ASA and group URL

Similar Questions

• ASA: webvpn: Group-url command

  Hell

  I don't know how the Group-url command doesn't work. Order reference:

  "Specifying a group URL or IP address eliminates the need for the user to select a group when connecting. When a user connects, the Adaptive security apparatus seeks URL/address of the user entering the tunnel group strategy table.

  When I type:

  ASA - 1(config-tunnel-WebVPN) # enable Group-url https://100.60.10.100/ssl

  What does the ASA? Compare the source_ip from the customer with this IP and HTTP request to check if there is "ssl" in ULR and only if the two matches with this configuration links this user to this group of tunnel?

  What happens if I type:

  ASA - 1(config-tunnel-WebVPN) # enable Group-url https://www.cisco.com/ssl

  that ASA exactly looking for this command?

  Thanx

  Group-url is another way to give users the right tunnel-group and political party. It is also configured under the params webvpn of the tunnel group. You must specify a url for each group of tunnel.

  When applications for WebVPN comes to ASA through the WebVPN active interface and if the URL matches anyone in the Group url configured in the tunnel-group, this group of tunnel is used to the WebVPN.

  It can be done in two ways, either mention the IP address or FULL domain name.

  Thank you

  Ajay

• What support DH Cisco ASA 14 group and more

  What support DH Cisco ASA 14 group and more.

  Model and IOS

  Hi John,.

  You must have ASA executes code 9.1 and above for DH group 14 and this only work for ikev2 only.

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.

• ASA and DAP group policy

  Hi all

  I intend to implement SSL VPN on ASA 8.2.1.

  For example, I create the DAP following 2 files to assign different access rights.

  Policy name: sales DAP

  ldap.memberOf = sales

  Action: continue

  Policy name: engineering DAP

  ldap.memberOf = genius

  Action: continue

  The next policy group are already configured on SAA.

  GP_sales

  GP_engineering

  If UserA, who is a member of the OU sales Active directory Access ASA, ASA know UserA must be associated by GP_sales?

  Thank you

  Hello

  You must configure the LDAP server in your ASA and LDAP attribute is mapped to the Cisco attribute. (LDAP memberOf is maps to GroupPolicy)

  Then you need to configure the mapping of LDAP attributes

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00808d1a7c.shtml

• WebVpn and enter URL

  I use an ASA and WebVPn. It all works well, but on the left side of the WebVpn page. I can enter in any url I love and get on this side, internal or external. Is there a way to delete this box where you enter a url.

  Most likely you have entered

  ASA(config-Group-WebVPN) functions entry url file-access - the entry of the file file-navigation

  No it takes the url entry to remove the toolbar from the url.

  HTH

  Hoogen

• the WebVPN asa8.0 portal (4): Group-url

  Hi all

  I have a problem when I try to use the group-list control to directly select the group for a ssl vpn without the drop-down list.

  Activate the command group-url https://a.a.a.a:port / test in the Tunnel-group, but even if I put it in my browser I still

  See the drop-down list.

  This happens with an ASA8.0 (4).

  I have an ASA8.2 (1) and I did not have this problem.

  I noticed this difference in the login page url after redirection:

  8.0 (4) https://a.a.a.a:port / + CSCOE + / logon.html? token = 4D6912AB72A1FCFA2643F325

  8.2 (1) https://a.a.a.a:port / + CSCOE + / logon.html? tg = test & token = 4D6912AB72A1FCFA2643F325

  Can we do any auggestion?

  Thank you in advance!

  There are a few bugs related to the group-URL in 8.0.4.  In your test above, what port you set the ASA to listen on the WebVPN connections?  If something other than port 443, you can be executed in bug CSCsu77167.

• Decoding and encoding URL

  Hello

  I need a way to encode and decode URLS but J2ME does not include all that is easy.

  Has anyone found a solution?

  Greg

  Also for url encoding: http://www.w3.org/International/URLUTF8Encoder.java

  For decoding url: http://groups.google.com/group/Google-Accounts-API/msg/6c1b5e7e5a2226be

• Troubleshooting IPSec Site to Site VPN between ASA and 1841

  Hi all

  in the past I've implemented several VPN connections between the devices of the SAA. So I thought a site link between an ASA site and 1841 would be easier... But it seems I was mistaken.

  I configured a VPN Site to Site, as it has been described in the Document ID: SDM 110198: IPsec Site to Site VPN between ASA/PIX and an example of IOS Router Configuration (I have not used SDM but CCP).

  I have run the wizards on the ASA with ASDM and the current IOS version 15.1 1841, with CCP.

  It seems to Phase 1 and 2 are coming although my ASA in ADSM reports (monitoring > VPN > VPN statistics > Sessions) a tunnel established with some of the Tx traffic but 0 Rx traffic),

  On the ASA:

  Output of the command: "sh crypto ipsec its peer 217.xx.yy.zz.

  address of the peers: 217.86.154.120
  Crypto map tag: VPN-OUTSIDE, seq num: 2, local addr: 62.aa.bb.cc

  access extensive list ip 192.168.37.0 outside_2_cryptomap_1 allow 255.255.255.0 172.20.2.0 255.255.255.0
  local ident (addr, mask, prot, port): (LAN-A/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (LAN-G/255.255.255.0/0/0)
  current_peer: 217.xx.yy.zz

  #pkts program: 400, #pkts encrypt: 400, #pkts digest: 400
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 400, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 62.aa.bb.cc, remote Start crypto. : 217.xx.yy.zz

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: 39135054
  current inbound SPI: B2E9E500

  SAS of the esp on arrival:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac no compression
  running parameters = {L2L, Tunnel, PFS 2 group}
  slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
  calendar of his: service life remaining (KB/s) key: (4374000/1598)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001
  outgoing esp sas:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac no compression
  running parameters = {L2L, Tunnel, PFS 2 group}
  slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
  calendar of his: service life remaining (KB/s) key: (4373976/1598)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Output of the command: "sh crypto isakmp his."

