ASA to remote access VPN with external IP dynamic

Hi forum,

I was wondering if it was possible to set up an ASA to provide access to remote connections VPN (IPSEC or WebVPN/SSL) of the outside world, if the external IP address is dynamic (i.e. obtained through DHCP)?  I understand how to use DynamicDNS to provide a host name for the VPN clients, I ask simply if the SAA can be configured to allow VPN connections from a DHCP interface addressed.  I understand there are problems with the site to site VPN when both sides are addressed in a dynamic way, but it seems that the remote VPN access should work.  Just hoping to confirm this before I go and I'm working on a config.

Thanks in advance...

The same configuration applies.

In my view, that the only difference is that with the external IP being dynamic:

interface e0/0

IP address dhcp setroute

crypto map

The only difference is that (the PCF file) VPN clients should have the VPN connection with a hostname (rather than an IP address) and the IP must be solved at the IPs of the SAA.

I'll try to find you an example configuration if you do not.

Federico.

Tags: Cisco Security

Similar Questions

  • Remote access VPN with ASA 5510 by using the DHCP server

    Hello

    Can someone please share your knowledge to help me find out why I'm not able to receive an IP address on the remote access VPN connection so that I can get an IP local pool DHCP?

    I'm trying to set up remote access VPN with ASA 5510. It works with dhcp local pool but does not seem to work when I tried to use an existing DHCP server. It is tested in an internal network as follows:

    !

    ASA Version 8.2 (5)

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    IP 10.6.0.12 255.255.254.0

    !

    IP local pool testpool 10.6.240.150 - 10.6.240.159 a mask of 255.255.248.0. (worked with it)

    !

    Route inside 0.0.0.0 0.0.0.0 10.6.0.1 1

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Crypto-map dynamic dyn1 1jeu transform-set FirstSet

    dynamic mymap 1 dyn1 ipsec-isakmp crypto map

    mymap map crypto inside interface

    crypto ISAKMP allow inside

    crypto ISAKMP policy 1

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 43200

    !

    VPN-addr-assign aaa

    VPN-addr-assign dhcp

    !

    internal group testgroup strategy

    testgroup group policy attributes

    DHCP-network-scope 10.6.192.1

    enable IPSec-udp

    IPSec-udp-port 10000

    !

    username testlay password * encrypted

    !

    tunnel-group testgroup type remote access

    tunnel-group testgroup General attributes

    strategy-group-by default testgroup

    DHCP-server 10.6.20.3

    testgroup group tunnel ipsec-attributes

    pre-shared key *.

    !

    I got following output when I test connect to the ASA with Cisco VPN client 5.0

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: (4) SA (1) + KE + NUNCIO (10) + ID (5), HDR + VENDO

    4024 bytesR copied in 3,41 0 seconds (1341 by(tes/sec) 13) of the SELLER (13) seller (13) + the SELLER (13), as well as the SELLER (13) ++ (0) NONE total length: 853

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, SA payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ISA_KE

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, nonce payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received xauth V6 VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, DPD received VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received Fragmentation VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received NAT-Traversal worm 02 VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, the customer has received Cisco Unity VID

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, connection landed on tunnel_group testgroup

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA proposal # 1, turn # 9 entry overall IKE acceptable matches # 1

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build the payloads of ISAKMP security

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building ke payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building nonce payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for answering machine...

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of payload ID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of Cisco Unity VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing payload V6 VID xauth

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building dpd vid payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing the payload of the NAT-Traversal VID ver 02

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of Fragmentation VID + load useful functionality

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, send Altiga/Cisco VPN3000/Cisco ASA GW VID

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR SA (1) KE (4) NUNCIO (10) + ID (5) + HASH (8) + SELLER (13) + the SELLER (13) + the SELLER (13) + the SELLER (13) NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) total length: 440

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + HASH (8) + NOTIFY (11) + NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) overall length: 168

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, useful treatment IOS/PIX Vendor ID (version: 1.0.0 capabilities: 00000408)

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, the customer has received Cisco Unity VID

    Jan 16 15:39:21 [IKEv1]: Group = testgroup, I

    [OK]

    KenS-mgmt-012 # P = 10.15.200.108, status of automatic NAT detection: remote end is NOT behind a NAT device this end is NOT behind a NAT device

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 72

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 87

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, transformation MODE_CFG response attributes.

