ASDM 6.02 Timeout

I have a runing ASA5520 Device Manager Version 6.0 (2)

When I run ASDM and try to connect I have connection has expired.

The ASA is transparent running and I can ssh to the machine.

http is enabled and that the image is in the config.

The only thing I can see the problem is that I have disabled the management interface and to access the device through the inside interface.

What else is there to watch?

Hello

If you can ssh to the device, I don't think that the problem might come from a management interface of the disabled.

You also specify the IP of the host and/or network access to the HTTP Server?

mask ip http inside

If this does not help, try debugging http, maybe this will give you some additional information on the nature of the problem.

Tags: Cisco Security

Similar Questions

  • L2TP - impossible to find a group valid tunnel

    Hello

    I'm sure this is a simple solution, but I don't see what I'm missing.

    Any help please?

    Get the following errors in debugging.

    [IKEv1]: invalid tunnel, leaving group = 95.83.254.91, IP = 95.x.x.x, impossible to find a group...!
    23 September 14:26:05 [IKEv1]: IP = 95.x.x.x, invalid header, lack of payload SA! (next payload = 4)

    Group of tunnel I want to use is Remote-L2TP

    Attached config.

    ASA Version 8.2 (5)
    !
    ciscoasa hostname
    domain xxxxx.local
    activate 8Ry2YjIyt7RRXU24 encrypted password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    name 192.168.1.40 description CCTV system CCTV_System
    name x.x.x.x outside outside interface description
    description of the SERVER name server 192.168.1.1
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    switchport access vlan 12
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    192.168.1.222 IP address 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address outside 255.255.255.252
    !
    passive FTP mode
    clock timezone GMT/IST 0
    summer time clock GMT/IDT recurring last Sun Mar 01:00 last Sun Oct 02:00
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    Server name 89.191.34.249
    domain xxxxx.local
    object-group service CCTV tcp
    port-object eq 9010
    object-group service CCTV_NEW tcp - udp
    port-object eq 9091
    object-group service BlackBerry tcp - udp
    port-object eq 3101
    object-group service NSM tcp - udp
    port-object eq 886
    object-group service RDP tcp - udp
    EQ port 3389 object
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    outside_access_in list extended access allowed object-group TCPUDP any host outside eq 9091
    outside_access_in list extended access allowed object-group TCPUDP any host outside eq 886
    outside_access_in list extended access allowed object-group TCPUDP any host outside eq 3101
    outside_access_in list extended access permit tcp any host outside eq https
    outside_access_in list extended access permit tcp any interface outside eq pptp
    outside_access_in list extended access allowed esp any external interface
    outside_access_in list extended access permit udp any interface outside isakmp eq
    outside_access_in list extended access permit udp any interface outside eq 4500
    outside_access_in list extended access permit udp any interface outside eq 1701
    standard access list for distance-VPN-Gp_splitTunnelAcl permit 192.168.1.0 255.255.255.0
    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.25.0 255.255.255.192
    RemoteVPN_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
    VPN-GP_splitTunnelAcl-list of allowed access standard 192.168.1.0 255.255.255.0
    standard L2TP_splitTunnelAcl-Remote Access-list allowed 192.168.1.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    mask of local pool Remote-DHCP-POOL 192.168.25.10 - 192.168.25.50 IP 255.255.255.0
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 1 0.0.0.0 0.0.0.0
    public static 9091 9091 CCTV_System netmask 255.255.255.255 interface tcp (indoor, outdoor)
    public static 886 886 SERVER netmask 255.255.255.255 interface tcp (indoor, outdoor)
    public static 3101 3101 SERVER netmask 255.255.255.255 interface tcp (indoor, outdoor)
    public static tcp (indoor, outdoor) interface https SERVER https netmask 255.255.255.255
    public static tcp (indoor, outdoor) pptp pptp netmask 255.255.255.255 SERVER interface
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 89.191.53.17 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    the ssh LOCAL console AAA authentication
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set esp-3des esp-sha-hmac trans
    Crypto ipsec transform-set trans transport mode
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    Crypto-map Dynamics dyno 20 transform-set trans
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    card crypto 20-isakmp ipsec vpn Dynamics dyno
    vpn outside crypto map interface
    Crypto ca trustpoint _SmartCallHome_ServerCA
    Configure CRL
    Crypto ca trustpoint ASDM_TrustPoint0
    registration auto
    name of the object CN = ciscoasa
    Configure CRL
    Crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
    010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
    30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
    0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
    65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
    68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
    302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
    63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
    010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
    082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
    ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
    45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
    1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
    6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
    445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
    1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
    2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
    4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
    b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
    99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018
    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
    quit smoking
    string encryption ca ASDM_TrustPoint0 certificates
    certificate 5eb57b56
    3082016a 30820201 a0030201 0202045e b57b5630 0d06092a 864886f7 0d 010105
    3111300f 05003045 06035504 03130863 6973636f 61736131 30302e06 092 has 8648
    09021621 63697363 6f617361 2e627574 6 c 657274 6563686e 6f6c6f67 86f70d01
    6965732e 6c6f6361 6c301e17 313630 39313931 33303732 395a170d 32363039 0d
    a 31373133 30373239 5 304531 11300f06 03550403 13086369 73636f61 73613130
    2a 864886 f70d0109 6973636f 02162163 6173612e 6275746c 65727465 302e0609
    63686e6f 6c6f6769 65732e6c 6f63616c 30819f30 0d06092a 864886f7 0d 010101
    8 D 003081 89028181 05000381 008e76a6 2ad8e079 15814471 df2c3309 abdc0ae7
    1c665f5f bb09154b 1ac3fd81 930b29cb 6da29338 738c 9373 a0b30f61 a1d08aa9
    f5ef926b 11ef1e22 e8beeb5f c6606090 7a71b367 cad571c5 56331678 d83d4bb4
    9f98a565 577cccd6 dc20e190 c7128cf2 e38d3ad1 37807440 3da501c2 14bbbe02
    45abf677 89248633 d 05589d 4886f70d 01010505 55 75020301 0001300 06092a 86
    000a7b9d 00038181 3e29b1d9 8459309b 5e24606a cae0710e b9e264f4 a61125b9
    2f431f3a 5c4a9485 fe9bc0b0 9f9f7072 13abd978 243e0542 e34642d6 ae33028d
    be03b9e9 56c693ab b082932d b44ab014 9366c0d4 529a7ff5 818f7293 2026521b
    52fcf5c7 d623f7fa 54019c 86 e64a4212 08444c 58 8ccd11d8 4297d18a c4b2de33
    2003eaf5 e2
    quit smoking
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH 192.168.1.0 255.255.255.0 inside
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 30
    SSH version 2
    Console timeout 0
    dhcpd outside auto_config
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
    NTP 79.125.112.210 Server
    NTP server 193.1.193.157 prefer external source
    WebVPN
    port 8443
    allow outside
    DTLS port 8443
    SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image
    SVC disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2 image
    Picture disk0:/sslclient-win-1.1.4.176.pkg 3 SVC
    enable SVC
    attributes of Group Policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
    WebVPN
    SVC request enable
    internal RemoteVPN group strategy
    attributes of Group Policy RemoteVPN
    value of server DNS 192.168.1.1 192.168.1.2
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list RemoteVPN_splitTunnelAcl
    XXXX.local value by default-field
    internal strategy group at distance-VPN-GP
    remote control-VPN-GP group policy attributes
    value of 192.168.1.1 DNS server
    Protocol-tunnel-VPN IPSec
    XXXXX.local value by default-field
    internal strategy group to distance-L2TP
    L2TP remote group policy attributes
    value of server DNS 192.168.1.1 192.168.1.2
    VPN-tunnel-Protocol webvpn
    username privilege 15 encrypted v5FJjvsPy8PsIOtZ xxxxpassword
    attributes of username xxxx
    VPN-group-policy RemoteVPN
    xxxxx YeC9t79Bj2E5FxxV username encrypted password
    attributes of username xxxxx
    Strategy-Group-VPN Remote - L2TP
    2KXeP2Ggcoa6BTsozucgAA password xxxxx user name is nt encrypted
    remote access of type tunnel-group to distance-VPN-GP
    distance-VPN-GP-global attributes tunnel-group
    Remote control-DHCP-POOL-pool of addresses
    Group Policy - by default-remote control-VPN-GP
    tunnel-group GP-remote control-VPN ipsec-attributes
    pre-shared key *.
    type tunnel-group Remote-L2TP remote access
    attributes global-tunnel-group Remote-L2TP
    Remote control-DHCP-POOL-pool of addresses
    Group Policy - by default-remote-L2TP
    tunnel-group Remote-L2TP ipsec-attributes
    pre-shared key *.
    tunnel-group Remote-L2TP ppp-attributes
    ms-chap-v2 authentication
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the pptp
    !
    global service-policy global_policy
    context of prompt hostname
    anonymous reporting remote call
    Cryptochecksum:c4b7c39420a91e2f7bb4adc5e5a8539b
    : end
    ciscoasa (config) #.

    Hello

    I see same Phase 2 is completed in the newspapers, so more than a customer issue.

    On the Security tab in the connection on the client profile, check if you have allowed the correct password and security protocols:

    https://www.SoftEther.org/4-docs/2-HOWTO/9.L2TPIPsec_Setup_Guide_for_Sof...

    Kind regards

    Aditya

    Please evaluate the useful messages and mark the correct answers.

  • Static Nat issue unable to resolve everything tried.

    Hello

    I have a cisco asa 5515 with asa worm 9.4.1 and asdm 7.4

    I have problem with configuring static nat, I have a server inside which ip is 172.16.1.85 and

    my external interface is configured with a static ip address.

    Internet works fine but cannot configure static nat...

    Here's my config running if please check and let me know what Miss me...

    Thank you

    ASA release 9.4 (1)
    !
    ciscoasa hostname

    names of
    !
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    IP 151.253.97.182 255.255.255.248
    !
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    IP 172.16.1.1 255.255.255.0
    !
    interface GigabitEthernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/5
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    management only
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    boot system Disk0: / asa941-smp - k8.bin
    passive FTP mode
    object remote desktop service
    source eq 3389 destination eq 3389 tcp service
    Description remote desktop
    network of the RDP_SERVER object
    Home 172.16.1.85
    outside_access_in list extended access allow desktop remotely any4 object RDP_SERVER
    pager lines 24
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    management of MTU 1500
    no failover
    no monitor-service-interface module of
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 743.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    !
    network of the RDP_SERVER object
    NAT (inside, outside) interface static service tcp 3389 3389
    !
    NAT source auto after (indoor, outdoor) dynamic one interface
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 151.253.97.177 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    identity of the user by default-domain LOCAL
    Enable http server
    http server idle-timeout 50
    http 192.168.1.0 255.255.255.0 management

    Telnet 192.168.1.0 255.255.255.0 management
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH 192.168.1.0 255.255.255.0 management
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    VPDN username bricks12 password * local store
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    dynamic-access-policy-registration DfltAccessPolicy
    username, password imran guVrfhrJftPA/rQZ encrypted privilege 15
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    anonymous reporting remote call

    ciscoasa #.

    Hello

    Change this ACL: -.

    outside_access_in list extended access allow desktop remotely any4 object RDP_SERVER

    TO

    outside_access_in list extended access allowed object RDP_SERVER eq any4 tcp 3389

    Thank you and best regards,

    Maryse Amrodia

  • Allow Exchange (SMTP) server by ASA 8.2 (5)

    Please help me! Tomorrow, I have to go on a customer site and configure the firewall to allow traffic from the server through it.

    I am CCIE Routing & switching certified.  But did not have enough hands with the ASA.

