is this possible to do?

Any help would be much appreciated!

Config site 2:

: Saved

:

ASA Version 7.2 (2)

!

ciscoasa hostname

domain default.domain.invalid

activate the password encrypted x

names of

name 192.168.1.250 DomeneServer

name of 192.168.1.10 NotesServer

name 192.168.1.90 Steadyily

name 192.168.1.97 TerminalServer

name 192.168.1.98 eyeshare w8

name 192.168.50.10 w8-print

name 192.168.1.94 w8 - app

name 192.168.1.89 FonnaFlyMedia

!

interface Vlan1

nameif Vlan1

security-level 100

IP 192.168.200.100 255.255.255.0

OSPF cost 10

!

interface Vlan2

nameif outside

security-level 0

IP address 79.x.x.226 255.255.255.224

OSPF cost 10

!

interface Vlan400

nameif vlan400

security-level 100

IP 192.168.1.1 255.255.255.0

OSPF cost 10

!

interface Vlan450

nameif Vlan450

security-level 100

IP 192.168.210.1 255.255.255.0

OSPF cost 10

!

interface Vlan460

nameif Vlan460-SuldalHotell

security-level 100

IP 192.168.2.1 255.255.255.0

OSPF cost 10

!

interface Vlan461

nameif Vlan461-SuldalHotellGjest

security-level 100

address 192.168.3.1 IP 255.255.255.0

OSPF cost 10

!

interface Vlan462

Vlan462-Suldalsposten nameif

security-level 100

192.168.4.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan470

nameif vlan470-Kyrkjekontoret

security-level 100

IP 192.168.202.1 255.255.255.0

OSPF cost 10

!

interface Vlan480

nameif vlan480 Telefoni

security-level 100

address 192.168.20.1 255.255.255.0

OSPF cost 10

!

interface Vlan490

nameif Vlan490-QNapBackup

security-level 100

IP 192.168.10.1 255.255.255.0

OSPF cost 10

!

interface Vlan500

nameif Vlan500-HellandBadlands

security-level 100

192.168.30.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan510

Vlan510-IsTak nameif

security-level 100

192.168.40.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan600

nameif Vlan600-SafeQ

security-level 100

192.168.50.1 IP address 255.255.255.0

OSPF cost 10

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 500

switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610

switchport mode trunk

!

interface Ethernet0/3

switchport access vlan 490

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd encrypted x

passive FTP mode

clock timezone WAT 1

DNS server-group DefaultDNS

domain default.domain.invalid

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

Lotus_Notes_Utgaaande tcp service object-group

UT og Frim Notes Description til alle

area of port-object eq

port-object eq ftp

port-object eq www

EQ object of the https port

port-object eq lotusnotes

EQ Port pop3 object

EQ pptp Port object

EQ smtp port object

Lotus_Notes_inn tcp service object-group

Description of the inn og alle til Notes

port-object eq www

port-object eq lotusnotes

EQ Port pop3 object

EQ smtp port object

object-group service Reisebyraa tcp - udp

3702 3702 object-port Beach

5500 5500 object-port Beach

range of object-port 9876 9876

object-group service Remote_Desktop tcp - udp

Description Tilgang til Remote Desktop

3389 3389 port-object range

object-group service Sand_Servicenter_50000 tcp - udp

Description program tilgang til sand service AS

object-port range 50000 50000

VNC_Remote_Admin tcp service object-group

Description Fra ¥ oss til alle

5900 5900 port-object range

object-group service Printer_Accept tcp - udp

9100 9100 port-object range

port-object eq echo

ICMP-type of object-group Echo_Ping

echo ICMP-object

response to echo ICMP-object

object-group service Print tcp

9100 9100 port-object range

FTP_NADA tcp service object-group

Suldalsposten NADA tilgang description

port-object eq ftp

port-object eq ftp - data

Telefonsentral tcp service object-group

Hoftun description

port-object eq ftp

port-object eq ftp - data

port-object eq www

EQ object of the https port

port-object eq telnet

Printer_inn_800 tcp service object-group

Fra 800 thought-out og inn til 400 port 7777 description

range of object-port 7777 7777

Suldalsposten tcp service object-group

Description send av mail hav Mac Mail at - Ã ¥ nrep smtp

EQ Port pop3 object

EQ smtp port object

http2 tcp service object-group

Beach of port-object 81 81

object-group service DMZ_FTP_PASSIVE tcp - udp

55536 56559 object-port Beach

object-group service DMZ_FTP tcp - udp

20 21 object-port Beach

object-group service DMZ_HTTPS tcp - udp

Beach of port-object 443 443

object-group service DMZ_HTTP tcp - udp

8080 8080 port-object range

DNS_Query tcp service object-group

of domain object from the beach

object-group service DUETT_SQL_PORT tcp - udp

Description for a mellom andre og duett Server nett

54659 54659 object-port Beach

outside_access_in of access allowed any ip an extended list

outside_access_out of access allowed any ip an extended list

vlan400_access_in list extended access deny ip any host 149.20.56.34

vlan400_access_in list extended access deny ip any host 149.20.56.32

vlan400_access_in of access allowed any ip an extended list

Vlan450_access_in list extended access deny ip any host 149.20.56.34

Vlan450_access_in list extended access deny ip any host 149.20.56.32

Vlan450_access_in of access allowed any ip an extended list

Vlan460_access_in list extended access deny ip any host 149.20.56.34

Vlan460_access_in list extended access deny ip any host 149.20.56.32

Vlan460_access_in of access allowed any ip an extended list

vlan400_access_out list extended access permit icmp any any Echo_Ping object-group

vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande

vlan400_access_out list extended access permit tcp any host DomeneServer object-group Remote_Desktop

vlan400_access_out list extended access permit tcp any host TerminalServer object-group Remote_Desktop

vlan400_access_out list extended access permit tcp any host http2 object-group Steadyily

vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_inn

vlan400_access_out list extended access permit tcp any host NotesServer object-group Remote_Desktop

vlan400_access_out allowed extended access list tcp any host w8-eyeshare object-group Remote_Desktop

vlan400_access_out allowed extended access list tcp any host w8 - app object-group Remote_Desktop

vlan400_access_out list extended access permit tcp any host FonnaFlyMedia range 8400-8600

vlan400_access_out list extended access permit udp any host FonnaFlyMedia 9000 9001 range

vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host DomeneServer

vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host w8 - app object-group DUETT_SQL_PORT

