ASA as a VPN Standalone hub

I replace a VPN3k with ASA, which will happen only as Concentrator VPN located in the demilitarized zone, protected by a firewall.

The other firewall already made inspection/corrections, so I wonder if there is any point in the default service policy by leaving in place.  I did a few tests in two ways and traffic seems to be flowing along very well in both cases.

Also, is there a "best practice" document for the use of the ASA as a stand-alone VPN concentrator?

Thank you.

Terry,

Indeed, if you don't plan to do NAT or filtering on the SAA, it is fair to assume that all inspections can go.

What kind of best practices were you looking for? I'm not aware of such a document (rather than saying that there is not).

Tags: Cisco Security

Similar Questions

  • ASA 5510 L2L VPN static gateway of azure and branches and

    Hello

    I am trying to configure an ASA to operate as a hub between two site-to-site VPN, at our office and the other on Azure.

    i.e.

    Office <-- internet="" --="">ASA <-- internet="" --="">Azure

    On the two sites I can establish a VPN for the hosts of the ASA and access on our data center network, but I can't seem to get the connectivity from end to end of Azure at our office or vice versa.

    Any ideas on what I can try as I have been hitting my head against a wall with this one.

    Hello

    If traffic also came from the blue to office network so it would seem that there is a problem with configuring VPN L2L between ASA and Azure, very probably on the Côte d'Azur.

    -Jouni

  • How to configure ASA as EZ - vpn client?

    How can I configure ASA as Ez - vpn client?

    Only ASA 5505 can be configured as a client VPN EZ.

    Here's a few example configuration:

    http://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/ezvpn505.html

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml

    Hope that helps.

  • ASA 5520: Remote VPN Clients cannot ping LAN, Internet

    I've set up a few of them in my time, but I am confused with this one.  Can I establish connect via VPN tunnel but I can't ping or go on the internet.  I searched the forum for similar and found a little issues, but none of the fixes seem to match.  I noticed a strange thing is when I run ipconfig/all of the vpn client, the IP address that has been leased over the Pool of the VPN is also the default gateway!

    I have attached the config.  Help, please.

    Thank you!

    Exemption of NAT ACL has not yet been applied.

    NAT (inside) 0-list of access Inside_nat0_outbound

    In addition, you have not split tunnel, not sure you were using internet ASA for the vpn client internet browsing.

    You can also enable icmp inspection if you test in scathing:

    Policy-map global_policy
    class inspection_default

    inspect the icmp

    Hope that helps.

  • ASA encrypt interesting VPN traffic

    Hello everybody out there using ASA.

    I had a few IPSEC VPN tunnels between the company's central site and remote sites.

    Two dsl lines were connected to the ASA, one for VPN traffic and the other for the internet.

    The default gateway has been configured online internet, some static while insured roads as traffic to the sites of the company was sent through the other line.

    A few days ago we changed the configuration of ASA to use only a single dsl connection, then the line serving the internet has been cut, while the other will become the gateway default and static routes have been removed.

    The VPN connections instant stopped working and trying to send packets to the remote lan, it seems that ASA will not recognize that the traffic is encrypted. Obviousely we checked cryptomap, acl, ecc, but we find no problem... do you have any suggestions?

    Thanks in advance,

    Matt

    -----------------------------------------------------------------------------------------------------------------------------------------------------------------

    XNetwork object network
    10.10.0.0 subnet 255.255.255.0

    network of the YNetwork object
    172.0.1.0 subnet 255.255.255.0

    card crypto RB1ITSHDSL001_map2 1 corresponds to the address RB1ITSHDSL001_1_cryptomap
    card crypto RB1ITSHDSL001_map2 1 set peer a.b.c.186
    RB1ITSHDSL001_map2 1 transform-set ESP-3DES-SHA crypto card game

    RB1ITSHDSL001_1_cryptomap list extended access permitted ip XNetwork object YNetwork

    -------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Hello

    Your exit the ASA must be encrypting the traffic between XNetwork and YNetwork.

    If the ASA does not encrypt this traffic, it could be because there is a problem with the NAT configuration.

    When the ASA receives a packet, it must first check if there are ACLs that allows traffic, passes through the inspection engine and check that the associated NAT. For example, if the package is coordinated, then the private IP encryption will never take place.

    Could ensure you that packets from the XNetwork are really reach the ASA, the NAT rule is correct and you may be looking for "debugging cry isa 127" and "scream ips 127" debug to check for errors of incompatibility.

    In addition, what is the condition of the tunnel trying to communicate: "sh cry isa his"

    Federico.

  • Simple IOS VPN IPsec HUB and Spoke failover HUB

    Hi all

    I have a nd architecture VPN Hub spoke with Asit, IKEv1 and IPsec.

    My hub is connected to a single service provider.

    I wish I had a hardware redundancy for my hub.

    Instead of creating a double tunnel in each Department, I would like to use my router 4000ISR failover protocol.

    Is it possible to simply achieve?

    If I use IOS IPsec failover that I need to deploy my changes on the two router or (such as ASA) I can set the active router and allow the watch to receive the chenges?

    Thanks to you all.

    Johnny

    If your ISP connection is one that has a routed block and you can connect two routers same in it, you can then configure HSRP.

    The source of the Tunnel becomes the HSRP address.  Rays may not know that there are two routers.

    Easy failover.

    Alternatively, you can have a single tunnel with hubs double (if you do not use HSRP).  You don't have to borrow the double tunnels.