    Here is the configuration of the firewall running

    QLC-11-FW-1 # sh run
    : Saved
    :
    ASA Version 8.2 (5)
    !
    QLC-11-FW-1 hostname
    activate 42Vosoeb.xpDtu0m encrypted password
    42Vosoeb.xpDtu0m encrypted passwd
    names of
    name 10.10.128.0 comments
    name 10.10.129.0 Guest_Wirless
    name 10.10.0.0 Internal_Networks
    !
    interface Ethernet0/0
    Description ' connection to BB-1-Gi2/5 ".
    nameif outside
    Security 0
    IP 10.10.102.254 255.255.255.0
    !
    interface Ethernet0/1
    Description ' connection to the BB-1-Gi2/3 ".
    nameif inside
    security-level 100
    IP 10.10.101.254 255.255.255.0
    !
    interface Ethernet0/2
    Description ' connection to the BB-1-Gi2/7 "»
    nameif DMZ
    security-level 50
    IP 10.10.103.254 255.255.255.0
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    management only
    !
    passive FTP mode
    object-group network invited
    The object-network 255.255.255.0 comments
    object-network Guest_Wirless 255.255.255.0
    object-group service Guest_services
    the purpose of the echo icmp message service
    response to echo icmp service object
    the purpose of the service tcp eq www
    the eq https tcp service object
    the eq field udp service object
    splitTunnelAcl standard access list allow Internal_Networks 255.255.0.0
    outside_in list extended access permit icmp any one
    ips_traffic of access allowed any ip an extended list
    inside_access_in list extended access allow object-group objects invited to a Guest_services-group
    inside_access_in list extended access deny ip object-group invited all
    inside_access_in list extended access permitted ip Internal_Networks 255.255.0.0 everything
    pager lines 24
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    MTU 1500 DMZ
    management of MTU 1500
    IP local pool ra_users 10.10.104.10 - 10.10.104.200 mask 255.255.255.0
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Access-group outside_in in external interface
    inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 10.10.102.250 1
    Route inside Internal_Networks 255.255.0.0 10.10.101.10 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    the ssh LOCAL console AAA authentication
    AAA authentication http LOCAL console
    LOCAL AAA authentication serial console
    Enable http server
    http 192.168.1.0 255.255.255.0 management
    http Internal_Networks 255.255.0.0 inside
    http 0.0.0.0 0.0.0.0 outdoors
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set distance esp - esp-md5-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Dynamic crypto map ra_dynamic 10 set transform-set remote control
    map ra 10-isakmp ipsec crypto dynamic ra_dynamic
    ra outside crypto map interface
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    md5 hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH Internal_Networks 255.255.0.0 inside
    SSH timeout 5
    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    internal GP group policy
    GP group policy attributes
    value of server DNS 212.77.192.60
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list splitTunnelAcl
    username admin privilege 15 encrypted password gXmhyPjHxCEshixG
    ahmed vDClM3sGVs2igaOA encrypted password username
    type tunnel-group GP remote access
    attributes global-tunnel-group GP
    address ra_users pool
    Group Policy - by default-GP
    tunnel-group GP ipsec-attributes
    pre-shared key *.
    !
    class-map ips_traffic_class
    corresponds to the ips_traffic access list
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    class ips_traffic_class
    IPS inline help
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:57e5e9b117c38869a93a645f88309571
    : end

    Thank you

    So I don't see any configuration nat here, so I guess it's either a private wan or you have a router upstream do nat?  If no Nat is required on the SAA so it should be as simple as

    outside_in list extended access permit tcp any host mail server eq smtp

  • Implementation of VPN

    Hi all

    Two years ago I had (finally) updated vpn in place, but I had to nuke the configuration later (for a long time to remember why).

    My configuration:

    Accelerator edge of Cisco ASA 5505 (revision 0 x 0)

    Base license.

    Cisco Adaptive Security Appliance Software Version 8.4 (2)
    Version 6.4 Device Manager (5)

    I created a DMZ and an indoor and outdoor area.

    All servers are Linux servers without a head.

    (I recently had to re - create the servers because of a damaged drive).

    So Setup is as follows:

    A main linux server also works as virtualbox host.

    A dmz-www-server and a server-ftp-dmz.

    I'll add a server linux for git and a few others.

    My first goal is to be able to reach the primary server with SSH. Second, to reach other servers on the network.

    I also want to use the cisco vpn client open source Linux and cisco VPN client which I also use to connect to other customers.

    Here is my current setup:

    interface Ethernet0/0
    switchport access vlan 2
    Speed 100
    full duplex
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5

    switchport access vlan 300
    Speed 100
    full duplex
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    DHCP IP address
    !
    interface Vlan300
    prior to interface Vlan1
    nameif dmz
    security-level 50
    IP 192.168.2.1 255.255.255.0
    !

    passive FTP mode
    clock timezone THATS 1
    clock to summer time recurring CEDT
    DNS lookup field inside
    DNS domain-lookup outside
    DNS domain-lookup dmz
    DNS server-group DefaultDNS
    name-server 192.168.1.8
    Server name 193.75.75.75
    Server name 193.75.75.193
    Name-Server 8.8.8.8
    domain name to inside - sport.no
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network obj_any object
    subnet 0.0.0.0 0.0.0.0
    the object to the Interior-net network
    subnet 192.168.1.0 255.255.255.0
    network dmz webserver object
    Home 192.168.2.100
    Web server host object description
    network dmz-ftpserver object
    Home 192.168.2.101
    Description purpose of FTP server host

    network of the DMZ.net object
    Subnet 192.168.2.0 255.255.255.0
    Service FTP object
    tcp source eq ftp service
    service object WWW
    tcp source eq www service
    outside_access_in list extended access permit tcp any host 192.168.2.101 eq ftp
    outside_access_in list extended access permit tcp any host 192.168.2.100 eq www
    inside_access_dmz list extended access permit tcp any object DMZ.net 1 65535 range
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    MTU 1500 dmz
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    NAT (dmz, external) source service interface static Web WWW WWW server dmz
    NAT (dmz, external) source service interface static dmz-ftpserver FTP FTP
    !
    network obj_any object
    NAT dynamic interface (indoor, outdoor)
    the object to the Interior-net network

    NAT dynamic interface (indoor, outdoor)
    network of the DMZ.net object
    NAT (dmz, outside) dynamic interface
    Access-group outside_access_in in interface outside
    Access-group inside_access_dmz in dmz interface
    Route outside 0.0.0.0 0.0.0.0 173.194.32.34 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    the ssh LOCAL console AAA authentication
    AAA authentication enable LOCAL console
    AAA authentication http LOCAL console
    LOCAL AAA authorization command
    AAA authorization exec-authentication server
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
    Crypto ca trustpoint _SmartCallHome_ServerCA
    Configure CRL
    Crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
    010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
    30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
    0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
    65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
    68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
    302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
    63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
    010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
    082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
    ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
    45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
    1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
    6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
    445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
    1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
    2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
    4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
    b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
    99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018

    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
    quit smoking
    Telnet timeout 5
    SSH 192.168.1.0 255.255.255.0 inside
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 30
    Console timeout 0
    management-access inside

    dhcpd dns 192.168.1.1 193.75.75.75
    dhcpd inner - sport.no
    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.20 - 192.168.1.49 inside
    dhcpd dns 192.168.1.1 interface inside
    dhcpd sport.no area inside - inside interface
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection

    no statistical threat detection tcp-interception
    WebVPN
    Bernard of encrypted foooo privilege 15 password username
    th baaar of encrypted privilege 15 password username
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny

    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    !
    global service-policy global_policy
    context of prompt hostname
    anonymous reporting remote call
    Cryptochecksum:88cf7ca3aa1aa19ec0418f557cc0fedf

    If you are looking for just a remote access VPN configuration, you could do something like the following just change the names and IP addresses as needed:

    local IP 10.10.10.1 VPNPOOL pool - 10.10.10.10

    IKEv1 crypto policy 5
    preshared authentication
    aes encryption
    sha hash
    Group 5

    Crypto ipsec transform-set ikev1 VPNSET aes - esp esp-sha-hmac

    Dynamic crypto map DYNMAP 65535 ikev1 set transform-set VPNSET
    Dynamic crypto map DYNMAP reverse-route value 65535
    card crypto VPNMAP 65535-isakmp dynamic ipsec DYNMAP
    VPNMAP interface card crypto outside

    Crypto ikev1 allow outside

    tunnel-group VPNGROUP type remote access
    IPSec-attributes tunnel-group VPNGROUP
    IKEv1 pre-shared key PASSWORD

    management-access inside

    --

    Please do not forget to select a correct answer and rate useful posts

  • ASA 5515 - Anyconnect - inside the subnet connection problem

    Hi all

    I have a problem with the connection to the Interior/subnet using Anyconnect SSL VPN.

    ASA worm. 5515

    Please find below of configuration:

    User access audit

    ASA1 # show running-config
    : Saved
    :
    ASA 9.1 Version 2
    !
    hostname ASA1
    activate 8Ry2YjIyt7RRXU24 encrypted password
    volatile xlate deny tcp any4 any4
    volatile xlate deny tcp any4 any6
    volatile xlate deny tcp any6 any4
    volatile xlate deny tcp any6 any6
    volatile xlate deny udp any4 any4 eq field
    volatile xlate deny udp any4 any6 eq field
    volatile xlate deny udp any6 any4 eq field
    volatile xlate deny udp any6 any6 eq field
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    mask of local pool swimming POOLS-for-AnyConnect 10.0.70.1 - 10.0.70.50 IP 255.255.255.0
    !
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    address IP A.A.A.A 255.255.255.240
    !
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    192.168.64.1 IP address 255.255.255.0
    !
    interface GigabitEthernet0/2
    nameif dmz
    security-level 20
    address IP B.B.B.B 255.255.255.0
    !
    interface GigabitEthernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/5
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    management only
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    passive FTP mode
    network of the OBJ_GENERIC_ALL object
    subnet 0.0.0.0 0.0.0.0
    network outside_to_inside_FR-Appsrv01 object
    Home 192.168.64.232
    network outside_to_dmz_fr-websvr-uat object
    Home 10.20.20.14
    network inside_to_dmz object
    192.168.64.0 subnet 255.255.255.0
    gtc-tomcat network object
    Home 192.168.64.228
    network of the USA-Appsrv01-UAT object
    Home 192.168.64.223
    network of the USA-Websvr-UAT object
    Home 10.20.20.13
    network vpn_to_inside object
    10.0.70.0 subnet 255.255.255.0
    extended access list acl_out permit everything all unreachable icmp
    acl_out list extended access permit icmp any any echo response
    acl_out list extended access permit icmp any one time exceed
    acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 3389
    acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 28080
    acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 9876
    acl_out list extended access permit udp any object outside_to_inside_FR-Appsrv01 eq 1720
    acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq www
    acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq https
    acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq 3389
    acl_out list extended access permit tcp any object USA-Appsrv01-UAT eq 9876
    acl_out list extended access permit udp any eq USA-Appsrv01-UAT object 1720
    acl_out list extended access permit tcp any object USA-Websvr-UAT eq www
    acl_out list extended access permit tcp any USA-Websvr-UAT eq https object
    acl_out list extended access permit tcp any object USA-Websvr-UAT eq 3389
    acl_out list extended access permit tcp any object USA-Appsrv01-UAT eq 3389
    acl_dmz list extended access permit icmp any any echo response
    acl_dmz of access allowed any ip an extended list
    acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 8080
    acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 8081
    acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 3389
    acl_dmz list extended access permitted tcp object USA-Websvr-UAT object USA-Appsrv01-UAT eq 8080
    acl_dmz list extended access permitted tcp object USA-Websvr-UAT object USA-Appsrv01-UAT eq 8081
    access extensive list ip 192.168.64.0 gtcvpn2 allow 255.255.255.0 10.0.70.0 255.255.255.0
    pager lines 24
    Outside 1500 MTU
    Within 1500 MTU
    MTU 1500 dmz
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT dynamic interface of OBJ_GENERIC_ALL source (indoor, outdoor)
    NAT (inside, outside) static source all all static destination vpn_to_inside vpn_to_inside
    !
    network outside_to_inside_FR-Appsrv01 object
    NAT static x.x.x.x (indoor, outdoor)
    network outside_to_dmz_fr-websvr-uat object
    NAT (dmz, outside) static x.x.x.x
    network of the USA-Appsrv01-UAT object
    NAT static x.x.x.x (indoor, outdoor)
    network of the USA-Websvr-UAT object
    NAT (dmz, outside) static x.x.x.x
    Access-group acl_out in interface outside
    Access-group acl_dmz in dmz interface
    Route outside 0.0.0.0 0.0.0.0 B.B.B.B 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    Enable http server
    http 192.168.64.204 255.255.255.255 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
    Crypto ipsec pmtu aging infinite - the security association
    Crypto ca trustpoint ASDM_TrustPoint0
    registration auto
    name of the object CN = ASA1
    GTCVPN2 key pair
    Configure CRL
    trustpool crypto ca policy
    string encryption ca ASDM_TrustPoint0 certificates
    certificate of 19897d 54
    308201cf 30820138 a0030201 02020419 897d 864886f7 0d 010105 5430 0d06092a
    0500302c 3111300f 06035504 03130851 57455354 32343031 17301506 092a 8648
    09021608 51574553 54323430 31343132 30333034 30333237 301e170d 86f70d01
    5a170d32 34313133 30303430 3332375a 302 c 3111 55040313 08515745 300f0603
    53543234 30311730 1506092a 864886f7 010902 16085157 45535432 34303081 0d
    9f300d06 092 has 8648 86f70d01 01010500 03818d 00 30818902 818100a 2 5e873d21
    dfa7cc00 ee438d1d bc400dc5 220f2dc4 aa896be4 39843044 d0521010 88 has 24454
    b4b1f345 84ec0ad3 cac13d47 a71f367a 2e71f5fc 0a9bd55f 05d 75648 72bfb9e9
    c5379753 26ec523d f2cbc438 d234616f a71e4f4f 42f39dde e4b99020 cfcd00ad
    73162ab8 1af6b6f5 fa1b47c6 d261db8b 4a75b249 60556102 03010001 fa3fbe7c
    300 d 0609 2a 864886 f70d0101 8181007a 05050003 be791b64 a9f0df8f 982d162d
    b7c884c1 eb183711 05d676d7 2585486e 5cdd23b9 af774a8f 9623e91a b3d85f10
    af85c009 9590c0b3 401cec03 4dccf99a f1ee8c01 1e6f0f3a 6516579c 12d9cbab
    59fcead4 63baf64b 7adece49 7799f94c 1865ce1d 2c0f3ced e65fefdc a784dc50
    350e8ba2 998f3820 e6370ae5 7e6c543b 6c1ced
    quit smoking
    Telnet 192.168.64.200 255.255.255.255 inside
    Telnet 192.168.64.169 255.255.255.255 inside
    Telnet 192.168.64.190 255.255.255.255 inside
    Telnet 192.168.64.199 255.255.255.255 inside
    Telnet timeout 5
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    SSL-trust ASDM_TrustPoint0 inside point
    SSL-trust outside ASDM_TrustPoint0 point
    WebVPN
    allow outside
    AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    AnyConnect enable
    tunnel-group-list activate
    internal GroupPolicy_GTCVPN2 group strategy
    attributes of Group Policy GroupPolicy_GTCVPN2
    WINS server no
    value of 192.168.64.202 DNS server 192.168.64.201
    client ssl-VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list gtcvpn2
    field default value mondomaine.fr
    username cHoYQ5ZzE4HJyyq password of duncan / encrypted
    username Aosl50Zig4zLZm4 admin password / encrypted
    password encrypted sebol U7rG3kt653p8ctAz user name
    type tunnel-group GTCVPN2 remote access
    attributes global-tunnel-group GTCVPN2
    Swimming POOLS-for-AnyConnect address pool
    Group Policy - by default-GroupPolicy_GTCVPN2
    tunnel-group GTCVPN2 webvpn-attributes
    enable GTCVPN2 group-alias
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    Review the ip options
    inspect the netbios
    inspect the rsh
    inspect the rtsp
    inspect the skinny
    inspect esmtp
    inspect sqlnet
    inspect sunrpc
    inspect the tftp
    inspect the sip
    inspect xdmcp
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory 19
    Subscribe to alert-group configuration periodic monthly 19
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:0b972b3b751b59085bc2bbbb6b0c2281
    : end
    ASA1 #.

    I can connect to the ASA from outside with the Anyconnect client, split tunneling works well unfortunately I can't ping anything inside the network, VPN subnet: 255.255.255.0, inside the 192.168.64.x 255.255.255.0 subnet 10.0.70.x

    When connecting from the outside, cisco anyconnect is showing 192.168.64.0/24 in the tab "details of the trip.

    Do you know if I'm missing something? (internal subnet to subnet route vpn?)

    Thank you

    Use your internal subnet ASA as its default gateway? If this isn't the case, it will take a route pointing to the ASA inside the interface.

    You can perform a packet - trace as:

    Packet-trace entry inside tcp 192.168.64.2 80 10.0.70.1 1025

    (simulation of traffic back from a web server inside a VPN client)

  • Cisco ASA 5505 - capable to connect to VPN - access forbidden inside

    Hello

    I tried to set up a virtual private network for weeks, I can connect to the public IP address of the ASA, but I can't reach anything behind Cisco.

    I give you my config:

    ASA Version 8.2 (5)
    !
    host name asa
    sarg domain name * .net
    activate the encrypted password of Z4K16OvBr0J5Dj/2
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address dhcp setroute
    !
    passive FTP mode
    DNS server-group DefaultDNS
    domain sargicisco.net
    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.1.0 255.255.255.0
    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.254.0 255.255.255.240
    Remote_Sargi_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
    sheep - in extended access-list permit ip 192.168.1.0 255.255.255.0 192.168.254.0 255.255.255.0
    pager lines 24
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    mask 192.168.254.1 - 192.168.254.10 255.255.255.0 IP local pool SAVPN_Pool
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    inside crypto map inside_map interface
    crypto ISAKMP allow outside
    crypto ISAKMP allow inside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    VPN-addr-assign local reuse / time 5
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    management-access inside
    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.5 - 192.168.1.36 inside
    Wis field dhcpd * .net interface inside
    dhcpd allow inside
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    allow outside
    allow inside
    SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image
    enable SVC
    tunnel-group-list activate
    attributes of Group Policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
    internal Remote_Sargi group strategy
    attributes of Group Policy Remote_Sargi
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list Remote_Sargi_splitTunnelAcl
    sargicisco.NET value by default-field
    username kevin mz6JxJib/sQqvsw9 password encrypted privilege 0
    username kevin attributes
    VPN-group-policy DfltGrpPolicy
    type tunnel-group SAVPN remote access
    attributes global-tunnel-group SAVPN
    address pool SAVPN_Pool
    tunnel-group SAVPN webvpn-attributes
    enable SAVPN group-alias
    allow group-url https://82.228.XXX.XXX/SAVPN
    type tunnel-group Remote_Sargi remote access
    attributes global-tunnel-group Remote_Sargi
    address pool SAVPN_Pool
    Group Policy - by default-Remote_Sargi
    IPSec-attributes tunnel-group Remote_Sargi
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:387a6e260247a545f4df0d3f28ba58c5
    : end

    Thank you

    Hello

    Could you remove this statement and add the last:

    no nat (inside) 0-list of access inside_nat0_outbound

    ADD: nat (inside) 0 access-list sheep - in

    Kind regards

    Aditya

    Please evaluate the useful messages and mark the correct answers.

  • Problem with the VPN site to site for the two cisco asa 5505

    Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

    Cisco Config asa1

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 172.xxx.xx.4 255.255.240.0
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.60.2 255.255.255.0
    !
    passive FTP mode
    network of the Lan_Outside object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
    network of the Lan_Outside object
    NAT (inside, outside) interface dynamic dns
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.60.0 255.255.255.0 inside
    http 96.xx.xx.222 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 96.88.75.222
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    inside access management

    dhcpd address 192.168.60.50 - 192.168.60.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_96.xx.xx.222 group strategy
    attributes of Group Policy GroupPolicy_96.xx.xx.222
    VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 96.xx.xx.222 type ipsec-l2l
    tunnel-group 96.xx.xx.222 General-attributes
    Group - default policy - GroupPolicy_96.xx.xx.222
    96.XX.XX.222 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error

    ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Cisco ASA 2 config

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 96.xx.xx.222 255.255.255.248
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.1.254 255.255.255.0
    !
    passive FTP mode
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network of the Lan_Outside object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_4
    ip protocol object
    icmp protocol object
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
    !
    network of the Lan_Outside object
    dynamic NAT (all, outside) interface
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    http 172.xxx.xx.4 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 172.110.74.4
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0

    dhcpd address 192.168.1.50 - 192.168.1.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_172.xxx.xx.4 group strategy
    attributes of Group Policy GroupPolicy_172.xxx.xx.4
    L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 172.xxx.xx.4 type ipsec-l2l
    tunnel-group 172.xxx.xx.4 General-attributes
    Group - default policy - GroupPolicy_172.xxx.xx.4
    172.xxx.XX.4 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error
    inspect the http

    For IKEv2 configuration: (example config, you can change to encryption, group,...)

    -You must add the declaration of exemption nat (see previous answer).

    -set your encryption domain ACLs:

    access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

    -Set the Phase 1:

    Crypto ikev2 allow outside
    IKEv2 crypto policy 10
    3des encryption
    the sha md5 integrity
    Group 5
    FRP sha
    second life 86400

    -Set the Phase 2:

    Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
    Esp aes encryption protocol
    Esp integrity sha-1 protocol

    -set the Group of tunnel

    tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
    REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
    IKEv2 authentication remote pre-shared-key cisco123


    IKEv2 authentication local pre-shared-key cisco123

    -Define the encryption card

    address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
    card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
    card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
    CRYPTOMAP interface card crypto outside
    crypto isakmp identity address

    On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

    Thank you

  • ASA 5505 VPN established, cannot access inside the network

    Hi, I recently got an ASA 5505, and I spent weeks to find a way to set up a VPN on it.

    After a few days, I finally found the solution to connect to my ASA with a VPN client yet and cannot access devices that are connected to the ASA.

    Here is my config:

    ASA Version 8.2 (5)
    !
    hostname asa01
    domain kevinasa01.net
    activate 8Ry2YjIyt7RRXU24 encrypted password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    switchport access vlan 5
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address dhcp setroute
    !
    interface Vlan5
    No nameif
    security-level 50
    IP 172.16.1.1 255.255.255.0
    !
    passive FTP mode
    DNS server-group DefaultDNS
    domain kevinasa01.net
    permit same-security-traffic intra-interface
    Remote_Kevin_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.254.0 255.255.255.240
    inside_nat0_outbound list of allowed ip extended access all 192.168.254.0 255.255.255.0
    inside_nat0_outbound list of allowed ip extended access entire 192.168.1.0 255.255.255.0
    sheep - in extended Access-list allow IP 192.168.254.0 255.255.255.0 192.168.1.0 255.255.255.0
    access extensive list ip 192.168.254.0 outside_access_in allow 255.255.255.0 any
    access extensive list ip 192.168.254.0 inside_access_in allow 255.255.255.0 any
    pager lines 24
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    pool pool 192.168.254.1 - 192.168.254.10 255.255.255.0 IP mask
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (outside) 1 192.168.254.0 255.255.255.0
    NAT (inside) 0 access-list sheep - in
    NAT (inside) 1 192.168.1.0 255.255.255.0
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Access-group outside_access_in in interface outside
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    management-access inside
    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.5 - 192.168.1.36 inside
    dhcpd allow inside
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    internal Remote_Kevin group strategy
    attributes of Group Policy Remote_Kevin
    value of server DNS 192.168.1.12 192.168.1.13
    VPN - connections 3
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list Remote_Kevin_splitTunnelAcl
    kevinasa01.NET value by default-field
    username kevin mz6JxJib/sQqvsw9 password encrypted privilege 0
    username kevin attributes
    VPN-group-policy Remote_Kevin
    type tunnel-group Remote_Kevin remote access
    attributes global-tunnel-group Remote_Kevin
    address-pool
    Group Policy - by default-Remote_Kevin
    IPSec-attributes tunnel-group Remote_Kevin
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:2bb1da52d1993eb9b13c2f6dc97c16cd
    : end

    Thank you

    Hello

    I read your message quickly through my cell phone. I don't know why you have spent your config twice. Maybe a typo issue.