Vlan500_access_in list extended access deny ip any host 149.20.56.34

Vlan500_access_in list extended access deny ip any host 149.20.56.32

Vlan500_access_in of access allowed any ip an extended list

vlan470_access_in list extended access deny ip any host 149.20.56.34

vlan470_access_in list extended access deny ip any host 149.20.56.32

vlan470_access_in of access allowed any ip an extended list

Vlan490_access_in list extended access deny ip any host 149.20.56.34

Vlan490_access_in list extended access deny ip any host 149.20.56.32

Vlan490_access_in of access allowed any ip an extended list

Vlan450_access_out list extended access permit icmp any any Echo_Ping object-group

Vlan1_access_out of access allowed any ip an extended list

Vlan1_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

Vlan1_access_out deny ip extended access list a whole

Vlan1_access_out list extended access permit icmp any any echo response

Vlan460_access_out list extended access permit icmp any any Echo_Ping object-group

Vlan490_access_out list extended access permit icmp any any Echo_Ping object-group

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTPS

Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTP

Vlan500_access_out list extended access permit icmp any any Echo_Ping object-group

vlan470_access_out list extended access permit icmp any any Echo_Ping object-group

vlan470_access_out list extended access permit tcp any host 192.168.202.10 - group Remote_Desktop object

Vlan510_access_out list extended access permit icmp any any Echo_Ping object-group

vlan480_access_out of access allowed any ip an extended list

Vlan510_access_in of access allowed any ip an extended list

Vlan600_access_in of access allowed any ip an extended list

Vlan600_access_out list extended access permit icmp any one

Vlan600_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

Vlan600_access_out list extended access permitted tcp 192.168.1.0 255.255.255.0 host w8-printing eq www

Vlan600_access_out list extended access permitted tcp 192.168.202.0 255.255.255.0 host w8-printing eq www

Vlan600_access_out list extended access permitted tcp 192.168.210.0 255.255.255.0 host w8-printing eq www

Vlan600_access_in_1 of access allowed any ip an extended list

Vlan461_access_in of access allowed any ip an extended list

Vlan461_access_out list extended access permit icmp any any Echo_Ping object-group

vlan400_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

outside_20_cryptomap_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

outside_20_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

access-list Vlan462-Suldalsposten_access_in extended ip allowed any one

access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo response

access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo response

access-list Vlan462-Suldalsposten_access_in_1 extended ip allowed any one

pager lines 24

Enable logging

asdm of logging of information

MTU 1500 Vlan1

Outside 1500 MTU

vlan400 MTU 1500

MTU 1500 Vlan450

MTU 1500 Vlan460-SuldalHotell

MTU 1500 Vlan461-SuldalHotellGjest

vlan470-Kyrkjekontoret MTU 1500

MTU 1500 vlan480-Telefoni

MTU 1500 Vlan490-QNapBackup

MTU 1500 Vlan500-HellandBadlands

MTU 1500 Vlan510-IsTak

MTU 1500 Vlan600-SafeQ

MTU 1500 Vlan462-Suldalsposten

no failover

Monitor-interface Vlan1

interface of the monitor to the outside

the interface of the monitor vlan400

the interface of the monitor Vlan450

the interface of the Vlan460-SuldalHotell monitor

the interface of the Vlan461-SuldalHotellGjest monitor

the interface of the vlan470-Kyrkjekontoret monitor

Monitor-interface vlan480-Telefoni

the interface of the Vlan490-QNapBackup monitor

the interface of the Vlan500-HellandBadlands monitor

Monitor-interface Vlan510-IsTak

Monitor-interface Vlan600-SafeQ

the interface of the monitor Vlan462-Suldalsposten

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 522.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

vlan400_nat0_outbound (vlan400) NAT 0 access list

NAT (vlan400) 1 0.0.0.0 0.0.0.0 dns

NAT (Vlan450) 1 0.0.0.0 0.0.0.0 dns

NAT (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0

NAT (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0

NAT (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0

NAT (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns

NAT (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0

NAT (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0

NAT (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0

NAT (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0

static (vlan400, external) 79.x.x.x DomeneServer netmask 255.255.255.255

static (vlan470-Kyrkjekontoret, external) 79.x.x.x 192.168.202.10 netmask 255.255.255.255

static (vlan400, external) 79.x.x.x NotesServer netmask 255.255.255.255 dns

static (vlan400, external) 79.x.x.231 netmask 255.255.255.255 TerminalServer

static (vlan400, external) 79.x.x.234 Steadyily netmask 255.255.255.255

static (vlan400, outside) w8-eyeshare netmask 255.255.255.255 79.x.x.232

static (Vlan490-QNapBackup, external) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns

static (Vlan600-SafeQ, external) 79.x.x.235 w8 - print subnet mask 255.255.255.255

static (vlan400, outside) w8 - app netmask 255.255.255.255 79.x.x.236

static (Vlan450, vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

(Vlan500-HellandBadlands, vlan400) static 192.168.30.0 192.168.30.0 netmask 255.255.255.0