  • Cisco ASA and dynamic VPN L2L Fortigate configuration

    I met a problem recently with an ASA 5510 (7.0) and a bunch of Fortigate 50 (3.0 MR7). The ASA is the hub and Fortigates are rays with a dynamic public IP.

    I followed this document on the site Web of Cisco (http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml) to set up my ASA and the parameters passed to my counterparts to set up their Fortigates.

    However, the ASA journal reveals that attemtps Fortigate connection always tried with DefaultRAGroup before falling back to DefaultL2LGroup and finally died. Experience with putting in place a dynamic VPN between Cisco and Fortigate someone? Which could not fail at each end? Here's a typical piece of error log ASA. The ASA is currently having a static VPN tunnel and a site-2-client VPN in two groups by default.

    6. January 10, 2011 20:58:45 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
    5. January 10, 2011 20:58:45 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
    6. January 10, 2011 20:58:45 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
    5. January 10, 2011 20:58:45 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
    6. January 10, 2011 20:58:41 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
    5. January 10, 2011 20:58:41 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
    4. January 10, 2011 20:58:39 | 713903: Group = DefaultL2LGroup, IP = 116.230.243.205, ERROR, had decrypt packets, probably due to problems not match pre-shared key.  Abandonment
    5. January 10, 2011 20:58:39 | 713904: Group = DefaultL2LGroup, IP = 116.230.243.205, received the package of Mode main Oakley encrypted with invalid payloads, MessID = 0
    6. January 10, 2011 20:58:39 | 713905: Group = DefaultRAGroup, IP = 116.230.243.205, WARNING, had decrypt packets, probably due to problems not match pre-shared key.  User switching to the tunnel-group: DefaultL2LGroup
    5. January 10, 2011 20:58:39 | 713904: Group = DefaultRAGroup, IP = 116.230.243.205, received the package of Mode main Oakley encrypted with invalid payloads, MessID = 0
    4. January 10, 2011 20:58:33 | 713903: Group = DefaultRAGroup, IP = 116.230.243.205, error: cannot delete PeerTblEntry
    3. January 10, 2011 20:58:33 | 713902: Group = DefaultRAGroup, IP = 116.230.243.205, Removing peer to peer table has no, no match!
    6. January 10, 2011 20:58:33 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
    5. January 10, 2011 20:58:33 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
    6. January 10, 2011 20:58:25 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
    5. January 10, 2011 20:58:25 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
    6. January 10, 2011 20:58:21 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
    5. January 10, 2011 20:58:21 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package.  Retransmit the last packet.
    5. January 10, 2011 20:58:19 | 713904: IP = 116.230.243.205, encrypted packet received with any HIS correspondent, drop

    Yes, sounds about right. He will try to match with the DefaultRAGroup first, and when you know that it's a dynamic IPSec in LAN-to-LAN, it will be

    then back to the DefaultL2LGroup, because he doesn't know if the VPN Client or L2L again when he is contacted fist as they are connecting from dynamic IP peer.

    You must ensure that your L2L tunnel-group by default has been configured with the corresponding pre-shared key.

    Assuming that you have configured the dynamic map and assign to the card encryption.

    Here is an example of configuration where ASA has a static and peripheral ip address pair has dynamic IP:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

    Hope that helps.

  • With the help of ASA for our VPN

    I was curious, if through the ASDM, there is a way to show that was recorded in the last week and for how long?  I know through the CLI I can use the sh sessiondb-vpn l2l to see who is connected, but trying to get a report of its total use by user, date and time?

    Hi Dan,.

    The ASA does not all historical data connections so it won't be possible.

    You can view the users connected to the part followed by ASDM but you do not have the reporting features.

    Kind regards

    Nicolas

  • PORT of Configuration.DEFAULT of ASA AnyConnect remote VPN access.

    Hello!!! Now, I need to configure the AnyConnect VPN remote access. And I have a question.

    The default 443 AnyConnect port, but the port is occupied on SAA. We use this port for another application.

    How to change the port to connect? Is this true? Thank you!!!

    Hi, please add the following configuration:

    1. Enable the WebVPN on the SAA feature:

      ASA(config)#webvpn
    2. Enable WebVPN services for the external interface of the ASA:
      ASA(config-webvpn)#enable outside
    3. Allow the ASA to listen WebVPN traffic on the custom port number:
      ASA(config-webvpn)#port <1-65535>

  • ASA 5505. VPN Site-to-Site does not connect!

    Hello!
    Already more than a week there, as we had a new channel of communication of MGTSa (Ontario terminal Sercomm RV6688BCM, who barely made in the 'bridge' - had to do the provider in order to receive our white Cisco Ip address), and now I train as well more that one week to raise between our IKEv1 IPsec Site-to-Site VPN tunnel closes offices.
    Configurable and use the wizard in ASDM and handles in the CLI, the result of a year, the connection does not rise.
    Cisco version 9.2 (2), the image of the Cisco asa922 - k8.bin, Security Plus license version, version 7.2 AMPS (2).
    What I'll never know...
    Debugging and complete configuration enclose below.
    Help, which can follow any responses, please! I was completely exhausted!

    Config:

    Output of the command: "sh run".