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = authorized

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = authorized

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized primary WINS

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized secondary WINS

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Compression IP = disabled

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling political = disabled

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: setting Proxy browser = no - modify

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: browser Local Proxy bypass = disable

    Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, (testlay) the authenticated user.

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 64

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + NONE (0) overall length: 60

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cfg ACK processing attributes

    Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 49ae1bb8) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 182

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, treatment cfg request attributes

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 address!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 network mask!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for DNS server address.

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the address of the WINS server.

    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, transaction mode attribute unhandled received: 5

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the banner!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting save PW!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: receipt of request for default domain name!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for Split-Tunnel list!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for split DNS!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for PFS setting!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Proxy Client browser setting!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the list of backup peer ip - sec!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting disconnect from the Client Smartcard Removal!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Version of the Application.

    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Type of Client: Windows NT Client Application Version: 5.0.07.0440

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for FWTYPE!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: request received for the DHCP for DDNS hostname is: DEC20128!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the UDP Port!

    Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

    Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = b04e830f) with payloads: HDR + HASH (8) + NOTIFY (11) + (0) NONE total length: 84

    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload

    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload

    Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE has received the response from type [] at the request of the utility of IP address

    Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cannot get an IP address for the remote peer

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE TM V6 WSF (struct & 0xd8030048) , : TM_DONE, EV_ERROR--> TM_BLD_REPLY, EV_IP_FAIL--> TM_BLD_REPLY NullEvent--> TM_BLD_REPLY, EV_GET_IP--> TM_BLD_REPLY, EV_NEED_IP--> TM_WAIT_REQ, EV_PROC_MSG--> TM_WAIT_REQ, EV_HASH_OK--> TM_WAIT_REQ, NullEvent

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE AM Responder WSF (struct & 0xd82b6740) , : AM_DONE, EV_ERROR--> AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL--> AM_TM_INIT_MODECFG_V6H NullEvent--> AM_TM_INIT_MODECFG, EV_WAIT--> AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG--> AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK--> AM_TM_INIT_XAUTH_V6H NullEvent--> AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b ending: 0x0945c001, refcnt flags 0, tuncnt 0

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending clear/delete with the message of reason

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing the payload to delete IKE

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 9de30522) with payloads: HDR HASH (8) + DELETE (12) + (0) NONE total length: 80

    Kind regards

    Lay

    For the RADIUS, you need a definition of server-aaa:

    Protocol AAA - NPS RADIUS server RADIUS

    AAA-server RADIUS NPS (inside) host 10.10.18.12

    key *.

    authentication port 1812

    accounting-port 1813

    and tell your tunnel-group for this server:

    General-attributes of VPN Tunnel-group

    Group-NPS LOCAL RADIUS authentication server

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • ASA 5505 - remote access VPN to access various internal networks

    Hi all

    A customer has an ASA 5505 with a remote access vpn. They are moving their internal network to a new regime and that you would be the users who come on the vpn to access the existing and new networks. Currently can only access the existing. When users connect to access remote vpn, the asa gave them the address 192.168.199.x. The current internal network is 200.190.1.x and that they would reach their new network of 10.120.110.x.

    Here is the config:

    :

    ASA Version 8.2 (5)

    !

    ciscoasa hostname

    enable encrypted password xxx

    XXX encrypted passwd

    names of

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 200.190.1.15 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP address 255.255.255.0 xxxxxxx

    !

    exec banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

    connection of the banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

    banner asdm the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

    passive FTP mode

    access extensive list ip 200.190.1.0 inside_access_in allow 255.255.255.0 any

    outside_access_in list extended access permit icmp any external interface

    access extensive list ip 192.168.199.0 outside_access_in allow 255.255.255.192 host 10.120.110.0

    Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 200.190.1.0 255.255.255.0

    MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0

    access extensive list ip 200.190.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192

    inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192

    pager lines 24

    Enable logging

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    mask 192.168.199.10 - 192.168.199.50 255.255.255.0 IP local pool Remote_IPSEC_VPN_Pool