(vlan400, Vlan500-HellandBadlands) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

(vlan400, Vlan450) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

static (vlan400, external) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255

static (Vlan462-Suldalsposten, vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0

static (vlan400, Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

static (vlan400, Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

static (Vlan600-SafeQ, vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

static (Vlan600-SafeQ, Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

static (Vlan600-SafeQ, vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

static (Vlan450, Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

static (vlan470-Kyrkjekontoret, Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0

Access-group interface Vlan1 Vlan1_access_out

Access-group outside_access_in in interface outside

Access-group outside_access_out outside interface

Access-group vlan400_access_in in the vlan400 interface

vlan400_access_out group access to the interface vlan400

Access-group Vlan450_access_in in the Vlan450 interface

Access-group interface Vlan450 Vlan450_access_out

Access-group interface Vlan460-SuldalHotell Vlan460_access_in

Access-group interface Vlan460-SuldalHotell Vlan460_access_out

Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_in

Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_out

Access-group vlan470_access_in in interface vlan470-Kyrkjekontoret

vlan470_access_out access to the interface vlan470-Kyrkjekontoret group

access to the interface vlan480-Telefoni, vlan480_access_out group

Access-group interface Vlan490-QNapBackup Vlan490_access_in

Access-group interface Vlan490-QNapBackup Vlan490_access_out

Access-group interface Vlan500-HellandBadlands Vlan500_access_in

Access-group interface Vlan500-HellandBadlands Vlan500_access_out

Access-group interface Vlan510-IsTak Vlan510_access_in

Access-group interface Vlan510-IsTak Vlan510_access_out

Access-group Vlan600_access_in_1 interface Vlan600-SafeQ

Access-group Vlan600_access_out interface Vlan600-SafeQ

Access-group Vlan462-Suldalsposten_access_in_1 Vlan462-Suldalsposten interface

Access-group Vlan462-Suldalsposten_access_out_1 Vlan462-Suldalsposten interface

Route outside 0.0.0.0 0.0.0.0 79.x.x.225 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

x x encrypted privilege 15 password username

the ssh LOCAL console AAA authentication

Enable http server

http 192.168.210.0 255.255.255.0 Vlan450

http 192.168.200.0 255.255.255.0 Vlan1

http 192.168.1.0 255.255.255.0 vlan400

No snmp server location

No snmp Server contact

SNMP-Server Community public

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

card crypto outside_map 20 match address outside_20_cryptomap_1

card crypto outside_map 20 set pfs

peer set card crypto outside_map 20 62.92.159.137

outside_map crypto 20 card value transform-set ESP-3DES-SHA

outside_map interface card crypto outside

crypto ISAKMP allow outside

ISAKMP crypto enable vlan400

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

tunnel-group 62.92.159.137 type ipsec-l2l

IPSec-attributes tunnel-group 62.92.159.137

pre-shared-key *.

Telnet 192.168.200.0 255.255.255.0 Vlan1

Telnet 192.168.1.0 255.255.255.0 vlan400

Telnet timeout 5

SSH 171.68.225.216 255.255.255.255 outside

SSH timeout 5

Console timeout 0

dhcpd update dns both

!

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1

!

dhcpd option 6 ip 81.167.36.3 81.167.36.11 outside interface

!

dhcpd address 192.168.1.100 - 192.168.1.225 vlan400

dhcpd option ip 6 DomeneServer 81.167.36.11 interface vlan400

dhcpd option 3 ip 192.168.1.1 interface vlan400

vlan400 enable dhcpd

!

dhcpd address 192.168.210.100 - 192.168.210.200 Vlan450

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450

dhcpd ip interface 192.168.210.1 option 3 Vlan450

enable Vlan450 dhcpd

!

dhcpd address 192.168.2.100 - 192.168.2.150 Vlan460-SuldalHotell

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell

dhcpd 192.168.2.1 ip interface option 3 Vlan460-SuldalHotell

dhcpd enable Vlan460-SuldalHotell

!

dhcpd address 192.168.3.100 - 192.168.3.200 Vlan461-SuldalHotellGjest

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest

dhcpd ip interface 192.168.3.1 option 3 Vlan461-SuldalHotellGjest

dhcpd enable Vlan461-SuldalHotellGjest

!

dhcpd address 192.168.202.100 - 192.168.202.199 vlan470-Kyrkjekontoret

interface of dhcpd option 3 ip 192.168.202.1 vlan470-Kyrkjekontoret

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret

dhcpd enable vlan470-Kyrkjekontoret

!

dhcpd option 3 192.168.20.1 ip interface vlan480-Telefoni

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni

!

dhcpd address 192.168.10.80 - 192.168.10.90 Vlan490-QNapBackup

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup

dhcpd 192.168.10.1 ip interface option 3 Vlan490-QNapBackup

!

dhcpd address 192.168.30.100 - 192.168.30.199 Vlan500-HellandBadlands

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands

dhcpd ip interface 192.168.30.1 option 3 Vlan500-HellandBadlands

dhcpd enable Vlan500-HellandBadlands

!

dhcpd address 192.168.40.100 - 192.168.40.150 Vlan510-IsTak

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak

dhcpd 3 ip Vlan510-IsTak 192.168.40.1 option interface

Vlan510-IsTak enable dhcpd

!

dhcpd address 192.168.50.150 - 192.168.50.199 Vlan600-SafeQ

dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ

Vlan600-SafeQ enable dhcpd

!

dhcpd address 192.168.4.100 - 192.168.4.150 Vlan462-Suldalsposten

interface option 6 ip DomeneServer 81.167.36.11 Vlan462-Suldalsposten dhcpd

interface ip dhcpd option 3 Vlan462-Suldalsposten 192.168.4.1

Vlan462-Suldalsposten enable dhcpd

!