    : Saved
    :
    : Serial: XXXXXXXXXXXX
    : Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor
    :
    ASA Version 9.2 (2)
    !
    hostname door-71
    activate the encrypted password of F6OJ0GOws7WHxeql
    names of
    IP local pool vpnpool 10.1.72.100 - 10.1.72.120 mask 255.255.255.0
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 10.1.72.254 255.255.255.0
    !
    interface Vlan2
    nameif outside_mgts
    security-level 0
    62.112.100.R1 255.255.255.252 IP address
    !
    passive FTP mode
    clock timezone 3 MSK/MSD
    clock to DST MSK/MDD recurring last Sun Mar 02:00 last Sun Oct 03:00
    DNS lookup field inside
    DNS server-group MGTS
    Server name 195.34.31.50
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network obj_any object
    subnet 0.0.0.0 0.0.0.0
    network of the NET72 object
    10.1.72.0 subnet 255.255.255.0
    network object obj - 0.0.0.0
    host 0.0.0.0
    network of the Nafanya object
    Home 10.1.72.5
    network object obj - 10.1.72.0
    10.1.72.0 subnet 255.255.255.0
    network of the NET61 object
    10.1.61.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_10.1.72.96_27 object
    subnet 10.1.72.96 255.255.255.224
    network of the NETT72 object
    10.1.72.0 subnet 255.255.255.0
    network of the NET30 object
    10.1.30.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_10.1.72.0_24 object
    10.1.72.0 subnet 255.255.255.0
    object-group service OG INET
    the purpose of the echo icmp message service
    response to echo icmp service object
    service-object icmp traceroute
    service-object unreachable icmp
    service-purpose tcp - udp destination eq echo
    the DM_INLINE_NETWORK_1 object-group network
    network-object NET30
    network-object, object NET72
    DM_INLINE_TCP_1 tcp service object-group
    port-object eq www
    EQ object of the https port
    inside_access_in extended access list permit ip object NET72 object-group DM_INLINE_NETWORK_1
    access extensive list ip 10.1.72.0 inside_access_in allow 255.255.255.0 any
    inside_access_in extended access list permit ip object Nafanya any idle state
    inside_access_in list extended access allowed object-group OG INET an entire
    inside_access_in of access allowed any ip an extended list
    inside_access_in list extended access deny ip any alerts on any newspaper
    outside_mgts_access_in list extended access allowed object-group OG INET an entire
    outside_mgts_access_in list extended access permit tcp any any DM_INLINE_TCP_1 object-group
    outside_mgts_access_in list extended access deny ip any alerts on any newspaper
    access extensive list ip 10.1.72.0 outside_mgts_cryptomap allow 255.255.255.0 object NET61
    VPN-ST_splitTunnelAcl permit 10.1.72.0 access list standard 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    outside_mgts MTU 1500
    IP check path reverse interface outside_mgts
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside outside_mgts) static source NET72 NET72 NETWORK_OBJ_10.1.72.96_27 NETWORK_OBJ_10.1.72.96_27 non-proxy-arp-search of route static destination
    NAT (inside outside_mgts) static source NETWORK_OBJ_10.1.72.0_24 NETWORK_OBJ_10.1.72.0_24 NET61 NET61 non-proxy-arp-search of route static destination
    !
    network obj_any object
    NAT (inside outside_mgts) dynamic obj - 0.0.0.0
    network of the NET72 object
    NAT (inside outside_mgts) interface dynamic dns
    inside_access_in access to the interface inside group
    Access-group outside_mgts_access_in in the outside_mgts interface
    Route 0.0.0.0 outside_mgts 0.0.0.0 62.112.100.R 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    without activating the user identity
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    the ssh LOCAL console AAA authentication
    Enable http server
    http 10.1.72.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    card crypto outside_mgts_map 1 match address outside_mgts_cryptomap
    card crypto outside_mgts_map 1 set pfs Group1
    peer set card crypto outside_mgts_map 1 91.188.180.42
    card crypto outside_mgts_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_mgts_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    card crypto outside_mgts_map interface outside_mgts
    inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    inside crypto map inside_map interface
    Crypto ca trustpoint ASDM_TrustPoint0
    registration auto
    E-mail [email protected] / * /
    name of the object CN = door-71
    Serial number
    IP address 62.112.100.42
    Proxy-loc-transmitter
    Configure CRL
    Crypto ca trustpoint ASDM_TrustPoint1
    registration auto
    ASDM_TrustPoint1 key pair
    Configure CRL
    trustpool crypto ca policy
    string encryption ca ASDM_TrustPoint0 certificates
    certificate eff26954
    30820395 3082027d a0030201 020204ef f2695430 0d06092a 864886f7 0d 010105
    019
    6460ae26 ec5f301d 0603551d 0e041604 14c9a3f2 d70e6789 38fa4b01 465d 1964
    60ae26ec 5f300d06 092 has 8648 01050500 03820101 00448753 7baa5c77 86f70d01
    62857b 65 d05dc91e 3edfabc6 7b3771af bbedee14 673ec67d 3d0c2de4 b7a7ac05
    5f203a8c 98ab52cf 076401e5 1a2c6cb9 3f7afcba 52c617a5 644ece10 d6e1fd7d
    28b57d8c aaf49023 2037527e 9fcfa218 9883191f 60b221bf a561f2be d6882091
    0222b7a3 3880d6ac 49328d1f 2e085b15 6d1c1141 5f850e5c b6cb3e67 0e373591
    94a 82781 44493217 and 38097952 d 003 5552 5c445f1f 92f04039 a23fba20 b9d51b13
    f511f311 d1feb2bb 6d056a15 7e63cc1b 1f134677 8124c 024 3af56b97 51af8253
    486844bc b1954abe 8acd7108 5e4212df db835d76 98ffdb2b 8c8ab915 193b 8167
    0db3dd54 c8346b96 c4f4eff7 1e7cd576 a8b1f86e 3b868a6e 89
    quit smoking
    string encryption ca ASDM_TrustPoint1 certificates
    certificate a39a2b54
    3082025f 30820377 a0030201 020204 has 3 9a2b5430 0d06092a 864886f7 0d 010105
    0500304 06035504 03130767 36313137 30120603 55040513 6174652d 3110300e b
       