    IP verify reverse path to the outside interface

    ICMP unreachable rate-limit 1 burst-size 1

    ICMP allow any inside

    ICMP allow all outside

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 200.190.1.0 255.255.255.0

    inside_access_in access to the interface inside group

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 190.213.43.1 1

    Route inside 10.120.110.0 255.255.255.0 200.190.1.50 1

    Route inside 192.168.50.0 255.255.255.0 200.190.1.56 1

    Route inside 192.168.60.0 255.255.255.0 200.190.1.56 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    http server enable 10443

    http server idle-timeout 5

    Server of http session-timeout 30

    HTTP 200.190.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    Crypto ca trustpoint _SmartCallHome_ServerCA

    Configure CRL

    Crypto ca certificate chain _SmartCallHome_ServerCA

    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

    (omitted)

    quit smoking

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Crypto isakmp nat-traversal 3600

    Telnet timeout 5

    SSH 200.190.1.0 255.255.255.0 inside

    SSH timeout 5

    SSH version 2

    Console timeout 5

    dhcpd outside auto_config

    !

    a basic threat threat detection

    scanning-threat shun threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    allow outside

    internal MD_SSL_Gp_Pol group strategy

    attributes of Group Policy MD_SSL_Gp_Pol

    VPN-tunnel-Protocol webvpn

    WebVPN

    list of URLS no

    disable the port forward

    hidden actions no

    disable file entry

    exploration of the disable files

    disable the input URL

    internal MD_IPSEC_Tun_Gp group strategy

    attributes of Group Policy MD_IPSEC_Tun_Gp

    value of banner welcome to remote VPN

    VPN - connections 1

    VPN-idle-timeout 5

    Protocol-tunnel-VPN IPSec webvpn

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list MD_IPSEC_Tun_Gp_splitTunnelAcl

    the address value Remote_IPSEC_VPN_Pool pools

    WebVPN

    value of the RDP URL-list

    attributes of username (omitted)

    VPN-group-policy MD_IPSEC_Tun_Gp

    type of remote access service

    type tunnel-group MD_SSL_Profile remote access

    attributes global-tunnel-group MD_SSL_Profile

    Group Policy - by default-MD_SSL_Gp_Pol

    type tunnel-group MD_IPSEC_Tun_Gp remote access

    attributes global-tunnel-group MD_IPSEC_Tun_Gp

    address pool Remote_IPSEC_VPN_Pool

    Group Policy - by default-MD_IPSEC_Tun_Gp

    IPSec-attributes tunnel-group MD_IPSEC_Tun_Gp

    pre-shared key *.

    !

    !

    context of prompt hostname

    : end

    The following ACL and NAT exemption ACL split tunnel is incorrect:

    MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0

    inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192

    It should have been:

    Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 10.120.110.0 255.255.255.0

    access extensive list ip 10.120.110.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192

    Then 'clear xlate' and reconnect with the VPN Client.

    Hope that helps.

  • ODA IP ASA when you browse the web via remote access vpn

    Hi all

    I was wondering if it is possible to configure an ASA5510 in a way to allow users remote access VPN use external IP of the ASA when browsing the web. So what I'm looking for is a solution to hide my IP address and use the IP address of the ASA, when browsing.

    The firmware version of the ASA is 9.1 (6)

    Thanks in advance

    Hello

    What you want to achieve is calles u-turn.

    You must enable the feature allowed same-security-traffic intra-interface

    For the configuration of the asa, here's the Cisco documentation (I don't copy paste on the post):

    http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

    Thank you

    PS: Please do not forget to rate and score as good response if this solves your problem

  • Cisco Asa 5505 and level 3 with remote access VPN switch

    Today I had a new CISCO LAYER 3 switch... So here's my scenrio

    Cisco Asa 5505

    I have

    Outside of the == 155.155.155.x

    Inside = 192.168.7.1

    Address POOL VPN = 10.10.10.1 - 10.10.10.20

    3 layer switch configuration

    VLAN 2

    ip address of the interface = 192.168.1.1

    VLAN 2

    ip address of the interface = 192.168.2.1

    VLAN 2

    ip address of 192.168.3.1 = interface

    VLAN 2

    ip address of the interface = 192.168.4.1

    VLAN 2

    ip address of the interface = 192.168.5.1

    IP Routing

    So I want the customers of my remote access VPN to access all that these networks. So please can you give me a useful tip or a link to set up the rest of my trip

    Thanks to you all

    Al ready has responded

    Sent by Cisco Support technique iPad App

  • Remote access VPN Cisco ASA

    Hello!