  HIS active: 4
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 4

  IKE Peer: 217.xx.yy.zz
  Type: L2L role: initiator
  Generate a new key: no State: MM_ACTIVE

  On the 1841

  1841 crypto isakmp #sh its
  IPv4 Crypto ISAKMP Security Association
  DST CBC conn-State id
  217.86.154.120 62.153.156.163 QM_IDLE 1002 ACTIVE

  1841 crypto ipsec #sh its

  Interface: Dialer1
  Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
  current_peer 62.153.156.163 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
  Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
  current outbound SPI: 0xB2E9E500 (3001672960)
  PFS (Y/N): Y, Diffie-Hellman group: group2

  SAS of the esp on arrival:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505068/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505118/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  Interface: virtual Network1
  Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
  current_peer 62.153.156.163 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
  Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
  current outbound SPI: 0xB2E9E500 (3001672960)
  PFS (Y/N): Y, Diffie-Hellman group: group2

  SAS of the esp on arrival:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505068/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505118/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  It seems that the routing on the 1841 is working properly as I can tear down the tunnel and relaunch in scathing a host on the network of 1841, but not vice versa.

  Trounleshoot VPN of the 1841 report shows a message like "the following sources are forwarded through the interface card crypto.      (172.20.2.0 1) go to "Configure-> routing" and correct the routing table.

  I have not found an error on the 1841 config so if one of the guys reading this thread has an idea I appreciate highly suspicion!

  It's the running of the 1841 configuration

  !
  version 15.1
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  host name 1841
  !
  boot-start-marker
  start the system flash c1841-adventerprisek9 - mz.151 - 1.T.bin
  boot-end-marker
  !
  logging buffered 51200 notifications
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  !
  AAA - the id of the joint session
  !
  iomem 20 memory size
  clock timezone PCTime 1
  PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
  dot11 syslog
  IP source-route
  !
  No dhcp use connected vrf ip
  !
  IP cef
  no ip bootp Server
  IP domain name test
  name of the IP-server 194.25.2.129
  name of the IP-server 194.25.2.130
  name of the IP-server 194.25.2.131
  name of the IP-server 194.25.2.132
  name of the IP-server 194.25.2.133
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  object-group network phone
  VoIP phone description
  Home 172.20.2.50
  Home 172.20.2.51
  !
  redundancy
  !
  !
  controller LAN 0/0/0
  atm mode
  Annex symmetrical shdsl DSL-mode B
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 62.aa.bb.cc
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to62.aa.bb.cc
  the value of 62.aa.bb.cc peer
  game of transformation-ESP-3DES-SHA
  PFS group2 Set
  match address 100
  !
  !
  !
  interface FastEthernet0/0
  DMZ description $ FW_OUTSIDE$
  10.10.10.254 IP address 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  automatic duplex
  automatic speed
  !
  interface FastEthernet0/1
  Description $ETH - LAN$ $FW_INSIDE$
  IP 172.20.2.254 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly
  IP tcp adjust-mss 1412
  automatic duplex
  automatic speed
  !
  ATM0/0/0 interface
  no ip address
  No atm ilmi-keepalive
  !
  point-to-point interface ATM0/0/0.1
  PVC 1/32
  PPPoE-client dial-pool-number 1
  !
  !
  interface Dialer1
  Description $FW_OUTSIDE$
  the negotiated IP address
  IP mtu 1452
  NAT outside IP
  IP virtual-reassembly
  encapsulation ppp
  Dialer pool 1
  Dialer-Group 2
  PPP authentication chap callin pap
  PPP chap hostname xxxxxxx
  PPP chap password 7 xxxxxxx8
  PPP pap sent-name of user password xxxxxxx xxxxxxx 7
  map SDM_CMAP_1 crypto
  !
  IP forward-Protocol ND
  IP http server
  local IP http authentication
  IP http secure server
  !
  !
  The dns server IP
  IP nat inside source static tcp 10.10.10.1 808 interface Dialer1 80
  IP nat inside source static tcp 10.10.10.1 25 25 Dialer1 interface
  IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
  IP nat inside source overload map route SDM_RMAP_2 interface Dialer1
  IP route 0.0.0.0 0.0.0.0 Dialer1 permanent
  !
  logging trap notifications
  Note category of access list 1 = 2 CCP_ACL
  access-list 1 permit 172.20.2.0 0.0.0.255
  Note access-list category 2 CCP_ACL = 2
  access-list 2 allow 10.10.10.0 0.0.0.255
  Note access-list 100 category CCP_ACL = 4
  Note access-list 100 IPSec rule
  access-list 100 permit ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  Note CCP_ACL the access list 101 = 2 category
  Note access-list 101 IPSec rule
  access-list 101 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  access-list 101 permit ip 172.20.2.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 2
  Note access-list 102 IPSec rule
  access-list 102 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  access-list 102 permit ip 10.10.10.0 0.0.0.255 any
  !

  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 101
  !
  allowed SDM_RMAP_2 1 route map
  corresponds to the IP 102
  !
  !
  control plan
  !
  !
  Line con 0
  line to 0
  line vty 0 4
  length 0
  transport input telnet ssh
  !
  Scheduler allocate 20000 1000
  NTP-Calendar Update
  NTP 172.20.2.250 Server prefer
  end

  As I mentioned previously: suspicion is much appreciated!

  Best regards

  Joerg

  Joerg,

  ASA receives not all VPN packages because IOS does not send anything.

  Try to send packets to the 1841 LAN to LAN of the ASA and see is the "sh cry ips its" on the 1841 increments the encrypted packets (there not)

  The problem seems so on the side of the router.

  I think that is a routing problem, but you only have one default gateway (no other channels on the router).

  The ACL 100 is set to encrypt the traffic between the two subnets.

  It seems that the ACL 101 is also bypassing NAT for VPN traffic.

  Follow these steps:

  Try running traffic of LAN router inside IP (source of ping 192.168.37.x 172.20.2.254) and see if the packages are not through the translation and obtaining encrypted.

  I would also like to delete 100 ACL from the inside interface on the router because it is used for the VPN. You can create an another ACL to apply to the interface.

  Federico.

• After Anyconnect I can't access to asa and LAN

  Dear all,

  My office use ASA 5505 and I use anyconnect from outside (sometimes overseas), I can connect to my network and business by ASA, internet access, but I can't access ASA and LAN (network of my client). WHY?

  Office 192.168.10.0/24

  192.168.11.0/24 VPN

  How can I solve this problem?