    c084dcd9 d250e194 abcb3eb8 1da93bd0 fb0dba1a b1c35b43 d547a841 5d4ee1a4
    14bdb207 7dd790a4 0cd 70471 5f3a896a 07bd56dc ea01b3dd 254cde88 e1490e97
    f3e54c05 551adde0 66aa3782 c85880c2 b162ec29 4e49346a df71062d 6d6d8f49
    62b9de93 ba07b4f7 a50e77e1 8f54b32b 6627cb27 e982b36f a 362973, 0 88de3272
    9bd6d4d2 8ca1e11f 214f20a9 78bdea95 78fdc45c d6d45674 6acb9bcb d0bd930e
    638eedfe cd559ab1 e1205c48 3ee9616f e631db55 e82b623c 434ffdc1 11020301
    0001 has 363 3061300f 0603551d 130101ff 0101ff30 04053003 0e060355 1d0f0101
    ff040403 1f060355 02018630 230418 30168014 0cea70bf 0d0e0c4b eb34a0b1 1 d
    8242 has 549 0603 551d0e04 1604140c ea70bf0d 0e0c4beb 34a0b182 301D 5183ccf9
    42a 54951 010105 05000382 0101004e 7bfe054a 0d 864886f7 0d06092a 83ccf930
    d434a27c 1d3dce15 529bdc5f 70a2dff1 98975de9 2a97333b 96077966 05a8e9ef
    bf320cbd ecec3819 ade20a86 9aeb5bde bd129c7b 29341e4b edf91473 f2bf235d
    9aaeae21 a629ccc6 3c79200b b9a89b08 bf38afb6 ea56b957 4430f692 a 4745, 411
    34d71fad 588e4e18 2b2d97af b2aae6b9 b6a22350 d031615b 49ea9b9f 2fdd82e6
    ebd4dccd df93c17e deceb796 f268abf1 881409b 5 89183841 f484f0e7 bd5f7b69
    ebf7481c faf69d3e 9d24df6e 9c2b0791 785019f7 a0d20e95 2ef35799 66ffc819
    4a77cdf2 c6fb4380 fe94c13c d4261655 7bf3d6ba 6289dc8b f9aad4e1 bd918fb7
    32916fe1 477666ab c2a3d591 a84dd435 51711f6e 93e2bd84 89884c
    quit smoking
    crypto isakmp identity address
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 activate outside_mgts port 443 customer service
    Crypto ikev2 access remote trustpoint ASDM_TrustPoint0
    Crypto ikev1 allow inside
    Crypto ikev1 enable outside_mgts
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    without ssh stricthostkeycheck
    SSH 10.1.72.0 255.255.255.0 inside
    SSH timeout 60
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    vpnclient Server 91.188.180.X
    vpnclient mode network-extension-mode
    vpnclient nem-st-autoconnect
    VPN - L2L vpnclient vpngroup password *.
    vpnclient username aradetskayaL password *.
    dhcpd auto_config outside_mgts
    !
    dhcpd update dns replace all two interface inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    SSL-trust ASDM_TrustPoint0 inside point
    SSL-trust ASDM_TrustPoint0 outside_mgts point
    WebVPN
    Select outside_mgts
    internal GroupPolicy_91.188.180.X group strategy
    attributes of Group Policy GroupPolicy_91.188.180.X
    Ikev1 VPN-tunnel-Protocol
    internal group VPN - ST strategy
    attributes of group VPN - ST policy
    value of 195.34.31.50 DNS Server 8.8.8.8
    Ikev1 VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    Split-tunnel-network-list value VPN-ST_splitTunnelAcl
    by default no
    aradetskayaL encrypted HR3qeva85hzXT6KK privilege 15 password username
    tunnel-group 91.188.180.X type ipsec-l2l
    attributes global-tunnel-group 91.188.180.X
    Group - default policy - GroupPolicy_91.188.180.42
    IPSec-attributes tunnel-group 91.188.180.X
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    remotely IKEv2 authentication certificate
    pre-shared-key authentication local IKEv2 *.
    remote access to tunnel-group VPN - ST type
    VPN-general ST-attributes tunnel-group
    address vpnpool pool
    Group Policy - by default-VPN-ST
    tunnel-group ipsec VPN ST-attributes
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:212e4f5035793d1c219fed57751983d8
    : end

    door-71 # sh crypto ikev1 his

    There are no SAs IKEv1

    door-71 # sh crypto ikev2 his

    There are no SAs IKEv2

    door-71 # sh crypto ipsec his


    There is no ipsec security associations
    door-71 # sh crypto isakmp

    There are no SAs IKEv1

    There are no SAs IKEv2

    Global statistics IKEv1
    The active Tunnels: 0
    Previous Tunnels: 0
    In bytes: 0
    In the packages: 0
    In packs of fall: 0
    In Notifys: 0
    In the constituencies of P2: 0
    In P2 invalid Exchange: 0
    In P2 Exchange rejects: 0
    Requests for removal in his P2: 0
    Bytes: 0
    Package: 0
    Fall packages: 0
    NOTIFYs out: 0