    I have 9.1 (3) version of Cisco ASA with remote access VPN set UP on the outside interface. When the user connects to the Internet on the outside interface, it works well. My goal is to allow the connection of all other interfaces (inside the dmz and etc.) to the outside interface. Cisco ASA allows to do? Order to packet - trace output is less to:

    MSK-hq-fw1 # packet - trace entry inside tcp 10.10.10.1 14214 1.1.1.2 443

    Phase: 1

    Type:-ROUTE SEARCH

    Subtype: entry

    Result: ALLOW

    Config:

    Additional information:

    developed 1.1.1.2 255.255.255.255 identity

    Phase: 2

    Type:-ROUTE SEARCH

    Subtype: entry

    Result: ALLOW

    Config:

    Additional information:

    developed 1.1.1.2 255.255.255.255 identity

    Result:

    input interface: inside

    entry status: to the top

    entry-line-status: to the top

    the output interface: NP identity Ifc

    the status of the output: to the top

    output-line-status: to the top

    Action: drop

    Drop-reason: (headwall) No. road to host

    Hello

    Well, you can of course turn VPN on other interfaces, but to be honest, I never even tried to set up the VPN it otherwise than of multiple multiple external interfaces in the case of the ISP and in this case only for testing purposes.

    Some things related to the ASA are well known but not well documented.

    The official document that I can remember: this is the following (which only refers to this limitation regarding the ICMP)

    Note

    For  security purposes the security appliance does not support far-end  interface ping, that is pinging the IP address of the outside interface  from the inside network.

    Source (old configuration guide):

    http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa71/configuration/guide/conf_gd/trouble.html#wp1059645

    -Jouni

  • ASA remote access VPN cleaning

    Experts,

    I have about three or four remote access VPN that must be removed from my ASA. What is the best way to ensure that I remove all configurations of the ASA? Thank you. Best.

    Hi Thomas,

    You can run the command "clear configure vpn" to clear some vpn commands, if you do not have all the certificates or site to site, you can run the command "claire configure crypto" and remove any command associated crypto.

    Rate if helps.

    -Randy-

  • Service of ASA module does on 6509-E support remote access VPN?

    I'm having a problem of configuration of remote access VPN (SSL, Anyconnect ect.) on the Module of ASA Service on 6509-E. It is even supported or I'm wasting my time trying to do something that won't work in a first place :) to work? Site-to-Site works without any problem.

    Technical info:

    6509-E current SUP 2 t SY 15.1 (2)

    Module of ASA - WS-SVC-ASA-SM1 running of the image - asa912-smp-k8 & asdm-712

    Licenses on ASA:

    Encryption--Activated

    3DES-AES-Encryption - enabled

    Thank you for the support.

    You run multiple context mode?

    If you are, access remote VPN only is not supported in this case:

    "Note several context mode only applies to the IKEv2 and IKEv1 site to another and applies not to the AnyConnect, clientless SSL VPN, the legacy Cisco VPN, native VPN client client of Apple, the VPN client from Microsoft or cTCP for IKEv1 IPsec."

    Reference.

  • Unable to SSH/telnet through the remote access VPN to ASA interface

    Hi all - im trying to SSH/telnet to my ASA in my remote access VPN tunnel but

    can't get this to work.  what Miss me?

    remote access VPN subnet: 192.168.25.0

    LAN subnet: 192.168.1.0

    config is attached.  THX-

    Please enter the command

    Private access Managament

    and you will be able to telnet/ssh to the asa on this ip 192.168.1.253

  • Problem with remote access VPN

    Hello

    I installed a remote access VPN on my firewall ASA5505 via the ASDM Assistant.