  ASA Version 9.2 (3)
  !
  ciscoasa hostname
  activate the encrypted password of XXXXXXXXXX
  volatile xlate deny tcp any4 any4
  volatile xlate deny tcp any4 any6
  volatile xlate deny tcp any6 any4
  volatile xlate deny tcp any6 any6
  volatile xlate deny udp any4 any4 eq field
  volatile xlate deny udp any4 any6 eq field
  volatile xlate deny udp any6 any4 eq field
  volatile xlate deny udp any6 any6 eq field
  passwd encrypted XXXXXXXXXX
  names of
  192.168.11.1 mask - 192.168.11.10 local pool Pool VPN IP 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP address 192.168.10.254 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  address IP AAA. BBB. CCC DDD EEE. FFF. GGG. HHH
  !
  boot system Disk0: / asa923 - k8.bin
  passive FTP mode
  clock timezone 8 HKST
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  Name-Server 8.8.8.8
  Server name 8.8.4.4
  permit same-security-traffic intra-interface
  network of the VPN_Pool object
  subnet 192.168.11.0 255.255.255.240
  network of the NETWORK_OBJ_192.168.10.0_24 object
  192.168.10.0 subnet 255.255.255.0
  inside_access_in of access allowed any ip an extended list
  outside_access_in list extended access permit icmp any one
  DefaultRAGroup_splitTunnelAcl_1 list standard access allowed 192.168.10.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm-731 - 101.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  interface NAT (outside, outside) dynamic source VPN_Pool
  NAT (inside, outside) static source any any static destination VPN_Pool VPN_Pool non-proxy-arp-search to itinerary
  !
  !
  NAT source auto after (indoor, outdoor) dynamic one interface
  inside_access_in access to the interface inside group
  Access-group outside_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 AAA. BBB. CCC DDD. 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Activate Server http XXXXX
  http 192.168.10.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA SHA-ESP-3DES ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-ESP ESP-3DES-SHA-TRANS TRANS-DES-SHA-TRANS
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  Crypto ca trustpoint ASDM_TrustPoint0
  Terminal registration
  name of the object CN = ciscoasa
  Configure CRL
  Crypto ca trustpoint Anyconnect_Self_Signed_Cert
  registration auto
  name of the object CN = ciscoasa
  Configure CRL
  Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
  registration auto
  name of the object CN = 115.160.145.114, CN = ciscoasa
  Configure CRL
  trustpool crypto ca policy
  string encryption ca Anyconnect_Self_Signed_Cert certificates
  certificate 5c7d4156
  308202d 4 308201bc a0030201 0202045c 415630 0d06092a 864886f7 0d 010105 7 d
  0500302c 3111300f 06035504 03130863 6973636f 61736131 17301506 092a 8648
  09021608 63697363 6f617361 31353131 31303131 31363231 301e170d 86f70d01
  5a170d32 35313130 37313131 3632315a 302 c 3111 55040313 08636973 300f0603
  636f6173 61311730 1506092a 864886f7 0d 010902 16086369 73636f61 73613082
  0122300d 06092 has 86 01010105 00038201 0f003082 010a 0282 010100cc 4886f70d
  af43a895 8c2c3f49 ad16c4b9 a855b47b 773f4245 1954c 728 7 c 568245 6ddc02ab
  78 c 45473 eb4073f6 401d1dca 050dc53f cfb93f58 68087f6d 03334fc 1 53f41daa
  454ff4bb 691235ab 34e21d98 4cfecef4 204e9c95 76b1b417 b5cf746c 830788b 4
  60063e89 0ffe5381 42694cf8 d1be20d4 4c95d9c6 93041af2 94783de0 fe93cf67
  4ad8954f 5392790b 4ded225c c3128cba 8d3ee07b f9fd2208 34b1956c be0a774a
  d054a290 14316cc0 1670bdea f04c828b 7f9483fb 409fa707 fbe5a257 33597fed
  ca790881 b1d4d3dc b0e1095e bf04014e 19c5cfeb f74aac57 ee39cd6e 7389cdd1
  8b9421fa ee2b99ae df07fba1 0b506cd8 ea9f64c5 dd9169ad 157fcdb7 f6cfff02
  03010001 300 d 0609 2a 864886 05050003 82010100 c8719770 1305bd9c f70d0101
  2608f039 0dc6b058 0dfe3d88 76793 has 18 8f601dda b 8553, 893 d95e3b25 30ef7354
  772f7d0b 772869d 7 372f8f5c f32992af fa2c8b6e 0f0ae4ce 4e068b8d b7916af2
  affa1953 5bfd01a6 1a3c147d 75d95d8c 1122fa85 3905f27b 2474aff4 11fff24f
  c305b648 b4c9d8d4 9dcf444b 9326cda3 0c4635d0 90ff8dd8 9444726c 82e002ec
  be120937 0414c20a 39df72fb 76cd9c38 cde9afda 019e9230 66e5dba8 ed208eae
  5faabb85 ff04f8f2 c36b724b 62ec52cc f967ee1d 1a6458fc 507a 2377 45 c 20635
  2c14c431 baac678a dcc20329 4db7aa51 02c 36904 75b5f307 f1cc056d 726bc436
  597a 3814 4ccd421d cb77d8f5 46a8ae69 2d617ac8 2160d7af
  quit smoking
  string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
  certificate 5d7d4156
  308201f0 30820308 a0030201 0202045d 415630 0d06092a 864886f7 0d 010105 7 d
  05003046 06035504 03130863 61736131 18301606 03550403 6973636f 3111300f
  130f3131 352e3136 302e3134 352e3131 1506092a 34311730 864886f7 0d 010902
  73636f61 16086369 7361301e 170d 0d 323531 3135 31313130 31323136 35395a 17
  3111300f 06035504 03130863 6973636f 61736131 a 31303731 32313635 395, 3046
  18301606 03550403 130f3131 352e3136 302e3134 352e3131 1506092's 34311730
  864886f7 0d 010902 16086369 73636f61 73613082 0122300d 06092 has 86 4886f70d
  01010105 00038201 0f003082 010 has 0282 010100cc af43a895 8c2c3f49 ad16c4b9
  a855b47b 773f4245 1954c 728 7 c 78 45473 eb4073f6 401d1dca 568245 6ddc02ab
  050dc53f cfb93f58 68087f6d 03334fc 1 53f41daa 454ff4bb 691235ab 34e21d98
  b 830788 4 4cfecef4 204e9c95 76b1b417 b5cf746c 60063e89 0ffe5381 42694cf8
  d1be20d4 4c95d9c6 93041af2 94783de0 fe93cf67 4ad8954f 5392790b 4ded225c
  c3128cba 8d3ee07b f9fd2208 34b1956c be0a774a d054a290 14316cc0 1670bdea
  f04c828b 7f9483fb 409fa707 fbe5a257 33597fed ca790881 b1d4d3dc b0e1095e
  bf04014e 19c5cfeb f74aac57 ee39cd6e 7389cdd1 8b9421fa ee2b99ae df07fba1
  0b506cd8 ea9f64c5 dd9169ad 157fcdb7 f6cfff02 03010001 300 d 0609 2a 864886
  05050003 82010100 00089cd 3 d0f65c5e 91f7ee15 bbd98446 35639ef9 f70d0101
  45b 64956 f146234c 472b52e6 f2647ced a109cb6b 52bf5f5d 92471cb7 a3a30b63
  052ac212 c6027535 16e42908 ea37c39a 4d203be9 8c4ed8cd 40935057 3fe8a537
  a837c75c feff4dcc 1b2fd276 257f0b46 8fcd2a5c cbdcacec cd14ee46 be136ae7
  7cd4ae0d aace54fe 5187ea57 40d2af87 cded3085 27d6f5d8 1c15ef98 f95cc90e
  a 485049 4 805efa8f 63406609 a663db53 06b94e53 07c1c808 61eadcdb 2c952bee
  74a0b3dd ae262d84 40b85ec5 a89179b2 7e41648e 93f0e419 3c482b29 e482d344
  d756d450 8f0d9302 d023ac43 a31469a4 105c8a0c b1418907 693c558c 08f499ef
  364bc8ba 4543297a a17735a0
  quit smoking
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 activate out of service the customer port 443
  Crypto ikev2 access remote trustpoint Anyconnect_Self_Signed_Cert
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  No ipv6-vpn-addr-assign aaa
  no local ipv6-vpn-addr-assign