    I see the acl sheep in the wrong way. I mean 192.168.254 are your pool VPN and 192.168.1.0 your local LAN.

    The acl must be:

    sheep - in extended access-list permit ip 192.168.1.0 255.255.255.0 192.168.254.0 255.255.255.0

    For nat (inside), you have 2 lines:

    NAT (inside) 1 192.168.1.0 255.255.255.0 ==> it is redundant as the 1 below does the same thing with more networks if there is inside side. You can delete it.
    NAT (inside) 1 0.0.0.0 0.0.0.0

    Why are you doing this nat (outside)?

    NAT (outside) 1 192.168.254.0 255.255.255.0

    Here are the first questions that I have seen by reading through my mobile. Let's change this and let me know. I'll take a look later with a computer (tonight or tomorrow)

    Thank you.

    PS: Please do not forget to rate and score as good response if this solves your problem.

  • ASA 5505 possibly interfere/blocking calls Incound UC560

    ASA 5505 interfering with incoming calls - Cisco - Spiceworks #entry - 5716462 #entry - 5716462

    All,

    We had this problem the phone when we lose connectivity for some reason any.  Here is an example:

    We have an ASA 5505 before our UC560.  Power lost to ASA (power connector from main Board loose) primary did identical backup with config.  The layout-design is the following:

    UC560<--->ASA 5505 Cisco IAD24523<--->(provider)<---WAN(3 bonded="">

    After the passage of the ASAs, incoming calls have been piecemeal.  I can see the traffic on the firewall when the calls log, nothing otherwise.   OS on the device are:

    UC560 - 15.0 XA (1r).

    ASA 5505-4, 0000 38

    Contacted the provider and after calls debugging support have been expire with the 408 SIP error.

    Release with support from Cisco and after debugging UC is to launch the SIP 487 disconnect error.

    So based on the above and the only variable being the ASA, I'm fairly certain that it is indeed the ASA.  Here is the config ASA (it's pretty long, sorry):

    Output of the command: "show run".

    : Saved
    :
    : Serial number:
    : Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor
    :
    ASA 4,0000 Version 38
    !
    XXXXX-CA hostname
    activate the encrypted password of WUGxGkjzJJSPhT9N
    volatile xlate deny tcp any4 any4
    volatile xlate deny tcp any4 any6
    volatile xlate deny tcp any6 any4
    volatile xlate deny tcp any6 any6
    volatile xlate deny udp any4 any4 eq field
    volatile xlate deny udp any4 any6 eq field
    volatile xlate deny udp any6 any4 eq field
    volatile xlate deny udp any6 any6 eq field
    WUGxGkjzJJSPhT9N encrypted passwd
    names of
    DNS-guard
    192.168.254.1 mask - local 192.168.254.25 pool XXXXX-Remote IP 255.255.255.0
    !
    interface Ethernet0/0
    Description-> Internet
    switchport access vlan 2
    !
    interface Ethernet0/1
    Description-> inside
    switchport access vlan 10
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Vlan2
    Description-> Internet<>
    nameif outside
    security-level 0
    address IP XXX.XXX. XXX.242 255.255.255.240
    !
    interface Vlan10
    nameif inside
    security-level 100
    IP 10.0.1.1 255.255.255.0
    !
    exec banner * W A R N I N G *.
    banner exec unauthorised access prohibited. All access is
    banner exec monitored and the intruder may be continued
    exec banner to the extent of the law.
    connection of the banner * W A R N I N G *.
    banner connect unauthorized access prohibited. All access is
    connection banner monitored, and intruders will be prosecuted
    connection banner to the extent of the law.
    Banner motd! ACCESS IS RESTRICTED TO AUTHORIZED PERSONNEL ONLY!
    Banner motd this is a private computer system.
    Banner motd, access is allowed only by authorized employees or agents of the
    company banner motd.
    Banner motd system can be used only for the authorized company.
    Banner motd business management approval is required for all access privileges.
    Banner motd, as this system is equipped with a safety system designed to prevent
    Banner motd and attempts of unauthorized access record.
    Banner motd
    Banner motd unauthorized access or use is a crime under the law.
    banner asdm XXXXX Enterprises Inc. $(hostname)
    boot system Disk0: / asa904-38 - k8.bin
    boot system Disk0: / asa904-29 - k8.bin
    passive FTP mode
    clock timezone PST - 8
    clock summer-time recurring PDT
    DNS domain-lookup outside
    permit same-security-traffic intra-interface
    object obj voip network
    10.1.1.0 subnet 255.255.255.0
    network object obj - 192.168.254.0