!

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

!

context of prompt hostname

Cryptochecksum:x

: end

Site 1 config:

: Saved

:

ASA Version 7.2 (4)

!

ciscoasa hostname

domain default.domain.invalid

activate the password encrypted x

passwd encrypted x

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.77.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

PPPoE Telenor customer vpdn group

IP address pppoe setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 15

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

DNS server-group DefaultDNS

domain default.domain.invalid

outside_access_in list extended access permit icmp any any disable log echo-reply

access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0

access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 524.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Access-group outside_access_in in interface outside

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

Enable http server

http 192.168.77.0 255.255.255.0 inside

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs

peer set card crypto outside_map 1 79.160.252.226

card crypto outside_map 1 set of transformation-ESP-3DES-SHA

outside_map interface card crypto outside

crypto ISAKMP allow inside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet 192.168.77.0 255.255.255.0 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

VPDN group Telenor request dialout pppoe

VPDN group Telenor localname x

VPDN group Telenor ppp authentication chap

VPDN x x local store password username

dhcpd outside auto_config

!

dhcpd address 192.168.77.100 - 192.168.77.130 inside

dhcpd dns 192.168.77.1 on the inside interface

dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside

dhcpd allow inside

!

dhcpd option 6 ip 130.67.15.198 193.213.112.4 outside interface

!

tunnel-group 79.160.252.226 type ipsec-l2l

IPSec-attributes tunnel-group 79.160.252.226

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:x

: end

Hello

The addition of a new network to the existing VPN L2L should be a fairly simple process.

Essentially, you need to add the network of the Crypto present ACL configurations "crypto map" . You also need to configure the NAT0 configuration for it in the appropriate interfaces of the SAA. These configurations are all made on both ends of the VPN L2L connection.

Looking at your configurations above it would appear that you need to the following configurations

SITE 1
- We add the new network at the same time the crypto ACL and ACL NAT0
access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.20.0 255.255.255.0

access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.20.0 255.255.255.0

SITE 2
- We add new ACL crypto network
- We create a new NAT0 configuration for interface Vlan480 because there is no previous NAT0 configuration
outside_20_cryptomap_1 to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

Comment by VLAN480-NAT0 NAT0 for VPN access-list

access-list VLAN480-NAT0 ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

NAT 0 access-list VLAN480-NAT0 (vlan480-Telefoni)

These configurations should pretty much do the trick.

Let me know if it worked

-Jouni

ASA 5505 site-site does not

Hi all

I'm having problems to set up a VPN site-to-site simple between two new ASA 5505. I tried several times with the ASDM entry manual configuration tool or by using the wizard, reset each time at the factory does not by default, but the tunnel.

I followed it it down to the following lines at the reception:

May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, PHASE 1 COMPLETED

    May 11 16:42:53 [IKEv1]: IP = 1.1.1.2, Keep-alive type for this connection: DPD

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Starting P1 rekey timer: 73440 seconds.

    May 11 16:42:53 [IKEv1 DECODE]: IP = 1.1.1.2, IKE Responder starting QM: msg id = 693161c8

    May 11 16:42:53 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=693161c8) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 192

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing SA payload

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing nonce payload

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload

    May 11 16:42:53 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received

    1.1.1.2

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received remote Proxy Host data in ID Payload:  Address 1.1.1.2, Protocol 0, Port 0

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload

    May 11 16:42:53 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received

    1.1.1.1

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received local Proxy Host data in ID Payload:  Address 1.1.1.1, Protocol 0, Port 0

    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing notify payload

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, QM IsRekeyed old sa not found by addr

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = outside_map, seq = 1...

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = outside_map, seq = 1, ACL does not match proxy IDs src:1.1.1.2 dst:1.1.1.1

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 1.1.1.2/255.255.255.255/0/0 local proxy 1.1.1.1/255.255.255.255/0/0 on interface outside

Looks to me to the remote proxy host and proxy localhost data outside IP instead of subnets (10.0.0.0/24 and 192.168.0.0/24)... How can I fix?

Hello

Him debugs watch ASA's answering machine, so the other ASA is the initiator.

It seems that you have configured the initiator mode only come

Example:

crypto map OUTSIDE_map 20 set type of connection are created only...

If you have that, it attempts to establish the phase 2 its between the ip address of (public) au first, then between the configured ACL...

If you are only created, please remove it.

Cisco ASA 5505 Dual-ISP backup VPN

I am creating a tunnel of an ASA 5505 to a pix 501 backup in the case of the failure of main Internet service provider. The external face of Pix will remain the same, but not quite how I can create a new card encryption and it use backup ISP interface without down the main tunnel.

My first thought was to add the following encryption to the configuration below card:

card crypto outside_map 2 match address outside_1_cryptomap
peer set card crypto outside_map 2 9.3.21.13
card outside_map 2 game of transformation-ESP-DES-MD5 crypto
card crypto outside_map interface backupisp--> but that would break the current tunnel.