  dhcpd 192.168.10.254 dns 8.8.8.8
  dhcpd rental 43200
  !
  dhcpd address 192.168.10.1 - 192.168.10.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  NTP AAA server. BBB. CCC. Source DDD outside prefer
  SSL-point of approval ASDM_Launcher_Access_TrustPoint_0 outside vpnlb-ip
  SSL-trust outside ASDM_Launcher_Access_TrustPoint_0 point
  WebVPN
  allow outside
  AnyConnect image disk0:/anyconnect-win-4.2.00096-k9.pkg 1
  AnyConnect profiles Anyconnect_client_profile disk0: / Anyconnect_client_profile.xml
  AnyConnect enable
  tunnel-group-list activate
  internal DefaultRAGroup_2 group strategy
  attributes of Group Policy DefaultRAGroup_2
  DNS-server AAA value. BBB. CCC AAA DDD. BBB. CCC DDD.
  Ikev2 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  internal GroupPolicy_Anyconnect group strategy
  attributes of Group Policy GroupPolicy_Anyconnect
  WINS server no
  value of server DNS 8.8.8.8 8.8.4.4
  Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client
  Split-tunnel-policy tunnelall
  IPv6-split-tunnel-policy excludespecified
  value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl_1
  by default no
  activate dns split-tunnel-all
  IPv6 address pools no
  WebVPN
  AnyConnect value Anyconnect_client_profile type user profiles
  username password XXXXXXX XXXXXXXXXXXXXXX encrypted privilege 15
  username password XXXXXXX XXXXXXXXXXXXXXX encrypted privilege 15
  attributes of username XXXXXXX
  Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client
  attributes global-tunnel-group DefaultRAGroup
  address pool VPN-pool
  Group Policy - by default-DefaultRAGroup_2
  IPSec-attributes tunnel-group DefaultRAGroup
  IKEv1 pre-shared key XXXXXXXXX
  tunnel-group DefaultRAGroup ppp-attributes
  ms-chap-v2 authentication
  tunnel-group Anyconnect type remote access
  tunnel-group Anyconnect General attributes
  address pool VPN-pool
  Group Policy - by default-GroupPolicy_Anyconnect
  NAT - to-public-ip assigned inside
  tunnel-group Anyconnect webvpn-attributes
  enable Anyconnect group-alias
  tunnel-group Anyconnect ppp-attributes
  ms-chap-v2 authentication
  !
  Global class-card class
  match default-inspection-traffic
  !
  !
  World-Policy policy-map
  Global category
  inspect the dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  service-policy-international policy global
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:24991680b66624113beb31d230c593bb
  : end

  Hi cwhlaw2009,

  You must configure a policy Split-tunnel, if you want to be able to access the internal and local network at the same time.

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/100936-asa8x-split-tunnel-AnyConnect-config.html

  It may be useful

  -Randy-

• Problem with IPsec VPN between ASA and router Cisco - ping is not response

  Hello

  I don't know because the IPsec VPN does not work. This is my setup (IPsec VPN between ASA and R2):

  my network topology data:

  LAN 1 connect ASA - 1 (inside the LAN)

  PC - 10.0.1.3 255.255.255.0 10.0.1.1

  ASA - GigabitEthernet 1: 10.0.1.1 255.255.255.0

  -----------------------------------------------------------------

  ASA - 1 Connect (LAN outide) R1

  ASA - GigabitEthernet 0: 172.30.1.2 255.255.255.252

  R1 - FastEthernet 0/0: 172.30.1.1 255.255.255.252

  ---------------------------------------------------------------------

  R1 R2 to connect

  R1 - FastEthernet 0/1: 172.30.2.1 255.255.255.252

  R2 - FastEthernet 0/1: 172.30.2.2 255.255.255.252

  R2 for lan connection 2

  --------------------------------------------------------------------

  R2 to connect LAN2

  R2 - FastEthernet 0/0: 10.0.2.1 255.255.255.0

  PC - 10.0.2.3 255.255.255.0 10.0.2.1

  ASA configuration:

  1 GigabitEthernet interface
  nameif inside
  security-level 100
  IP 10.0.1.1 255.255.255.0
  no downtime
  interface GigabitEthernet 0
  nameif outside
  security-level 0
  IP 172.30.1.2 255.255.255.252
  no downtime
  Route outside 0.0.0.0 0.0.0.0 172.30.1.1

  ------------------------------------------------------------

  access-list scope LAN1 to LAN2 ip 10.0.1.0 allow 255.255.255.0 10.0.2.0 255.255.255.0
  object obj LAN
  subnet 10.0.1.0 255.255.255.0
  object obj remote network
  10.0.2.0 subnet 255.255.255.0
  NAT (inside, outside) 1 static source obj-local obj-local destination obj-remote control remote obj non-proxy-arp static

  -----------------------------------------------------------
  IKEv1 crypto policy 10
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 3600
  Crypto ikev1 allow outside
  crypto isakmp identity address

  ------------------------------------------------------------
  tunnel-group 172.30.2.2 type ipsec-l2l
  tunnel-group 172.30.2.2 ipsec-attributes
  IKEv1 pre-shared-key cisco123
  Crypto ipsec transform-set esp-aes-192 ASA1TS, esp-sha-hmac ikev1

  -------------------------------------------------------------
  card crypto ASA1VPN 10 is the LAN1 to LAN2 address
  card crypto ASA1VPN 10 set peer 172.30.2.2
  card crypto ASA1VPN 10 set transform-set ASA1TS ikev1
  card crypto ASA1VPN set 10 security-association life seconds 3600
  ASA1VPN interface card crypto outside

  R2 configuration:

  interface fastEthernet 0/0
  IP 10.0.2.1 255.255.255.0
  no downtime
  interface fastEthernet 0/1
  IP 172.30.2.2 255.255.255.252
  no downtime

  -----------------------------------------------------

  router RIP
  version 2
  Network 10.0.2.0
  network 172.30.2.0

  ------------------------------------------------------
  access-list 102 permit ahp 172.30.1.2 host 172.30.2.2
  access-list 102 permit esp 172.30.1.2 host 172.30.2.2
  access-list 102 permit udp host 172.30.1.2 host 172.30.2.2 eq isakmp
  interface fastEthernet 0/1
  IP access-group 102 to

  ------------------------------------------------------
  crypto ISAKMP policy 110
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 42300

  ------------------------------------------------------
  ISAKMP crypto key cisco123 address 172.30.1.2

  -----------------------------------------------------
  Crypto ipsec transform-set esp - aes 128 R2TS

  ------------------------------------------------------

  access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

  ------------------------------------------------------

  R2VPN 10 ipsec-isakmp crypto map
  match address 101
  defined by peer 172.30.1.2
  PFS Group1 Set
  R2TS transformation game
  86400 seconds, life of security association set
  interface fastEthernet 0/1
  card crypto R2VPN

  I don't know what the problem

  Thank you

  If the RIP is not absolutely necessary for you, try adding the default route to R2:

  IP route 0.0.0.0 0.0.0.0 172.16.2.1

  If you want to use RIP much, add permissions ACL 102:

  access-list 102 permit udp any any eq 520

• Internet access with VPN Client to ASA and full effect tunnel

  I'm trying to migrate our concentrator at our new 5520 s ASA. The concentrator has been used only for VPN Client connections, and I have not the easiest road. However, I, for some reason, can't access to internet through our business network when I've got profiles with lots of tunneling.

  I've included the configuration file, with many public IP information and omitted site-to-site tunnels. I left all the relevant stuff on tunnel-groups and group strategies concerning connectivity of VPN clients. The range of addresses that I use for VPN clients is 172.16.254.0/24. The group, with what I'm trying to access the internet "adsmgt" and the complete tunnel to our network part is fine.

  As always, any help is appreciated. Thank you!

  Hüseyin... good to see you come back.. bud, yes try these Hüseyin sugesstiong... If we looked to be ok, we'll try a different approach...

  IM thinking too, because complete tunnel is (no separation) Jim ASA has to go back for the outbound traffic from the internet, a permit same-security-traffic intra-interface, instruction should be able to do it... but Jim start by Hüseyin suggestions.

  Rgds

  Jorge

• problem setting up vpn site-to-site between asa and 1811 router

  I get the following error.

  3. January 8, 2008 | 15: 47:31 | 710003 | 192.168.0.45 | 192.168.0.50. TCP access denied by ACL to 192.168.0.45/3698 to LAN:192.168.0.50/80

  3. January 8, 2008 | 15:47:28 | 710003 | 192.168.0.45 | 192.168.0.50. TCP access denied by ACL to 192.168.0.45/3698 to LAN:192.168.0.50/80

  6. January 8, 2008 | 15:47:28 | 302021 | 192.168.0.45 | 192.168.0.50. Connection of disassembly for faddr gaddr laddr 192.168.0.50/0 192.168.0.50/0 192.168.0.45/1024 ICMP

  6. January 8, 2008 | 15:47:28 | 302020 | 192.168.0.45 | 192.168.0.50. Built of ICMP incoming connections for faddr gaddr laddr 192.168.0.50/0 192.168.0.50/0 192.168.0.45/1024

  5. January 8, 2008 | 15: 47:03 | 713904 | IP = public IP address, encrypted packet received with any HIS correspondent, drop

  4. January 8, 2008 | 15: 47:03 | 113019 | Group = public IP address, Username = public IP address, IP = IP address public, disconnected Session. Session type: IPSecLAN2LAN, duration: 0 h: 00 m: 00s, xmt bytes: 0, RRs bytes: 0, right: Phase 2 Mismatch

  3. January 8, 2008 | 15: 47:03 | 713902 | Group = public IP address, IP = public IP address, peer table correlator withdrawal failed, no match!

  3. January 8, 2008 | 15: 47:03 | 713902 | Group = public IP address, IP = IP address public, error QM WSF (P2 struct & 0x4969c90, mess id 0xf3d044e8).

  5. January 8, 2008 | 15: 47:03 | 713904 | Group = public IP address, IP = IP proposals public, IPSec Security Association all found unacceptable.