    192.168.254.0 subnet 255.255.255.0
    pool of local addresses of description
    object obj cue-network
    10.1.10.0 subnet 255.255.255.0
    object obj priv-network
    192.168.10.0 subnet 255.255.255.0
    object obj data network
    subnet 10.0.1.0 255.255.255.0
    network object obj - 192.168.0.0
    192.168.0.0 subnet 255.255.255.0
    Description not used
    network object obj - 192.168.1.0
    subnet 192.168.1.0 255.255.255.0
    Description not used
    object obj nj-asa-private-network
    Subnet 192.168.2.0 255.255.255.0
    network obj object -? asa-private-network
    192.168.5.0 subnet 255.255.255.0
    network obj object -? asa-private-network
    192.168.6.0 subnet 255.255.255.0
    network obj object -? -asa - private-network
    subnet 192.168.3.0 255.255.255.0
    network obj object -? asa-priv-networl
    subnet 192.168.4.0 255.255.255.0
    network obj object -? asa-private-network
    192.168.7.0 subnet 255.255.255.0
    object obj-asa-Interior-voip-nic network
    host 10.1.1.1
    network obj_any object
    subnet 0.0.0.0 0.0.0.0
    network obj_any-01 object
    subnet 0.0.0.0 0.0.0.0
    network object obj - 0.0.0.0
    host 0.0.0.0
    object obj-vpn-nic network
    Home 192.168.10.20
    object obj XXXX-asa-private-network
    192.168.8.0 subnet 255.255.255.0
    House of XXXX description
    network obj object -? asa-private-network
    192.168.9.0 subnet 255.255.255.0
    object asa inside-network data
    subnet 10.0.1.0 255.255.255.0
    asa data-outside-network object
    subnet XXX.XXX. XXX.240 255.255.255.240
    network of china-education-and-research-network-center object
    Home 202.194.158.191
    Acl explicitly blocked description
    China unicom shandong network item
    60.214.232.0 subnet 255.255.255.0
    Acl explicitly blocked description
    pbx-cue-Interior-nic network object
    Home 10.1.10.2
    pbx-cue-outside-nic network object
    host 10.1.10.1
    telepacific-voip-trunk network object
    Home 64.60.66.250
    Description is no longer used
    us-la-mianbaodianying network object
    Home 68.64.168.46
    Acl explicitly blocked description
    object network cue
    10.1.10.0 subnet 255.255.255.0
    private-network data object
    192.168.10.0 subnet 255.255.255.0
    pbx-outside-data-nic network object
    host 10.0.1.2
    pbx-voip-Interior-nic network object
    host 10.1.1.1
    voip network object
    10.1.1.0 subnet 255.255.255.0
    vpn-server-nic network object
    Home 192.168.10.20
    asa-data-outside-nic network object
    host XXX.XXX. XXX.242
    asa-voip-ctl-outside-nic network object
    host XXX.XXX. XXX.244
    the object 192.168.0.0 network
    192.168.0.0 subnet 255.255.255.0
    Description not used
    the object 192.168.1.0 network
    subnet 192.168.1.0 255.255.255.0
    Description not used
    nj-asa-priv-netowrk network object
    Subnet 192.168.2.0 255.255.255.0
    network of the 192.168.254.0 object
    192.168.254.0 subnet 255.255.255.0
    pool of local addresses of description
    network of the object? -asa - private-network
    subnet 192.168.3.0 255.255.255.0
    network of the object? asa-private-network
    subnet 192.168.4.0 255.255.255.0
    network of the object? asa-private-network
    192.168.5.0 subnet 255.255.255.0
    network of the object? asa-private-network
    192.168.6.0 subnet 255.255.255.0
    network of the object? asa-private-network
    192.168.7.0 subnet 255.255.255.0
    network of the object? asa-private-network
    192.168.9.0 subnet 255.255.255.0
    the XXXX-asa-private-network object network
    192.168.8.0 subnet 255.255.255.0
    network object XXX.XXX. XXX.242
    host XXX.XXX. XXX.242
    service object 47
    tcp source eq eq 47 47 destination service
    object network dvr
    Home 192.168.10.16
    network dvr-nat-tcp8888 object
    Home 192.168.10.16
    network dvr-nat-tcp6036 object
    Home 192.168.10.16
    network dvr-nat-udp6036 object
    Home 192.168.10.16
    dvr-8888 service object
    destination eq 8888 tcp service
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    object-group service dvr-6036-tcp - udp
    port-object eq 6036
    détermine access-list extended allow object to ip pbx-outside-data-nic any4 inactive
    détermine access-list extended allow ip pbx-outside-data-nic inactive object any4
    access-list extended testout allowed ip object asa-voip-ctl-outside-nic any4 inactive
    access-list extended testout allowed ip any4 object asa-voip-ctl-outside-nic inactive
    XXXXX-Remote_splitTunnelAcl-list of allowed access standard 10.0.1.0 255.255.255.0
    XXXXX-Remote_splitTunnelAcl-list of allowed access standard 10.1.1.0 255.255.255.0
    XXXXX-Remote_splitTunnelAcl-list of allowed access standard 10.1.10.0 255.255.255.0
    XXXXX-Remote_splitTunnelAcl-list of allowed access standard 192.168.10.0 255.255.255.0
    inside_nat0_outbound list extended access permitted ip network voip 192.168.254.0 object
    inside_nat0_outbound list extended access permitted ip object cue-network 192.168.254.0
    inside_nat0_outbound list extended access permits data-private-network ip object 192.168.254.0 object
    inside_nat0_outbound list extended access permitted ip object asa-data-inside-network 192.168.254.0
    inside_nat0_outbound list extended access permitted ip voip-network 192.168.0.0 idle object
    inside_nat0_outbound list extended access permitted ip inactive cue-network 192.168.0.0 object
    inside_nat0_outbound list extended access allowed object data-private-network 192.168.0.0 inactive ip
    inside_nat0_outbound list extended access allowed object asa-data-inside-network 192.168.0.0 inactive ip
    inside_nat0_outbound list extended access permitted ip voip-network 192.168.1.0 idle object
    inside_nat0_outbound list extended access permitted ip inactive cue-network 192.168.1.0 object
    inside_nat0_outbound list extended access allowed object data-private-network 192.168.1.0 inactive ip
    inside_nat0_outbound list extended access allowed object asa-data-inside-network 192.168.1.0 inactive ip
    inside_nat0_outbound list extended access allowed object ip voip-network object nj-asa-priv-netowrk
    inside_nat0_outbound list extended access permitted ip cue-network object nj-asa-priv-netowrk object
    inside_nat0_outbound list extended access permitted ip object data-private-network nj-asa-priv-netowrk
    inside_nat0_outbound list extended access permitted ip object asa data-inside-network-nj-asa-priv-netowrk
    inside_nat0_outbound list extended access permitted ip cue-XXXX-asa-private-network network object
    inside_nat0_outbound extended access list permit ip object asa - Interior-data object XXXX-asa-private-network network
    inside_nat0_outbound list extended access permitted ip voip XXXX-asa-private-network network object
    inside_nat0_outbound list extended access allowed object of data-private-network ip XXXX-asa-private-network object
    ezvpn1 list standard access allowed 192.168.10.0 255.255.255.0
    ezvpn1 list standard access allowed 10.1.10.0 255.255.255.0
    ezvpn1 list standard access allowed 10.0.1.0 255.255.255.0
    ezvpn1 list standard access allowed 10.1.1.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.0.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.1.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.2.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.3.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.4.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.5.0 255.255.255.0
    ezvpn1 standard access list allow the 192.168.6.0 255.255.255.0
    ezvpn1 standard access list allow 192.168.7.0 255.255.255.0
    ezvpn1 standard access list allow 192.168.8.0 255.255.255.0
    ezvpn1 list standard access allowed 192.168.9.0 255.255.255.0
    access-list capout extended permitted udp object asa-data-outside-nic telepacific-voip-trunk inactive
    access-list capout extended permitted udp object telepacific-voip-trunk asa-data-outside-nic inactive
    allowed to capture access extended list ip pbx-cue-outside-nic object nj-asa-priv-netowrk
    allowed to capture access extended list ip pbx-cue-Interior-nic object nj-asa-priv-netowrk
    object capture allowed extended ip access list? object - asa-private-network pbx-cue-outside-nic
    object capture allowed extended ip access list? object - asa-private-network pbx-cue-Interior-nic
    capture extensive list ip pbx object nj-asa-priv-netowrk-cue-exterieur-nic object access permits
    capture extensive list ip pbx object nj-asa-priv-netowrk-cue-interieur-nic object access permits
    object capture allowed extended ip access list? object - asa-private-network pbx-cue-outside-nic
    object capture allowed extended ip access list? object - asa-private-network pbx-cue-Interior-nic
    ciscotest list extended access allowed host ip network voip 192.168.5.41 idle object
    access-list extended ciscotest allowed host 192.168.5.41 voip inactive ip network object
    ciscotest list extended access allowed host ip network voip 192.168.5.43 idle object
    access-list extended ciscotest allowed host 192.168.5.43 voip inactive ip network object
    access-list out_in note remote access attempted
    out_in list extended access deny ip object China unicom shandong network any4
    access-list out_in note remote access attempted
    out_in list extended access deny ip object we-the-mianbaodianying any4
    out_in list extended access deny SIP pbx-voip-Interior-nic EQ udp object china-education-and-research-network-center object
    out_in list extended access allow icmp any4 object vpn-server-nic
    out_in list extended access permitted tcp any4 pptp vpn-server-nic eq of object
    out_in list extended access permitted tcp any4 object vpn-server-nic eq 47
    out_in list extended access allow accord any4 object vpn-server-nic
    out_in list extended access allow icmp any4 object pbx-voip-Interior-nic
    out_in list extended access permitted udp any4 object pbx-voip-Interior-nic eq tftp
    out_in list extended access permitted tcp any4 object pbx-voip-Interior-nic eq h323
    out_in list extended access permitted udp any4 sip pbx-voip-Interior-nic eq of object
    Comment from out_in-HTTPS access outside the access list
    out_in list extended access permitted tcp any4 object data-private-network eq https
    outside_access_in list extended access allow icmp host 192.168.10.20 any4
    access-list extended outside_access_in permit tcp host 192.168.10.20 any4 eq pptp
    outside_access_in list extended access allowed host any4 object 47 192.168.10.20
    outside_access_in list extended access allow accord any4 host 192.168.10.20
    outside_access_in list extended access permit tcp any object dvr dvr-6036 object-group
    outside_access_in list extended access permit udp any object dvr dvr-6036 object-group
    outside_access_in list extended access allowed object dvr-8888 any object dvr
    outside_access_in list extended access allow icmp any4 host 10.1.1.1
    access-list extended outside_access_in permit udp host 10.1.1.1 any4 eq tftp
    access-list extended outside_access_in permit tcp host 10.1.1.1 any4 eq h323
    access-list allowed outside_access_in extended udp any4 host 10.1.1.1 eq sip
    go to list of access outside_access_in note incoming https.
    outside_access_in list extended access permitted tcp any4 192.168.10.0 255.255.255.0 eq https
    pager lines 24
    Enable logging
    exploitation forest-size of the buffer 1048576
    monitor debug logging
    debug logging in buffered memory
    asdm of logging of information
    address record [email protected] / * /
    exploitation forest-address recipient [email protected] / * / level of errors
    exploitation forest flash-bufferwrap
    No registration message 106015
    No message logging 313001
    No registration message 313008
    no logging message 106023
    No message logging 710003
    no logging message 106100
    No message logging 302015
    No message recording 302014
    No message logging 302013
    No message logging 302018
    No message logging 302017
    No message logging 302016
    No message logging 302021
    No message logging 302020
    destination of exports flow inside 192.168.10.20 4432
    Outside 1500 MTU
    Within 1500 MTU
    ICMP unreachable rate-limit 3 burst-size 1
    ICMP allow any response of echo outdoors
    ICMP allow any echo outdoors
    ICMP allow any inaccessible outside
    ICMP permitted host 75.140.0.86 outside
    ICMP allow any inside
    ASDM image disk0: / asdm-715 - 100.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, all) static source network-voip-obj obj-voip-network destination static obj - 192.168.254.0 obj - 192.168.254.0 no-proxy-arp-search to itinerary
    NAT (inside, all) static source network-cue-obj obj-cue-network destination static obj - 192.168.254.0 obj - 192.168.254.0 no-proxy-arp-search to itinerary
    NAT (inside, all) static source network-priv-obj obj-private-network destination static obj - 192.168.254.0 obj - 192.168.254.0 no-proxy-arp-search to itinerary
    NAT (inside, all) static obj-data-network-obj-network destination static obj - 192.168.254.0 obj - 192.168.254.0 no-proxy-arp-search to itinerary
    NAT (inside, all) static source network-voip-obj obj-voip-network destination static obj - 192.168.0.0 obj - 192.168.0.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static source network-cue-obj obj-cue-network destination static obj - 192.168.0.0 obj - 192.168.0.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static source network-priv-obj obj-private-network destination static obj - 192.168.0.0 obj - 192.168.0.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static obj-data-network-obj-network source destination static obj - 192.168.0.0 obj - 192.168.0.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static source network-voip-obj obj-voip-network destination static obj - 192.168.1.0 obj - 192.168.1.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static source network-cue-obj obj-cue-network destination static obj - 192.168.1.0 obj - 192.168.1.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static source network-priv-obj obj-private-network destination static obj - 192.168.1.0 obj - 192.168.1.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static obj-data-network-obj-network source destination static obj - 192.168.1.0 obj - 192.168.1.0 to route non-proxy-arp-search inactive
    NAT (inside, all) static source network-voip-obj obj-voip-network destination static obj-nj-asa-private-network obj-nj-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static source network-cue-obj obj-cue-network destination static obj-nj-asa-private-network obj-nj-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static source network-priv-obj obj-private-network destination static obj-nj-asa-private-network obj-nj-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static obj-data-network-obj-network source destination static obj-nj-asa-private-network obj-nj-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static obj-data-network-obj-network destination static obj -? -asa - private - network obj -? -asa - private-network non-proxy-arp-route search
    NAT (inside, all) static source network-voip-obj obj-voip-network destination static obj -? -asa - private - network obj -? -asa - private-network non-proxy-arp-route search
    NAT (inside, all) static source network-cue-obj obj-cue-network destination static obj -? -asa - private - network obj -? -asa - private-network non-proxy-arp-route search
    NAT (inside, all) static source network-priv-obj obj-private-network destination static obj -? -asa - private - network obj -? -asa - private-network non-proxy-arp-route search
    static static obj obj-data-network-obj-network destination NAT (inside, all) source -? -asa-priv-networl obj -? -asa-priv-networl non-proxy-arp-route search
    static static obj obj-voip-network obj-voip-network destination NAT (inside, all) source -? -asa-priv-networl obj -? -asa-priv-networl non-proxy-arp-route search
    static static obj obj-cue-network obj-cue-network destination NAT (inside, all) source -? -asa-priv-networl obj -? -asa-priv-networl non-proxy-arp-route search
    static static obj obj-private-network obj-private-network destination NAT (inside, all) source -? -asa-priv-networl obj -? -asa-priv-networl non-proxy-arp-route search
    static static obj obj-cue-network obj-cue-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-data-network-obj-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-voip-network obj-voip-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-private-network obj-private-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-data-network-obj-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-voip-network obj-voip-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-cue-network obj-cue-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-private-network obj-private-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-data-network-obj-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-voip-network obj-voip-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-cue-network obj-cue-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-private-network obj-private-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    NAT (inside, all) static obj-data-network-obj-network source destination static obj-XXXX-asa-private-network obj-XXXX-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static source network-voip-obj obj-voip-network destination static obj-XXXX-asa-private-network obj-XXXX-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static source network-cue-obj obj-cue-network destination static obj-XXXX-asa-private-network obj-XXXX-asa-private-network non-proxy-arp-search directions
    NAT (inside, all) static source network-priv-obj obj-private-network destination static obj-XXXX-asa-private-network obj-XXXX-asa-private-network non-proxy-arp-search directions
    static static obj obj-data-network-obj-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-voip-network obj-voip-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-cue-network obj-cue-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    static static obj obj-private-network obj-private-network destination NAT (inside, all) source -? obj - asa-private-network -? -asa-private-network non-proxy-arp-route search
    !
    object obj-asa-Interior-voip-nic network
    NAT XXX.XXX static (inside, outside). XXX.244
    network obj_any object
    NAT dynamic interface (indoor, outdoor)
    network obj_any-01 object
    NAT (inside, outside) dynamic obj - 0.0.0.0
    object obj-vpn-nic network
    NAT XXX.XXX static (inside, outside). XXX.254
    network dvr-nat-tcp8888 object
    NAT (inside, outside) interface static 8888 8888 tcp service
    network dvr-nat-tcp6036 object
    NAT (inside, outside) interface static 6036 6036 tcp service
    network dvr-nat-udp6036 object
    NAT (inside, outside) interface static service udp 6036 6036
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 XXX.XXX. XXX.241 1
    Route inside 10.1.1.0 255.255.255.0 10.0.1.2 1
    Route inside 10.1.10.0 255.255.255.252 10.0.1.2 1
    Route inside 192.168.10.0 255.255.255.0 10.0.1.2 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    the ssh LOCAL console AAA authentication
    AAA authentication http LOCAL console
    AAA authentication enable LOCAL console
    LOCAL AAA authentication serial console
    AAA authentication LOCAL telnet console
    Enable http server
    http 192.168.10.0 255.255.255.0 inside
    http 10.0.1.0 255.255.255.0 inside
    http 192.168.254.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outdoors
    authentication & encryption v3 private Server SNMP group
    SNMP server group No_Authentication_No_Encryption v3 /noauth
    SNMP-server host inside the 192.168.10.20 community *.
    Server SNMP Ontario, CA location
    SNMP Server contact [email protected] / * /
    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec pmtu aging infinite - the security association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256