    Exchanges of P2: 0
    The Invalides Exchange P2: 0
    Exchange of P2 rejects: 0
    Requests to remove on P2 Sa: 0
    Tunnels of the initiator: 0
    Initiator fails: 0
    Answering machine fails: 0
    Ability system breaks down: 0
    AUTH failed: 0
    Decrypt failed: 0
    Valid hash fails: 0
    No failure his: 0

    IKEV1 statistics for Admission appeals
    In negotiating SAs Max: 25
    In negotiating SAs: 0
    In negotiating SAs Highwater: 0
    In negotiating SAs rejected: 0

    Global statistics IKEv2
    The active Tunnels: 0
    Previous Tunnels: 0
    In bytes: 0
    In the packages: 0
    In packs of fall: 0
    In Fragments of fall: 0
    In Notifys: 0
    In Exchange for the P2: 0
    In P2 invalid Exchange: 0
    In P2 Exchange rejects: 0
    In IPSEC delete: 0
    In delete IKE: 0
    Bytes: 0
    Package: 0
    Fall packages: 0
    Fragments of fall: 0
    NOTIFYs out: 0
    Exchange of P2: 0
    The Invalides Exchange P2: 0
    Exchange of P2 rejects: 0
    On IPSEC delete: 0
    The IKE Delete: 0
    Locally launched sAs: 0
    Locally launched sAs failed: 0
    SAs remotely initiated: 0
    SAs remotely initiated failed: 0
    System capacity: 0
    Authentication failures: 0
    Decrypt failures: 0
    Hash failures: 0
    Invalid SPI: 0
    In the Configs: 0
    Configs: 0
    In the Configs rejects: 0
    Configs rejects: 0
    Previous Tunnels: 0
    Previous Tunnels wraps: 0
    In the DPD Messages: 0
    The DPD Messages: 0
    The NAT KeepAlive: 0
    IKE recomposition launched locally: 0
    IKE returned to the remote initiated key: 0
    Generate a new key CHILD initiated locally: 0
    CHILD given to the remote initiated key: 0

    IKEV2 statistics for Admission appeals
    Max active SAs: no limit
    Max in negotiating SAs: 50
    Challenge cookie line: never
    Active sAs: 0
    In negotiating SAs: 0
    Incoming requests: 0
    Accepted incoming requests: 0
    A rejected incoming requests: 0
    Out of requests: 0
    Out of the applications accepted: 0
    The outgoing rejected requests: 0
    A rejected queries: 0
    Rejected at the SA: 0 Max limit
    Rejected low resources: 0
    Rejected the current reboot: 0
    Challenges of cookie: 0
    Cookies transmitted challenges: 0
    Challenges of cookie failed: 0

    IKEv1 global IPSec over TCP statistics
    --------------------------------
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Incoming packets: 0
    Inbound packets ignored: 0
    Outgoing packets: 0
    Outbound packets ignored: 0
    The RST packets: 0
    Heartbeat Recevied ACK packets: 0
    Bad headers: 0
    Bad trailers: 0
    Chess timer: 0
    Checksum errors: 0
    Internal error: 0

     
    door-71 # sh statistical protocol all cryptographic
    [Statistics IKEv1]
    Encrypt packets of requests: 0
    Encapsulate packets of requests: 0
    Decrypt packets of requests: 0
    Decapsulating requests for package: 0
    HMAC calculation queries: 0
    ITS creation queries: 0
    SA asked to generate a new key: 0
    Deletion requests: 0
    Next phase of allocation key applications: 0
    Number of random generation queries: 0
    Failed requests: 0
    [Statistics IKEv2]
    Encrypt packets of requests: 0
    Encapsulate packets of requests: 0
    Decrypt packets of requests: 0
    Decapsulating requests for package: 0
    HMAC calculation queries: 0
    ITS creation queries: 0
    SA asked to generate a new key: 0
    Deletion requests: 0
    Next phase of allocation key applications: 0
    Number of random generation queries: 0
    Failed requests: 0
    [IPsec statistics]
    Encrypt packets of requests: 0
    Encapsulate packets of requests: 0
    Decrypt packets of requests: 0
    Decapsulating requests for package: 0
    HMAC calculation queries: 0

    ITS creation queries: 0
    SA asked to generate a new key: 0
    Deletion requests: 0
    Next phase of allocation key applications: 0
    Number of random generation queries: 0
    Failed requests: 0
    [SSL statistics]
    Encrypt packets of queries: 19331
    Encapsulate packets of queries: 19331
    Decrypt packets of queries: 437
    Package requests decapsulating: 437
    HMAC calculation queries: 19768
    ITS creation queries: 178
    SA asked to generate a new key: 0
    Requests to remove SA: 176
    Next phase of allocation key applications: 0
    Number of random generation queries: 0
    Failed requests: 0
    [Statistical SSH are not taken in charge]
    [Statistics SRTP]
    Encrypt packets of requests: 0
    Encapsulate packets of requests: 0
    Decrypt packets of requests: 0
    Decapsulating requests for package: 0
    HMAC calculation queries: 0
    ITS creation queries: 0
    SA asked to generate a new key: 0
    Deletion requests: 0
    Next phase of allocation key applications: 0
    Number of random generation queries: 0
    Failed requests: 0
    [Statistics]
    Encrypt packets of requests: 0
    Encapsulate packets of requests: 0
    Decrypt packets of requests: 0
    Decapsulating requests for package: 0
    HMAC calculation queries: 6238
    ITS creation queries: 0
    SA asked to generate a new key: 0
    Deletion requests: 0
    Next phase of allocation key applications: 0
    Number of queries random generation: 76
    Failure of queries: 9

    door-71 # sh crypto ca trustpoints

    Trustpoint ASDM_TrustPoint0:
    Configured for the production of a self-signed certificate.