NYASA # sh run
: Saved
:
ASA Version 7.2 (4)
!
NYASA hostname
domain girls.org
activate the encrypted password of CHwdJ2WMUcjxIIm8
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Vlan1
nameif inside
security-level 100
10.1.2.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP 9.17.5.8 255.255.255.240
!
interface Vlan3
Description backup ISP
nameif backupisp
security-level 0
IP 6.27.9.5 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
DNS server-group DefaultDNS

outside_access_in list extended access permit icmp any any echo response
outside_access_in list extended access permit icmp any any source-quench
outside_access_in list extended access allow all unreachable icmp
outside_access_in list extended access permit icmp any one time exceed
outside_access_in list extended access permit icmp any one
inside_nat0_outbound to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.1.0 255.255.255.0
inside_nat0_outbound to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.100.0 255.255.255.0
outside_1_cryptomap to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.1.0 255.255.255.0
outside_1_cryptomap to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.100.0 255.255.255.0
access-list extended 150 permit ip any host 10.1.2.27
access-list 150 extended allow host ip 10.1.2.27 all
pager lines 24
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
backupisp MTU 1500
no failover
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 524.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
interface of global (backupisp) 1
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 0.0.0.0 0.0.0.0
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 9.17.5.7 1 track 1
Route 0.0.0.0 backupisp 0.0.0.0 6.27.9.1 254
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
the ssh LOCAL console AAA authentication
Enable http server
http 10.1.2.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
ALS 10 monitor
type echo protocol ipIcmpEcho 4.2.2.2 outside interface
NUM-package of 3
timeout of 1000
frequency 3
Annex monitor SLA 10 life never start-time now
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
card crypto outside_map 1 match address outside_1_cryptomap
peer set card crypto outside_map 1 9.3.21.13
map outside_map 1 set of transformation-ESP-DES-MD5 crypto
outside_map interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
the Encryption
md5 hash
Group 2
life 86400
Crypto isakmp nat-traversal 20
!
track 1 rtr 10 accessibility
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 60
Console timeout 0
management-access inside

ptiadmin encrypted BtOLil2gR0VaUjfX privilege 15 password username
tunnel-group 9.4.21.13 type ipsec-l2l
IPSec-attributes tunnel-Group 9.4.21.13
pre-shared-key *.
!
!
context of prompt hostname
Cryptochecksum:22bb60b07c4c1805b89eb2376683f861
: end
NYASA #.

Thanks in advance.

In this case is the PIX in need of two peers (to the ASA).

The ASA is it requires the card encryption to be applied to the interface of backup as well (as you mentioned)

card crypto outside_map interface backupisp--> but that would break the current tunnel.

The command above should not break the current tunnel (if the road to reach the other end goes out through the main interface).

In addition, you must IP SLA configured in the ASA to allow him to use the primary connection and aid for the connection of accumulation relief tunnel (both to reuse the primary interface when she recovers).

Federico.

ASA 5505 Site tunnel site

I have a simple question, but want to make sure, before I start.

I have 3 5505 devices corp 1 and 1 to two areas of the site. Is it possible to have several tunnels on the asa corp? a #1 site and the other site #2?

My license is based on the whole of the SAA.

I already have remote user VPN configuration on the devices as well. Who does wrong or interfere with anything to add tunnels?

Appreciate any help or advice.

-Jon

You can have up to 10 peers of vpn based on your license, which included the two vpn site-to-site and remote access.

If the total number of simultaneous vpn peers is not greater than 10 (2 at most 8 and site to site vpn remote connected), you should be OK.

Cisco ASA 5505 Site to Site

Hello, I'm having some trouble at two ASA Site Site configuration and looking for help. I really appreciate your time and effort. When I do a

L2Lsite2 # show crypto isakmp his

There is no isakmp sas

L2Lsite2 # show crypto ipsec his

There is no ipsec security associations

If I'm on the side of L2Lsite1 I can not ping 192.168.3.1

Will transfer configs later.

Thanks again in advance for your help in this important issue.

can share you the commmand you used for ping, you can also use packet trace silmulate a VPN traffic, for example:

Packet-trace within the icmp [the source ip address] 8 8 [destination ip adrdress] detail

VPN site to Site - NAT network internal

Hi all

I have a site to site VPN setup (both sites have Cisco ASA) where my internal network is 192.168.1.0/24 and internal, the other site of the network happens to have the exact same internal network. Is it possible that I can NAT my internal address to 172.18.1.0/24 and I get the job? It should then allow both sites to communicate successfully. Thank you.

Hello

You'll have to NAT to both ends of the VPN L2L connection. This is because even if you the other end to another network NAT it will mean that this site would have to connect to a destination address that is apparently in its own network and connections would fail.

The format of configuration depends on your level of ASAs software

8.2 software (and below)

Comment by L2LVPN-POLICYNAT-access list policy NAT for VPN L2L

permit access-list L2LVPN-POLICYNAT

static (inside, outside) access-list L2LVPN-POLICYNAT

Software 8.3 (and above)

the object of the LAN network

subnet

network of the LAN - NAT object

subnet

network of the REMOTE object

subnet

NAT static LAN LAN destination - NAT source (indoor, outdoor) static REMOTE

Note to use the correct networks in the statements above. The destination in the configuration network is naturally the NAT network uses the other site.

In the same say, you can you make sure your L2L Crypto ACL VPN connections using the local NAT network as the source and the remote NAT network as the destination.

Hope this helps

-Jouni

Client VPN und Cisco asa 5505 tunnel work but no traffic

Hi all

I am new to this forum and Don t have a lot of experience with Cisco, so I hope I can get help from specialists.

I have the following problem:

I installed und konfigured ASA 5505 for use with vpn client. I would like to access the local network from outside through vpn.

To test, I installed ASA 5505 with ADSL (pppoe) and tried to give access to the internal network.

Of course whenever I have recive the supplier's different IP address, but it didn't is not a problem reconfigure in the vpn client.

After the connection is established (vpn tunnel work) I can see my external network packets. But I Don t have any connection to the internal network.

I erased my setup yesterday and tried to reconfigure ASA again. I didn t tested yesterday, because it was too late. And I know that I Don t have the authorization rule at present by the ACL. But I think I'm having the same problem again. (tunnel but no traffic).