    -MD5-ESP-3DES-MD5 ESP-3DES-SHA SHA-DES-ESP ESP - THE - MD5
    Crypto dynamic-map myDYN-card 5 set transform-set ESP-DES-MD5 ikev1
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    dynamic crypto isakmp 65535 ipsec myDYN-map myMAP map
    Crypto ca trustpoint CAP-RTP-001_trustpoint
    Terminal registration
    Configure CRL
    Crypto ca trustpoint CAP-RTP-002_trustpoint
    Terminal registration
    Configure CRL
    Crypto ca trustpoint _internal_ctl_phoneproxy_file_SAST_0
    registration auto
    full domain name no
    name of the object cn = "_internal_ctl_phoneproxy_file_SAST_0"; UO = "STG"; o = "Cisco Inc."
    _internal_ctl_phoneproxy_file_SAST_0 key pair
    Configure CRL
    Crypto ca trustpoint _internal_ctl_phoneproxy_file_SAST_1
    registration auto
    full domain name no
    name of the object cn = "_internal_ctl_phoneproxy_file_SAST_1"; UO = "STG"; o = "Cisco Inc."
    _internal_ctl_phoneproxy_file_SAST_1 key pair
    Configure CRL
    Crypto ca trustpoint _internal_PP_ctl_phoneproxy_file
    registration auto
    full domain name no
    name of the object cn = "_internal_PP_ctl_phoneproxy_file"; UO = "STG"; o = "Cisco Inc."
    _internal_PP_ctl_phoneproxy_file key pair
    Configure CRL
    Crypto ca trustpoint Cisco-Mfg-CA
    Terminal registration
    Configure CRL
    Crypto ca trustpoint phoneproxy_trustpoint
    registration auto
    full domain name XXXXXXXXXX.com
    name of the object CN = XXXXXX - ASA
    phoneproxy_trustpoint key pair
    Configure CRL
    trustpool crypto ca policy
    string encryption CAP-RTP-001_trustpoint ca certificates
    certificate ca 7612f960153d6f9f4e42202032b72356
    quit smoking
    string encryption CAP-RTP-002_trustpoint ca certificates
    certificate ca 353fb24bd70f14a346c1f3a9ac725675
    quit smoking
    Crypto ca certificate chain _internal_ctl_phoneproxy_file_SAST_0
    certificate e1aee24c
    CA
    quit smoking
    Crypto ca certificate chain _internal_ctl_phoneproxy_file_SAST_1
    certificate e4aee24c
    quit smoking
    Crypto ca certificate chain _internal_PP_ctl_phoneproxy_file
    certificate e8aee24c
    quit smoking
    a string of ca crypto Cisco-Mfg-CA certificates
    certificate ca 6a6967b3000000000003
    quit smoking
    Crypto ca certificate chain phoneproxy_trustpoint
    certificate 83cbe64c
    quit smoking
    Crypto ikev1 allow outside
    IKEv1 crypto policy 5
    preshared authentication
    the Encryption
    md5 hash
    Group 2
    life 86400
    IKEv1 crypto policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH 10.0.1.0 255.255.255.0 inside
    SSH 0.0.0.0 0.0.0.0 inside
    SSH timeout 60
    Console timeout 0
    management-access inside

    priority-queue outdoors
    TX-ring-limit of 256
    !
    maximum-session TLS-proxy 24
    !
    !
    TLS-proxy tls_proxy
    _internal_PP_ctl_phoneproxy_file point server trust
    CTL-file ctl_phoneproxy_file
    file-entry cucm-tftp trustpoint phoneproxy_trustpoint address 73.200.75.244
    !
    Media-termination asdm_media_termination
    address XXX.XXX. XXX.245 outside interface
    address interface inside 10.0.1.245

    !
    Phone-proxy asdm_phone_proxy
    Media-termination asdm_media_termination
    interface address 10.1.1.1 TFTP server on the inside
    TLS-proxy tls_proxy
    no settings disable service
    XXX.XXX proxy server address. Outside the xxx.242 80 interface
    a basic threat threat detection
    threat detection statistics
    a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
    NTP server 192.168.10.60 source inside
    internal group myGROUP strategy
    Group myGROUP policy attributes
    VPN-idle-timeout no
    VPN-session-timeout no
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list ezvpn1
    allow to NEM
    XXXXX group policy / internal remote
    attributes of group XXXXX policy / remote
    Ikev1 VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    Split-tunnel-network-list value XXXXX-Remote_splitTunnelAcl
    fstorm encrypted EICAA5sjaiU.vh05 privilege 15 password username
    username fstorm attributes
    type of remote access service
    username password encrypted PPfytzRN94JBZlXh privilege 0 ciscotac
    username cisco password encrypted privilege 15 omWHH15zt6aLxWSr
    attributes username cisco
    type of remote access service
    username XXXXXu8 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu8 attributes
    type of remote access service
    username password uniadmin G72KWXo/GsACJLJ7 encrypted privilege 15
    username XXXXXU1 encrypted password privilege 0 rmZe1Ee0HeReQn6N
    username XXXXXU1 attributes
    Strategy Group-VPN-XXXXX / remote
    type of remote access service
    username XXXXXu3 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu3 attributes
    type of remote access service
    username XXXXXu2 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu2 attributes
    type of remote access service
    username XXXXXu5 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu5 attributes
    type of remote access service
    username XXXXXu4 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu4 attributes
    type of remote access service
    username XXXXXu7 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu7 attributes
    type of remote access service
    username XXXXXu6 encrypted password rmZe1Ee0HeReQn6N
    username XXXXXu6 attributes
    type of remote access service
    tunnel-group XXXXX type remote access / remote
    attributes global-tunnel-group XXXXX / remote
    XXXXX address pool / remote
    Group Policy - by default-XXXXX / remote
    IPSec-attributes tunnel-group XXXXX / remote
    IKEv1 pre-shared-key *.
    type tunnel-group mytunnel remote access
    tunnel-group mytunnel General-attributes
    strategy - by default-group myGROUP
    mytunnel group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    !
    class-card CM-VOICE-SIGNAL
    match dscp af31
    class-map-outside-phoneproxy
    match eq 2443 tcp port
    class-map inspection_default
    match default-inspection-traffic
    Class-map data
    match flow ip destination-address
    match tunnel-group mytunnel
    class-card CM-VOICE
    match dscp ef
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 1024
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the pptp
    inspect the icmp
    class class by default
    Statistical accounting of user
    flow-export-type of event all 192.168.10.20 destination
    outside-policy policy-map
    class outside-phoneproxy
    inspect the thin phone-proxy asdm_phone_proxy
    CM-VOICE class
    priority
    CM-VOICE-SIGNAL class
    priority
    World-Policy policy-map
    !
    global service-policy global_policy
    207.46.163.138 SMTP server
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    HPM topN enable
    Cryptochecksum:8bb3014c2a6deba7c80e5f897b3d34cb
    : end

    If someone could give a clue as to what could be the problem, I would appreciate it.

    / / / / o ? 0:o); ++ rc; c ++) a [c] .apply (i, r); var s = f [g [n]]; {return s & s.push ([m, n, r, i]), I} function p (e, t) {[e] w = l (e) .concat (t)} function l (e) {return [e] w |} []} function d (e) {return s [e] [e] s =: o (n)} function v (e, t) {c (e, function (e, n) {t = t |})} "" featured ", g [n] = t, f t | (f[t]=[])})} var w = {,} g = {}, m = {on: p, emit: n, get: d, listeners: l, context: t, buffer: v}; "return m} function i() {return new r} var a ='[email protected] / * /', u = e ("GDS"), (2) c = e, f is {}, s = {}, p is t.exports = o (); [p.backlog = f}, {}], gos: [function (e, t, n) {function r (e, t, n) {if (o.call (e, t)) e [t] return; var r = n (); if (Object.defineProperty & Object.keys) try {return Object.defineProperty (e t, {value: r, available in writing:! 0, countable:! 1}), r} catch (i) {return [t] = r, r e} var o = Object.prototype.hasOwnProperty; t.exports = r}, {}], handle: [function (e, t, n) {function r (e, t, n [{(, r) {o.buffer([e],r), o.emit(e,t,n)} var o = e("ee").get ("handle"); t.exports = r, r.ee = o}, {}], id: [function (e, t, n) {function r (e) {var t = typeof e; return! e |}}] "(» Object"!==t&&"function"!==t?-1:e===Window?0:a(e,i,Function() {return o ++})} var o = 1, I = "[email protected] / * /', a = e ("gos"); [t.exports = r}, {}], charger: [function (e, t, n) {function r() {if(!w++) {var e = v.info = NREUM.info, t = s.getElementsByTagName ("script") [0]; if(e&&e.licenseKey&&e.applicationID&&t) {c (l, function (t, n) {[t] e |})}}}}] (e [t] = n)}) ; var n = "https" = p.split (":") [0] | e.sslForHttp; v.proto = n? ([' https://":"http://",u("Mark",["OnLoad",a ()], null,"api"); var r = s.createElement ("script");r.src=v.proto+e.agent,t.parentNode.insertBefore(r,t)}}} function o() {"complete" = s.readyState & i ()} function i() {u ("mark", ["domContent", a ()], null, "api")} function a() {return (new Date) .getTime ()} var u = e ('handful'), c = e (2), f = window, s = f.document; NREUM.o = {ST:setTimeout, CT:clearTimeout, XHR:f.XMLHttpRequest, REQ:f.Request, EV:f.Event, PR:f.Promise, MO:f.MutationObserver}, e (1); var p=""+location,l={beacon:"bam.nr-data.net",errorBeacon:"bam.nr-data.net",agent:"js-agent.newrelic.com/nr-918.min.js"},d=window. XMLHttpRequest&&XMLHttpRequest.prototype&&XMLHttpRequest.prototype.addEventListener&&!/CriOS/.test (navigator.userAgent), v = t.exports = {offset: a (), original: p, features: {}, xhrWrappable:d}; s.addEventListener? (s.addEventListener("DOMContentLoaded",i,!1),f.addEventListener("load",r,!1)):(s.attachEvent("onreadystatechange",o),f.attachEvent("onload",r)),u("mark",["firstbyte",a ()], null, "api"); ({[var w = 0}, {}]}, {}, ["loader"]); // ]]> // // //

    Glad you were able to solve the problem! Also, thank you for taking the time to come back and post the solution here (+ 5 from me)!

    Now, given that your issue is resolved, you must mark the thread as "answered" :)

    Thank you for evaluating useful messages!

  • Cannot Ping hosts after you connect to ASA5500 using a client connection

    I can ping hosts and gateways of the ASA5500, but after I connect I can't ping anything. The ASA5500 is connected to a layer 2 switch, this switch is shared resources for a layer 3. This 3 level switch is connected to another switch to level 3 where the gateways and hosts live. Again, I can ping hosts and gateways of the ASA5500 itself.

    ASA Version 8.2 (5)
    !
    activate 8Ry2YjIyt7RRXU24 encrypted password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    IP address 208.19.xxx.xx 255.255.255.240
    !
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    IP 10.47.146.199 255.255.255.0
    !
    interface GigabitEthernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    <--- more="" ---="">
    !
    interface GigabitEthernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    passive FTP mode
    DNS server-group DefaultDNS
    permit same-security-traffic inter-interface
    IP 10.47.138.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.140.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.141.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.148.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.149.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.150.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.151.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.133.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.212.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.153.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.157.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.154.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    IP 10.47.146.0 allow Access - list extended SHEEP 255.255.255.0 172.16.1.0 255.255.255.0
    pager lines 24
    Within 1500 MTU
    Outside 1500 MTU
    mask 172.16.1.10 - 172.16.1.200 255.255.255.0 IP local pool VPNpool
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Route outside 0.0.0.0 0.0.0.0 208.19.xxx.xx 1
    Route inside 10.47.133.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.138.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.140.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.141.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.148.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.149.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.150.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.151.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.153.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.154.0 255.255.255.0 10.47.146.1 1
    Route inside 10.47.157.0 255.255.255.0 10.47.146.1 1
    Route inside the 10.47.212.0 255.255.254.0 10.47.146.1 1
    Route inside the 10.47.214.0 255.255.254.0 10.47.146.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    No snmp server location
    No snmp Server contact
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    allow outside
    SVC disk0:/anyconnect-win-3.1.04072-k9.pkg 1 image
    enable SVC
    tunnel-group-list activate
    Anyconnect-policy group policy interns
    Anyconnect-policy-strategy of group attributes
    VPN - 100 simultaneous connections
    VPN-idle-timeout no
    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
    WebVPN
    SVC Dungeon-Installer installed
    SVC request to enable default timeout 20 svc
    username billuser1 password eS3lou7xhp / 8g 705 encrypted
    username billuser1 attributes
    type of remote access service
    tunnel-group bill type remote access
    tunnel-group invoice General attributes
    address pool VPNpool
    strategy-group-by default Anyconnect-policy
    tunnel-group bill webvpn-attributes
    activation of the Group billgroup_users alias
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    Review the ip options
    inspect the netbios
    inspect the rsh
    inspect the rtsp
    inspect the skinny
    inspect esmtp
    inspect sqlnet
    inspect sunrpc
    inspect the tftp
    inspect the sip
    inspect xdmcp
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/De destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:80003da27b3641b2123e30df5ef6b320
    : end
    cvpn #.