    Trustpoint ASDM_TrustPoint1:
    Configured for the production of a self-signed certificate.

    If you need something more, then spread!
    Please explain why it is that I don't want to work?

    Hello

    When the IPSEC tunnel does not come to the top, the first thing comes to my mind is to run a tracer of package from the CLI and the phases in it. Please run this command from your firewall side and share the output. I've just compiled this command with the random ip address and ports of your given range.

    Packet-trace entry inside tcp 10.1.72.2 1233 10.1.61.2 443 detailed

    Best regards

    Amandine

  • Cisco ASA AnyConnect SSL VPN - certificates + token?

    Hello

    I'm looking for an answer is it possible such configuration:

    The Cisco AnyConnect SSL VPN service with two-factor - first method is the Microsoft CA certificate local and second method - a token solution Symantec VIP password?

    I don't know if two-factor authentication is user/password from Active Directory + OTP by Symantec VIP there is no problem, because you can send the user + pass with Radius, but with certificates I do not really understand who will check the validity of the certificate, which certificate, we will send you to the RADIUS for the validation server and how the configuration of the point of view of ASA will look like.

    Thank you very much for the help!

    Hi Alex,

    I don't see a problem with having certificate + token to connect to the VPN. Certificate authentication must be performed on the SAA, see an example below:

    https://supportforums.Cisco.com/blog/152941/AnyConnect-certificate-based-authentication

    Authentication token can be specified as primary/secondary (authentication SDI) on the SAA, an example below:

    http://www.Cisco.com/c/en/us/TD/docs/security/vpn_client/AnyConnect/anyconnect31/Administration/Guide/anyconnectadmin31/ac11authenticate.html#pgfId-1060345

    It may be useful

    -Randy-

  • Cisco ASA 5515 two asa firewall ipsec vpn tunnel is not coming

    HelloW everyone.

    I configured ipsec vpn tunnel between Singapore and Malaysia with asa firewall.

    but the vpn does not come to the top. can someone tell me what can be the root cause?

    Here is the configuration of twa asa: (I changed the ip address all the)

    Singapore:

    See the race
    ASA 2.0000 Version 4
    !
    ASA5515-SSG520M hostname
    activate the encrypted password of PVSASRJovmamnVkD
    names of
    !
    interface GigabitEthernet0/0
    nameif inside
    security-level 100
    IP 192.168.15.4 255.255.255.0
    !
    interface GigabitEthernet0/1
    nameif DMZ
    security-level 50
    IP 192.168.5.3 255.255.255.0
    !
    interface GigabitEthernet0/2
    nameif outside
    security-level 0
    IP 160.83.172.8 255.255.255.224
    <--- more="" ---="">
                  
    !
    <--- more="" ---="">
                  
    interface GigabitEthernet0/3
    <--- more="" ---="">
                  
    Shutdown
    <--- more="" ---="">
                  
    No nameif
    <--- more="" ---="">
                  
    no level of security
    <--- more="" ---="">
                  
    no ip address
    !
    interface GigabitEthernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/5
    nameif test
    security-level 100
    IP 192.168.168.219 255.255.255.0
    !
    interface Management0/0
    management only
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    connection of the banner ^ C please disconnect if you are unauthorized access ^ C
    connection of the banner please disconnect if you are unauthorized access
    boot system Disk0: / asa922-4-smp - k8.bin
    passive FTP mode
    network of the SG object
    <--- more="" ---="">
                  
    192.168.15.0 subnet 255.255.255.0
    network of the MK object
    192.168.6.0 subnet 255.255.255.0
    service of the TCP_5938 object
    Service tcp destination eq 5938
    Team Viewer description
    service tcp_3306 object
    Service tcp destination eq 3306
    service tcp_465 object
    tcp destination eq 465 service
    service tcp_587 object
    Service tcp destination eq 587
    service tcp_995 object
    tcp destination eq 995 service
    service of the TCP_9000 object
    tcp destination eq 9000 service
    network of the Inside_host object
    Home 192.168.15.202
    service tcp_1111 object
    Service tcp destination eq 1111
    service tcp_7878 object
    Service tcp destination eq 7878
    service tcp_5060 object
    SIP, service tcp destination eq
    <--- more="" ---="">
                  
    service tcp_5080 object
    Service tcp destination eq 5080
    network of the NETWORK_OBJ_192.168.15.0_24 object
    192.168.15.0 subnet 255.255.255.0
    inside_access_in list extended access allowed object SG ip everything
    OUTSIDE_IN list extended access permit tcp any newspaper EQ 9000 Inside_host object
    access extensive list ip 192.168.15.0 outside_cryptomap allow 255.255.255.0 object MK
    pager lines 24
    Enable logging
    timestamp of the record
    exploitation forest-size of the buffer of 30000
    debug logging in buffered memory
    recording of debug trap
    debugging in the history record
    asdm of logging of information
    host test 192.168.168.231 record
    host test 192.168.168.203 record
    Within 1500 MTU
    MTU 1500 DMZ
    Outside 1500 MTU
    test MTU 1500
    management of MTU 1500
    no failover
    <--- more="" ---="">
                  