What I did wrong. Could someone let me know what I have to do today.

With hope for your help Dimitri.

ASA configuration after reset and basic configuration: works to the Internet from within the course.

: Saved

: Written by enable_15 to the CEDT 20:29:18.909 Sunday, August 29, 2010

!

ASA Version 8.2 (2)

!

ciscoasa hostname

activate 2KFQnbNIdI.2KYOU encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

PPPoE client vpdn group home

IP address pppoe setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

boot system Disk0: / asa822 - k8.bin

passive FTP mode

clock timezone THATS 1

clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

DNS domain-lookup outside

DNS server-group DefaultDNS

Server name 194.25.0.60

Server name 194.25.0.68

DM_INLINE_TCP_1 tcp service object-group

port-object eq www

EQ object of the https port

inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 no matter what eq field open a debug session

inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any object-group DM_INLINE_TCP_1 open a debug session

inside_access_in list extended access deny ip any any debug log

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.0.0 255.255.0.0

permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.10.0 255.255.255.128

homegroup_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.0

pager lines 24

Enable logging

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

IP local pool homepool 192.168.10.1 - 192.168.10.100 mask 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm-625 - 53.bin

ASDM location 192.168.0.0 255.255.0.0 inside

ASDM location 192.168.10.0 255.255.255.0 inside

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

inside_access_in access to the interface inside group

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

VPDN group home request dialout pppoe

VPDN group House localname 04152886790

VPDN group House ppp authentication PAP

VPDN username 04152886790 password 1

dhcpd outside auto_config

!

dhcpd address 192.168.1.5 - 192.168.1.36 inside

dhcpd allow inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

TFTP server 192.168.1.5 inside c:/tftp-root

WebVPN

Group Policy inner residential group

attributes of the strategy of group home group

value of 192.168.1.1 DNS server

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list homegroup_splitTunnelAcl

username user01 encrypted password privilege 0 v5P40l1UGvtJa7Nn

user01 username attributes

VPN-strategy group home group

tunnel-group home group type remote access

attributes global-tunnel-group home group

address homepool pool

Group Policy - by default-homegroup

tunnel-group group residential ipsec-attributes

pre-shared-key ciscotest

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:930e6cddf25838e47ef9633dc2f07acb

: end

Hello

Normally, you want a static public IP address on the ASA to allow it to receive connections from VPN clients (avoid to change the IP address all the time).

If you connect via VPN, check the following:

1. the tunnel is established:

HS cry isa his

Must say QM_IDLE or MM_ACTIVE

2 traffic is flowing (encrypted/decrypted):

HS cry ips its

3. Enter the command:

management-access inside

And check if you can PING the inside ASA VPN client IP.

4. check that the default gateway for the LAN internal ASA within intellectual property (or there is a road to the ASA to send traffic to the VPN clients).

Federico.

VPN between ASA and 871

Hello

I'm setting up a VPN router between 871 and ASA 5505 for the first time and having a problem. I have attached my network diagram as well as the configuration of 871 and ASA. Although the VPN tunnel is coming for example sh crypto isakmp his watch QM_IDLE and Exchange ipsec SA is successuful as well, but none of the machine can access each other. Please help as I am in desperate need to operate.

Thank you all,.

Jérôme

Hello

It seems that you are missing some required configuration. See the link below...

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805e8c80.shtml

HTH

MS

* Rate of useful messages *.

On ASA 5505 VPN cannot access remote (LAN)

I have an ASA 5505 upward and running, all static NAT statements I need to forward ports to the internal services such as smtp, desktop remotely and it works very well, however I have set up an IPSEC vpn connection that authenticates to our DC and part works. However, after I connect and cannot ping anything on the local network or access services. I don't know what a NAT statement I have corrected. Here is the config. I really need to get this up and going tomorrow. Thanks for any help.

Tyler

Just remove the line of nat (outside) and ACL outside_nat0_outbound.

And talk about these statements:

IPSec-1 sysopt connection permit... (If it is disabled, you can check with sh run sysopt).

2, crypto isakmp nat traversal 10 or 20

3 no NAT ACL, mention your local subnets as the source and vpn client as the destination.

4, create the other ACL (ST) with different name and source and destination like no nat ACL.

5, then type nat (inside) 0 access-list sheep

6, in the dwgavpn group policy, talk to splittunnel tunnelspecified and mention the tunnel split ACL (ST).

Concerning

Error of customer Cisco VPN connection ASA 5505

I am unable to connect to the vpn I created on my ASA 5505 using the Cisco VPN Client on a Windows machine. The log of the vpn client and the config of the ASA 5505 is lower. Any help to solve this is appreciated.

CISCO VPN CLIENT LOG

Cisco Systems VPN Client Version 5.0.06.0160

Copyright (C) 1998-2009 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.1.7600

Config files directory: C:\Program Cisco Systems Client\

1 09:34:23.030 13/04/11 Sev = Info/4 CM / 0 x 63100002

Start the login process

2 09:34:23.061 13/04/11 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

3 09:34:23.061 13/04/11 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "71.xx.xx.253".

4 09:34:23.061 13/04/11 Sev = Info/6 IKE/0x6300003B

Attempts to establish a connection with 71.xx.xx.253.