    Hello

    You must ensure that networks l3 behind firewalls have itinerary for your "VPNpool" subnet and you need create the rule of no - NAT as shown below

    NAT (inside) 0 access-list SHEEP

    HTH

    Averroès.

  • do not access my home network via antconnect

    I am able to connect through the anyconnect client and get an ip address, but I am not able to access my administration (internal network)

    Administration = 10.18.1.120

    VPN pool = 172.16.10.0/28

    10.17.13.120 outside

    This is my config

    ASA 1.0000 Version 2
    !
    !
    interface GigabitEthernet0/0
    nameif administration
    security-level 100
    IP 10.18.1.120 255.255.0.0
    !
    interface GigabitEthernet0/1
    nameif outside
    security-level 0
    IP 10.17.13.120 255.255.0.0
    !
    interface GigabitEthernet0/2
    nameif admin-out13
    security-level 0
    IP 10.13.1.120 255.255.0.0
    !
    interface GigabitEthernet0/3
    nameif VOIP
    security-level 0
    IP 10.90.100.120 255.255.0.0
    !
    passive FTP mode
    network of the NETWORK_OBJ_172.16.10.0_29 object
    subnet 172.16.10.0 255.255.255.248
    network of the Admin_Email_Server object
    Home 10.18.4.120
    e-mail Description admin server
    network of the Admin_Srv_Farm object
    10.18.4.0 subnet 255.255.255.0
    Description subenet where the admin servers are hosted
    ICMP-type of object-group ICMP_Group
    alternate address ICMP-object
    ICMP-object-conversion error
    echo ICMP-object
    response to echo ICMP-object
    ICMP-object information-response
    ICMP-object-request for information
    ICMP object-mask-reply
    Mask-request ICMP-object
    ICMP-object mobile-redirect
    ICMP-object-parameter problem
    redirect ICMP-object
    ICMP-object-announcement of router
    ICMP-object-solicitation of router
    Object-ICMP source-quench
    ICMP-object has exceeded the time
    ICMP-object-response to timestamp
    Timestamp-request ICMP-object
    Object-ICMP traceroute
    ICMP-unreachable object
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    pager lines 24
    Enable logging
    asdm of logging of information
    management of MTU 1500
    administration of MTU 1500
    Outside 1500 MTU
    Admin-out13 MTU 1500
    ip_phones MTU 1500
    local pool ADMIN_VPN_POOL 172.16.10.1 - 172.16.10.10 255.255.255.0 IP mask
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 66114.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT (administration, outside) static source any any static destination NETWORK_OBJ_172.16.10.0_29 NETWORK_OBJ_172.16.10.0_29 non-proxy-arp-search to itinerary
    public static NETWORK_OBJ_172.16.10.0_29 NETWORK_OBJ_172.16.10.0_29 destination NAT (outside directors) static source Admin_Srv_Farm Admin_Srv_Farm
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    LOCAL AAA authentication serial console
    AAA authentication LOCAL telnet console
    the ssh LOCAL console AAA authentication
    Enable http server
    http 10.18.0.0 255.255.0.0 administration
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    Crypto ca trustpoint ASDM_TrustPoint0
    registration auto
    name of the object CN = admin-pare-fire
    Configure CRL
    string encryption ca ASDM_TrustPoint0 certificates
     
    Crypto ikev2 activate out of service the customer port 443
    Crypto ikev2 access remote trustpoint ASDM_TrustPoint0
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    dhcpd address 10.90.100.1 - 10.90.100.100 ip_phones
    dhcpd 4.2.2.2 dns 8.8.8.8 interface ip_phones
    dhcpd lease 1800 interface ip_phones
    dhcpd field uz.ac.zw interface ip_phones
    dhcpd option 3 ip 10.90.1.254 interface ip_phones
    ip_phones enable dhcpd
    !
    !
    maximum session 1000 TLS-proxy
    !
    a basic threat threat detection
    threat detection statistics
    a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
    SSL-trust outside ASDM_TrustPoint0 point
    WebVPN
    allow outside
    AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    AnyConnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2
    AnyConnect profiles ITADMIN_VPN_client_profile disk0: / ITADMIN_VPN_client_profile.xml
    AnyConnect enable
    tunnel-group-list activate
    internal GroupPolicy_ITADMIN_VPN group strategy
    attributes of Group Policy GroupPolicy_ITADMIN_VPN
    WINS server no
    value of 10.18.4.120 DNS server 10.50.7.178
    client ssl-VPN-tunnel-Protocol ikev2
    uz.AC.ZW value by default-field
    WebVPN
    AnyConnect value ITADMIN_VPN_client_profile type user profiles
    webster nwgth7HVlZ/qiWnP password encrypted username
    webster username attributes
    type of remote access service
    username admin password encrypted xxxxxxxxxxx privilege 15
    username user2 encrypted password privilege 15 xxxxxxxxxxx
    attributes of user user2 name
    type of remote access service
    type tunnel-group ITADMIN_VPN remote access
    attributes global-tunnel-group ITADMIN_VPN
    address ADMIN_VPN_POOL pool
    Group Policy - by default-GroupPolicy_ITADMIN_VPN
    tunnel-group ITADMIN_VPN webvpn-attributes
    enable ITADMIN_VPN group-alias
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    class class by default
    Statistical accounting of user
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:c9820a69d5b4fb9e3f7cce253f2450e4

    After the addition of administration management-access command, please check if you are able to ping to the administration interface (ip = 10.18.1.120) of the remote user's machine. In addition, run this command on the ASA.

    Packet-trace entry administration icmp 8 0 detailed

    Once you run this copy please order the output and the share here. Please see links to the ip address of the host, sitting behind the administration interface that you think that the ip address of the internal host should be able to ping from outside. Assigned ip address is the ip address that is assigned to the pool anyconnect client.

    Share the details here and we will be able to understand the question.

    Thank you

    Vishnu

  • Unable to reach the other subnet to VPN

    I need the vpn users to access the resources of the SITE-A. VPN access all the resources of the SITE B but unable to reach all servers in A SITE. ASA, I can ping servers A SITE without any problem. I tried to configure the tcp-bypass (http://packetflow.io/2014/03/asa-hairpinning-and-tcp-state-bypass.html) but still not able to reach A SITE. I also tried the crossed this site (https://nat0.net/cisco-asa-hairpinning/) and still no luck. Any idea is appreciated. I can provide SITE-B router config if necessary.

    DNS-guard
    mask pool POOL-VPN-IP 10.240.25.15 - IP 255.255.255.0 10.240.25.50
    !
    interface Ethernet0/0
    Speed 1000
    full duplex
    nameif OUTSIDE
    security-level 0
    IP 10.0.0.1
    !
    interface Ethernet0/1
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/1.10
    VLAN 10
    nameif inside
    security-level 100
    IP 172.18.83.250 255.255.255.0
    !
    interface Ethernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    boot system Disk0: / asa916 - k8.bin
    passive FTP mode
    clock timezone PST - 8
    clock summer-time recurring PDT
    DNS domain-lookup OUTSIDE
    domain-search DNS inside
    DNS server-group DefaultDNS
    Server name 172.18.83.10
    Server name 172.18.83.11
    Name-Server 4.2.2.2
    domain.com domain name
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    the object OBJ - ANY network
    subnet 0.0.0.0 0.0.0.0
    service object MSTSC
    service destination tcp 3389 eq
    network of the VPNPOOL object
    10.240.25.0 subnet 255.255.255.0
    object SITE-B network
    172.18.83.0 subnet 255.255.255.0
    object SITE-A network
    172.18.80.0 subnet 255.255.255.0
    object-group, INTERNAL-LAN network
    object-network 172.18.83.0 255.255.255.0
    standard access list permits 172.18.83.0 SPLIT-TUNNEL 255.255.255.0
    standard access list permits 172.18.80.0 SPLIT-TUNNEL 255.255.255.0
    OUTSIDE_access_in list extended access permitted ip object VPNPOOL SITE-a.
    Outside 1500 MTU
    MTU 1500 inside
    IP verify reverse path to the OUTSIDE interface
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 743.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (INSIDE, OUTSIDE) static source SITE SITE-B-B static destination VPNPOOL VPNPOOL non-proxy-arp-search to itinerary
    NAT (INSIDE, OUTSIDE) static source SITE-has-a-SITE static destination VPNPOOL VPNPOOL non-proxy-arp-search to itinerary
    !
    object SITE-B network
    dynamic NAT interface (all, OUTSIDE)
    Route outside 0.0.0.0 0.0.0.0 X.X.X.X 1
    Route to the INTERIOR of 172.18.80.0 255.255.255.0 172.18.83.1 1
    dynamic-access-policy-registration DfltAccessPolicy
    action to terminate
    dynamic-access-policy-record VPNTUNNEL
    AAA-server VPN-users ldap Protocol
    AAA-server VPN-users (INSIDE) X.X.X.X
    LDAP-base-dn DC = DOMAIN, DC = com
    LDAP-scope subtree
    LDAP-naming-attribute sAMAccountName
    LDAP-login-password *.
    LDAP-connection-dn CN = CISCO, OU = Service accounts, DC = DOMAIN, DC = com
    microsoft server type
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    LOCAL AAA authentication serial console
    the ssh LOCAL console AAA authentication
    Enable http server
    Server of http session-timeout 60


    redirect http 80 outside
    No snmp server location
    No snmp Server contact
    Telnet timeout 5
    Console timeout 0
    management-access INTERIOR
    No ipv6-vpn-addr-assign aaa
    no local ipv6-vpn-addr-assign
    a basic threat threat detection
    threat detection statistics
    a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
    SSL server-version everything
    client SSL version all
    SSL-trust VPNCERT OUTSIDE point
    WebVPN
    allow outside
    AnyConnect essentials
    AnyConnect image disk0:/anyconnect-win-3.1.09013-k9.pkg 1
    AnyConnect image disk0:/anyconnect-macosx-i386-3.1.09013-k9.pkg 2
    AnyConnect enable
    tunnel-group-list activate
    attributes of Group Policy DfltGrpPolicy
    VPN-tunnel-Protocol ikev1, ikev2 ssl clientless ssl ipsec l2tp client
    value by default-domain domain.com
    Group Policy GroupPolicy_VPN SITE internal
    attributes of Group Policy GroupPolicy_VPN to SITE
    WINS server no
    value of 172.18.83.10 DNS server 172.18.83.11
    VPN - 4 concurrent connections
    VPN-idle-timeout 120
    3600 VPN-session-timeout
    client ssl-VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    Split-tunnel-network-list value of SPLIT TUNNEL
    value by default-domain domain.com
    WebVPN
    AnyConnect mtu 1200
    time to generate a new key 30 AnyConnect ssl
    AnyConnect ssl generate a new method ssl key
    AnyConnect ask flawless anyconnect
    attributes global-tunnel-group DefaultWEBVPNGroup
    LOCAL VPN users authentication-server-group
    tunnel-group VPNTUNNEL type remote access
    tunnel-group VPNTUNNEL General attributes
    address IP-VPN-POOL pool
    LOCAL VPN users authentication-server-group
    Group Policy - by default-GroupPolicy_VPNTUNNEL
    management of the password password-expire-to-days 7
    tunnel-group VPNTUNNEL webvpn-attributes
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the ftp
    Review the ip options
    inspect the pptp
    inspect the tftp
    inspect the icmp
    class class by default
    Statistical accounting of user

    It is most likely your problem then.  Your VPN clients, 10.240.25.0/24 can get to the Site, but because the Site doesn't know how to return to 10.240.25.0/24 traffic is lost.  You will need to advertise out of site B.