  3. January 8, 2008 | 15: 47:03 | 713119 | Group = public IP address, IP = IP address public, PHASE 1 COMPLETED

  6. January 8, 2008 | 15: 47:03 | 113009 | AAA recovered in group policy by default (DfltGrpPolicy) to the user = public IP address

  4. January 8, 2008 | 15: 47:03 | 713903 | Group = public IP address, IP = IP address public, previously allocated memory release for authorization-dn-attributes

  I do not think that because of the incompatibility of encryption. Any help is appreciated.

  Thank you

  Nilesh

  You have PFS (Perfect Forward Secrecy) configured on the ASA and not the router. This could be one of the reasons why the tunnel fails in Phase 2.

  If you do not need a PFS, can you not make a 'no encryption card WAN_map 1 set pfs' the configuration of the ASA and make appear the tunnel.

  Kind regards

  Arul

• ASA, blocking long URL access

  Hi Forum,

  I can't seem to find an answer to my ASA blocks access to long URL. below is the only http filtering configurations I can find on my firewall. What is the default settings? How can I activate it, y at - there a better way?

  I use ASA5500.

  Thank you very much

  Paul

  http-map inbound_http

  content-length min 100 max 2000 action open

  content-type-checking match-req-rsp action open

  allow the action header-MaxLength request 100

  Open the max-uri-length 100 action

  You have any filter http commands and orders url server configured? If so, there is an option to truncate long URLS.

  In addition, bugs seem to exist in the http inspection engine in versions after 7.1 (2). Try to disable the http inspection and see if the problem goes away.

  Andrew

• Cisco ASA and dynamic VPN L2L Fortigate configuration

  I met a problem recently with an ASA 5510 (7.0) and a bunch of Fortigate 50 (3.0 MR7). The ASA is the hub and Fortigates are rays with a dynamic public IP.

  I followed this document on the site Web of Cisco (http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml) to set up my ASA and the parameters passed to my counterparts to set up their Fortigates.

  However, the ASA journal reveals that attemtps Fortigate connection always tried with DefaultRAGroup before falling back to DefaultL2LGroup and finally died. Experience with putting in place a dynamic VPN between Cisco and Fortigate someone? Which could not fail at each end? Here's a typical piece of error log ASA. The ASA is currently having a static VPN tunnel and a site-2-client VPN in two groups by default.

  6. January 10, 2011 20:58:45 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
  5. January 10, 2011 20:58:45 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
  6. January 10, 2011 20:58:45 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
  5. January 10, 2011 20:58:45 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
  6. January 10, 2011 20:58:41 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
  5. January 10, 2011 20:58:41 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
  4. January 10, 2011 20:58:39 | 713903: Group = DefaultL2LGroup, IP = 116.230.243.205, ERROR, had decrypt packets, probably due to problems not match pre-shared key.  Abandonment
  5. January 10, 2011 20:58:39 | 713904: Group = DefaultL2LGroup, IP = 116.230.243.205, received the package of Mode main Oakley encrypted with invalid payloads, MessID = 0
  6. January 10, 2011 20:58:39 | 713905: Group = DefaultRAGroup, IP = 116.230.243.205, WARNING, had decrypt packets, probably due to problems not match pre-shared key.  User switching to the tunnel-group: DefaultL2LGroup
  5. January 10, 2011 20:58:39 | 713904: Group = DefaultRAGroup, IP = 116.230.243.205, received the package of Mode main Oakley encrypted with invalid payloads, MessID = 0
  4. January 10, 2011 20:58:33 | 713903: Group = DefaultRAGroup, IP = 116.230.243.205, error: cannot delete PeerTblEntry
  3. January 10, 2011 20:58:33 | 713902: Group = DefaultRAGroup, IP = 116.230.243.205, Removing peer to peer table has no, no match!
  6. January 10, 2011 20:58:33 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
  5. January 10, 2011 20:58:33 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
  6. January 10, 2011 20:58:25 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
  5. January 10, 2011 20:58:25 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
  6. January 10, 2011 20:58:21 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
  5. January 10, 2011 20:58:21 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
  5. January 10, 2011 20:58:19 | 713904: IP = 116.230.243.205, encrypted packet received with any HIS correspondent, drop

  Yes, sounds about right. He will try to match with the DefaultRAGroup first, and when you know that it's a dynamic IPSec in LAN-to-LAN, it will be

  then back to the DefaultL2LGroup, because he doesn't know if the VPN Client or L2L again when he is contacted fist as they are connecting from dynamic IP peer.

  You must ensure that your L2L tunnel-group by default has been configured with the corresponding pre-shared key.

  Assuming that you have configured the dynamic map and assign to the card encryption.

  Here is an example of configuration where ASA has a static and peripheral ip address pair has dynamic IP:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

  Hope that helps.

• Connectivity problems from site to Site - ASA and PIX

  I'm trying to set up a tunnel between the ASA and PIX but I have some difficulty.

  On the side of the ASA

  June 29 at 08:09:44 [IKEv1]: Group = 190.213.57.203, IP = 190.213.57.203, error QM WSF (P2 struct & 0xc9309260, mess id 0x7e79b74e).

  June 29 at 08:09:44 [IKEv1]: Group = 190.213.57.203, IP = 190.213.57.203, peer table correlator Removing failed, no match!

  June 29 at 08:09:44 [IKEv1]: Group = 190.213.57.203, IP = 190.213.57.203, Session is be demolished. Reason: Phase 2

  On the side of PIX

  ISAKMP (0): the total payload length: 37
  to return to the State is IKMP_NO_ERROR
  crypto_isakmp_process_block:src:63.143.77.114, dest:190.213.57.203 spt:500 dpt:500
  Exchange OAK_MM
  ISAKMP (0): processing ID payload. Message ID = 0
  ISAKMP (0): HASH payload processing. Message ID = 0
  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): Peer Remote supports dead peer detection

  ISAKMP (0): SA has been authenticated.