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 7221.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source SG SG static destination MK MK non-proxy-arp-search to itinerary
    !
    network of the SG object
    NAT dynamic interface (indoor, outdoor)
    network of the Inside_host object
    NAT (inside, outside) interface static 9000 9000 tcp service
    inside_access_in access to the interface inside group
    Access-group OUTSIDE_IN in interface outside
    Route outside 0.0.0.0 0.0.0.0 160.83.172.x 1
    Route inside 10.0.1.0 255.255.255.0 192.168.15.199 1
    Route inside 10.0.2.0 255.255.255.0 192.168.15.199 1
    Route inside 10.0.11.0 255.255.255.0 192.168.15.199 1
    Route inside 10.1.0.0 255.255.0.0 192.168.15.199 1
    Route inside 10.8.0.0 255.255.0.0 192.168.15.199 1
    Route inside 10.104.0.0 255.255.0.0 192.168.15.199 1
    Route inside 192.168.8.0 255.255.255.0 192.168.15.199 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    <--- more="" ---="">
                  
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    the ssh LOCAL console AAA authentication
    Enable http server

    Community trap SNMP-server host test 192.168.168.231 *.
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps syslog
    Crypto ipsec transform-set ikev1 VPN-TRANSFORM esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec pmtu aging infinite - the security association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    crypto CRYPTO - map 2 map corresponds to the address outside_cryptomap
    card crypto CRYPTO-map 2 set peer 103.246.3.54
    card crypto CRYPTO-map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto CRYPTO-map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    CRYPTO-card interface card crypto outside
    trustpool crypto ca policy
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400

    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
    internal GroupPolicy1 group strategy
    attributes of Group Policy GroupPolicy1
    Ikev1 VPN-tunnel-Protocol
    username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
    username gmsadmin password HS/VyK0jtJ/PANQT encrypted privilege 15
    tunnel-group 143.216.30.7 type ipsec-l2l
    tunnel-group 143.216.30.7 General-attributes
    Group Policy - by default-GroupPolicy1
    <--- more="" ---="">
                  
    IPSec-attributes tunnel-group 143.216.30.7
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    Overall description
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    <--- more="" ---="">
                  
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:ccce9a600b491c8db30143590825c01d
    : end

    Malaysia:

    :
    ASA 2.0000 Version 4
    !
    hostname ASA5515-SSG5-MK
    activate the encrypted password of PVSASRJovmamnVkD
    names of
    !
    interface GigabitEthernet0/0
    nameif inside
    security-level 100
    IP 192.168.6.70 255.255.255.0
    !
    interface GigabitEthernet0/1
    nameif DMZ
    security-level 50
    IP 192.168.12.2 255.255.255.0
    !
    interface GigabitEthernet0/2
    nameif outside
    security-level 0
    IP 143.216.30.7 255.255.255.248
    <--- more="" ---="">
                  
    !
    interface GigabitEthernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/5
    nameif test
    security-level 100
    IP 192.168.168.218 255.255.255.0
    !
    interface Management0/0
    management only
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    <--- more="" ---="">
                  
    Interface Port - Channel 1
    No nameif
    no level of security
    IP 1.1.1.1 255.255.255.0
    !
    boot system Disk0: / asa922-4-smp - k8.bin
    passive FTP mode
    clock timezone GMT + 8 8
    network of the SG object
    192.168.15.0 subnet 255.255.255.0
    network of the MK object
    192.168.6.0 subnet 255.255.255.0
    service of the TCP_5938 object
    Service tcp destination eq 5938
    Team Viewer description
    service tcp_3306 object
    Service tcp destination eq 3306
    service tcp_465 object
    tcp destination eq 465 service
    service tcp_587 object
    Service tcp destination eq 587
    service tcp_995 object
    tcp destination eq 995 service
    service of the TCP_9000 object
    <--- more="" ---="">
                  
    tcp destination eq 9000 service
    network of the Inside_host object
    Home 192.168.6.23
    service tcp_1111 object
    Service tcp destination eq 1111
    service tcp_7878 object
    Service tcp destination eq 7878
    service tcp_5060 object
    SIP, service tcp destination eq
    service tcp_5080 object
    Service tcp destination eq 5080
    network of the NETWORK_OBJ_192.168.2.0_24 object
    192.168.6.0 subnet 255.255.255.0
    inside_access_in list extended access allowed object SG ip everything
    VPN-INTERESTING-TRAFFIC extended access list permit ip object MK SG
    OUTSIDE_IN list extended access permit tcp any newspaper EQ 9000 Inside_host object
    outside_cryptomap to access extended list ip 192.168.6.0 allow 255.255.255.0 object SG
    pager lines 24
    Enable logging
    timestamp of the record
    exploitation forest-size of the buffer of 30000
    debug logging in buffered memory
    recording of debug trap
    asdm of logging of information
    <--- more="" ---="">
                  
    host test 192.168.168.231 record
    host test 192.168.168.203 record
    Within 1500 MTU
    MTU 1500 DMZ
    Outside 1500 MTU
    test MTU 1500
    management of MTU 1500
    reverse IP check management interface path
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 7221.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source MK MK static destination SG SG route no-proxy-arp-search
    NAT (inside, outside) static source NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 static destination SG SG route no-proxy-arp-search
    !
    network of the MK object
    NAT dynamic interface (indoor, outdoor)
    network of the Inside_host object
    NAT (inside, outside) interface static 9000 9000 tcp service
    inside_access_in access to the interface inside group
    Access-group OUTSIDE_IN in interface outside
    Route outside 0.0.0.0 0.0.0.0 143.216.30.x 1
    <--- more="" ---="">
                  