  • ASA 5505 cannot configure FTP and I tried almost everything

    Not sure if my device is faulty or not, but I'm running on a base license and cannot establish an FTP connection for the life of me. Here is my config;

    Thanks in advance...

    ASA Version 7.2 (2)
    !
    ciscoasa hostname
    domain default.domain.invalid
    activate the encrypted password of TGFUt.AsMHJOyury
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address dhcp setroute
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    2KFQnbNIdI.2KYOU encrypted passwd
    passive FTP mode
    DNS server-group DefaultDNS
    domain default.domain.invalid
    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp
    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp - data
    pager lines 24
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 522.bin
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect
    Timeout, uauth 0:05:00 absolute
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Telnet 192.168.1.0 255.255.255.0 inside
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.2 - 192.168.1.33 inside
    dhcpd allow inside
    !

    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    !
    global service-policy global_policy
    context of prompt hostname
    Cryptochecksum:641863a581e04222e46e2ab17a880147
    : end

    Where is the static nat translation, or configuration of port forwarding?

    you have bellows acl lines, these access lists is not yet applied to the external interface of the firewall.

    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp
    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp - data

    How the outside internet hosts are able to connect to a non-public such as the 192.168.1.110 IP address?

    you need little things to fix in your configuration, your external interface is first attributed to dynamic ip for ISPS to provide the public IP seen in your config like:

    interface Vlan2
    nameif outside
    security-level 0
    IP address dhcp setroute

    Number 1- because we don't know what address IP of the ISP dynamically given the firewall, you must know what address is provided by the show on the asa show ip interface brief command line and take notes on the IP Vlan2... that Ip address will be the use of a single for hosts on the internet so you can connect to your FTP 192.168.1.110 server.

    Number 2 - because you do not spared a public IP address to use a one-to-one translation NAT for your server ftp within a public IP to the outside address, you must use the keyword interface on your translation of static port and the real access list 100 for the firewall to allow this connection and sends the request to the server ftp inside.

    public static tcp (indoor, outdoor) interface 192.168.1.110 ftp ftp netmask 255.255.255.255
    public static tcp (indoor, outdoor) interface ftp - data 192.168.1.110 ftp - data netmask 255.255.255.255

    Then re - configure acl 100 as below and apply it to the external interface

    access-list extended 100 permit tcp any which interface outside eq ftp
    access-list extended 100 permit tcp any which interface outside eq ftp_data

    Access-group 100 in external interface

    Finally, make sure you have your FTP server is running, don't forget not that from outside you will be using the public IP address you got output show ip interface brief , which will be the IP address that will be used to FTP from the outside to the inside.

  • ASA 5505 as internet gateway (must reverse NAT)

    Hi all the Cisco guru

    I have this diet:

    Office-> Cisco 877-> Internet-> ASA 5505-> remote network

    Office network: 192.168.10.0/24

    Cisco 877 IP internal: 192.168.10.200

    Cisco 877 external IP: a.a.a.a

    ASA 5505 external IP: b.b.b.b

    ASA 5505 internal IP: 192.168.1.3 and 192.168.17.3

    Remote network: 192.168.17.0/24 and 192.168.1.0/24

    VPN tunnel is OK and more. I have the Office Access to the remote network and the remote network access to the bureau by the tunnel.

    But when I try to access the network remotely (there are 2 VLANS: management and OLD-private) to the internet, ASA answer me:

    305013 *. * NAT rules asymetrique.64.9 matched 53 for flows forward and backward; Connection for udp src OLD-Private:192.168.17.138/59949 dst WAN:*.*.64.9/53 refused due to path failure reverse that of NAT

    Ping of OLD-private interface to google result:

    110003 192.168.17.2 0 66.102.7.104 0 routing cannot locate the next hop for icmp NP identity Ifc:192.168.17.2/0 to OLD-Private:66.102.7.104/0

    Result of traceroute

    How can I fix reverse NAT and make ASA as internet gateway?

    There is my full config

    !
    ASA Version 8.2 (2)
    !
    hostname ASA2
    domain default.domain.invalid
    activate the encrypted password password
    encrypted passwd password
    names of
    !
    interface Vlan1
    Description INTERNET
    1234.5678.0002 Mac address
    nameif WAN
    security-level 100
    IP address b.b.b.b 255.255.248.0
    OSPF cost 10
    !
    interface Vlan2
    OLD-PRIVATE description
    1234.5678.0202 Mac address
    nameif OLD-private
    security-level 0
    IP 192.168.17.3 255.255.255.0
    OSPF cost 10
    !
    interface Vlan6
    Description MANAGEMENT
    1234.5678.0206 Mac address
    nameif management
    security-level 0
    192.168.1.3 IP address 255.255.255.0
    OSPF cost 10
    !
    interface Ethernet0/0
    !
    interface Ethernet0/1
    Shutdown
    !
    interface Ethernet0/2
    Shutdown
    !
    interface Ethernet0/3
    Shutdown
    !
    interface Ethernet0/4
    Shutdown
    !
    interface Ethernet0/5
    Shutdown
    !
    interface Ethernet0/6
    switchport trunk allowed vlan 2.6
    switchport mode trunk
    !
    interface Ethernet0/7
    Shutdown
    !
    connection of the banner * W A R N I N G *.
    banner connect unauthorized access prohibited. All access is
    connection banner monitored, and intruders will be prosecuted
    connection banner to the extent of the law.
    Banner motd * W A R N I N G *.
    Banner motd unauthorised access prohibited. All access is
    Banner motd monitored and trespassers will be prosecuted
    Banner motd to the extent of the law.
    boot system Disk0: / asa822 - k8.bin
    passive FTP mode
    DNS domain-lookup WAN
    DNS server-group DefaultDNS
    Server name dns.dns.dns.dns
    domain default.domain.invalid
    permit same-security-traffic intra-interface
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    object-group service RDP - tcp
    RDP description
    EQ port 3389 object
    Access extensive list ip 192.168.17.0 LAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
    Standard access list LAN_IP allow 192.168.17.0 255.255.255.0
    WAN_access_in list of allowed ip extended access all any debug log
    WAN_access_in list extended access permitted ip OLD-private interface WAN newspaper inactive debugging interface
    WAN_access_in list extended access permit tcp any object-group RDP any RDP log debugging object-group
    MANAGEMENT_access_in list of allowed ip extended access all any debug log
    access-list extended OLD-PRIVATE_access_in any allowed ip no matter what debug log
    access-list OLD-PRIVATE_access_in extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 inactive debug log
    OLD-PRIVATE_access_in allowed extended object-group TCPUDP host 192.168.10.7 access-list no matter how inactive debug log
    access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.10.254 interface private OLD newspaper inactive debugging
    access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.17.155 interface private OLD newspaper debugging
    access-list 101 extended allow host tcp 192.168.10.7 any eq 3389 debug log
    Access extensive list ip 192.168.17.0 WAN_1_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0
    WAN_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
    WAN_cryptomap_2 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
    Capin list extended access permit ip host 192.18.17.155 192.168.10.7
    Capin list extended access permit ip host 192.168.10.7 192.168.17.155
    LAN_access_in list of allowed ip extended access all any debug log
    Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
    Access extensive list ip 192.168.17.0 WAN_2_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0

    permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0
    pager lines 24
    Enable logging
    recording of debug trap
    logging of debug asdm
    Debugging trace record
    Debug class auth record trap
    MTU 1500 WAN
    MTU 1500 OLD-private
    MTU 1500 management
    mask 192.168.1.150 - 192.168.1.199 255.255.255.0 IP local pool VPN_Admin_IP
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP permitted host a.a.a.a WAN
    ICMP deny any WAN
    ICMP permitted host 192.168.10.7 WAN
    ICMP permitted host b.b.b.b WAN
    ASDM image disk0: / asdm - 631.bin
    don't allow no asdm history
    ARP timeout 14400
    Global (OLD-private) 1 interface
    Global interface (management) 1
    NAT (WAN) 1 0.0.0.0 0.0.0.0

    inside_nat0_outbound (WAN) NAT 0 access list
    WAN_access_in access to the WAN interface group
    Access-group interface private-OLD OLD-PRIVATE_access_in
    Access-group MANAGEMENT_access_in in the management interface
    Route WAN 0.0.0.0 0.0.0.0 b.b.b.185 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    the ssh LOCAL console AAA authentication
    local AAA authentication attempts 10 max in case of failure
    Enable http server
    http 192.168.1.0 255.255.255.0 WAN
    http 0.0.0.0 0.0.0.0 WAN
    http b.b.b.b 255.255.255.255 WAN
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Service resetoutside
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    card crypto WAN_map 1 corresponds to the address WAN_1_cryptomap
    card crypto WAN_map 1 set peer a.a.a.a
    WAN_map 1 transform-set ESP-DES-SHA crypto card game
    card crypto WAN_map WAN interface
    ISAKMP crypto enable WAN
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    crypto ISAKMP policy 30
    preshared authentication
    the Encryption
    sha hash
    Group 1
    life 86400
    Telnet timeout 5
    SSH a.a.a.a 255.255.255.255 WAN
    SSH timeout 30
    SSH version 2
    Console timeout 0
    dhcpd auto_config management
    !

    a basic threat threat detection
    host of statistical threat detection
    Statistics-list of access threat detection
    a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
    NTP server 129.6.15.28 source WAN prefer
    WebVPN
    attributes of Group Policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
    internal admin group strategy
    group admin policy attributes
    DNS.DNS.DNS.DNS value of DNS server
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list LAN_IP
    privilege of encrypted password password username administrator 15
    type tunnel-group admin remote access
    tunnel-group admin general attributes
    address pool VPN_Admin_IP
    strategy-group-by default admin
    tunnel-group a.a.a.a type ipsec-l2l
    tunnel-group a.a.a.a general-attributes
    strategy-group-by default admin
    a.a.a.a group of tunnel ipsec-attributes
    pre-shared-key *.
    NOCHECK Peer-id-validate
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !

    Thank you for your time and help

    Why you use this NAT type?

    Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 any
    NAT (OLD-private) 0-list of access WAN_nat0_outbound

    You are basically saying the ASA not NAT traffic. This private IP address range is not routed on the Internet. This traffic is destined to be sent over the Internet? If so, that LAC should then not be there.

    If you want NAT traffic to one IP public outside the ASA, you must remove this line and let the NAT and GLOBAL work:

    NAT (OLD-private) 1 0.0.0.0 0.0.0.0

    Global (WAN) 1 interface

Maybe you are looking for

  • Tecra M5-388: Question on the Chipset

    Is identical to the M5 T2400 chipset on a new tecra M5 - 388 (T5600)? We created an image for the M5 T2400 PTM51E 02S01REN, but now they'll end of line I need to know if our existing image will work on the replacement of M5 - 388 (T5600) PTM51E-0N805

  • A60-743: is it possible to upgrade the DVD/CD-RW combo

    Hi, I have a Satellite A60 743 and I need to upgrade the firmware and drivers from the DVD pioneer dvr-k13A and engraver.I can't find the place where, can you help me please?Thank youRiccardo

  • How to install iOS 9.3

    How to download iSO.9.3 and install

  • Operating system crashed

    Hello! IM arlene, my hp laptop began to slow down and start to display the files and folders crashed and when im trying to delete recycle bin cannot access or delete. Now Im trying to reformat it by myself, but it started to freeze in step "Configura

  • Boot Manager issue

    I have Lenovo G560 laptop computers... I run recovery of the system (base of the plant)... after the system recovers when I turn on the computer its race at F8 command how can I fix the windows Boot Manager Thank you Mangala