    I can successfully connect with the Cisco VPN client. My firewall also shows me the VPN session and shows the Rx packets. However, Tx packets remain 0, so no traffic is getting out. My ASA5505 is configured as a router on a stick with 25 different VLAN. I want to restrict traffic to one VLAN specific using a card encryption.

    When I run a command to ping t on my connected Windows box, the firewall log shows me the following message:

    "Unable to find political IKE initiator: outside Intf, Src: 10.7.11.18, Dst: ' 172.16.1.1

    "This message indicates that the fast path IPSec processing a packet that triggered of IKE, but IKE policy research has failed. This error could be associated calendar. The ACL triggering IKE could have been deleted before IKE has processed the request for initiation. "This problem will likely correct itself."

    Unfortunately, the problem is correct.

    The "sh cry isa his" and "sh cry ips its ' commands show the following output:

    2 IKE peers: 62.140.137.99

    Type: user role: answering machine

    Generate a new key: no State: AM_ACTIVE

    Interface: outside

    Tag crypto map: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 85.17.xxx.xxx (outside interface IP)

    local ident (addr, mask, prot, port): (0.0.0.0/0.0.0.0/0/0)

    Remote ident (addr, mask, prot, port): (172.16.1.1/255.255.255.255/0/0)

    current_peer: 62.140.137.99, username: eclipsevpn

    dynamic allocated peer ip: 172.16.1.1

    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

    #pkts decaps: 4351, #pkts decrypt: 4351, #pkts check: 4351

    compressed #pkts: 0, unzipped #pkts: 0

    #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

    success #frag before: 0, failures before #frag: 0, #fragments created: 0

    Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

    #send errors: 0, #recv errors: 0

    local crypto endpt. : 85.17.xxx.xxx/4500, remote Start crypto. : 62.140.137.99/3698

    Path mtu 1500, fresh ipsec generals 82, media, mtu 1500

    current outbound SPI: B3D60F71

    current inbound SPI: B89BA14A

    SAS of the esp on arrival:

    SPI: 0xB89BA14A (3097207114)

    transform: aes - esp esp-sha-hmac no compression

    running parameters = {RA, Tunnel, NAT-T program,}

    slot: 0, id_conn: 196608, crypto-card: SYSTEM_DEFAULT_CRYPTO_MAP

    calendar of his: service life remaining key (s): 25126

    Size IV: 16 bytes

    support for replay detection: Y

    Anti-replay bitmap:

    0xFFE1FFF8 0xFFFFFFFF

    outgoing esp sas:

    SPI: 0xB3D60F71 (3017150321)

    transform: aes - esp esp-sha-hmac no compression

    running parameters = {RA, Tunnel, NAT-T program,}

    slot: 0, id_conn: 196608, crypto-card: SYSTEM_DEFAULT_CRYPTO_MAP

    calendar of his: service life remaining key (s): 25126

    Size IV: 16 bytes

    support for replay detection: Y

    Anti-replay bitmap:

    0x00000000 0x00000001

    I really have no idea what's going on. I installed a remote access VPN countless times, but this time it shows me the error as described above.

    Hi Martijn,

    just a few quick thoughts:

    -is your ok NAT exemption, i.e. ensure that the return traffic is not NAT' ed.

    -Make sure that there is no overlap crypto ACL

    -When connected, make a package tracer to see what is happening with the return packages.

    for example

    packet-tracer in the interface within the icmp 10.7.11.18 0 0 172.16.1.1 detail

    (where is the name of the interface on which 10.7.11.18 resides)

    This will show you all the steps the rail package in-house (routing, nat, encryption etc.) so it should give you an idea of what is happening, for example when it comes to the bad interface, nat evil rule, wrong entry card crypto etc.

    HTH

    Herbert

  • DMVPN with based remote access VPN client

    Hi all

    We DMVPN deployed to connect to our remote location now I want to configure the vpn remote access also with DMVPN tunnel so if somehow our DMVPN tunnel goes down we can connect to the router through vpn remote access client based around... I want experts to do the light on it is it possible or what are the technical challenges that I have to face in this regard.

    Thank you

    Salman Jamshed

    Hello Salman,

    It's 100% possible, there is no harm in having them both up on your router.