    Route inside 10.2.0.0 255.255.0.0 192.168.6.200 1
    Route inside 10.6.0.0 255.255.0.0 192.168.6.200 1
    Route inside 192.168.254.0 255.255.255.0 192.168.6.200 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    the ssh LOCAL console AAA authentication
    Enable http server

    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 VPN-TRANSFORM esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec pmtu aging infinite - the security association
    crypto CRYPTO - map 2 map corresponds to the address outside_cryptomap
    card crypto CRYPTO-map 2 set peer 160.83.172.8
    card crypto CRYPTO-map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    CRYPTO-card interface card crypto outside
    trustpool crypto ca policy
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    SSH timeout 60
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
    attributes of Group Policy DfltGrpPolicy
    Ikev1 VPN-tunnel-Protocol l2tp ipsec without ssl-client
    internal GroupPolicy1 group strategy
    attributes of Group Policy GroupPolicy1
    Ikev1 VPN-tunnel-Protocol
    username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
    username gmsadmin password HS/VyK0jtJ/PANQT encrypted privilege 15
    <--- more="" ---="">
                  
    tunnel-group MK SG type ipsec-l2l
    IPSec-attributes tunnel-group MK-to-SG
    IKEv1 pre-shared-key *.
    tunnel-group 160.83.172.8 type ipsec-l2l
    tunnel-group 160.83.172.8 General-attributes
    Group Policy - by default-GroupPolicy1
    IPSec-attributes tunnel-group 160.83.172.8
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    <--- more="" ---="">
                  
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
    : end

    Good news, that VPN has been implemented!

    According to the ping problem, my suggestion is to check, if some type of firewall based on host computers on both sides block ICMP requests.

    Anyway, you can still use the capture of packets on the inside of the interfaces of the two ASAs, to check if the ICMP traffic is to reach the ASA.

    In addition, you can try to enable ICMP inspection:

    Policy-map global_policy
    class inspection_default

    inspect the icmp

    inspect the icmp error

  • MAC and PC can reach the same an ASA for Anyconnect VPN?

    Hi, we have MAC and PC users. We configure the Anyconnect VPN in an ASA. But two users need two image of sorts. We must therefore use the two commands:

    AnyConnect image disk0: / anyconnect -win- 3.1.04066 - k9.pkg

    AnyConnect image disk0: / anyconnect -macosx- i386 - 2.5.2014 - k9.pkg.

    This is what two commands cannot coexist in an ASA. How to solve the problem? I hope your suggestion. Thank you

    They can co-exist, but you must add different sequence numbers at the end of each command.

  • ASA: Show sesiions VPN

    What CLI commands display session VPN site-to-site on asa 5520.

    Thank you

    Colm

    ISAKMP crypto to show his<- for="" tunnels="">

    and

    Crypto ipsec to show his<- for="" tunnel="" traffic="">

  • The ASA with crossed VPN Port forwarding

    Hello

    I worked on a question for a while and I have managed to track down the issue, but I don't know how to solve the problem.

    I have an ASA 5505 8.4 (7) running with a tunnel for incoming remote users anyconnect vpn. I also want to configure incoming Web server port forwarding.

    The question seems to be traversed rule which stops incoming port forwarding:

    NAT (outside, outside) NETWORK_OBJ_172.16.1.0_28 interface description dynamic source hairpin to natting users vpn on the external interface

    When I disable the port forwarding will work perfectly (according to tracer packet that is).

    I have attached the config to this post. I would appreciate any idea how to get the through VPN and the transfer to the incoming port working.

    The config has been condensed to remove unneed config.

    Thank you

    Hello

    What is the configuration commands, you use to put in place the static PAT (Port Forward)?

    The problem is most likely order of the NAT configurations such as configuring NAT above in the upper part of the NAT configurations.

    Configuring static PAT, that you could use to make it work would be

    the SERVER object network

    host

    service object WWW

    tcp source eq www service

    NAT (server, on the outside) of the interface to the static SERVER 1 source WWW WWW service

    The above assumes the source for the host interface is "Server" and the service that you want to PAT static TCP/80.

    Note that we add the number '1' in the 'nat' command. This will add at the top. The same should be done for any other static PAT you configure you want for these VPN Clients.

    Hope this helps

    -Jouni

Maybe you are looking for

  • LJ pro M177fw: eprint center connection problem

    Hello today I am trying to add my new printer to my eprint account, but I do not remember my pwd, so I want to co reset the password. By e-mail, I received a link http://h30495.www3.HP.com/reset_password/xxxxxxxxxxxxxxx but it didn't work, the Web se

  • Airport not showing is not as network device?

    My Airport Extreme 802.11ac does not appear in the finder as a network device. It showed in the previous Extreme model I was using, then leave for any reason any. After messing around for a month or two, then trying to get it working again, I bought

  • Microsoft Office Starter missing after restoring on HP Pavilion Notebook g6

    Hello. I recently restored, using the recovery partition HP and not the KNOW-HOW of recovery (5 discs) media, which were provided by the KNOW-HOW. I noticed that several software, were not restored. Adobe Reader and Skype to name a few. I downloaded

  • stars on the notification bar

    Ive just got a star beside the signal bars. What does that mean? https://www.dropbox.com/s/fovsxr4blalq8g5/Screenshot_2015-04-11-16-35-49.PNG?DL=0

  • Copy of the user folders to clean Vista install

    I did a clean install of Vista on a new 500 GB drive and download updates 100plus, but now I need to copy it to my user (data and user settings) files to the new drive. I've connected the old disk with a shell of external drive to the laptop via the