  ISAKMP (0): start Quick Mode Exchange, M - ID - 813626169:cf810cc7IPSEC (key_engine): had an event of the queue...
  IPSec (spi_response): spi 0xbb1797c2 graduation (3138885570) for SA
  from 63.143.77.114 to 190.213.57.203 for prot 3

  to return to the State is IKMP_NO_ERROR
  ISAKMP (0): send to notify INITIAL_CONTACT
  ISAKMP (0): sending message 24578 NOTIFY 1 protocol
  Peer VPN: ISAKMP: approved new addition: ip:63.143.77.114/500 Total VPN peers: 2
  Peer VPN: ISAKMP: ip:63.143.77.114/500 Ref cnt is incremented to peers: 1 Total VPN peers: 2
  crypto_isakmp_process_block:src:63.143.77.114, dest:190.213.57.203 spt:500 dpt:500
  ISAKMP (0): processing NOTIFY payload 14 Protocol 3
  SPI 0, message ID = 2038434904
  to return to the State is IKMP_NO_ERR_NO_TRANS
  crypto_isakmp_process_block:src:63.143.77.114, dest:190.213.57.203 spt:500 dpt:500
  ISAKMP (0): processing DELETE payload. Message ID = 1798094647, spi size = 16
  ISAKMP (0): delete SA: src 190.213.57.203 dst 63.143.77.114
  to return to the State is IKMP_NO_ERR_NO_TRANS
  ISADB: Reaper checking HIS 0x11fa6fc, id_conn = 0
  ISADB: Reaper checking HIS 0x121ac3c, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: ip:63.143.77.114/500 Ref cnt decremented to peers: 0 Total of VPN peers: 2
  Peer VPN: ISAKMP: deleted peer: ip:63.143.77.114/500 VPN Total peers:1IPSEC (key_engine): had an event of the queue...
  IPSec (key_engine_delete_sas): rec would remove the ISAKMP notify
  IPSec (key_engine_delete_sas): remove all SAs shared with 63.143.77.114

  The ASA configuration

  ASA Version 8.2 (5)

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.102.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 63.143.77.114 255.255.255.252

  !

  passive FTP mode

  clock timezone IS - 5

  DNS lookup field inside

  DNS domain-lookup outside

  DNS server-group DefaultDNS

  domain lexlocal

  object-group service DM_INLINE_SERVICE_3

  the eq https tcp service object

  the eq telnet tcp service object

  ICMP service object

  the purpose of the service tcp - udp eq www

  the udp service object

  object-group service DM_INLINE_SERVICE_5

  the udp service object

  the tcp service object

  the purpose of the service tcp - udp eq www

  the purpose of the service tcp eq www

  the purpose of the service udp eq www

  ICMP service object

  object-group service DM_INLINE_SERVICE_8

  the eq https tcp service object

  the purpose of the service tcp - udp eq www

  object-group Protocol DM_INLINE_PROTOCOL_1

  ip protocol object

  object-protocol udp

  object-tcp protocol

  object-group service DM_INLINE_SERVICE_4

  the purpose of the service tcp - udp eq www

  the eq https tcp service object

  EQ-tcp smtp service object

  the purpose of the udp eq snmp service

  the purpose of the ip service

  ICMP service object

  object-group Protocol DM_INLINE_PROTOCOL_2

  ip protocol object

  object-protocol udp

  object-tcp protocol

  object-group Protocol DM_INLINE_PROTOCOL_3

  ip protocol object

  object-protocol udp

  object-tcp protocol

  inside_nat0_outbound list of allowed ip extended access all VPN_Access 255.255.255.240

  access extensive list ip 192.168.102.0 inside_nat0_outbound allow Barbado-internal 255.255.255.0 255.255.255.0

  inside_nat0_outbound list of allowed ip extended access all VPN_Access 255.255.255.192

  access extensive list ip 192.168.102.0 inside_nat0_outbound allow 255.255.255.0 JA_Office_Internal 255.255.255.0

  access extensive list ip 192.168.102.0 inside_nat0_outbound allow 255.255.255.0 P.O.S_Office_internal 255.255.255.0

  outside_authentication list extended access allowed object-group DM_INLINE_PROTOCOL_3 all all idle state

  inside_access_in access-list extended ip any any idle state to allow

  inside_access_in list extended access allowed object-group host Jeremy DM_INLINE_SERVICE_5 all

  inside_access_in list extended access allowed object-group DM_INLINE_SERVICE_3 192.168.102.0 255.255.255.0 any

  inside_access_in list extended access allowed object-group DM_INLINE_PROTOCOL_1 192.168.102.0 255.255.255.0 192.168.102.0 255.255.255.0

  outside_access_in list extended access allowed object-groups DM_INLINE_PROTOCOL_2 host interface idle outside Jeremy

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_4 any external interface

  extended access list ip 255.255.255.0 Barbado-internal outside_access_in allow 192.168.102.0 255.255.255.0

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_8 any inactive external interface

  IP JA_Office_Internal 255.255.255.0 JA_Office_Internal 255.255.255.0 allow Access-list extended outside_access_in

  IP P.O.S_Office_internal 255.255.255.0 P.O.S_Office_internal 255.255.255.0 allow Access-list extended outside_access_in

  access extensive list ip 192.168.102.0 outside_1_cryptomap allow Barbado-internal 255.255.255.0 255.255.255.0

  access extensive list ip 192.168.102.0 outside_2_cryptomap allow 255.255.255.0 JA_Office_Internal 255.255.255.0

  access extensive list ip 192.168.102.0 outside_3_cryptomap allow 255.255.255.0 P.O.S_Office_internal 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  mask of local pool remote_users 192.168.200.1 - 192.168.200.10 IP 255.255.255.0

  mask of local pool VPN_IPs 192.168.200.25 - 192.168.200.50 IP 255.255.255.248

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow any inside

  don't allow no asdm history

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 0.0.0.0 0.0.0.0

  inside_access_in access to the interface inside group

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 63.143.77.113 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  AAA authentication match outside the LOCAL outside_authentication

  Enable http server

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Sysopt connection timewait

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

  Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set pfs

  peer set card crypto outside_map 1 200.50.87.198

  card crypto outside_map 1 set of transformation-ESP-3DES-SHA

  card crypto outside_map 2 match address outside_2_cryptomap

  card crypto outside_map 2 set pfs

  peer set card crypto outside_map 2 66.54.113.191

  card crypto outside_map 2 game of transformation-ESP-3DES-SHA

  card crypto outside_map 3 match address outside_3_cryptomap

  card crypto outside_map 3 set pfs

  peer set card crypto outside_map 3 190.213.57.203

  card crypto outside_map 3 game of transformation-ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  crypto ISAKMP policy 30

  authentication crack

  3des encryption

  sha hash

  Group 2

  life 86400

  crypto ISAKMP policy 50

  preshared authentication

  the Encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  crypto ISAKMP disconnect - notify