    In fact, as you have said that it will provide an extra layer of redundancy if by chance the DMVPN tunnel breaks down.

    That being said, you can go ahead and do it is a movement course

    Julio

  • Remote access VPN user permission

    Hi support them.

    It is a way for a remote access VPN to allow some users access to "Host A, B, C" and other users to access hosts D, E, F? Basically, we want to have some users have access at home to a few servers and other users have access only to some other servers. Is this possible without a GANYMEDE or some other device? Thank you guys!

    Hi John,.

    Yes, you can configure split tunneling to allow a specific group of users access to specific hosts.
    How this is achieved, it is that you create a connection profile different for different users, associate a policy group and the title of each group policy, you have a split tunnelling access-list defined with entries of different hosts.

    You must create 2 profiles of connection here and match them with 2-group policy allowing access to 2 differernt resources (they can be multiple as well)

    Here is a reference document: -.

    http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/100936-asa8x-split-tunnel-AnyConnect-config.html

    Kind regards
    Dinesh Moudgil

    PS Please rate helpful messages.

  • PIX 515E and remote access VPN

    I use a PIX 515E with: ASDM Version: 5,0000 51 PIX Version: 8.0 (4) and configure it with remote access VPN.

    I would like to get an email every time that a user login (and or disconnection) to the VPN. Remote clients use the Cisco VPN Client.

    Any help is appreciated,

    Hello

    Here is a link to the email configuration when you log in to the ASA/PIX: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc7

    Then you can create a list of message to send the logs only for the connection/disconnection of the VPN user: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc18

    There is a wire that is linked here: https://supportforums.cisco.com/discussion/10798976/asa-email-logging-issue

  • Remote access VPN pix version 8.0 (3)

    Hi all

    First of all, I would like to thank to all members of the forum who got help in several messages on the configuration of the pix 515.

    I am now configuring remote VPN access with radius authentication to my network, but I can't connect.

    I use the cisco vpn client 5.0.03.0560, I have also tested my pix radius (inside) server authentication and works very well.

    I already tried to retype the key of the cli, but I still can't remote access vpn to work.

    I also tried to create another remote vpn with another name and local authentication, but I have the same problem.

    I use 8.0 (3) version pix.

    Can someone help me

    I attach the log file of the cisco vpn client to help solve the problem, as well a configuration of the pix folder.

    Thank you very much in advance and I seek prior information.

    http://www.Cisco.com/en/us/docs/security/ASA/asa72/configuration/guide/vpnadd.html#wp999516

    [Pls RATE if HELP]

  • Remote access VPN group name and password

    Hi guys,.

    Can someone tell me please the command to display a remote access VPN group name and the password on a firewall version 8.0 of ASA? Any help will be greatly appreciated.

    Thank you

    Lake

    Remote VPN IPsec IKEv1 access are listed as groups of tunnel. If you enter

    more system:running-config | b tunnel-group

    You can see the config sections (starting with the first mention of the tunnel-group) as well as the pre-shared key ikev1 plaintext String.

Maybe you are looking for

  • The OE Mail recover after the damage caused by the virus.

    My PC has just blown to bits by a virus.I hope to be able to save the data files, including those that define the accounts rules, for example, and contain emails.How can I restore my EYE as much as possible in its original configuration and emails us

  • Support for Firefox 20.0.1?

    When will he come Firefox 20.0.1 support?

  • Incompatible Mabview and responses of Matlab

    Hi all I need to determine a transfer function of which augurs well for response: _______________________ 17dB / / / / / __________________________________/ -14dB 1.5 kHz 20 kHz   I tried to do it with Labview and matlab. However, the same transfer f

  • xw8200 Workstation processor upgrade

    Hello world! I recently acquired a workstation xw8200. I know its old technology, but it works pretty well actually, even with win7. However, I expect the squeek little more life out of it as a secondary computer. The first thing I want to do is max

  • Touchpad HP Pavilion 17 works does not after using an external wireless mouse

    I have the HP Pavilion 17 laptop.  It is running Windows 8.1.  Everything worked fine until I used an external wireless mouse.  After unplugging the mouse the touchpad does not itself again.  I have therefore no pointer and no touchpad to use unless