5 09:34:23.061 13/04/11 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

6 09:34:23.077 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) at 71.xx.xx.253

7 09:34:23.170 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

8 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

9 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

10 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

11 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

12 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

13 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

14 09:34:23.170 13/04/11 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

15 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) at 71.xx.xx.253

16 09:34:23.170 13/04/11 Sev = Info/6 IKE / 0 x 63000055

Sent a keepalive on the IPSec Security Association

17 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xEB07, Remote Port = 0 x 1194

18 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is behind a NAT device

19 09:34:23.170 13/04/11 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

20 09:34:23.170 13/04/11 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

21 09:34:23.186 13/04/11 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

22 09:34:23.186 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to 71.xx.xx.253

23 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

24 09:34:23.248 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

25 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 172.26.6.1

26 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.0.0

27 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 172.26.0.250

28 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 172.26.0.251

29 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000000

30 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = TLCUSA

31 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

32 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc. ASA5505 Version 8.2 (1) built by manufacturers on Wednesday 5 May 09 22:45

33 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

34 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = received and by using the NAT - T port number, value = 0 x 00001194

35 09:34:23.248 13/04/11 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

36 09:34:23.264 13/04/11 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 172.26.6.1, GW IP = 71.xx.xx.253, Remote IP = 0.0.0.0

37 09:34:23.264 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > QM ISAKMP OAK * (HASH, SA, NO, ID, ID) to 71.xx.xx.253

38 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

39 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

40 09:34:23.326 13/04/11 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

41 09:34:23.326 13/04/11 Sev = Info/5 IKE / 0 x 63000047

This AA is already living from 0 seconds, setting the expiration to 86400 seconds right now

42 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

43 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">

44 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO *(HASH, DEL) to 71.xx.xx.253

45 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000049

IPsec security association negotiation made scrapped, MsgID = 89EE7032

46 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000017

Marking of IKE SA delete (I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED

47 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

48 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000058

Received an ISAKMP for a SA message no assets, I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8

49 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(dropped)="" from="">

50 09:34:26.696 13/04/11 Sev = Info/4 IKE/0x6300004B

IKE negotiation to throw HIS (I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED

51 09:34:26.696 13/04/11 Sev = Info/4 CM / 0 x 63100012

ITS phase 1 deleted before first Phase 2 SA is caused by "DEL_REASON_IKE_NEG_FAILED". Crypto 0 Active IKE SA, 0 IKE SA authenticated user in the system

52 09:34:26.696 13/04/11 Sev = Info/5 CM / 0 x 63100025

Initializing CVPNDrv

53 09:34:26.696 13/04/11 Sev = Info/6 CM / 0 x 63100046

Set indicator established tunnel to register to 0.

54 09:34:26.696 13/04/11 Sev = Info/4 IKE / 0 x 63000001

Signal received IKE to complete the VPN connection

----------------------------------------------------------------------------------------

ASA 5505 CONFIG

: Saved

:

ASA Version 8.2 (1)

!

ciscoasa hostname

domain masociete.com

activate tdkuTUSh53d2MT6B encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 172.26.0.252 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

IP address 71.xx.xx.253 255.255.255.240

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone IS - 5

clock to summer time EDT recurring

DNS server-group DefaultDNS

domain masociete.com

access-list LIMU_Split_Tunnel_List note the network of the company behind the ASA

Standard access list LIMU_Split_Tunnel_List allow 172.26.0.0 255.255.0.0

outside_access_in list extended access permit icmp any one

outside_access_in list extended access udp allowed any any eq 4500

outside_access_in list extended access udp allowed any any eq isakmp

outside_access_in list extended access permit tcp any host 71.xx.xxx.251 eq ftp

outside_access_in list extended access permit tcp any host 71.xx.xxx.244 eq 3389

inside_outbound_nat0_acl list of allowed ip extended access all 172.26.5.192 255.255.255.240

inside_outbound_nat0_acl list of allowed ip extended access all 172.26.6.0 255.255.255.128

pager lines 24

Enable logging

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

local pool VPN_POOL 172.26.6.1 - 172.26.6.100 255.255.0.0 IP mask

ICMP unreachable rate-limit 1 burst-size 1

enable ASDM history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_outbound_nat0_acl

NAT (inside) 1 0.0.0.0 0.0.0.0

static (inside, outside) 71.xx.xxx.251 172.26.5.9 netmask 255.255.255.255

static (inside, outside) 71.xx.xxx.244 172.26.0.136 netmask 255.255.255.255

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 71.xx.xxx.241 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

Enable http server

http 172.26.0.0 255.255.0.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_MD5

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS_ESP_3DES_MD5

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

no basic threat threat detection

no statistical access list - a threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server WINS 172.26.0.250 172.26.0.251

value of 172.26.0.250 DNS server 172.26.0.251

Protocol-tunnel-VPN IPSec l2tp ipsec svc

value by default-field TLCUSA

internal LIMUVPNPOL1 group policy

LIMUVPNPOL1 group policy attributes

value of 172.26.0.250 DNS server 172.26.0.251

VPN-idle-timeout 30

Protocol-tunnel-VPN IPSec l2tp ipsec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list LIMU_Split_Tunnel_List

the address value VPN_POOL pools

internal TLCVPNGROUP group policy

TLCVPNGROUP group policy attributes

value of 172.26.0.250 DNS server 172.26.0.251

Protocol-tunnel-VPN IPSec l2tp ipsec svc

Re-xauth disable

enable IPSec-udp

value by default-field TLCUSA

barry.julien YCkQv7rLwCSNRqra06 + QXg password user name is nt encrypted privilege 0

username barry.julien attributes

VPN-group-policy TLCVPNGROUP

Protocol-tunnel-VPN IPSec l2tp ipsec

bjulien bhKBinDUWhYqGbP4 encrypted password username

username bjulien attributes

VPN-group-policy TLCVPNGROUP

attributes global-tunnel-group DefaultRAGroup

address VPN_POOL pool

Group Policy - by default-DefaultRAGroup

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key *.

tunnel-group DefaultRAGroup ppp-attributes

no authentication ms-chap-v1

ms-chap-v2 authentication

type tunnel-group TLCVPNGROUP remote access

attributes global-tunnel-group TLCVPNGROUP

address VPN_POOL pool

Group Policy - by default-TLCVPNGROUP

IPSec-attributes tunnel-group TLCVPNGROUP

pre-shared-key *.