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  dhcpd address 192.168.102.30 - 192.168.102.50 inside

  dhcpd dns 66.54.116.4 66.54.116.5 interface inside

  dhcpd allow inside

  !

  dhcpd dns 66.54.116.4 66.54.116.5 outside interface

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

  WebVPN

  allow outside

  internal DefaultRAGroup group strategy

  attributes of Group Policy DefaultRAGroup

  VPN-tunnel-Protocol svc

  lexlocal value by default-field

  WebVPN

  SVC keepalive no

  internal DefaultRAGroup_1 group strategy

  attributes of Group Policy DefaultRAGroup_1

  Protocol-tunnel-VPN l2tp ipsec

  lexlocal value by default-field

  WebVPN

  SVC keepalive no

  internal VPN_Tunnel_Client group strategy

  attributes of Group Policy VPN_Tunnel_Client

  value of server DNS 192.168.102.1

  Protocol-tunnel-VPN IPSec l2tp ipsec svc

  lexlocal value by default-field

  username VPN_Connect password 6f7B + J8S2ADfQF4a/CJfvQ is nt encrypted

  username VPN_Connect attributes

  type of nas-prompt service

  xxxxex iFxSRrE9uIWAFjJE encrypted password username

  attributes global-tunnel-group DefaultRAGroup

  address pool remote_users

  address pool VPN_IPs

  Group Policy - by default-DefaultRAGroup_1

  IPSec-attributes tunnel-group DefaultRAGroup

  pre-shared key *.

  tunnel-group 200.50.87.198 type ipsec-l2l

  IPSec-attributes tunnel-group 200.50.87.198

  pre-shared key *.

  type tunnel-group VPN_Tunnel_Client remote access

  attributes global-tunnel-group VPN_Tunnel_Client

  address pool remote_users

  Group Policy - by default-VPN_Tunnel_Client

  IPSec-attributes tunnel-group VPN_Tunnel_Client

  pre-shared key *.

  tunnel-group 66.54.113.191 type ipsec-l2l

  IPSec-attributes tunnel-group 66.54.113.191

  pre-shared key *.

  tunnel-group 190.213.57.203 type ipsec-l2l

  IPSec-attributes tunnel-group 190.213.57.203

  pre-shared key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  Review the ip options

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  call-home

  Profile of CiscoTAC-1

  PIX configuration

  lexmailserver name 192.168.1.3

  name 192.168.1.120 Lextt-SF

  name 192.168.1.6 Lextt-ms

  name 192.168.100.0 Barbados

  name 192.168.102.0 Data_Center_Internal

  outside_access_in tcp allowed access list any interface outside eq smtp

  outside_access_in tcp allowed access list any interface outside eq www

  outside_access_in tcp allowed access list any interface outside eq https

  inside_outbound_nat0_acl ip access list allow any 192.168.2.0 255.255.255.224

  permit 192.168.1.0 ip access list inside_outbound_nat0_acl 255.255.255.0 Barbado

  permit 192.168.1.0 ip access list inside_outbound_nat0_acl 255.255.255.0 Data_Ce

  permit 192.168.1.0 ip access list outside_cryptomap_20 255.255.255.0 Barbados 25

  permit 192.168.1.0 ip access list outside_cryptomap_40 255.255.255.0 Data_Center

  pager lines 24

  opening of session

  debug logging in buffered memory

  logging trap information

  logging out of the 190.213.57.203 host

  Outside 1500 MTU

  Within 1500 MTU

  external IP 190.213.57.203 255.255.255.0

  IP address inside 192.168.1.1 255.255.255.0

  IP verify reverse path to the outside interface

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool vpn_pool 192.168.2.0 - 192.168.2.20

  no failover

  failover timeout 0:00:00

  failover poll 15

  No IP failover outdoors

  No IP failover inside

  PDM location lexmailserver 255.255.255.255 outside

  location of PDM Lextt-ms 255.255.255.255 outside

  location of PDM 192.168.2.0 255.255.255.224 outside

  location of PDM 200.50.87.198 255.255.255.255 outside

  PDM location Barbados 255.255.255.0 inside

  location of PDM 255.255.255.255 Lextt-SF on the inside

  PDM location 255.255.255.0 outside Barbados

  location of PDM 255.255.255.255 Lextt-ms on the inside

  location of PDM Data_Center_Internal 255.255.255.0 outside

  PDM 100 logging alerts

  history of PDM activate

  ARP timeout 14400

  Global interface 10 (external)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 10 192.168.1.0 255.255.255.0 0 0

  public static tcp (indoor, outdoor) interface smtp smtp Lextt-SF netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface www Lextt-ms www netmask 255.255.255.255 0

  public static tcp (indoor, outdoor) interface Lextt-ms https netmask 255.255.255.2 https

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 190.213.73.1 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  AAA authentication enable LOCAL console

  the ssh LOCAL console AAA authentication

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  Barbados 255.255.255.0 HTTP inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  peer set card crypto outside_map 20 200.50.87.198

  outside_map card crypto 20 the transform-set ESP-DES-MD5 value

  outside_map 40 ipsec-isakmp crypto map

  card crypto outside_map 40 correspondence address outside_cryptomap_40

  peer set card crypto outside_map 40 63.143.77.114

  outside_map card crypto 40 the transform-set ESP-DES-MD5 value

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address 200.50.87.198 netmask 255.255.255.255

  ISAKMP key * address 63.143.77.114 netmask 255.255.255.255

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Telnet timeout 5

  If you haven't already done so, you must clear the SAs Phase I on both sides after you make a change to the map.  Once the Phase I SA has been cleared, he renegotiate and reset Phase II.  If you alerady made this, the only other thing I can think is manually re-enter the secrets disclosed in advance on tunnel groups then erase both the Phase I and Phase II SAs.