ISAKMP ikev1-user authentication no

tunnel-group TLCVPNGROUP ppp-attributes

PAP Authentication

ms-chap-v2 authentication

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:b94898c163c59cee6c143943ba87e8a4

: end

enable ASDM history

can you try to change the transformation of dynamic value ESP-3DES-SHA map.

for example

remove the encryption scheme dynamic-map outside_dyn_map 20 transform-set TRANS_ESP_3DES_MD5

and replace with

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

Impossible to disable Easy VPN remote for ASA 5505 6.4 AMPS

When installing ASA 5505, we chose Easy VPN remote. Now, we want to turn it off. We go to Configuration in ASDM > remote access VPN > Easy VPN remote and try to clear the checkbox enable Easy VPN remote, but it will not uncheck. How can we disable it?

ASDM, go in tools--> command line Interface...--> and then enter 'without activating vpnclient'--> the button 'send '.

Which will disable the Easy VPN remote on the SAA.

Hope that helps.

No Internet connectivity with ASA 5505 VPN remote access

Hello

I configured ASA 5505 for remote access VPN to allow a remote user to connect to the Remote LAN officce. VPN works well, users can access Office Resource of LAN with sahred etc., but once they have connected to the VPN, they are unable to browse the internet?

Internet navigation stop working as soon as their customer VPN connect with ASA 5505 t, once they are disconnected from VPN, once again they can browse the internet.

Not ASA 5505 blocking browsing the internet for users of VPN? Is there anything else that I need congfure to ensure that VPN users can browse the internet?

I have to configure Split Tunnleing, NATing or routing for VPN users? or something else.

Thank you very much for you help.

Concerning

Salman

Salman

What you run into is a default behavior of the ASA in which she will not route traffic back on the same interface on which he arrived. So if the VPN traffic arrived on the external interface the ASA does not want to send back on the external interface for Internet access.

You have at least 2 options:

-You can configure split tunneling, as you mention, and this would surf the Internet to continue during the use of VPN.

-You can set an option on the ASA to allow traffic back on the same interface (this is sometimes called crossed). Use the command

permit same-security-traffic intra-interface

HTH

Rick

Site to Site VPN between Cisco ASA 5505 and Sonicwall TZ170

I'm trying to implement a VPN site-to site between our data center and office. The data center has a Cisco ASA 5505 and the Office has a Sonicwall TZ170. I managed to configure the two so that the vpn connects. Each of the firewall I ping the IP Address of the internet firewall on the other side and a desktop computer I can ping the IP Address of the firewall internal datacenter but I can't carry traffic between private subnets datacenter and desktop. Can anyone help?

The config below has had IPs/passwords has changed.

External Datacenter: 1.1.1.4

External office: 1.1.1.1

Internal data center: 10.5.0.1/24

Internal office: 10.10.0.1/24

: Saved
:
ASA Version 8.2 (1)
!
hostname datacenterfirewall
mydomain.tld domain name
activate the password encrypted
passwd encrypted
names of
name 10.10.0.0 OfficeNetwork
10.5.0.0 DatacenterNetwork name
!
interface Vlan1
nameif inside
security-level 100
10.5.0.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
1.1.1.4 IP address 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS server-group DefaultDNS
buydomains.com domain name
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
inside_access_in list extended access permit icmp any one
inside_access_in list extended access permitted tcp a whole
inside_access_in list extended access udp allowed a whole
inside_access_in of access allowed any ip an extended list
outside_access_in list extended access permit icmp any one
outside_access_in list extended access udp allowed any any eq isakmp
IP DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0
IP OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0
outside_cryptomap_66.1 list of allowed ip extended access all OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 ip OfficeNetwork 255.255.255.0 allowed extended access list all
outside_cryptomap_66.1 list extended access permit icmp any OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 list extended access allowed icmp OfficeNetwork 255.255.255.0 everything
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
IP verify reverse path to the outside interface
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 623.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route inside 0.0.0.0 0.0.0.0 1.1.1.1 1
Route OfficeNetwork 255.255.255.0 outside 1.1.1.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 10.5.0.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-aes-256 walthamoffice, esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto dynamic-map ciscopix 1 corresponds to the address outside_cryptomap_66.1
Crypto dynamic-map ciscopix 1 transform-set walthamoffice
Crypto dynamic-map ciscopix 1 the value reverse-road
map dynmaptosw 66-isakmp ipsec crypto dynamic ciscopix
dynmaptosw interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 13
preshared authentication
aes-256 encryption
sha hash
Group 2
lifetime 28800
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 10.5.0.0 255.255.255.0 inside
Telnet timeout 5
SSH 10.5.0.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
management-access inside
dhcpd address 10.5.0.2 - 10.5.0.254 inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 66.250.45.2 source outdoors
NTP server 72.18.205.157 source outdoors
NTP server 208.53.158.34 source outdoors
WebVPN
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
username admin password encrypted
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key *.
!
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
!
context of prompt hostname
Cryptochecksum:7f319172e5de9c0e550804a263f8e49e
: end

Mattew, obvious lack of education is the rule exempt from nat for your tunnel, your access list pixtosw is similar on this example, I assume that you have gone through this link, if it does not see the configs on both sides.

Add the statement of rule sheep in asa and try again.

NAT (inside) 0-list of access pixtosw

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008052c9d4.shtml

Concerning

ASA 5505 site to site VPN between A to site B, then B site MPLS network internal

Similar Questions

Maybe you are looking for